# Clang 9 documentation

## 1. Available Checkers

The analyzer performs checks that are categorized into families or “checkers”.

The default set of checkers covers a variety of checks targeted at finding security and API usage bugs, dead code, and other logic errors. See the Default Checkers checkers list below.

In addition to these, the analyzer contains a number of Experimental Checkers (aka alpha checkers). These checkers are under development and are switched off by default. They may crash or emit a higher number of false positives.

The debug package contains checkers for analyzer developers for debugging purposes.

Table of Contents

- Available Checkers

  - Default Checkers

    - core

      - core.CallAndMessage (C, C++, ObjC)

      - core.DivideZero (C, C++, ObjC)

      - core.NonNullParamChecker (C, C++, ObjC)

      - core.NullDereference (C, C++, ObjC)

      - core.StackAddressEscape (C)

      - core.UndefinedBinaryOperatorResult (C)

      - core.VLASize (C)

      - core.uninitialized.ArraySubscript (C)

      - core.uninitialized.Assign (C)

      - core.uninitialized.Branch (C)

      - core.uninitialized.CapturedBlockVariable (C)

      - core.uninitialized.UndefReturn (C)

    - cplusplus

      - cplusplus.InnerPointer

      - cplusplus.NewDelete (C++)

      - cplusplus.NewDeleteLeaks (C++)

      - cplusplus.SelfAssignment (C++)

    - deadcode

      - deadcode.DeadStores (C)

    - nullability

      - nullability.NullPassedToNonnull (ObjC)

      - nullability.NullReturnedFromNonnull (ObjC)

      - nullability.NullableDereferenced (ObjC)

      - nullability.NullablePassedToNonnull (ObjC)

      - nullability.NullableReturnedFromNonnull (ObjC)

    - optin

      - optin.cplusplus.UninitializedObject (C++)

      - optin.cplusplus.VirtualCall (C++)

      - optin.mpi.MPI-Checker (C)

      - optin.osx.cocoa.localizability.EmptyLocalizationContextChecker (ObjC)

      - optin.osx.cocoa.localizability.NonLocalizedStringChecker (ObjC)

      - optin.performance.GCDAntipattern

      - optin.performance.Padding

      - optin.portability.UnixAPI

    - security

      - security.FloatLoopCounter (C)

      - security.insecureAPI.UncheckedReturn (C)

      - security.insecureAPI.bcmp (C)

      - security.insecureAPI.bcopy (C)

      - security.insecureAPI.bzero (C)

      - security.insecureAPI.getpw (C)

      - security.insecureAPI.gets (C)

      - security.insecureAPI.mkstemp (C)

      - security.insecureAPI.mktemp (C)

      - security.insecureAPI.rand (C)

      - security.insecureAPI.strcpy (C)

      - security.insecureAPI.vfork (C)

      - security.insecureAPI.DeprecatedOrUnsafeBufferHandling (C)

    - unix

      - unix.API (C)

      - unix.Malloc (C)

      - unix.MallocSizeof (C)

      - unix.MismatchedDeallocator (C, C++)

      - unix.Vfork (C)

      - unix.cstring.BadSizeArg (C)

      - unix.cstrisng.NullArg (C)

    - osx

      - osx.API (C)

      - osx.NumberObjectConversion (C, C++, ObjC)

      - osx.ObjCProperty (ObjC)

      - osx.SecKeychainAPI (C)

      - osx.cocoa.AtSync (ObjC)

      - osx.cocoa.AutoreleaseWrite

      - osx.cocoa.ClassRelease (ObjC)

      - osx.cocoa.Dealloc (ObjC)

      - osx.cocoa.IncompatibleMethodTypes (ObjC)

      - osx.cocoa.Loops

      - osx.cocoa.MissingSuperCall (ObjC)

      - osx.cocoa.NSAutoreleasePool (ObjC)

      - osx.cocoa.NSError (ObjC)

      - osx.cocoa.NilArg (ObjC)

      - osx.cocoa.NonNilReturnValue

      - osx.cocoa.ObjCGenerics (ObjC)

      - osx.cocoa.RetainCount (ObjC)

      - osx.cocoa.RunLoopAutoreleaseLeak

      - osx.cocoa.SelfInit (ObjC)

      - osx.cocoa.SuperDealloc (ObjC)

      - osx.cocoa.UnusedIvars (ObjC)

      - osx.cocoa.VariadicMethodTypes (ObjC)

      - osx.coreFoundation.CFError (C)

      - osx.coreFoundation.CFNumber (C)

      - osx.coreFoundation.CFRetainRelease (C)

      - osx.coreFoundation.containers.OutOfBounds (C)

      - osx.coreFoundation.containers.PointerSizedValues (C)

  - Experimental Checkers

    - alpha.clone

      - alpha.clone.CloneChecker (C, C++, ObjC)

      - alpha.core.BoolAssignment (ObjC)

    - alpha.core

      - alpha.core.CallAndMessageUnInitRefArg (C,C++, ObjC)

      - alpha.core.CastSize (C)

      - alpha.core.CastToStruct (C, C++)

      - alpha.core.Conversion (C, C++, ObjC)

      - alpha.core.DynamicTypeChecker (ObjC)

      - alpha.core.FixedAddr (C)

      - alpha.core.IdenticalExpr (C, C++)

      - alpha.core.PointerArithm (C)

      - alpha.core.PointerSub (C)

      - alpha.core.SizeofPtr (C)

      - alpha.core.StackAddressAsyncEscape (C)

      - alpha.core.TestAfterDivZero (C)

    - alpha.cplusplus

      - alpha.cplusplus.DeleteWithNonVirtualDtor (C++)

      - alpha.cplusplus.EnumCastOutOfRange (C++)

      - alpha.cplusplus.InvalidatedIterator (C++)

      - alpha.cplusplus.IteratorRange (C++)

      - alpha.cplusplus.MismatchedIterator (C++)

      - alpha.cplusplus.MisusedMovedObject (C++)

    - alpha.deadcode

      - alpha.deadcode.UnreachableCode (C, C++)

    - alpha.llvm

      - alpha.llvm.Conventions

    - alpha.osx

      - alpha.osx.cocoa.DirectIvarAssignment (ObjC)

      - alpha.osx.cocoa.DirectIvarAssignmentForAnnotatedFunctions (ObjC)

      - alpha.osx.cocoa.InstanceVariableInvalidation (ObjC)

      - alpha.osx.cocoa.MissingInvalidationMethod (ObjC)

      - alpha.osx.cocoa.localizability.PluralMisuseChecker (ObjC)

    - alpha.security

      - alpha.security.ArrayBound (C)

      - alpha.security.ArrayBoundV2 (C)

      - alpha.security.MallocOverflow (C)

      - alpha.security.MmapWriteExec (C)

      - alpha.security.ReturnPtrRange (C)

      - alpha.security.taint.TaintPropagation (C, C++)

    - alpha.unix

      - alpha.unix.BlockInCriticalSection (C)

      - alpha.unix.Chroot (C)

      - alpha.unix.PthreadLock (C)

      - alpha.unix.SimpleStream (C)

      - alpha.unix.Stream (C)

      - alpha.unix.cstring.BufferOverlap (C)

      - alpha.unix.cstring.NotNullTerminated (C)

      - alpha.unix.cstring.OutOfBounds (C)

      - alpha.nondeterminism.PointerIteration (C++)

      - alpha.nondeterminism.PointerSorting (C++)

  - Debug Checkers

    - debug

      - debug.AnalysisOrder

      - debug.ConfigDumper

      - debug.DumpCFG Display

      - debug.DumpCallGraph

      - debug.DumpCalls

      - debug.DumpDominators

      - debug.DumpLiveVars

      - debug.DumpTraversal

      - debug.ExprInspection

      - debug.Stats

      - debug.TaintTest

      - debug.ViewCFG

      - debug.ViewCallGraph

      - debug.ViewExplodedGraph

## 1.1. Default Checkers

### 1.1.1. core

Models core language features and contains general-purpose checkers such as division by zero, null pointer dereference, usage of uninitialized values, etc. These checkers must be always switched on as other checker rely on them.

#### 1.1.1.1. core.CallAndMessage (C, C++, ObjC)

> Check for logical errors for function calls and Objective-C message expressions (e.g., uninitialized arguments, null function pointers).

    //C
    void test() {
       void (*foo)(void);
       foo = 0;
       foo(); // warn: function pointer is null
     }

     // C++
     class C {
     public:
       void f();
     };

     void test() {
       C *pc;
       pc->f(); // warn: object pointer is uninitialized
     }

     // C++
     class C {
     public:
       void f();
     };

     void test() {
       C *pc = 0;
       pc->f(); // warn: object pointer is null
     }

     // Objective-C
     @interface MyClass : NSObject
     @property (readwrite,assign) id x;
     - (long double)longDoubleM;
     @end

     void test() {
       MyClass *obj1;
       long double ld1 = [obj1 longDoubleM];
         // warn: receiver is uninitialized
     }

     // Objective-C
     @interface MyClass : NSObject
     @property (readwrite,assign) id x;
     - (long double)longDoubleM;
     @end

     void test() {
       MyClass *obj1;
       id i = obj1.x; // warn: uninitialized object pointer
     }

     // Objective-C
     @interface Subscriptable : NSObject
     - (id)objectAtIndexedSubscript:(unsigned int)index;
     @end

     @interface MyClass : Subscriptable
     @property (readwrite,assign) id x;
     - (long double)longDoubleM;
     @end

     void test() {
       MyClass *obj1;
       id i = obj1[0]; // warn: uninitialized object pointer
     }

#### 1.1.1.2. core.DivideZero (C, C++, ObjC)

> Check for division by zero.

    void test(int z) {
      if (z == 0)
        int x = 1 / z; // warn
    }

    void test() {
      int x = 1;
      int y = x % 0; // warn
    }

#### 1.1.1.3. core.NonNullParamChecker (C, C++, ObjC)

Check for null pointers passed as arguments to a function whose arguments are references or marked with the ‘nonnull’ attribute.

    int f(int *p) __attribute__((nonnull));

    void test(int *p) {
      if (!p)
        f(p); // warn
    }

#### 1.1.1.4. core.NullDereference (C, C++, ObjC)

Check for dereferences of null pointers.

    // C
    void test(int *p) {
      if (p)
        return;

      int x = p[0]; // warn
    }

    // C
    void test(int *p) {
      if (!p)
        *p = 0; // warn
    }

    // C++
    class C {
    public:
      int x;
    };

    void test() {
      C *pc = 0;
      int k = pc->x; // warn
    }

    // Objective-C
    @interface MyClass {
    @public
      int x;
    }
    @end

    void test() {
      MyClass *obj = 0;
      obj->x = 1; // warn
    }

#### 1.1.1.5. core.StackAddressEscape (C)

Check that addresses to stack memory do not escape the function.

    char const *p;

    void test() {
      char const str[] = "string";
      p = str; // warn
    }

    void* test() {
       return __builtin_alloca(12); // warn
    }

    void test() {
      static int *x;
      int y;
      x = &y; // warn
    }

#### 1.1.1.6. core.UndefinedBinaryOperatorResult (C)

Check for undefined results of binary operators.

    void test() {
      int x;
      int y = x + 1; // warn: left operand is garbage
    }

#### 1.1.1.7. core.VLASize (C)

Check for declarations of Variable Length Arrays of undefined or zero size.

> Check for declarations of VLA of undefined or zero size.

    void test() {
      int x;
      int vla1[x]; // warn: garbage as size
    }

    void test() {
      int x = 0;
      int vla2[x]; // warn: zero size
    }

#### 1.1.1.8. core.uninitialized.ArraySubscript (C)

Check for uninitialized values used as array subscripts.

    void test() {
      int i, a[10];
      int x = a[i]; // warn: array subscript is undefined
    }

#### 1.1.1.9. core.uninitialized.Assign (C)

Check for assigning uninitialized values.

    void test() {
      int x;
      x |= 1; // warn: left expression is uninitialized
    }

#### 1.1.1.10. core.uninitialized.Branch (C)

Check for uninitialized values used as branch conditions.

    void test() {
      int x;
      if (x) // warn
        return;
    }

#### 1.1.1.11. core.uninitialized.CapturedBlockVariable (C)

Check for blocks that capture uninitialized values.

    void test() {
      int x;
      ^{ int y = x; }(); // warn
    }

#### 1.1.1.12. core.uninitialized.UndefReturn (C)

Check for uninitialized values being returned to the caller.

    int test() {
      int x;
      return x; // warn
    }

### 1.1.2. cplusplus

C++ Checkers.

#### 1.1.2.1. cplusplus.InnerPointer

Check for inner pointers of C++ containers used after re/deallocation.

#### 1.1.2.2. cplusplus.NewDelete (C++)

Check for double-free and use-after-free problems. Traces memory managed by new/delete.

    void f(int *p);

    void testUseMiddleArgAfterDelete(int *p) {
      delete p;
      f(p); // warn: use after free
    }

    class SomeClass {
    public:
      void f();
    };

    void test() {
      SomeClass *c = new SomeClass;
      delete c;
      c->f(); // warn: use after free
    }

    void test() {
      int *p = (int *)__builtin_alloca(sizeof(int));
      delete p; // warn: deleting memory allocated by alloca
    }

    void test() {
      int *p = new int;
      delete p;
      delete p; // warn: attempt to free released
    }

    void test() {
      int i;
      delete &i; // warn: delete address of local
    }

    void test() {
      int *p = new int[1];
      delete[] (++p);
        // warn: argument to 'delete[]' is offset by 4 bytes
        // from the start of memory allocated by 'new[]'
    }

#### 1.1.2.3. cplusplus.NewDeleteLeaks (C++)

Check for memory leaks. Traces memory managed by new/delete.

    void test() {
      int *p = new int;
    } // warn

#### 1.1.2.4. cplusplus.SelfAssignment (C++)

Checks C++ copy and move assignment operators for self assignment.

### 1.1.3. deadcode

Dead Code Checkers.

#### 1.1.3.1. deadcode.DeadStores (C)

Check for values stored to variables that are never read afterwards.

    void test() {
      int x;
      x = 1; // warn
    }

### 1.1.4. nullability

Objective C checkers that warn for null pointer passing and dereferencing errors.

#### 1.1.4.1. nullability.NullPassedToNonnull (ObjC)

Warns when a null pointer is passed to a pointer which has a _Nonnull type.

    if (name != nil)
      return;
    // Warning: nil passed to a callee that requires a non-null 1st parameter
    NSString *greeting = [@"Hello " stringByAppendingString:name];

#### 1.1.4.2. nullability.NullReturnedFromNonnull (ObjC)

Warns when a null pointer is returned from a function that has _Nonnull return type.

    - (nonnull id)firstChild {
      id result = nil;
      if ([_children count] > 0)
        result = _children[0];

      // Warning: nil returned from a method that is expected
      // to return a non-null value
      return result;
    }

#### 1.1.4.3. nullability.NullableDereferenced (ObjC)

Warns when a nullable pointer is dereferenced.

    struct LinkedList {
      int data;
      struct LinkedList *next;
    };

    struct LinkedList * _Nullable getNext(struct LinkedList *l);

    void updateNextData(struct LinkedList *list, int newData) {
      struct LinkedList *next = getNext(list);
      // Warning: Nullable pointer is dereferenced
      next->data = 7;
    }

#### 1.1.4.4. nullability.NullablePassedToNonnull (ObjC)

Warns when a nullable pointer is passed to a pointer which has a _Nonnull type.

    typedef struct Dummy { int val; } Dummy;
    Dummy *_Nullable returnsNullable();
    void takesNonnull(Dummy *_Nonnull);

    void test() {
      Dummy *p = returnsNullable();
      takesNonnull(p); // warn
    }

#### 1.1.4.5. nullability.NullableReturnedFromNonnull (ObjC)

Warns when a nullable pointer is returned from a function that has _Nonnull return type.

### 1.1.5. optin

Checkers for portability, performance or coding style specific rules.

#### 1.1.5.1. optin.cplusplus.UninitializedObject (C++)

This checker reports uninitialized fields in objects created after a constructor call. It doesn’t only find direct uninitialized fields, but rather makes a deep inspection of the object, analyzing all of it’s fields subfields. The checker regards inherited fields as direct fields, so one will recieve warnings for uninitialized inherited data members as well.

    // With Pedantic and CheckPointeeInitialization set to true

    struct A {
      struct B {
        int x; // note: uninitialized field 'this->b.x'
        // note: uninitialized field 'this->bptr->x'
        int y; // note: uninitialized field 'this->b.y'
        // note: uninitialized field 'this->bptr->y'
      };
      int *iptr; // note: uninitialized pointer 'this->iptr'
      B b;
      B *bptr;
      char *cptr; // note: uninitialized pointee 'this->cptr'

      A (B *bptr, char *cptr) : bptr(bptr), cptr(cptr) {}
    };

    void f() {
      A::B b;
      char c;
      A a(&b, &c); // warning: 6 uninitialized fields
     //          after the constructor call
    }

    // With Pedantic set to false and
    // CheckPointeeInitialization set to true
    // (every field is uninitialized)

    struct A {
      struct B {
        int x;
        int y;
      };
      int *iptr;
      B b;
      B *bptr;
      char *cptr;

      A (B *bptr, char *cptr) : bptr(bptr), cptr(cptr) {}
    };

    void f() {
      A::B b;
      char c;
      A a(&b, &c); // no warning
    }

    // With Pedantic set to true and
    // CheckPointeeInitialization set to false
    // (pointees are regarded as initialized)

    struct A {
      struct B {
        int x; // note: uninitialized field 'this->b.x'
        int y; // note: uninitialized field 'this->b.y'
      };
      int *iptr; // note: uninitialized pointer 'this->iptr'
      B b;
      B *bptr;
      char *cptr;

      A (B *bptr, char *cptr) : bptr(bptr), cptr(cptr) {}
    };

    void f() {
      A::B b;
      char c;
      A a(&b, &c); // warning: 3 uninitialized fields
     //          after the constructor call
    }

Options

This checker has several options which can be set from command line (e.g. `-analyzer-config optin.cplusplus.UninitializedObject:Pedantic=true`):

- `Pedantic` (boolean). If to false, the checker won’t emit warnings for objects that don’t have at least one initialized field. Defaults to false.

- `NotesAsWarnings` (boolean). If set to true, the checker will emit a warning for each uninitalized field, as opposed to emitting one warning per constructor call, and listing the uninitialized fields that belongs to it in notes. Defaults to false.

- `CheckPointeeInitialization` (boolean). If set to false, the checker will not analyze the pointee of pointer/reference fields, and will only check whether the object itself is initialized. Defaults to false.

- `IgnoreRecordsWithField` (string). If supplied, the checker will not analyze structures that have a field with a name or type name that matches the given pattern. Defaults to “”.

#### 1.1.5.2. optin.cplusplus.VirtualCall (C++)

Check virtual function calls during construction or destruction.

    class A {
    public:
      A() {
        f(); // warn
      }
      virtual void f();
    };

    class A {
    public:
      ~A() {
        this->f(); // warn
      }
      virtual void f();
    };

#### 1.1.5.3. optin.mpi.MPI-Checker (C)

Checks MPI code.

    void test() {
      double buf = 0;
      MPI_Request sendReq1;
      MPI_Ireduce(MPI_IN_PLACE, &buf, 1, MPI_DOUBLE, MPI_SUM,
          0, MPI_COMM_WORLD, &sendReq1);
    } // warn: request 'sendReq1' has no matching wait.

    void test() {
      double buf = 0;
      MPI_Request sendReq;
      MPI_Isend(&buf, 1, MPI_DOUBLE, 0, 0, MPI_COMM_WORLD, &sendReq);
      MPI_Irecv(&buf, 1, MPI_DOUBLE, 0, 0, MPI_COMM_WORLD, &sendReq); // warn
      MPI_Isend(&buf, 1, MPI_DOUBLE, 0, 0, MPI_COMM_WORLD, &sendReq); // warn
      MPI_Wait(&sendReq, MPI_STATUS_IGNORE);
    }

    void missingNonBlocking() {
      int rank = 0;
      MPI_Comm_rank(MPI_COMM_WORLD, &rank);
      MPI_Request sendReq1[10][10][10];
      MPI_Wait(&sendReq1[1][7][9], MPI_STATUS_IGNORE); // warn
    }

#### 1.1.5.4. optin.osx.cocoa.localizability.EmptyLocalizationContextChecker (ObjC)

Check that NSLocalizedString macros include a comment for context.

    - (void)test {
      NSString *string = NSLocalizedString(@"LocalizedString", nil); // warn
      NSString *string2 = NSLocalizedString(@"LocalizedString", @" "); // warn
      NSString *string3 = NSLocalizedStringWithDefaultValue(
        @"LocalizedString", nil, [[NSBundle alloc] init], nil,@""); // warn
    }

#### 1.1.5.5. optin.osx.cocoa.localizability.NonLocalizedStringChecker (ObjC)

Warns about uses of non-localized NSStrings passed to UI methods expecting localized NSStrings.

    NSString *alarmText =
      NSLocalizedString(@"Enabled", @"Indicates alarm is turned on");
    if (!isEnabled) {
      alarmText = @"Disabled";
    }
    UILabel *alarmStateLabel = [[UILabel alloc] init];

    // Warning: User-facing text should use localized string macro
    [alarmStateLabel setText:alarmText];

#### 1.1.5.6. optin.performance.GCDAntipattern

Check for performance anti-patterns when using Grand Central Dispatch.

#### 1.1.5.7. optin.performance.Padding

Check for excessively padded structs.

#### 1.1.5.8. optin.portability.UnixAPI

Finds implementation-defined behavior in UNIX/Posix functions.

### 1.1.6. security

Security related checkers.

#### 1.1.6.1. security.FloatLoopCounter (C)

Warn on using a floating point value as a loop counter (CERT: FLP30-C, FLP30-CPP).

    void test() {
      for (float x = 0.1f; x <= 1.0f; x += 0.1f) {} // warn
    }

#### 1.1.6.2. security.insecureAPI.UncheckedReturn (C)

Warn on uses of functions whose return values must be always checked.

    void test() {
      setuid(1); // warn
    }

#### 1.1.6.3. security.insecureAPI.bcmp (C)

Warn on uses of the ‘bcmp’ function.

    void test() {
      bcmp(ptr0, ptr1, n); // warn
    }

#### 1.1.6.4. security.insecureAPI.bcopy (C)

Warn on uses of the ‘bcopy’ function.

    void test() {
      bcopy(src, dst, n); // warn
    }

#### 1.1.6.5. security.insecureAPI.bzero (C)

Warn on uses of the ‘bzero’ function.

    void test() {
      bzero(ptr, n); // warn
    }

#### 1.1.6.6. security.insecureAPI.getpw (C)

Warn on uses of the ‘getpw’ function.

    void test() {
      char buff[1024];
      getpw(2, buff); // warn
    }

#### 1.1.6.7. security.insecureAPI.gets (C)

Warn on uses of the ‘gets’ function.

    void test() {
      char buff[1024];
      gets(buff); // warn
    }

#### 1.1.6.8. security.insecureAPI.mkstemp (C)

Warn when ‘mkstemp’ is passed fewer than 6 X’s in the format string.

    void test() {
      mkstemp("XX"); // warn
    }

#### 1.1.6.9. security.insecureAPI.mktemp (C)

Warn on uses of the `mktemp` function.

    void test() {
      char *x = mktemp("/tmp/zxcv"); // warn: insecure, use mkstemp
    }

#### 1.1.6.10. security.insecureAPI.rand (C)

Warn on uses of inferior random number generating functions (only if arc4random function is available): `drand48, erand48, jrand48, lcong48, lrand48, mrand48, nrand48, random, rand_r`.

    void test() {
      random(); // warn
    }

#### 1.1.6.11. security.insecureAPI.strcpy (C)

Warn on uses of the `strcpy` and `strcat` functions.

    void test() {
      char x[4];
      char *y = "abcd";

      strcpy(x, y); // warn
    }

#### 1.1.6.12. security.insecureAPI.vfork (C)

> Warn on uses of the ‘vfork’ function.

    void test() {
      vfork(); // warn
    }

#### 1.1.6.13. security.insecureAPI.DeprecatedOrUnsafeBufferHandling (C)

> Warn on occurrences of unsafe or deprecated buffer handling functions, which now have a secure variant: `sprintf, vsprintf, scanf, wscanf, fscanf, fwscanf, vscanf, vwscanf, vfscanf, vfwscanf, sscanf, swscanf, vsscanf, vswscanf, swprintf, snprintf, vswprintf, vsnprintf, memcpy, memmove, strncpy, strncat, memset`

    void test() {
      char buf [5];
      strncpy(buf, "a", 1); // warn
    }

### 1.1.7. unix

POSIX/Unix checkers.

#### 1.1.7.1. unix.API (C)

Check calls to various UNIX/Posix functions: `open, pthread_once, calloc, malloc, realloc, alloca`.

    // Currently the check is performed for apple targets only.
    void test(const char *path) {
      int fd = open(path, O_CREAT);
        // warn: call to 'open' requires a third argument when the
        // 'O_CREAT' flag is set
    }

    void f();

    void test() {
      pthread_once_t pred = {0x30B1BCBA, {0}};
      pthread_once(&pred, f);
        // warn: call to 'pthread_once' uses the local variable
    }

    void test() {
      void *p = malloc(0); // warn: allocation size of 0 bytes
    }

    void test() {
      void *p = calloc(0, 42); // warn: allocation size of 0 bytes
    }

    void test() {
      void *p = malloc(1);
      p = realloc(p, 0); // warn: allocation size of 0 bytes
    }

    void test() {
      void *p = alloca(0); // warn: allocation size of 0 bytes
    }

    void test() {
      void *p = valloc(0); // warn: allocation size of 0 bytes
    }

#### 1.1.7.2. unix.Malloc (C)

Check for memory leaks, double free, and use-after-free problems. Traces memory managed by malloc()/free().

    void test() {
      int *p = malloc(1);
      free(p);
      free(p); // warn: attempt to free released memory
    }

    void test() {
      int *p = malloc(sizeof(int));
      free(p);
      *p = 1; // warn: use after free
    }

    void test() {
      int *p = malloc(1);
      if (p)
        return; // warn: memory is never released
    }

    void test() {
      int a[] = { 1 };
      free(a); // warn: argument is not allocated by malloc
    }

    void test() {
      int *p = malloc(sizeof(char));
      p = p - 1;
      free(p); // warn: argument to free() is offset by -4 bytes
    }

#### 1.1.7.3. unix.MallocSizeof (C)

Check for dubious `malloc` arguments involving `sizeof`.

    void test() {
      long *p = malloc(sizeof(short));
        // warn: result is converted to 'long *', which is
        // incompatible with operand type 'short'
      free(p);
    }

#### 1.1.7.4. unix.MismatchedDeallocator (C, C++)

Check for mismatched deallocators.

    // C, C++
    void test() {
      int *p = (int *)malloc(sizeof(int));
      delete p; // warn
    }

    // C, C++
    void __attribute((ownership_returns(malloc))) *user_malloc(size_t);

    void test() {
      int *p = (int *)user_malloc(sizeof(int));
      delete p; // warn
    }

    // C, C++
    void test() {
      int *p = new int;
      free(p); // warn
    }

    // C, C++
    void test() {
      int *p = new int[1];
      realloc(p, sizeof(long)); // warn
    }

    // C, C++
    template <typename T>
    struct SimpleSmartPointer {
      T *ptr;

      explicit SimpleSmartPointer(T *p = 0) : ptr(p) {}
      ~SimpleSmartPointer() {
        delete ptr; // warn
      }
    };

    void test() {
      SimpleSmartPointer<int> a((int *)malloc(4));
    }

    // C++
    void test() {
      int *p = (int *)operator new(0);
      delete[] p; // warn
    }

    // Objective-C, C++
    void test(NSUInteger dataLength) {
      int *p = new int;
      NSData *d = [NSData dataWithBytesNoCopy:p
                   length:sizeof(int) freeWhenDone:1];
        // warn +dataWithBytesNoCopy:length:freeWhenDone: cannot take
        // ownership of memory allocated by 'new'
    }

#### 1.1.7.5. unix.Vfork (C)

Check for proper usage of `vfork`.

    int test(int x) {
      pid_t pid = vfork(); // warn
      if (pid != 0)
        return 0;

      switch (x) {
      case 0:
        pid = 1;
        execl("", "", 0);
        _exit(1);
        break;
      case 1:
        x = 0; // warn: this assignment is prohibited
        break;
      case 2:
        foo(); // warn: this function call is prohibited
        break;
      default:
        return 0; // warn: return is prohibited
      }

      while(1);
    }

#### 1.1.7.6. unix.cstring.BadSizeArg (C)

Check the size argument passed into C string functions for common erroneous patterns. Use `-Wno-strncat-size` compiler option to mute other `strncat`-related compiler warnings.

    void test() {
      char dest[3];
      strncat(dest, """""""""""""""""""""""""*", sizeof(dest));
        // warn: potential buffer overflow
    }

#### 1.1.7.7. unix.cstrisng.NullArg (C)

Check for null pointers being passed as arguments to C string functions: `strlen, strnlen, strcpy, strncpy, strcat, strncat, strcmp, strncmp, strcasecmp, strncasecmp`.

    int test() {
      return strlen(0); // warn
    }

### 1.1.8. osx

macOS checkers.

#### 1.1.8.1. osx.API (C)

Check for proper uses of various Apple APIs.

    void test() {
      dispatch_once_t pred = 0;
      dispatch_once(&pred, ^(){}); // warn: dispatch_once uses local
    }

#### 1.1.8.2. osx.NumberObjectConversion (C, C++, ObjC)

Check for erroneous conversions of objects representing numbers into numbers.

    NSNumber *photoCount = [albumDescriptor objectForKey:@"PhotoCount"];
    // Warning: Comparing a pointer value of type 'NSNumber *'
    // to a scalar integer value
    if (photoCount > 0) {
      [self displayPhotos];
    }

#### 1.1.8.3. osx.ObjCProperty (ObjC)

Check for proper uses of Objective-C properties.

    NSNumber *photoCount = [albumDescriptor objectForKey:@"PhotoCount"];
    // Warning: Comparing a pointer value of type 'NSNumber *'
    // to a scalar integer value
    if (photoCount > 0) {
      [self displayPhotos];
    }

#### 1.1.8.4. osx.SecKeychainAPI (C)

Check for proper uses of Secure Keychain APIs.

    void test() {
      unsigned int *ptr = 0;
      UInt32 length;

      SecKeychainItemFreeContent(ptr, &length);
        // warn: trying to free data which has not been allocated
    }

    void test() {
      unsigned int *ptr = 0;
      UInt32 *length = 0;
      void *outData;

      OSStatus st =
        SecKeychainItemCopyContent(2, ptr, ptr, length, outData);
        // warn: data is not released
    }

    void test() {
      unsigned int *ptr = 0;
      UInt32 *length = 0;
      void *outData;

      OSStatus st =
        SecKeychainItemCopyContent(2, ptr, ptr, length, &outData);

      SecKeychainItemFreeContent(ptr, outData);
        // warn: only call free if a non-NULL buffer was returned
    }

    void test() {
      unsigned int *ptr = 0;
      UInt32 *length = 0;
      void *outData;

      OSStatus st =
        SecKeychainItemCopyContent(2, ptr, ptr, length, &outData);

      st = SecKeychainItemCopyContent(2, ptr, ptr, length, &outData);
        // warn: release data before another call to the allocator

      if (st == noErr)
        SecKeychainItemFreeContent(ptr, outData);
    }

    void test() {
      SecKeychainItemRef itemRef = 0;
      SecKeychainAttributeInfo *info = 0;
      SecItemClass *itemClass = 0;
      SecKeychainAttributeList *attrList = 0;
      UInt32 *length = 0;
      void *outData = 0;

      OSStatus st =
        SecKeychainItemCopyAttributesAndData(itemRef, info,
                                             itemClass, &attrList,
                                             length, &outData);

      SecKeychainItemFreeContent(attrList, outData);
        // warn: deallocator doesn't match the allocator
    }

#### 1.1.8.5. osx.cocoa.AtSync (ObjC)

Check for nil pointers used as mutexes for @synchronized.

    void test(id x) {
      if (!x)
        @synchronized(x) {} // warn: nil value used as mutex
    }

    void test() {
      id y;
      @synchronized(y) {} // warn: uninitialized value used as mutex
    }

#### 1.1.8.6. osx.cocoa.AutoreleaseWrite

Warn about potentially crashing writes to autoreleasing objects from different autoreleasing pools in Objective-C.

#### 1.1.8.7. osx.cocoa.ClassRelease (ObjC)

Check for sending ‘retain’, ‘release’, or ‘autorelease’ directly to a Class.

    @interface MyClass : NSObject
    @end

    void test(void) {
      [MyClass release]; // warn
    }

#### 1.1.8.8. osx.cocoa.Dealloc (ObjC)

Warn about Objective-C classes that lack a correct implementation of -dealloc

    @interface MyObject : NSObject {
      id _myproperty;
    }
    @end

    @implementation MyObject // warn: lacks 'dealloc'
    @end

    @interface MyObject : NSObject {}
    @property(assign) id myproperty;
    @end

    @implementation MyObject // warn: does not send 'dealloc' to super
    - (void)dealloc {
      self.myproperty = 0;
    }
    @end

    @interface MyObject : NSObject {
      id _myproperty;
    }
    @property(retain) id myproperty;
    @end

    @implementation MyObject
    @synthesize myproperty = _myproperty;
      // warn: var was retained but wasn't released
    - (void)dealloc {
      [super dealloc];
    }
    @end

    @interface MyObject : NSObject {
      id _myproperty;
    }
    @property(assign) id myproperty;
    @end

    @implementation MyObject
    @synthesize myproperty = _myproperty;
      // warn: var wasn't retained but was released
    - (void)dealloc {
      [_myproperty release];
      [super dealloc];
    }
    @end

#### 1.1.8.9. osx.cocoa.IncompatibleMethodTypes (ObjC)

Warn about Objective-C method signatures with type incompatibilities.

    @interface MyClass1 : NSObject
    - (int)foo;
    @end

    @implementation MyClass1
    - (int)foo { return 1; }
    @end

    @interface MyClass2 : MyClass1
    - (float)foo;
    @end

    @implementation MyClass2
    - (float)foo { return 1.0; } // warn
    @end

#### 1.1.8.10. osx.cocoa.Loops

Improved modeling of loops using Cocoa collection types.

#### 1.1.8.11. osx.cocoa.MissingSuperCall (ObjC)

Warn about Objective-C methods that lack a necessary call to super.

    @interface Test : UIViewController
    @end
    @implementation test
    - (void)viewDidLoad {} // warn
    @end

#### 1.1.8.12. osx.cocoa.NSAutoreleasePool (ObjC)

Warn for suboptimal uses of NSAutoreleasePool in Objective-C GC mode.

    void test() {
      NSAutoreleasePool *pool = [[NSAutoreleasePool alloc] init];
      [pool release]; // warn
    }

#### 1.1.8.13. osx.cocoa.NSError (ObjC)

Check usage of NSError parameters.

    @interface A : NSObject
    - (void)foo:(NSError """""""""""""""""""""""")error;
    @end

    @implementation A
    - (void)foo:(NSError """""""""""""""""""""""")error {
      // warn: method accepting NSError"""""""""""""""""""""""" should have a non-void
      // return value
    }
    @end

    @interface A : NSObject
    - (BOOL)foo:(NSError """""""""""""""""""""""")error;
    @end

    @implementation A
    - (BOOL)foo:(NSError """""""""""""""""""""""")error {
      *error = 0; // warn: potential null dereference
      return 0;
    }
    @end

#### 1.1.8.14. osx.cocoa.NilArg (ObjC)

Check for prohibited nil arguments to ObjC method calls.

> - caseInsensitiveCompare:

> - compare:

> - compare:options:

> - compare:options:range:

> - compare:options:range:locale:

> - componentsSeparatedByCharactersInSet:

> - initWithFormat:

    NSComparisonResult test(NSString *s) {
      NSString *aString = nil;
      return [s caseInsensitiveCompare:aString];
        // warn: argument to 'NSString' method
        // 'caseInsensitiveCompare:' cannot be nil
    }

#### 1.1.8.15. osx.cocoa.NonNilReturnValue

Models the APIs that are guaranteed to return a non-nil value.

#### 1.1.8.16. osx.cocoa.ObjCGenerics (ObjC)

Check for type errors when using Objective-C generics.

    NSMutableArray *names = [NSMutableArray array];
    NSMutableArray *birthDates = names;

    // Warning: Conversion from value of type 'NSDate *'
    // to incompatible type 'NSString *'
    [birthDates addObject: [NSDate date]];

#### 1.1.8.17. osx.cocoa.RetainCount (ObjC)

Check for leaks and improper reference count management

    void test() {
      NSString *s = [[NSString alloc] init]; // warn
    }

    CFStringRef test(char *bytes) {
      return CFStringCreateWithCStringNoCopy(
               0, bytes, NSNEXTSTEPStringEncoding, 0); // warn
    }

#### 1.1.8.18. osx.cocoa.RunLoopAutoreleaseLeak

Check for leaked memory in autorelease pools that will never be drained.

#### 1.1.8.19. osx.cocoa.SelfInit (ObjC)

Check that ‘self’ is properly initialized inside an initializer method.

    @interface MyObj : NSObject {
      id x;
    }
    - (id)init;
    @end

    @implementation MyObj
    - (id)init {
      [super init];
      x = 0; // warn: instance variable used while 'self' is not
             // initialized
      return 0;
    }
    @end

    @interface MyObj : NSObject
    - (id)init;
    @end

    @implementation MyObj
    - (id)init {
      [super init];
      return self; // warn: returning uninitialized 'self'
    }
    @end

#### 1.1.8.20. osx.cocoa.SuperDealloc (ObjC)

Warn about improper use of ‘[super dealloc]’ in Objective-C.

    @interface SuperDeallocThenReleaseIvarClass : NSObject {
      NSObject *_ivar;
    }
    @end

    @implementation SuperDeallocThenReleaseIvarClass
    - (void)dealloc {
      [super dealloc];
      [_ivar release]; // warn
    }
    @end

#### 1.1.8.21. osx.cocoa.UnusedIvars (ObjC)

Warn about private ivars that are never used.

    @interface MyObj : NSObject {
    @private
      id x; // warn
    }
    @end

    @implementation MyObj
    @end

#### 1.1.8.22. osx.cocoa.VariadicMethodTypes (ObjC)

Check for passing non-Objective-C types to variadic collection initialization methods that expect only Objective-C types.

    void test() {
      [NSSet setWithObjects:@"Foo", "Bar", nil];
        // warn: argument should be an ObjC pointer type, not 'char *'
    }

#### 1.1.8.23. osx.coreFoundation.CFError (C)

Check usage of CFErrorRef* parameters

    void test(CFErrorRef *error) {
      // warn: function accepting CFErrorRef* should have a
      // non-void return
    }

    int foo(CFErrorRef *error) {
      *error = 0; // warn: potential null dereference
      return 0;
    }

#### 1.1.8.24. osx.coreFoundation.CFNumber (C)

Check for proper uses of CFNumber APIs.

    CFNumberRef test(unsigned char x) {
      return CFNumberCreate(0, kCFNumberSInt16Type, &x);
       // warn: 8 bit integer is used to initialize a 16 bit integer
    }

#### 1.1.8.25. osx.coreFoundation.CFRetainRelease (C)

Check for null arguments to CFRetain/CFRelease/CFMakeCollectable.

    void test(CFTypeRef p) {
      if (!p)
        CFRetain(p); // warn
    }

    void test(int x, CFTypeRef p) {
      if (p)
        return;

      CFRelease(p); // warn
    }

#### 1.1.8.26. osx.coreFoundation.containers.OutOfBounds (C)

Checks for index out-of-bounds when using ‘CFArray’ API.

    void test() {
      CFArrayRef A = CFArrayCreate(0, 0, 0, &kCFTypeArrayCallBacks);
      CFArrayGetValueAtIndex(A, 0); // warn
    }

#### 1.1.8.27. osx.coreFoundation.containers.PointerSizedValues (C)

Warns if ‘CFArray’, ‘CFDictionary’, ‘CFSet’ are created with non-pointer-size values.

    void test() {
      int x[] = { 1 };
      CFArrayRef A = CFArrayCreate(0, (const void """""""""""""""""""""""")x, 1,
                                   &kCFTypeArrayCallBacks); // warn
    }

## 1.2. Experimental Checkers

These are checkers with known issues or limitations that keep them from being on by default. They are likely to have false positives. Bug reports and especially patches are welcome.

### 1.2.1. alpha.clone

#### 1.2.1.1. alpha.clone.CloneChecker (C, C++, ObjC)

Reports similar pieces of code.

    void log();

    int max(int a, int b) { // warn
      log();
      if (a > b)
        return a;
      return b;
    }

    int maxClone(int x, int y) { // similar code here
      log();
      if (x > y)
        return x;
      return y;
    }

#### 1.2.1.2. alpha.core.BoolAssignment (ObjC)

Warn about assigning non-{0,1} values to boolean variables.

    void test() {
      BOOL b = -1; // warn
    }

### 1.2.2. alpha.core

#### 1.2.2.1. alpha.core.CallAndMessageUnInitRefArg (C,C++, ObjC)

Check for logical errors for function calls and Objective-C message expressions (e.g., uninitialized arguments, null function pointers, and pointer to undefined variables).

    void test(void) {
      int t;
      int &p = t;
      int &s = p;
      int &q = s;
      foo(q); // warn
    }

    void test(void) {
      int x;
      foo(&x); // warn
    }

#### 1.2.2.2. alpha.core.CastSize (C)

Check when casting a malloc’ed type `T`, whether the size is a multiple of the size of `T`.

    void test() {
      int *x = (int *) malloc(11); // warn
    }

#### 1.2.2.3. alpha.core.CastToStruct (C, C++)

Check for cast from non-struct pointer to struct pointer.

    // C
    struct s {};

    void test(int *p) {
      struct s *ps = (struct s *) p; // warn
    }

    // C++
    class c {};

    void test(int *p) {
      c *pc = (c *) p; // warn
    }

#### 1.2.2.4. alpha.core.Conversion (C, C++, ObjC)

Loss of sign/precision in implicit conversions.

    void test(unsigned U, signed S) {
      if (S > 10) {
        if (U < S) {
        }
      }
      if (S < -10) {
        if (U < S) { // warn (loss of sign)
        }
      }
    }

    void test() {
      long long A = 1LL << 60;
      short X = A; // warn (loss of precision)
    }

#### 1.2.2.5. alpha.core.DynamicTypeChecker (ObjC)

Check for cases where the dynamic and the static type of an object are unrelated.

    id date = [NSDate date];

    // Warning: Object has a dynamic type 'NSDate *' which is
    // incompatible with static type 'NSNumber *'"
    NSNumber *number = date;
    [number doubleValue];

#### 1.2.2.6. alpha.core.FixedAddr (C)

Check for assignment of a fixed address to a pointer.

    void test() {
      int *p;
      p = (int *) 0x10000; // warn
    }

#### 1.2.2.7. alpha.core.IdenticalExpr (C, C++)

Warn about unintended use of identical expressions in operators.

    // C
    void test() {
      int a = 5;
      int b = a | 4 | a; // warn: identical expr on both sides
    }

    // C++
    bool f(void);

    void test(bool b) {
      int i = 10;
      if (f()) { // warn: true and false branches are identical
        do {
          i--;
        } while (f());
      } else {
        do {
          i--;
        } while (f());
      }
    }

#### 1.2.2.8. alpha.core.PointerArithm (C)

Check for pointer arithmetic on locations other than array elements.

    void test() {
      int x;
      int *p;
      p = &x + 1; // warn
    }

#### 1.2.2.9. alpha.core.PointerSub (C)

Check for pointer subtractions on two pointers pointing to different memory chunks.

    void test() {
      int x, y;
      int d = &y - &x; // warn
    }

#### 1.2.2.10. alpha.core.SizeofPtr (C)

Warn about unintended use of `sizeof()` on pointer expressions.

    struct s {};

    int test(struct s *p) {
      return sizeof(p);
        // warn: sizeof(ptr) can produce an unexpected result
    }

#### 1.2.2.11. alpha.core.StackAddressAsyncEscape (C)

Check that addresses to stack memory do not escape the function that involves dispatch_after or dispatch_async. This checker is a part of `core.StackAddressEscape`, but is temporarily disabled until some false positives are fixed.

    dispatch_block_t test_block_inside_block_async_leak() {
      int x = 123;
      void (^inner)(void) = ^void(void) {
        int y = x;
        ++y;
      };
      void (^outer)(void) = ^void(void) {
        int z = x;
        ++z;
        inner();
      };
      return outer; // warn: address of stack-allocated block is captured by a
                    //       returned block
    }

#### 1.2.2.12. alpha.core.TestAfterDivZero (C)

Check for division by variable that is later compared against 0. Either the comparison is useless or there is division by zero.

    void test(int x) {
      var = 77 / x;
      if (x == 0) { } // warn
    }

### 1.2.3. alpha.cplusplus

#### 1.2.3.1. alpha.cplusplus.DeleteWithNonVirtualDtor (C++)

Reports destructions of polymorphic objects with a non-virtual destructor in their base class.

    NonVirtual *create() {
      NonVirtual *x = new NVDerived(); // note: conversion from derived to base
                                       //       happened here
      return x;
    }

    void sink(NonVirtual *x) {
      delete x; // warn: destruction of a polymorphic object with no virtual
                //       destructor
    }

#### 1.2.3.2. alpha.cplusplus.EnumCastOutOfRange (C++)

Check for integer to enumeration casts that could result in undefined values.

    enum TestEnum {
      A = 0
    };

    void foo() {
      TestEnum t = static_cast(-1);
          // warn: the value provided to the cast expression is not in
                   the valid range of values for the enum

#### 1.2.3.3. alpha.cplusplus.InvalidatedIterator (C++)

Check for use of invalidated iterators.

    void bad_copy_assign_operator_list1(std::list &L1,
                                        const std::list &L2) {
      auto i0 = L1.cbegin();
      L1 = L2;
      *i0; // warn: invalidated iterator accessed
    }

#### 1.2.3.4. alpha.cplusplus.IteratorRange (C++)

Check for iterators used outside their valid ranges.

    void simple_bad_end(const std::vector &v) {
      auto i = v.end();
      *i; // warn: iterator accessed outside of its range
    }

#### 1.2.3.5. alpha.cplusplus.MismatchedIterator (C++)

Check for use of iterators of different containers where iterators of the same container are expected.

    void bad_insert3(std::vector &v1, std::vector &v2) {
      v2.insert(v1.cbegin(), v2.cbegin(), v2.cend()); // warn: container accessed
                                                      //       using foreign
                                                      //       iterator argument
      v1.insert(v1.cbegin(), v1.cbegin(), v2.cend()); // warn: iterators of
                                                      //       different containers
                                                      //       used where the same
                                                      //       container is
                                                      //       expected
      v1.insert(v1.cbegin(), v2.cbegin(), v1.cend()); // warn: iterators of
                                                      //       different containers
                                                      //       used where the same
                                                      //       container is
                                                      //       expected
    }

#### 1.2.3.6. alpha.cplusplus.MisusedMovedObject (C++)

Method calls on a moved-from object and copying a moved-from object will be reported.

     struct A {
      void foo() {}
    };

    void f() {
      A a;
      A b = std::move(a); // note: 'a' became 'moved-from' here
      a.foo();            // warn: method call on a 'moved-from' object 'a'
    }

### 1.2.4. alpha.deadcode

#### 1.2.4.1. alpha.deadcode.UnreachableCode (C, C++)

Check unreachable code.

    // C
    int test() {
      int x = 1;
      while(x);
      return x; // warn
    }

    // C++
    void test() {
      int a = 2;

      while (a > 1)
        a--;

      if (a > 1)
        a++; // warn
    }

    // Objective-C
    void test(id x) {
      return;
      [x retain]; // warn
    }

### 1.2.5. alpha.llvm

#### 1.2.5.1. alpha.llvm.Conventions

Check code for LLVM codebase conventions:

- A StringRef should not be bound to a temporary std::string whose lifetime is shorter than the StringRef’s.

- Clang AST nodes should not have fields that can allocate memory.

### 1.2.6. alpha.osx

#### 1.2.6.1. alpha.osx.cocoa.DirectIvarAssignment (ObjC)

Check for direct assignments to instance variables.

    @interface MyClass : NSObject {}
    @property (readonly) id A;
    - (void) foo;
    @end

    @implementation MyClass
    - (void) foo {
      _A = 0; // warn
    }
    @end

#### 1.2.6.2. alpha.osx.cocoa.DirectIvarAssignmentForAnnotatedFunctions (ObjC)

Check for direct assignments to instance variables in the methods annotated with `objc_no_direct_instance_variable_assignment`.

    @interface MyClass : NSObject {}
    @property (readonly) id A;
    - (void) fAnnotated __attribute__((
        annotate("objc_no_direct_instance_variable_assignment")));
    - (void) fNotAnnotated;
    @end

    @implementation MyClass
    - (void) fAnnotated {
      _A = 0; // warn
    }
    - (void) fNotAnnotated {
      _A = 0; // no warn
    }
    @end

#### 1.2.6.3. alpha.osx.cocoa.InstanceVariableInvalidation (ObjC)

Check that the invalidatable instance variables are invalidated in the methods annotated with objc_instance_variable_invalidator.

    @protocol Invalidation <NSObject>
    - (void) invalidate
      __attribute__((annotate("objc_instance_variable_invalidator")));
    @end

    @interface InvalidationImpObj : NSObject <Invalidation>
    @end

    @interface SubclassInvalidationImpObj : InvalidationImpObj {
      InvalidationImpObj *var;
    }
    - (void)invalidate;
    @end

    @implementation SubclassInvalidationImpObj
    - (void) invalidate {}
    @end
    // warn: var needs to be invalidated or set to nil

#### 1.2.6.4. alpha.osx.cocoa.MissingInvalidationMethod (ObjC)

Check that the invalidation methods are present in classes that contain invalidatable instance variables.

    @protocol Invalidation <NSObject>
    - (void)invalidate
      __attribute__((annotate("objc_instance_variable_invalidator")));
    @end

    @interface NeedInvalidation : NSObject <Invalidation>
    @end

    @interface MissingInvalidationMethodDecl : NSObject {
      NeedInvalidation *Var; // warn
    }
    @end

    @implementation MissingInvalidationMethodDecl
    @end

#### 1.2.6.5. alpha.osx.cocoa.localizability.PluralMisuseChecker (ObjC)

Warns against using one vs. many plural pattern in code when generating localized strings.

    NSString *reminderText =
      NSLocalizedString(@"None", @"Indicates no reminders");
    if (reminderCount == 1) {
      // Warning: Plural cases are not supported across all languages.
      // Use a .stringsdict file instead
      reminderText =
        NSLocalizedString(@"1 Reminder", @"Indicates single reminder");
    } else if (reminderCount >= 2) {
      // Warning: Plural cases are not supported across all languages.
      // Use a .stringsdict file instead
      reminderText =
        [NSString stringWithFormat:
          NSLocalizedString(@"%@ Reminders", @"Indicates multiple reminders"),
            reminderCount];
    }

### 1.2.7. alpha.security

#### 1.2.7.1. alpha.security.ArrayBound (C)

Warn about buffer overflows (older checker).

    void test() {
      char *s = "";
      char c = s[1]; // warn
    }

    struct seven_words {
      int c[7];
    };

    void test() {
      struct seven_words a, *p;
      p = &a;
      p[0] = a;
      p[1] = a;
      p[2] = a; // warn
    }

    // note: requires unix.Malloc or
    // alpha.unix.MallocWithAnnotations checks enabled.
    void test() {
      int *p = malloc(12);
      p[3] = 4; // warn
    }

    void test() {
      char a[2];
      int *b = (int*)a;
      b[1] = 3; // warn
    }

#### 1.2.7.2. alpha.security.ArrayBoundV2 (C)

Warn about buffer overflows (newer checker).

    void test() {
      char *s = "";
      char c = s[1]; // warn
    }

    void test() {
      int buf[100];
      int *p = buf;
      p = p + 99;
      p[1] = 1; // warn
    }

    // note: compiler has internal check for this.
    // Use -Wno-array-bounds to suppress compiler warning.
    void test() {
      int buf[100][100];
      buf[0][-1] = 1; // warn
    }

    // note: requires alpha.security.taint check turned on.
    void test() {
      char s[] = "abc";
      int x = getchar();
      char c = s[x]; // warn: index is tainted
    }

#### 1.2.7.3. alpha.security.MallocOverflow (C)

Check for overflows in the arguments to malloc().

    void test(int n) {
      void *p = malloc(n * sizeof(int)); // warn
    }

#### 1.2.7.4. alpha.security.MmapWriteExec (C)

Warn on mmap() calls that are both writable and executable.

    void test(int n) {
      void *c = mmap(NULL, 32, PROT_READ | PROT_WRITE | PROT_EXEC,
                     MAP_PRIVATE | MAP_ANON, -1, 0);
      // warn: Both PROT_WRITE and PROT_EXEC flags are set. This can lead to
      //       exploitable memory regions, which could be overwritten with malicious
      //       code
    }

#### 1.2.7.5. alpha.security.ReturnPtrRange (C)

Check for an out-of-bound pointer being returned to callers.

    static int A[10];

    int *test() {
      int *p = A + 10;
      return p; // warn
    }

    int test(void) {
      int x;
      return x; // warn: undefined or garbage returned
    }

#### 1.2.7.6. alpha.security.taint.TaintPropagation (C, C++)

Generate taint information used by other checkers. A data is tainted when it comes from an unreliable source.

    void test() {
      char x = getchar(); // 'x' marked as tainted
      system(&x); // warn: untrusted data is passed to a system call
    }

    // note: compiler internally checks if the second param to
    // sprintf is a string literal or not.
    // Use -Wno-format-security to suppress compiler warning.
    void test() {
      char s[10], buf[10];
      fscanf(stdin, "%s", s); // 's' marked as tainted

      sprintf(buf, s); // warn: untrusted data as a format string
    }

    void test() {
      size_t ts;
      scanf("%zd", &ts); // 'ts' marked as tainted
      int *p = (int *)malloc(ts * sizeof(int));
        // warn: untrusted data as buffer size
    }

### 1.2.8. alpha.unix

#### 1.2.8.1. alpha.unix.BlockInCriticalSection (C)

Check for calls to blocking functions inside a critical section. Applies to: `lock, unlock, sleep, getc, fgets, read, recv, pthread_mutex_lock,` `` pthread_mutex_unlock, mtx_lock, mtx_timedlock, mtx_trylock, mtx_unlock, lock_guard, unique_lock``

    void test() {
      std::mutex m;
      m.lock();
      sleep(3); // warn: a blocking function sleep is called inside a critical
                //       section
      m.unlock();
    }

#### 1.2.8.2. alpha.unix.Chroot (C)

Check improper use of chroot.

    void f();

    void test() {
      chroot("/usr/local");
      f(); // warn: no call of chdir("/") immediately after chroot
    }

#### 1.2.8.3. alpha.unix.PthreadLock (C)

Simple lock -> unlock checker. Applies to: `pthread_mutex_lock, pthread_rwlock_rdlock, pthread_rwlock_wrlock, lck_mtx_lock, lck_rw_lock_exclusive` `lck_rw_lock_shared, pthread_mutex_trylock, pthread_rwlock_tryrdlock, pthread_rwlock_tryrwlock, lck_mtx_try_lock, lck_rw_try_lock_exclusive, lck_rw_try_lock_shared, pthread_mutex_unlock, pthread_rwlock_unlock, lck_mtx_unlock, lck_rw_done`.

    pthread_mutex_t mtx;

    void test() {
      pthread_mutex_lock(&mtx);
      pthread_mutex_lock(&mtx);
        // warn: this lock has already been acquired
    }

    lck_mtx_t lck1, lck2;

    void test() {
      lck_mtx_lock(&lck1);
      lck_mtx_lock(&lck2);
      lck_mtx_unlock(&lck1);
        // warn: this was not the most recently acquired lock
    }

    lck_mtx_t lck1, lck2;

    void test() {
      if (lck_mtx_try_lock(&lck1) == 0)
        return;

      lck_mtx_lock(&lck2);
      lck_mtx_unlock(&lck1);
        // warn: this was not the most recently acquired lock
    }

#### 1.2.8.4. alpha.unix.SimpleStream (C)

Check for misuses of stream APIs. Check for misuses of stream APIs: `fopen, fclose` (demo checker, the subject of the demo (Slides , Video) by Anna Zaks and Jordan Rose presented at the 2012 LLVM Developers’ Meeting).

    void test() {
      FILE *F = fopen("myfile.txt", "w");
    } // warn: opened file is never closed

    void test() {
      FILE *F = fopen("myfile.txt", "w");

      if (F)
        fclose(F);

      fclose(F); // warn: closing a previously closed file stream
    }

#### 1.2.8.5. alpha.unix.Stream (C)

Check stream handling functions: `fopen, tmpfile, fclose, fread, fwrite, fseek, ftell, rewind, fgetpos,` `fsetpos, clearerr, feof, ferror, fileno`.

    void test() {
      FILE *p = fopen("foo", "r");
    } // warn: opened file is never closed

    void test() {
      FILE *p = fopen("foo", "r");
      fseek(p, 1, SEEK_SET); // warn: stream pointer might be NULL
      fclose(p);
    }

    void test() {
      FILE *p = fopen("foo", "r");

      if (p)
        fseek(p, 1, 3);
         // warn: third arg should be SEEK_SET, SEEK_END, or SEEK_CUR

      fclose(p);
    }

    void test() {
      FILE *p = fopen("foo", "r");
      fclose(p);
      fclose(p); // warn: already closed
    }

    void test() {
      FILE *p = tmpfile();
      ftell(p); // warn: stream pointer might be NULL
      fclose(p);
    }

#### 1.2.8.6. alpha.unix.cstring.BufferOverlap (C)

Checks for overlap in two buffer arguments. Applies to: `memcpy, mempcpy`.

    void test() {
      int a[4] = {0};
      memcpy(a + 2, a + 1, 8); // warn
    }

#### 1.2.8.7. alpha.unix.cstring.NotNullTerminated (C)

Check for arguments which are not null-terminated strings; applies to: `strlen, strnlen, strcpy, strncpy, strcat, strncat`.

    void test() {
      int y = strlen((char *)&test); // warn
    }

#### 1.2.8.8. alpha.unix.cstring.OutOfBounds (C)

Check for out-of-bounds access in string functions; applies to:`` strncopy, strncat``.

    void test() {
      int y = strlen((char *)&test); // warn
    }

#### 1.2.8.9. alpha.nondeterminism.PointerIteration (C++)

Check for non-determinism caused by iterating unordered containers of pointers.

    void test() {
     int a = 1, b = 2;
     std::unordered_set<int *> UnorderedPtrSet = {&a, &b};

     for (auto i : UnorderedPtrSet) // warn
       f(i);
    }

#### 1.2.8.10. alpha.nondeterminism.PointerSorting (C++)

Check for non-determinism caused by sorting of pointers.

    void test() {
     int a = 1, b = 2;
     std::vector<int *> V = {&a, &b};
     std::sort(V.begin(), V.end()); // warn
    }

## 1.3. Debug Checkers

### 1.3.1. debug

Checkers used for debugging the analyzer. Debug Checks page contains a detailed description.

#### 1.3.1.1. debug.AnalysisOrder

Print callbacks that are called during analysis in order.

#### 1.3.1.2. debug.ConfigDumper

Dump config table.

#### 1.3.1.3. debug.DumpCFG Display

Control-Flow Graphs.

#### 1.3.1.4. debug.DumpCallGraph

Display Call Graph.

#### 1.3.1.5. debug.DumpCalls

Print calls as they are traversed by the engine.

#### 1.3.1.6. debug.DumpDominators

Print the dominance tree for a given CFG.

#### 1.3.1.7. debug.DumpLiveVars

Print results of live variable analysis.

#### 1.3.1.8. debug.DumpTraversal

Print branch conditions as they are traversed by the engine.

#### 1.3.1.9. debug.ExprInspection

Check the analyzer’s understanding of expressions.

#### 1.3.1.10. debug.Stats

Emit warnings with analyzer statistics.

#### 1.3.1.11. debug.TaintTest

Mark tainted symbols as such.

#### 1.3.1.12. debug.ViewCFG

View Control-Flow Graphs using GraphViz.

#### 1.3.1.13. debug.ViewCallGraph

View Call Graph using GraphViz.

#### 1.3.1.14. debug.ViewExplodedGraph

View Exploded Graphs using GraphViz.