程序分析 clang系列学习（一）
clang-static-analyzer
- 一.关于llvm/clang/CSA
- 二.clang的使用
-
- 2.1.dump出token序列
- 2.2.dump出AST
- 2.3.dump出CFG
- 2.4.生成IR
- 三.CSA的使用
-
- 3.1.使用示例
- 3.2.开发自定义checker参考文档
接触了程序分析这么久，对程序分析依旧一知半解，导师建议我们可以学习下clang-static-analyzer(CSA)，重点从编写自定义checker入手，于是踏上了clang的学习道路。在这方面如果我的blog里有错误欢迎大佬们指正。
一.关于llvm/clang/CSA
CSA是clang的一部分，clang又是LLVM的一部分，因此学习CSA肯定离不开学习clang和LLVM。
这里不过多介绍llvm/clang，贴上一个blog。
在不同的语境下，LLVM有不同的含义（这里不全）：
-
LLVM可以指LLVM基础架构，即一个完整编译器项目集合，包括前端，后端，优化器，汇编器，JIT引擎等。
-
LLVM还可以指基于LLVM构造的编译器：部分或完全使用LLVM构建的编译器。
-
LLVM后端，包含了代码优化与目标代码生成部分，与Clang组成一个完整的编译器。
-
LLVM项目。
Clang允许hook编译过程，并获得编译每个阶段生成的数据结构的详尽信息，包括AST，CFG。clang tools的一个应用是自动查找程序中的缺陷（defects），提供比编译器多得多的警告。比如clang-tidy工具通过检测程序中使用的语法来发现style问题和不安全或可能不可移植的结构。
CSA是一个查找程序缺陷的符号执行工具。实际程序的实际行为都取决于外部因素，例如输入值、随机数和库组件的行为，analyzer engine用符号值表示未知值，并基于这些符号值执行符号计算。它能检测出导致程序出错的符号值的条件。
因此，Clang Static Analyzer能够发现只发生在罕见程序路径上的深层错误。手动测试或自动测试套件可能错过了这些路径。在发现bug时，analyzer会绘制导致bug的整个路径，并在每个条件语句上显示跳转方向。
二.clang的使用
先贴上llvm的github网址，我用到的llvm是12.0.0版。采用的安装方式是直接下tar包解压的方式（github release链接，我下的是clang+llvm-12.0.0-x86_64-linux-gnu-ubuntu-16.04.tar.xz，编译安装实在是太麻烦了，下tar包多简单），安装并配置好环境变量之后可以用clang --version查看版本，前面给出的blog中已有clang的使用示例，这里就跳过了。我的llvm部分目录如下（可作参考）：
llvm
-- bin # 都是二进制PE文件
-- clang
-- clang++
-- clang-tidy
-- clang-format
-- clang-scan-deps
...
-- include # 都是文件夹
-- c++
-- clang
-- clang-c
-- clang-tidy
-- llvm
...
-- lib
...
-- libexec # Perl脚本
-- c++-analyzer
-- ccc-analyzer
-- share # 都是文件夹
-- clang
-- man
-- opt-viewer
-- scan-build
-- scan-view
这里介绍下clang的简单使用，参考前面贴上的博客。我用的示例代码main.c如下
#include 2.1.dump出token序列
用clang -E -Xclang -dump-tokens main.c命令进行词法分析，命令行输出（只截取main.c中的内容）为
int 'int' [StartOfLine] Loc=<main.c:3:1>
identifier 'main' [LeadingSpace] Loc=<main.c:3:5>
l_paren '(' Loc=<main.c:3:9>
void 'void' Loc=<main.c:3:10>
r_paren ')' Loc=<main.c:3:14>
l_brace '{' Loc=<main.c:3:15>
int 'int' [StartOfLine] [LeadingSpace] Loc=<main.c:4:5>
identifier 'i' [LeadingSpace] Loc=<main.c:4:9>
comma ',' Loc=<main.c:4:10>
identifier 'n' [LeadingSpace] Loc=<main.c:4:12>
semi ';' Loc=<main.c:4:13>
identifier 'scanf' [StartOfLine] [LeadingSpace] Loc=<main.c:5:5>
l_paren '(' Loc=<main.c:5:10>
string_literal '"%d"' Loc=<main.c:5:11>
comma ',' Loc=<main.c:5:15>
amp '&' Loc=<main.c:5:16>
identifier 'n' Loc=<main.c:5:17>
r_paren ')' Loc=<main.c:5:18>
semi ';' Loc=<main.c:5:19>
if 'if' [StartOfLine] [LeadingSpace] Loc=<main.c:6:5>
l_paren '(' [LeadingSpace] Loc=<main.c:6:8>
identifier 'n' Loc=<main.c:6:9>
greater '>' [LeadingSpace] Loc=<main.c:6:11>
numeric_constant '10' [LeadingSpace] Loc=<main.c:6:13>
r_paren ')' Loc=<main.c:6:15>
identifier 'printf' [StartOfLine] [LeadingSpace] Loc=<main.c:7:9>
l_paren '(' Loc=<main.c:7:15>
string_literal '"hello world\n"' Loc=<main.c:7:16>
r_paren ')' Loc=<main.c:7:31>
semi ';' Loc=<main.c:7:32>
else 'else' [StartOfLine] [LeadingSpace] Loc=<main.c:8:5>
identifier 'printf' [StartOfLine] [LeadingSpace] Loc=<main.c:9:9>
l_paren '(' Loc=<main.c:9:15>
string_literal '"no\n"' Loc=<main.c:9:16>
r_paren ')' Loc=<main.c:9:22>
semi ';' Loc=<main.c:9:23>
for 'for' [StartOfLine] [LeadingSpace] Loc=<main.c:10:5>
l_paren '(' [LeadingSpace] Loc=<main.c:10:9>
identifier 'i' Loc=<main.c:10:10>
equal '=' [LeadingSpace] Loc=<main.c:10:12>
numeric_constant '0' [LeadingSpace] Loc=<main.c:10:14>
semi ';' Loc=<main.c:10:15>
identifier 'i' [LeadingSpace] Loc=<main.c:10:17>
less '<' [LeadingSpace] Loc=<main.c:10:19>
numeric_constant '10' [LeadingSpace] Loc=<main.c:10:21>
semi ';' Loc=<main.c:10:23>
plusplus '++' [LeadingSpace] Loc=<main.c:10:25>
identifier 'i' Loc=<main.c:10:27>
r_paren ')' Loc=<main.c:10:28>
l_brace '{' Loc=<main.c:10:29>
identifier 'n' [StartOfLine] [LeadingSpace] Loc=<main.c:11:9>
equal '=' [LeadingSpace] Loc=<main.c:11:11>
identifier 'i' [LeadingSpace] Loc=<main.c:11:13>
plus '+' [LeadingSpace] Loc=<main.c:11:15>
numeric_constant '1' [LeadingSpace] Loc=<main.c:11:17>
semi ';' Loc=<main.c:11:18>
identifier 'n' [StartOfLine] [LeadingSpace] Loc=<main.c:12:9>
plusequal '+=' [LeadingSpace] Loc=<main.c:12:11>
numeric_constant '2' [LeadingSpace] Loc=<main.c:12:14>
semi ';' Loc=<main.c:12:15>
r_brace '}' [StartOfLine] [LeadingSpace] Loc=<main.c:13:5>
return 'return' [StartOfLine] [LeadingSpace] Loc=<main.c:14:5>
numeric_constant '0' [LeadingSpace] Loc=<main.c:14:12>
semi ';' Loc=<main.c:14:13>
r_brace '}' [StartOfLine] Loc=<main.c:15:1>
eof '' Loc=<main.c:15:2>
2.2.dump出AST
用clang -fsyntax-only -Xclang -ast-dump main.c命令查看AST，命令行输出为
-FunctionDecl 0x7d0ffd8 <main.c:3:1, line:15:1> line:3:5 main 'int (void)'
`-CompoundStmt 0x7d10890 <col:15, line:15:1>
|-DeclStmt 0x7d10190 <line:4:5, col:13>
| |-VarDecl 0x7d10090 <col:5, col:9> col:9 used i 'int'
| `-VarDecl 0x7d10110 <col:5, col:12> col:12 used n 'int'
|-CallExpr 0x7d102f0 <line:5:5, col:18> 'int'
| |-ImplicitCastExpr 0x7d102d8 <col:5> 'int (*)(const char *restrict, ...)' <FunctionToPointerDecay>
| | `-DeclRefExpr 0x7d101a8 <col:5> 'int (const char *restrict, ...)' Function 0x7d045b8 'scanf' 'int (const char *restrict, ...)'
| |-ImplicitCastExpr 0x7d10338 <col:11> 'const char *' <NoOp>
| | `-ImplicitCastExpr 0x7d10320 <col:11> 'char *' <ArrayToPointerDecay>
| | `-StringLiteral 0x7d10208 <col:11> 'char [3]' lvalue "%d"
| `-UnaryOperator 0x7d10248 <col:16, col:17> 'int *' prefix '&' cannot overflow
| `-DeclRefExpr 0x7d10228 <col:17> 'int' lvalue Var 0x7d10110 'n' 'int'
|-IfStmt 0x7d105a0 <line:6:5, line:9:22> has_else
| |-BinaryOperator 0x7d103a8 <line:6:9, col:13> 'int' '>'
| | |-ImplicitCastExpr 0x7d10390 <col:9> 'int' <LValueToRValue>
| | | `-DeclRefExpr 0x7d10350 <col:9> 'int' lvalue Var 0x7d10110 'n' 'int'
| | `-IntegerLiteral 0x7d10370 <col:13> 'int' 10
| |-CallExpr 0x7d10480 <line:7:9, col:31> 'int'
| | |-ImplicitCastExpr 0x7d10468 <col:9> 'int (*)(const char *, ...)' <FunctionToPointerDecay>
| | | `-DeclRefExpr 0x7d103c8 <col:9> 'int (const char *, ...)' Function 0x7cff6f0 'printf' 'int (const char *, ...)'
| | `-ImplicitCastExpr 0x7d104c0 <col:16> 'const char *' <NoOp>
| | `-ImplicitCastExpr 0x7d104a8 <col:16> 'char *' <ArrayToPointerDecay>
| | `-StringLiteral 0x7d10428 <col:16> 'char [13]' lvalue "hello world\n"
| `-CallExpr 0x7d10548 <line:9:9, col:22> 'int'
| |-ImplicitCastExpr 0x7d10530 <col:9> 'int (*)(const char *, ...)' <FunctionToPointerDecay>
| | `-DeclRefExpr 0x7d104d8 <col:9> 'int (const char *, ...)' Function 0x7cff6f0 'printf' 'int (const char *, ...)'
| `-ImplicitCastExpr 0x7d10588 <col:16> 'const char *' <NoOp>
| `-ImplicitCastExpr 0x7d10570 <col:16> 'char *' <ArrayToPointerDecay>
| `-StringLiteral 0x7d104f8 <col:16> 'char [4]' lvalue "no\n"
|-ForStmt 0x7d10828 <line:10:5, line:13:5>
| |-BinaryOperator 0x7d10610 <line:10:10, col:14> 'int' '='
| | |-DeclRefExpr 0x7d105d0 <col:10> 'int' lvalue Var 0x7d10090 'i' 'int'
| | `-IntegerLiteral 0x7d105f0 <col:14> 'int' 0
| |-<<<NULL>>>
| |-BinaryOperator 0x7d10688 <col:17, col:21> 'int' '<'
| | |-ImplicitCastExpr 0x7d10670 <col:17> 'int' <LValueToRValue>
| | | `-DeclRefExpr 0x7d10630 <col:17> 'int' lvalue Var 0x7d10090 'i' 'int'
| | `-IntegerLiteral 0x7d10650 <col:21> 'int' 10
| |-UnaryOperator 0x7d106c8 <col:25, col:27> 'int' prefix '++'
| | `-DeclRefExpr 0x7d106a8 <col:27> 'int' lvalue Var 0x7d10090 'i' 'int'
| `-CompoundStmt 0x7d10808 <col:29, line:13:5>
| |-BinaryOperator 0x7d10778 <line:11:9, col:17> 'int' '='
| | |-DeclRefExpr 0x7d106e0 <col:9> 'int' lvalue Var 0x7d10110 'n' 'int'
| | `-BinaryOperator 0x7d10758 <col:13, col:17> 'int' '+'
| | |-ImplicitCastExpr 0x7d10740 <col:13> 'int' <LValueToRValue>
| | | `-DeclRefExpr 0x7d10700 <col:13> 'int' lvalue Var 0x7d10090 'i' 'int'
| | `-IntegerLiteral 0x7d10720 <col:17> 'int' 1
| `-CompoundAssignOperator 0x7d107d8 <line:12:9, col:14> 'int' '+=' ComputeLHSTy='int' ComputeResultTy='int'
| |-DeclRefExpr 0x7d10798 <col:9> 'int' lvalue Var 0x7d10110 'n' 'int'
| `-IntegerLiteral 0x7d107b8 <col:14> 'int' 2
`-ReturnStmt 0x7d10880 <line:14:5, col:12>
`-IntegerLiteral 0x7d10860 <col:12> 'int' 0
2.3.dump出CFG
在低版本的llvm中可以通过clang --cc1 -analyze -cfg-dump main.c来查看main.c的控制流图，不过这个版本好像不行了。需要用clang -cc1 -analyze -analyzer-checker=debug.ViewCFG main.c命令调用CSA的ViewCFG checker来查看。
但是我的测试代码中引用了stdio.h，clang -cc1默认仅限当前目录，所以会出现fata error: 'stdio.h' file not found的情况，需要使用-I参数包含库，这里我的stdio.h在目录/usr/include下。而这里还需要引入一个stddef.h，这个文件在目录$LLVM_DIR/lib/clang/12.0.0/include下，其中$LLVM_DIR是llvm的安装目录。
最终命令如下:clang -cc1 -I /usr/include -I $LLVM_DIR/lib/clang/12.0.0/include -analyze -analyzer-checker=debug.DumpCFG main.c
命令行输出的CFG如下
int main()
[B9 (ENTRY)]
Succs (1): B8
[B1]
1: 0
2: return [B1.1];
Preds (1): B4
Succs (1): B0
[B2]
1: i
2: ++[B2.1]
Preds (1): B3
Succs (1): B4
[B3]
1: i
2: [B3.1] (ImplicitCastExpr, LValueToRValue, int)
3: 1
4: [B3.2] + [B3.3]
5: n
6: [B3.5] = [B3.4]
7: n
8: 2
9: [B3.7] += [B3.8]
Preds (1): B4
Succs (1): B2
[B4]
1: i
2: [B4.1] (ImplicitCastExpr, LValueToRValue, int)
3: 10
4: [B4.2] < [B4.3]
T: for (...; [B4.4]; ...)
Preds (2): B2 B5
Succs (2): B3 B1
[B5]
1: 0
2: i
3: [B5.2] = [B5.1]
Preds (2): B6 B7
Succs (1): B4
[B6]
1: printf
2: [B6.1] (ImplicitCastExpr, FunctionToPointerDecay, int (*)(const char *, ...))
3: "no\n"
4: [B6.3] (ImplicitCastExpr, ArrayToPointerDecay, char *)
5: [B6.4] (ImplicitCastExpr, NoOp, const char *)
6: [B6.2]([B6.5])
Preds (1): B8
Succs (1): B5
[B7]
1: printf
2: [B7.1] (ImplicitCastExpr, FunctionToPointerDecay, int (*)(const char *, ...))
3: "hello world\n"
4: [B7.3] (ImplicitCastExpr, ArrayToPointerDecay, char *)
5: [B7.4] (ImplicitCastExpr, NoOp, const char *)
6: [B7.2]([B7.5])
Preds (1): B8
Succs (1): B5
[B8]
1: int i;
2: int n;
3: __isoc99_scanf
4: [B8.3] (ImplicitCastExpr, FunctionToPointerDecay, int (*)(const char *, ...))
5: "%d"
6: [B8.5] (ImplicitCastExpr, ArrayToPointerDecay, char *)
7: [B8.6] (ImplicitCastExpr, NoOp, const char *)
8: n
9: &[B8.8]
10: [B8.4]([B8.7], [B8.9])
11: n
12: [B8.11] (ImplicitCastExpr, LValueToRValue, int)
13: 10
14: [B8.12] > [B8.13]
T: if [B8.14]
Preds (1): B9
Succs (2): B7 B6
[B0 (EXIT)]
Preds (1): B1
CFG的结点序号是倒序的，化成流程图如下：
这里clang把int i, n;解析成了 int i； int n; 2个语句，CFG结点是手动翻译回来的。至于clang输出的CFG文本怎么解析还有待研究。
2.4.生成IR
LLVM IR使用静态单赋值（SSA）策略（但这并不是说clang生成的IR是SSA的，LLVM 采用了一个“小技巧”，可以把构造 SSA 的工作从前端clang分离出来。这个 trick 是 LLVM 所特有的），生成的IR具有下面特性
-
以三地址码形式组织指令
-
假设有无数寄存器可用
LLVM IR有3种表示形式（本质是等价的，可以相互转换）:
- text:便于阅读的文本格式，类似于汇编语言，拓展名.ll，通过命令
clang -S -emit-llvm main.c获得，-S表示Only run preprocess and compilation steps - memory:内存形式，
Function和Instruction类表示的IR。 - bitcode:二进制格式，拓展名.bc，
clang -c -emit-llvm main.c获得，通过命令-c表示Only run preprocess, compile, and assemble steps，适用于JIT编译器的快速加载。
这里dump出text格式的
; ModuleID = 'main.c'
source_filename = "main.c"
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"
@.str = private unnamed_addr constant [3 x i8] c"%d\00", align 1
@.str.1 = private unnamed_addr constant [13 x i8] c"hello world\0A\00", align 1
@.str.2 = private unnamed_addr constant [4 x i8] c"no\0A\00", align 1
; Function Attrs: noinline nounwind optnone uwtable
define dso_local i32 @main() #0 {
%1 = alloca i32, align 4
%2 = alloca i32, align 4
%3 = alloca i32, align 4
store i32 0, i32* %1, align 4
%4 = call i32 (i8*, ...) @__isoc99_scanf(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str, i64 0, i64 0), i32* %3)
%5 = load i32, i32* %3, align 4
%6 = icmp sgt i32 %5, 10
br i1 %6, label %7, label %9
7: ; preds = %0
%8 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.1, i64 0, i64 0))
br label %11
9: ; preds = %0
%10 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([4 x i8], [4 x i8]* @.str.2, i64 0, i64 0))
br label %11
11: ; preds = %9, %7
store i32 0, i32* %2, align 4
br label %12
12: ; preds = %20, %11
%13 = load i32, i32* %2, align 4
%14 = icmp slt i32 %13, 10
br i1 %14, label %15, label %23
15: ; preds = %12
%16 = load i32, i32* %2, align 4
%17 = add nsw i32 %16, 1
store i32 %17, i32* %3, align 4
%18 = load i32, i32* %3, align 4
%19 = add nsw i32 %18, 2
store i32 %19, i32* %3, align 4
br label %20
20: ; preds = %15
%21 = load i32, i32* %2, align 4
%22 = add nsw i32 %21, 1
store i32 %22, i32* %2, align 4
br label %12, !llvm.loop !2
23: ; preds = %12
ret i32 0
}
declare dso_local i32 @__isoc99_scanf(i8*, ...) #1
declare dso_local i32 @printf(i8*, ...) #1
attributes #0 = { noinline nounwind optnone uwtable "disable-tail-calls"="false" "frame-pointer"="all" "less-precise-fpmad"="false" "min-legal-vector-width"="0" "no-infs-fp-math"="false" "no-jump-tables"="false" "no-nans-fp-math"="false" "no-signed-zeros-fp-math"="false" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" "unsafe-fp-math"="false" "use-soft-float"="false" }
attributes #1 = { "disable-tail-calls"="false" "frame-pointer"="all" "less-precise-fpmad"="false" "no-infs-fp-math"="false" "no-nans-fp-math"="false" "no-signed-zeros-fp-math"="false" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" "unsafe-fp-math"="false" "use-soft-float"="false" }
!llvm.module.flags = !{!0}
!llvm.ident = !{!1}
!0 = !{i32 1, !"wchar_size", i32 4}
!1 = !{!"clang version 12.0.0"}
!2 = distinct !{!2, !3}
!3 = !{!"llvm.loop.mustprogress"}
以后会补充对IR的解释。
三.CSA的使用
3.1.使用示例
CSA是clang的一部分，安装好llvm和clang之后CSA已经存在目录之下了，并且目录中已经存在一些CSA checker，通过命令clang -cc1 -analyzer-checker-help可查询checker list。同时官方给出的checker list（可以对比）
再llvm project的clang/include/clang/StaticAnalyzer/Checkers下有个Checker.td文件保存了Checker的描述。
OVERVIEW: Clang Static Analyzer Checkers List
USAGE: -analyzer-checker <CHECKER or PACKAGE,...>
CHECKERS:
core.CallAndMessage Check for logical errors for function calls and Objective-C message expressions (e.g., uninitialized arguments, null function pointers)
core.DivideZero Check for division by zero
core.NonNullParamChecker Check for null pointers passed as arguments to a function whose arguments are references or marked with the 'nonnull' attribute
core.NullDereference Check for dereferences of null pointers
core.StackAddressEscape Check that addresses to stack memory do not escape the function
core.UndefinedBinaryOperatorResult
Check for undefined results of binary operators
core.VLASize Check for declarations of VLA of undefined or zero size
core.uninitialized.ArraySubscript
Check for uninitialized values used as array subscripts
core.uninitialized.Assign Check for assigning uninitialized values
core.uninitialized.Branch Check for uninitialized values used as branch conditions
core.uninitialized.CapturedBlockVariable
Check for blocks that capture uninitialized values
core.uninitialized.UndefReturn Check for uninitialized values being returned to the caller
cplusplus.InnerPointer Check for inner pointers of C++ containers used after re/deallocation
cplusplus.Move Find use-after-move bugs in C++
cplusplus.NewDelete Check for double-free and use-after-free problems. Traces memory managed by new/delete.
cplusplus.NewDeleteLeaks Check for memory leaks. Traces memory managed by new/delete.
cplusplus.PlacementNew Check if default placement new is provided with pointers to sufficient storage capacity
cplusplus.PureVirtualCall Check pure virtual function calls during construction/destruction
deadcode.DeadStores Check for values stored to variables that are never read afterwards
fuchsia.HandleChecker A Checker that detect leaks related to Fuchsia handles
nullability.NullPassedToNonnull
Warns when a null pointer is passed to a pointer which has a _Nonnull type.
nullability.NullReturnedFromNonnull
Warns when a null pointer is returned from a function that has _Nonnull return type.
nullability.NullableDereferenced
Warns when a nullable pointer is dereferenced.
nullability.NullablePassedToNonnull
Warns when a nullable pointer is passed to a pointer which has a _Nonnull type.
nullability.NullableReturnedFromNonnull
Warns when a nullable pointer is returned from a function that has _Nonnull return type.
optin.cplusplus.UninitializedObject
Reports uninitialized fields after object construction
optin.cplusplus.VirtualCall Check virtual function calls during construction/destruction
optin.mpi.MPI-Checker Checks MPI code
optin.osx.OSObjectCStyleCast Checker for C-style casts of OSObjects
optin.osx.cocoa.localizability.EmptyLocalizationContextChecker
Check that NSLocalizedString macros include a comment for context
optin.osx.cocoa.localizability.NonLocalizedStringChecker
Warns about uses of non-localized NSStrings passed to UI methods expecting localized NSStrings
optin.performance.GCDAntipattern
Check for performance anti-patterns when using Grand Central Dispatch
optin.performance.Padding Check for excessively padded structs.
optin.portability.UnixAPI Finds implementation-defined behavior in UNIX/Posix functions
osx.API Check for proper uses of various Apple APIs
osx.MIG Find violations of the Mach Interface Generator calling convention
osx.NumberObjectConversion Check for erroneous conversions of objects representing numbers into numbers
osx.OSObjectRetainCount Check for leaks and improper reference count management for OSObject
osx.ObjCProperty Check for proper uses of Objective-C properties
osx.SecKeychainAPI Check for proper uses of Secure Keychain APIs
osx.cocoa.AtSync Check for nil pointers used as mutexes for @synchronized
osx.cocoa.AutoreleaseWrite Warn about potentially crashing writes to autoreleasing objects from different autoreleasing pools in Objective-C
osx.cocoa.ClassRelease Check for sending 'retain', 'release', or 'autorelease' directly to a Class
osx.cocoa.Dealloc Warn about Objective-C classes that lack a correct implementation of -dealloc
osx.cocoa.IncompatibleMethodTypes
Warn about Objective-C method signatures with type incompatibilities
osx.cocoa.Loops Improved modeling of loops using Cocoa collection types
osx.cocoa.MissingSuperCall Warn about Objective-C methods that lack a necessary call to super
osx.cocoa.NSAutoreleasePool Warn for suboptimal uses of NSAutoreleasePool in Objective-C GC mode
osx.cocoa.NSError Check usage of NSError** parameters
osx.cocoa.NilArg Check for prohibited nil arguments to ObjC method calls
osx.cocoa.NonNilReturnValue Model the APIs that are guaranteed to return a non-nil value
osx.cocoa.ObjCGenerics Check for type errors when using Objective-C generics
osx.cocoa.RetainCount Check for leaks and improper reference count management
osx.cocoa.RunLoopAutoreleaseLeak
Check for leaked memory in autorelease pools that will never be drained
osx.cocoa.SelfInit Check that 'self' is properly initialized inside an initializer method
osx.cocoa.SuperDealloc Warn about improper use of '[super dealloc]' in Objective-C
osx.cocoa.UnusedIvars Warn about private ivars that are never used
osx.cocoa.VariadicMethodTypes Check for passing non-Objective-C types to variadic collection initialization methods that expect only Objective-C types
osx.coreFoundation.CFError Check usage of CFErrorRef* parameters
osx.coreFoundation.CFNumber Check for proper uses of CFNumber APIs
osx.coreFoundation.CFRetainRelease
Check for null arguments to CFRetain/CFRelease/CFMakeCollectable
osx.coreFoundation.containers.OutOfBounds
Checks for index out-of-bounds when using 'CFArray' API
osx.coreFoundation.containers.PointerSizedValues
Warns if 'CFArray', 'CFDictionary', 'CFSet' are created with non-pointer-size values
security.FloatLoopCounter Warn on using a floating point value as a loop counter (CERT: FLP30-C, FLP30-CPP)
security.insecureAPI.DeprecatedOrUnsafeBufferHandling
Warn on uses of unsecure or deprecated buffer manipulating functions
security.insecureAPI.UncheckedReturn
Warn on uses of functions whose return values must be always checked
security.insecureAPI.bcmp Warn on uses of the 'bcmp' function
security.insecureAPI.bcopy Warn on uses of the 'bcopy' function
security.insecureAPI.bzero Warn on uses of the 'bzero' function
security.insecureAPI.decodeValueOfObjCType
Warn on uses of the '-decodeValueOfObjCType:at:' method
security.insecureAPI.getpw Warn on uses of the 'getpw' function
security.insecureAPI.gets Warn on uses of the 'gets' function
security.insecureAPI.mkstemp Warn when 'mkstemp' is passed fewer than 6 X's in the format string
security.insecureAPI.mktemp Warn on uses of the 'mktemp' function
security.insecureAPI.rand Warn on uses of the 'rand', 'random', and related functions
security.insecureAPI.strcpy Warn on uses of the 'strcpy' and 'strcat' functions
security.insecureAPI.vfork Warn on uses of the 'vfork' function
unix.API Check calls to various UNIX/Posix functions
unix.Malloc Check for memory leaks, double free, and use-after-free problems. Traces memory managed by malloc()/free().
unix.MallocSizeof Check for dubious malloc arguments involving sizeof
unix.MismatchedDeallocator Check for mismatched deallocators.
unix.Vfork Check for proper usage of vfork
unix.cstring.BadSizeArg Check the size argument passed into C string functions for common erroneous patterns
unix.cstring.NullArg Check for null pointers being passed as arguments to C string functions
valist.CopyToSelf Check for va_lists which are copied onto itself.
valist.Uninitialized Check for usages of uninitialized (or already released) va_lists.
valist.Unterminated Check for va_lists which are not released by a va_end call.
webkit.NoUncountedMemberChecker
Check for no uncounted member variables.
webkit.RefCntblBaseVirtualDtor Check for any ref-countable base class having virtual destructor.
webkit.UncountedLambdaCapturesChecker
Check uncounted lambda captures.
这些checker源代码的目录在lib/StaticAnalyzer之下。前面查看程序的CFG用到了debug.DumpCFG checker。
对单个源文件（单个文件的小程序）进行检测时，执行命令clang --analyze -Xanalyzer -analyzer-checker=
这里我简单使用下DivideZero Checker（core.DivideZero），命令行help信息显示的是Check for division by zero，源码位置应该是DivZeroChecker.cpp（我自己猜的，可能有误），官方提供的测试样例。
int fooPR10616 (int qX ) {
int a, c, d;
d = (qX-1);
while ( d != 0 ) {
d = c - (c/d) * d;
}
return (a % (qX-1)); // expected-warning {{Division by zero}}
}
根据注释，CSA应该会对 (a % (qX-1)) 报出一个warning。这里面涉及到除法的只有 c / d 和 a % (qX - 1)，前者在外面有while循环护体，躲过一劫。这里我运行命令 clang -cc1 -analyze -analyzer-checker=core.DivideZero div-zero.c，CSA报出的信息如下:
div-zero.c:9:13: warning: Division by zero [core.DivideZero]
return (a % (qX-1)); // expected-warning {{Division by zero}}
~~^~~~~~~~
1 warning generated.
3.2.开发自定义checker参考文档
可供参考的文档（不过有的是基于4.0.0相关的版本，我用的12.0.0，有的代码不一样了，相应的lib也就不一样了）：
-
clang-developer-manual
-
How to Write a Checker in 24 Hours(slide)
-
clang-analyzer-guide-v0.1-pdf
首先，CSA有关内容都在llvm project（我这是12.0.0版）目录下
-
include/clang/StaticAnalyzer
-
lib/StaticAnalyzer：里面有一些checker的源代码
-
test/Analysis
这里我贴上clang-analyzer-guide的示例MainCallChecker。这个checker的目标是查找代码中是否有违反下面rule的情况
- The function
mainshall not be used within a program：main函数不应该递归（程序总是会包括main的，但是main中的任何内容不应该再调用main）。这看起来容易，好像只要只要找函数调用语句并且匹配函数名是否是main就可以（AST匹配）。而实际上忽略了函数指针的情况。
typedef int (*main_t)(int, char**);
int main (int argc , char** argv) {
main_t foo = main ;
int exit_code = foo(argc, argv); // actually calls main ()!
return exit_code ;
}
上面代码中main_t是自定义的函数指针类型，这类函数返回值int，第一个形参数是int，第二个是char**，上面代码中程序定义了一个函数指针变量foo指向main，并通过foo调用main，因此存在调用main的情况，需要抛出warn，而简单的AST匹配（syntax-based check）是不可能做到的。
这里我就不贴上checker的代码了，官方给出了demo。写出的checker有3种运行的方式。
-
静态：通过静态链接的方式，需要修改Checker.td并重新编译clang，比较麻烦，但重新编译之后自定义checker就已经集成进去了。
-
动态：自定义checker作为一个单独的模块编译成动态链接库so文件，调用的时候通过
clang -cc1 -load Checker.so加载（Checker.so是自定义的checker）。这里我选择用动态集成的方式。 -
同时也可以写一个独立的程序来检测（libtooling方式），就是写好Checker后不再集成回Clang而是作为独立程序运行。
这里我贴上一些官方MainCallChecker的demo
同时这有另一个自定义clang plugin工程，这里写的plugin独立运行和动态集成的版本都是。