Gitiles
Code Review Sign In
gerrit-public.fairphone.software / platform / external / clang / a9b21d22bb9337649723a8477b5cb15f83451e7d / . / www / analyzer / release_notes.html
blob: b6a035923ecea49d84088b84d84839a8f5b4af1e [file] [log] [blame]
Ted Kremenekef35cbc2011-01-27 19:41:08 +0000[diff] [blame]1<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
2 "http://www.w3.org/TR/html4/strict.dtd">
3<html>
4<head>
5 <title>Release notes for checker-XXX builds</title>
Benjamin Kramer665a8dc2012-01-15 15:26:07 +0000[diff] [blame]6 <link type="text/css" rel="stylesheet" href="menu.css">
7 <link type="text/css" rel="stylesheet" href="content.css">
Ted Kremenekef35cbc2011-01-27 19:41:08 +0000[diff] [blame]8 <script type="text/javascript" src="scripts/menu.js"></script>
9</head>
10<body>
11
12<div id="page">
13<!--#include virtual="menu.html.incl"-->
14<div id="content">
15
16<h1>Release notes for <tt>checker-XXX</tt> builds</h1>
17
Ted Kremenek8ec2bc82012-01-26 03:02:34 +0000[diff] [blame]18<h4 id="checker_260">checker-260</h4>
19
20<p><b>built: </b>January 25, 2012<br>
21<b>download:</b> <a href="http://bit.ly/wpAqVP">checker-260.tar.bz2</a></p>
22<p><b>highlights:</b></p>
23
24<p>This is essentially the same as checker-259, but enables the following <i>experimental</i> checkers (please provide feedback):</p>
25
26<ul>
27 <li>Warns about unsafe uses of CFArrayCreate, CFSetCreate, and CFDictionaryCreate</li>
28 <li>Warns about unsafe uses of getpw, gets, which are sources of buffer overflows</li>
29 <li>Warns about unsafe uses of mktemp and mktemps, which can lead to insecure temporary files</li>
30 <li>Warns about unsafe uses of vfork, which is <a href="https://www.securecoding.cert.org/confluence/display/seccode/POS33-C.+Do+not+use+vfork()">insecure</a> to use</li>
31 <li>Warns about not checking the return values of setuid, setgid, seteuid, setegid, setreuid, setregid (another security issue)</li>
32</ul>
33
Ted Kremenekd2e70902012-01-25 22:18:04 +0000[diff] [blame]34<h4 id="checker_259">checker-259</h4>
35
36<p><b>built: </b>January 25, 2012<br>
37<b>download:</b> <a href="http://bit.ly/zOWf1P">checker-259.tar.bz2</a></p>
38<p><b>highlights:</b></p>
39
40<ul>
41 <li>Contains a newer version of the analyzer than the one shipped in Xcode 4.2.</li>
42 <li>Significant performance optimizations to reduce memory usage of the analyzer.</li>
43 <li>Tweaks to scan-build to have it work more easily with Xcode projects using Clang.</li>
44 <li>Numerous bug fixes to better support code using ARC.</li>
45</ul>
46
Ted Kremenekbb19cd82011-10-14 04:15:19 +0000[diff] [blame]47<h4 id="checker_258">checker-258</h4>
48
Ted Kremenekd2e70902012-01-25 22:18:04 +0000[diff] [blame]49<p><b>built: </b>October 13, 2011<br>
Ted Kremenekbb19cd82011-10-14 04:15:19 +0000[diff] [blame]50<p><b>highlights:</b></p>
51
52<ul>
53 <li>Contains a newer version of the analyzer than the one shipped in Xcode 4.2.</li>
54 <li>Adds a new security checker for looking at correct uses of the Mac OS KeyChain API.</li>
55 <li>Supports ARC (please file bugs where you see issues)</li>
56 <li>Major under-the-cover changes. This should result in more precise results in some cases, but this is laying the groundwork for major improvements. Please file bugs where you see regressions or issues.</li>
57</ul>
58
Ted Kremenekf30c4cc2011-05-25 16:30:14 +0000[diff] [blame]59<h4 id="checker_257">checker-257</h4>
60
Ted Kremenekd2e70902012-01-25 22:18:04 +0000[diff] [blame]61<p><b>built: </b>May 25, 2011<br>
Ted Kremenekf30c4cc2011-05-25 16:30:14 +0000[diff] [blame]62<p><b>highlights:</b></p>
63
64<ul>
65 <li>The analyzer is now far more aggressive with checking conformance with Core Foundation conventions. Any function that returns a CF type must now obey the Core Foundation naming conventions, or use the <a href="/annotations.html#attr_cf_returns_retained">cf_returns_retained</a> or <a href="/annotations.html#attr_cf_returns_not_retained">cf_returns_not_retained</a> annotations.</li>
66 <li>Fixed a serious regression where the analyzer would not analyze Objective-C methods in class extensions.</li>
67 <li>Misc. bug fixes to improve analyzer precision.
68 </li>
69</ul>
70
Ted Kremenek2d5f2da2011-04-13 21:48:34 +0000[diff] [blame]71<h4 id="checker_256">checker-256</h4>
72
Ted Kremenekd2e70902012-01-25 22:18:04 +0000[diff] [blame]73<p><b>built: </b>April 13, 2011<br>
Ted Kremenek2d5f2da2011-04-13 21:48:34 +0000[diff] [blame]74<p><b>highlights:</b></p>
75
76<ul>
77 <li>Lots of bug fixes and improvements to analyzer precision (fewer false positives, possibly more bugs found).
78 <li>Introductory analysis support for C++ and Objective-C++.
79</ul>
80
81<p>This build contains basic support for C++ and Objective-C++ that is ready to be tried out
82 by general users. It is still in its infancy, but establishes a baseline for things to come. The main hope is that it can find some
83 issues and have a reasonable false positive rate.</p>
84
85<p><b>Please</b> <a href="/filing_bugs.html">file bugs</a> when you see issues of any kind so we can assess
86 where development on C++ analysis support needs to be focused.</p>
87
88<p>To try out C++ analysis support, it should work out of the box using <tt>scan-build</tt>. If you are using this checker build
89 as a replacement to the analyzer bundled with Xcode, first use the <tt>set-xcode-analyzer</tt> script to <a href="/xcode.html">change Xcode to use
90 your version of the analyzer</a>. You will then need to modify one configuration file in Xcode to enable C++ analysis support. This can
91 be done with the following steps:</p>
92
93<ol>
94 <li>Find the clang .xcspec file:
95<pre>$ cd /Developer/Library
96$ find . | grep xcspec | grep Clang
97./Xcode/<b>&lt;SNIP&gt;</b>/Clang LLVM 1.0.xcplugin/Contents/Resources/Clang LLVM 1.0.xcspec
98</pre></li>
99 <li>The exact location of the file may vary depending on your installation of Xcode. Edit that file, and look for the string &quot;--analyze&quot;:
100<pre>
101 SourceFileOption = "--analyze";
102 FileTypes = (
103 "sourcecode.c.c",
104 "sourcecode.c.objc",
105 );
106 ...
107</pre>
108 Change the &quot;FileTypes&quot; entry to:
109<pre>
110 FileTypes = (
111 "sourcecode.c.c",
112 "sourcecode.c.objc",
113 "sourcecode.cpp.cpp",
114 "sourcecode.cpp.objcpp",
115 );
116</pre></li>
117<li>Restart Xcode.</li>
118</ol>
119
Ted Kremeneke6732792011-02-12 03:20:34 +0000[diff] [blame]120<h4 id="checker_255">checker-255</h4>
121
Ted Kremenekd2e70902012-01-25 22:18:04 +0000[diff] [blame]122<p><b>built: </b> February 11, 2011<br>
Ted Kremeneke6732792011-02-12 03:20:34 +0000[diff] [blame]123<p><b>highlights:</b></p>
124
125<ul>
126<li>Mac OS X builds are now Intel <tt>i386</tt> and <tt>x86_64</tt> only (no <tt>ppc</tt> support)</li>
127<li>Turns on new <tt>-init</tt> method checker by default</li>
128<li>Reduces memory usage of analyzer by 10%</li>
129<li>Misc. fixes to reduce false positives on dead stores and idempotent operations.</li>
130</ul>
131
Ted Kremenekef35cbc2011-01-27 19:41:08 +0000[diff] [blame]132<h4 id="checker_254">checker-254</h4>
133
Ted Kremenekd2e70902012-01-25 22:18:04 +0000[diff] [blame]134<p><b>built: </b> January 27, 2011<br>
Ted Kremenekef35cbc2011-01-27 19:41:08 +0000[diff] [blame]135<p><b>highlights:</b></p>
136
137<ul>
138<li>Introduces new <tt>-init</tt> method checker to check if a super class's init method is properly called.</li>
139<li>Objective-C retain/release checker now reasons about calls to property accessor methods (setter/getter).</li>
140<li>Introduces new attribute <a href="annotations.html#attr_ns_consumes_self">ns_consumes_self</a> to educate the Objective-C retain/release checker about custom &quot;init-like&quot; methods that do not follow the standard Cocoa naming conventions.</li>
141<li>Introduces new attributes <a href="annotations.html#attr_ns_consumed">ns_consumed</a> and <a href="annotations.html#attr_cf_consumed">cf_consumed</a> to educate the Objective-C retain/release checker about methods/functions that decrement the reference count of a parameter.</li>
142</ul>
143
144</div>
145</div>
146</body>
147</html>
148