1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
"http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<title>Clang Static Analyzer</title>
<link type="text/css" rel="stylesheet" href="content.css" />
<link type="text/css" rel="stylesheet" href="menu.css" />
<script type="text/javascript" src="scripts/menu.js"></script>
</head>
<body>
<div id="page">
<!--#include virtual="menu.html.incl"-->
<div id="content">
<table style="margin-top:0px" width="100%" border="0" cellpadding="0px" cellspacing="0">
<tr><td>
<h1>Clang Static Analyzer</h1>
<p>The Clang Static Analyzer consists of both a source code analysis framework
and a standalone tool that finds bugs in C and Objective-C programs.</p>
<p>The
standalone tool is invoked from the command-line, and is intended to run in
tandem with a build of a project or code base.</p>
<p>Both are 100% open source and are part of the <a
href="http://clang.llvm.org">Clang</a> project.</p>
<!-- Generated from: http://www.spiffycorners.com/index.php -->
<style type="text/css">
.spiffy{display:block}
.spiffy *{
display:block;
height:1px;
overflow:hidden;
font-size:.01em;
background:#EBF0FA}
.spiffy1{
margin-left:3px;
margin-right:3px;
padding-left:1px;
padding-right:1px;
border-left:1px solid #f6f8fc;
border-right:1px solid #f6f8fc;
background:#f0f3fb}
.spiffy2{
margin-left:1px;
margin-right:1px;
padding-right:1px;
padding-left:1px;
border-left:1px solid #fdfdfe;
border-right:1px solid #fdfdfe;
background:#eef2fa}
.spiffy3{
margin-left:1px;
margin-right:1px;
border-left:1px solid #eef2fa;
border-right:1px solid #eef2fa;}
.spiffy4{
border-left:1px solid #f6f8fc;
border-right:1px solid #f6f8fc}
.spiffy5{
border-left:1px solid #f0f3fb;
border-right:1px solid #f0f3fb}
.spiffyfg{
background:#EBF0FA}
.spiffyfg h2 {
margin:0px; padding:10px;
}
</style>
<style type="text/css">
#left { float:left; }
#left h2 { margin:1px; padding-top:0px; }
#right { float:left; margin-left:20px; margin-right:20px; padding:0px ;}
#right h2 { padding:0px; margin:0px; }
#wrappedcontent { padding:15px;}
</style>
<div style="padding:0px; font-size: 90%">
<b class="spiffy">
<b class="spiffy1"><b></b></b>
<b class="spiffy2"><b></b></b>
<b class="spiffy3"></b>
<b class="spiffy4"></b>
<b class="spiffy5"></b></b>
<div class="spiffyfg">
<div style="padding:15px">
<h2 style="padding:0px; margin:0px">Download</h2>
<h3 style="margin-top:5px">Mac OS X</h3>
<ul>
<li>Latest build (Universal binary, 10.5+):
<!--#include virtual="latest_checker.html.incl"-->
</li>
<li><a href="/installation.html">Installation</a> and <a
href="/scan-build.html">usage</a></li>
</ul>
<h3>Other Platforms</h3>
<p>For other platforms, please follow the instructions for <a
href="/installation#OtherPlatforms">building the analyzer</a> from
source code.<p>
</div>
</div>
<b class="spiffy">
<b class="spiffy5"></b>
<b class="spiffy4"></b>
<b class="spiffy3"></b>
<b class="spiffy2"><b></b></b>
<b class="spiffy1"><b></b></b></b>
</div>
</td><td style="padding-left:10px">
<a href="images/analyzer_xcode.png"><img src="images/analyzer_xcode.png" width="450x" border=0></a>
<center><b>Viewing static analyzer results in Xcode 3.2</b></center>
<a href="images/analyzer_html.png"><img src="images/analyzer_html.png" width="450px" border=0></a>
<center><b>Viewing static analyzer results in a web browser</b></center>
</td></tr></table>
<h2 id="StaticAnalysis">What is Static Analysis?</h2>
<p>The term "static analysis" is conflated, but here we use it to mean
a collection of algorithms and techniques used to analyze source code in order
to automatically find bugs. The idea is similar in spirit to compiler warnings
(which can be useful for finding coding errors) but to take that idea a step
further and find bugs that are traditionally found using run-time debugging
techniques such as testing.</p>
<p>Static analysis bug-finding tools have evolved over the last several decades
from basic syntactic checkers to those that find deep bugs by reasoning about
the semantics of code. The goal of the Clang Static Analyzer is to provide a
industrial-quality static analysis framework for analyzing C and Objective-C
programs that is freely available, extensible, and has a high quality of
implementation.</p>
<h3 id="Clang">Part of Clang and LLVM</h3>
<p>As its name implies, the Clang Static Analyzer is built on top of <a
href="http://clang.llvm.org">Clang</a> and <a href="http://llvm.org">LLVM</a>.
Strictly speaking, the analyzer is part of Clang, as Clang consists of a set of
reusable C++ libraries for building powerful source-level tools. The static
analysis engine used by the Clang Static Analyzer is a Clang library, and has
the capability to be reused in different contexts and by different clients.</p>
<h2>Important Points to Consider</h2>
<p>While we believe that the static analyzer is already very useful for finding
bugs, we ask you to bear in mind a few points when using it.</p>
<h3>Work-in-Progress</h3>
<p>The analyzer is a continuous work-in-progress.
There are many planned enhancements to improve both the precision and scope of
its analysis algorithms as well as the kinds bugs it will find. While there are
fundamental limitations to what static analysis can do, we have a long way to go
before hitting that wall.</p>
<h3>Slower than Compilation</h3>
<p>Operationally, using static analysis to
automatically find deep program bugs is about trading CPU time for the hardening
of code. Because of the deep analysis performed by state-of-the-art static
analysis tools, static analysis can be much slower than compilation.</p>
<p>While the Clang Static Analyzer is being designed to be as fast and
light-weight as possible, please do not expect it to be as fast as compiling a
program (even with optimizations enabled). Some of the algorithms needed to find
bugs require in the worst case exponential time.</p>
<p>The Clang Static Analyzer runs in a reasonable amount of time by both
bounding the amount of checking work it will do as well as using clever
algorithms to reduce the amount of work it must do to find bugs.</p></li>
<h3>False Positives</h3>
<p>Static analysis is not perfect. It can falsely flag bugs in a program where
the code behaves correctly. Because some code checks require more analysis
precision than others, the frequency of false positives can vary widely between
different checks. Our long-term goal is to have the analyzer have a low false
positive rate for most code on all checks.</p>
<p>Please help us in this endeavor by <a href="filing_bugs.html">reporting false
positives</a>. False positives cannot be addressed unless we know about
them.</p>
<h3>More Checks</h3>
<p>Static analysis is not magic; a static analyzer can only find bugs that it
has been specifically engineered to find. If there are specific kinds of bugs
you would like the Clang Static Analyzer to find, please feel free to
file <a href="filing_bugs.html">feature requests</a> or contribute your own
patches.</p>
</div>
</div>
</body>
</html>
|
