Available Checkers
The analyzer performs checks that are categorized into families or "checkers". The default set of checkers covers a variety of checks targeted at finding security and API usage bugs, dead code, and other logic errors. See the Default Checkers list below. In addition to these, the analyzer contains a number of Experimental (Alpha) Checkers.Writeups with examples of some of the bugs that the analyzer finds
- Bug Finding With Clang: 5 Resources To Get You Started
- Finding Memory Leaks With The LLVM/Clang Static Analyzer
- Under the Microscope - The Clang Static Analyzer
- Mike Ash - Using the Clang Static Analyzer
Default Checkers
- Core Checkers model core language features and perform general-purpose checks such as division by zero, null pointer dereference, usage of uninitialized values, etc.
- C++ Checkers perform C++-specific checks
- Dead Code Checkers check for unused code
- Nullability Checkers
- Optin Checkers
- OS X Checkers perform Objective-C-specific checks and check the use of Apple's SDKs (OS X and iOS)
- Security Checkers check for insecure API usage and perform checks based on the CERT Secure Coding Standards
- Unix Checkers check the use of Unix and POSIX APIs
Core Checkers
| Name, Description | Example | 
| 
core.CallAndMessage
(C, C++, ObjC) 
Check for logical errors for function calls and Objective-C message expressions
(e.g., uninitialized arguments, null function pointers). | 
// C
struct S {
  int x;
};
void f(struct S s);
void test() {
  struct S s;
  f(s); // warn: passed-by-value arg contain uninitialized data
}
// C
void test() {
  void (*foo)(void);
  foo(); // warn: function pointer is uninitialized
}
// C
void test() {
  void (*foo)(void);
  foo = 0;
  foo(); // warn: function pointer is null
}
// C++
class C {
public:
  void f();
};
void test() {
  C *pc;
  pc->f(); // warn: object pointer is uninitialized
}
// C++
class C {
public:
  void f();
};
void test() {
  C *pc = 0;
  pc->f(); // warn: object pointer is null
}
// Objective-C
@interface MyClass : NSObject
@property (readwrite,assign) id x;
- (long double)longDoubleM;
@end
void test() {
  MyClass *obj1;
  long double ld1 = [obj1 longDoubleM];
    // warn: receiver is uninitialized
}
// Objective-C
@interface MyClass : NSObject
@property (readwrite,assign) id x;
- (long double)longDoubleM;
@end
void test() {
  MyClass *obj1;
  id i = obj1.x; // warn: uninitialized object pointer
}
// Objective-C
@interface Subscriptable : NSObject
- (id)objectAtIndexedSubscript:(unsigned int)index;
@end
@interface MyClass : Subscriptable
@property (readwrite,assign) id x;
- (long double)longDoubleM;
@end
void test() {
  MyClass *obj1;
  id i = obj1[0]; // warn: uninitialized object pointer
}
 | 
| 
core.DivideZero
(C, C++, ObjC) 
Check for division by zero. | 
void test(int z) {
  if (z == 0)
    int x = 1 / z; // warn
}
void test() {
  int x = 1;
  int y = x % 0; // warn
}
 | 
| 
core.NonNullParamChecker
(C, C++, ObjC) 
Check for null pointers passed as arguments to a function whose arguments are
marked with the  nonnullattribute. | 
int f(int *p) __attribute__((nonnull));
void test(int *p) {
  if (!p)
    f(p); // warn
}
 | 
| 
core.NullDereference
(C, C++, ObjC) 
Check for dereferences of null pointers. | 
// C
void test(int *p) {
  if (p)
    return;
  int x = p[0]; // warn
}
// C
void test(int *p) {
  if (!p)
    *p = 0; // warn
}
// C++
class C {
public:
  int x;
};
void test() {
  C *pc = 0;
  int k = pc->x; // warn
}
// Objective-C
@interface MyClass {
@public
  int x;
}
@end
void test() {
  MyClass *obj = 0;
  obj->x = 1; // warn
}
 | 
| 
core.StackAddressEscape
(C) 
Check that addresses of stack memory do not escape the function. | 
char const *p;
void test() {
  char const str[] = "string";
  p = str; // warn
}
void* test() {
   return __builtin_alloca(12); // warn
}
void test() {
  static int *x;
  int y;
  x = &y; // warn
}
 | 
| 
core.UndefinedBinaryOperatorResult
(C) 
Check for undefined results of binary operators. | 
void test() {
  int x;
  int y = x + 1; // warn: left operand is garbage
}
 | 
| 
core.VLASize
(C) 
Check for declarations of VLA of undefined or zero size. | 
void test() {
  int x;
  int vla1[x]; // warn: garbage as size
}
void test() {
  int x = 0;
  int vla2[x]; // warn: zero size
}
 | 
| 
core.uninitialized.ArraySubscript
(C) 
Check for uninitialized values used as array subscripts. | 
void test() {
  int i, a[10];
  int x = a[i]; // warn: array subscript is undefined
}
 | 
| 
core.uninitialized.Assign
(C) 
Check for assigning uninitialized values. | 
void test() {
  int x;
  x |= 1; // warn: left expression is uninitialized
}
 | 
| 
core.uninitialized.Branch
(C) 
Check for uninitialized values used as branch conditions. | 
void test() {
  int x;
  if (x) // warn
    return;
}
 | 
| 
core.uninitialized.CapturedBlockVariable
(C) 
Check for blocks that capture uninitialized values. | 
void test() {
  int x;
  ^{ int y = x; }(); // warn
}
 | 
| 
core.uninitialized.UndefReturn
(C) 
Check for uninitialized values being returned to the caller. | 
int test() {
  int x;
  return x; // warn
}
 | 
C++ Checkers
| Name, Description | Example | 
| 
cplusplus.NewDelete
(C++) 
Check for double-free, use-after-free and offset problems involving C++  
delete. | 
void f(int *p);
void testUseMiddleArgAfterDelete(int *p) {
  delete p;
  f(p); // warn: use after free
}
class SomeClass {
public:
  void f();
};
void test() {
  SomeClass *c = new SomeClass;
  delete c;
  c->f(); // warn: use after free
}
void test() {
  int *p = (int *)__builtin_alloca(sizeof(int));
  delete p; // warn: deleting memory allocated by alloca
}
void test() {
  int *p = new int;
  delete p;
  delete p; // warn: attempt to free released
}
void test() {
  int i;
  delete &i; // warn: delete address of local
}
void test() {
  int *p = new int[1];
  delete[] (++p);
    // warn: argument to 'delete[]' is offset by 4 bytes
    // from the start of memory allocated by 'new[]'
}
 | 
| 
cplusplus.NewDeleteLeaks
(C++) 
Check for memory leaks. Traces memory managed by  new/
delete. | 
void test() {
  int *p = new int;
} // warn
 | 
Dead Code Checkers
| Name, Description | Example | 
| 
deadcode.DeadStores
(C) 
Check for values stored to variables that are never read afterwards. | 
void test() {
  int x;
  x = 1; // warn
}
 | 
Nullability Checkers
| Name, Description | Example | 
| 
nullability.NullPassedToNonnull
(ObjC) 
Warns when a null pointer is passed to a pointer which has a 
_Nonnull type. | if (name != nil) return; // Warning: nil passed to a callee that requires a non-null 1st parameter NSString *greeting = [@"Hello " stringByAppendingString:name]; | 
| 
nullability.NullReturnedFromNonnull
(ObjC) 
Warns when a null pointer is returned from a function that has 
_Nonnull return type. | 
- (nonnull id)firstChild {
  id result = nil;
  if ([_children count] > 0)
    result = _children[0];
  // Warning: nil returned from a method that is expected 
  // to return a non-null value
  return result;
}
 | 
| 
nullability.NullableDereferenced
(ObjC) 
Warns when a nullable pointer is dereferenced. | 
struct LinkedList {
  int data;
  struct LinkedList *next;
};
struct LinkedList * _Nullable getNext(struct LinkedList *l);
void updateNextData(struct LinkedList *list, int newData) {
  struct LinkedList *next = getNext(list);
  // Warning: Nullable pointer is dereferenced
  next->data = 7;
}
 | 
| 
nullability.NullablePassedToNonnull
(ObjC) 
Warns when a nullable pointer is passed to a pointer which has a _Nonnull type. | 
typedef struct Dummy { int val; } Dummy;
Dummy *_Nullable returnsNullable();
void takesNonnull(Dummy *_Nonnull);
void test() {
  Dummy *p = returnsNullable();
  takesNonnull(p); // warn
}
 | 
Optin Checkers
| Name, Description | Example | 
| 
optin.mpi.MPI-Checker
(C) 
Checks MPI code | 
void test() {
  double buf = 0;
  MPI_Request sendReq1;
  MPI_Ireduce(MPI_IN_PLACE, &buf, 1, MPI_DOUBLE, MPI_SUM, 
      0, MPI_COMM_WORLD, &sendReq1);
} // warn: request 'sendReq1' has no matching wait.
void test() {
  double buf = 0;
  MPI_Request sendReq;
  MPI_Isend(&buf, 1, MPI_DOUBLE, 0, 0, MPI_COMM_WORLD, &sendReq);
  MPI_Irecv(&buf, 1, MPI_DOUBLE, 0, 0, MPI_COMM_WORLD, &sendReq); // warn
  MPI_Isend(&buf, 1, MPI_DOUBLE, 0, 0, MPI_COMM_WORLD, &sendReq); // warn
  MPI_Wait(&sendReq, MPI_STATUS_IGNORE);
}
void missingNonBlocking() {
  int rank = 0;
  MPI_Comm_rank(MPI_COMM_WORLD, &rank);
  MPI_Request sendReq1[10][10][10];
  MPI_Wait(&sendReq1[1][7][9], MPI_STATUS_IGNORE); // warn
}
 | 
| 
optin.osx.cocoa.localizability.EmptyLocalizationContextChecker
(ObjC) 
Check that NSLocalizedString macros include a comment for context. | 
- (void)test {
  NSString *string = NSLocalizedString(@"LocalizedString", nil); // warn
  NSString *string2 = NSLocalizedString(@"LocalizedString", @" "); // warn
  NSString *string3 = NSLocalizedStringWithDefaultValue(
    @"LocalizedString", nil, [[NSBundle alloc] init], nil,@""); // warn
}
 | 
| 
optin.osx.cocoa.localizability.NonLocalizedStringChecker
(ObjC) 
Warns about uses of non-localized NSStrings passed to UI methods 
expecting localized NSStrings | 
NSString *alarmText = 
  NSLocalizedString(@"Enabled", @"Indicates alarm is turned on");
if (!isEnabled) {
  alarmText = @"Disabled";
}
UILabel *alarmStateLabel = [[UILabel alloc] init];
// Warning: User-facing text should use localized string macro
[alarmStateLabel setText:alarmText];
 | 
OS X Checkers
| Name, Description | Example | 
| 
osx.API
(C) 
Check for proper uses of various Apple APIs: 
dispatch_once | 
void test() {
  dispatch_once_t pred = 0;
  dispatch_once(&pred, ^(){}); // warn: dispatch_once uses local
}
 | 
| 
osx.NumberObjectConversion
(C, C++, ObjC) 
Check for erroneous conversions of objects representing numbers 
into numbers | 
NSNumber *photoCount = [albumDescriptor objectForKey:@"PhotoCount"];
// Warning: Comparing a pointer value of type 'NSNumber *' 
// to a scalar integer value
if (photoCount > 0) {
  [self displayPhotos];
}
 | 
| 
osx.SecKeychainAPI
(C) 
Check for improper uses of the Security framework's Keychain APIs: 
SecKeychainItemCopyContent SecKeychainFindGenericPassword SecKeychainFindInternetPassword SecKeychainItemFreeContent SecKeychainItemCopyAttributesAndData SecKeychainItemFreeAttributesAndData | 
void test() {
  unsigned int *ptr = 0;
  UInt32 length;
  SecKeychainItemFreeContent(ptr, &length);
    // warn: trying to free data which has not been allocated
}
void test() {
  unsigned int *ptr = 0;
  UInt32 *length = 0;
  void *outData;
  OSStatus st =
    SecKeychainItemCopyContent(2, ptr, ptr, length, outData);
    // warn: data is not released
}
void test() {
  unsigned int *ptr = 0;
  UInt32 *length = 0;
  void *outData;
  OSStatus st =
    SecKeychainItemCopyContent(2, ptr, ptr, length, &outData);
  SecKeychainItemFreeContent(ptr, outData);
    // warn: only call free if a non-NULL buffer was returned
}
void test() {
  unsigned int *ptr = 0;
  UInt32 *length = 0;
  void *outData;
  OSStatus st =
    SecKeychainItemCopyContent(2, ptr, ptr, length, &outData);
  st = SecKeychainItemCopyContent(2, ptr, ptr, length, &outData);
    // warn: release data before another call to the allocator
  if (st == noErr)
    SecKeychainItemFreeContent(ptr, outData);
}
void test() {
  SecKeychainItemRef itemRef = 0;
  SecKeychainAttributeInfo *info = 0;
  SecItemClass *itemClass = 0;
  SecKeychainAttributeList *attrList = 0;
  UInt32 *length = 0;
  void *outData = 0;
  OSStatus st =
    SecKeychainItemCopyAttributesAndData(itemRef, info,
                                         itemClass, &attrList,
                                         length, &outData);
  SecKeychainItemFreeContent(attrList, outData);
    // warn: deallocator doesn't match the allocator
}
 | 
| 
osx.cocoa.AtSync
(ObjC) 
Check for nil pointers used as mutexes for  @synchronized. | 
void test(id x) {
  if (!x)
    @synchronized(x) {} // warn: nil value used as mutex
}
void test() {
  id y;
  @synchronized(y) {} // warn: uninitialized value used as mutex
}
 | 
| 
osx.cocoa.ClassRelease
(ObjC) 
Check for sending  retain,release, or
autoreleasedirectly to a class. | 
@interface MyClass : NSObject
@end
void test(void) {
  [MyClass release]; // warn
}
 | 
| 
osx.cocoa.Dealloc
(ObjC) 
Warn about Objective-C classes that lack a correct implementation 
of  -dealloc. | 
@interface MyObject : NSObject {
  id _myproperty;  
}
@end
@implementation MyObject // warn: lacks 'dealloc'
@end
@interface MyObject : NSObject {}
@property(assign) id myproperty;
@end
@implementation MyObject // warn: does not send 'dealloc' to super
- (void)dealloc {
  self.myproperty = 0;
}
@end
@interface MyObject : NSObject {
  id _myproperty;
}
@property(retain) id myproperty;
@end
@implementation MyObject
@synthesize myproperty = _myproperty;
  // warn: var was retained but wasn't released
- (void)dealloc {
  [super dealloc];
}
@end
@interface MyObject : NSObject {
  id _myproperty;
}
@property(assign) id myproperty;
@end
@implementation MyObject
@synthesize myproperty = _myproperty;
  // warn: var wasn't retained but was released
- (void)dealloc {
  [_myproperty release];
  [super dealloc];
}
@end
 | 
| 
osx.cocoa.IncompatibleMethodTypes
(ObjC) 
Check for an incompatible type signature when overriding an Objective-C method. | 
@interface MyClass1 : NSObject
- (int)foo;
@end
@implementation MyClass1
- (int)foo { return 1; }
@end
@interface MyClass2 : MyClass1
- (float)foo;
@end
@implementation MyClass2
- (float)foo { return 1.0; } // warn
@end
 | 
| 
alpha.osx.cocoa.MissingSuperCall
(ObjC) 
Warn about Objective-C methods that lack a necessary call to super. (Note: The
compiler now has a warning for methods annotated with  objc_requires_superattribute. The checker exists to check methods in the Cocoa frameworks
that haven't yet adopted this attribute.) | 
@interface Test : UIViewController
@end
@implementation test
- (void)viewDidLoad {} // warn
@end
 | 
| 
osx.cocoa.NSAutoreleasePool
(ObjC) 
Warn for suboptimal uses of NSAutoreleasePool in Objective-C
GC mode ( -fobjc-gccompiler option). | 
void test() {
  NSAutoreleasePool *pool = [[NSAutoreleasePool alloc] init];
  [pool release]; // warn
}
 | 
| 
osx.cocoa.NSError
(ObjC) 
Check usage of  NSError**parameters. | 
@interface A : NSObject
- (void)foo:(NSError **)error;
@end
@implementation A
- (void)foo:(NSError **)error {
  // warn: method accepting NSError** should have a non-void
  // return value
}
@end
@interface A : NSObject
- (BOOL)foo:(NSError **)error;
@end
@implementation A
- (BOOL)foo:(NSError **)error {
  *error = 0; // warn: potential null dereference
  return 0;
}
@end
 | 
| 
osx.cocoa.NilArg
(ObjC) 
Check for prohibited nil arguments in specific Objective-C method calls: 
- caseInsensitiveCompare: - compare: - compare:options: - compare:options:range: - compare:options:range:locale: - componentsSeparatedByCharactersInSet: - initWithFormat: | 
NSComparisonResult test(NSString *s) {
  NSString *aString = nil;
  return [s caseInsensitiveCompare:aString];
    // warn: argument to 'NSString' method
    // 'caseInsensitiveCompare:' cannot be nil
}
 | 
| 
osx.cocoa.ObjCGenerics
(ObjC) 
Check for type errors when using Objective-C generics | NSMutableArray | 
| 
osx.cocoa.RetainCount
(ObjC) 
Check for leaks and violations of the Cocoa Memory Management rules. | 
void test() {
  NSString *s = [[NSString alloc] init]; // warn
}
CFStringRef test(char *bytes) {
  return CFStringCreateWithCStringNoCopy(
           0, bytes, NSNEXTSTEPStringEncoding, 0); // warn
}
 | 
| 
osx.cocoa.SelfInit
(ObjC) 
Check that  selfis properly initialized inside an initializer
method. | 
@interface MyObj : NSObject {
  id x;
}
- (id)init;
@end
@implementation MyObj
- (id)init {
  [super init];
  x = 0; // warn: instance variable used while 'self' is not
         // initialized
  return 0;
}
@end
@interface MyObj : NSObject
- (id)init;
@end
@implementation MyObj
- (id)init {
  [super init];
  return self; // warn: returning uninitialized 'self'
}
@end
 | 
| 
osx.cocoa.SuperDealloc
(ObjC) 
Warn about improper use of '[super dealloc]' in Objective-C | 
@interface SuperDeallocThenReleaseIvarClass : NSObject {
  NSObject *_ivar;
}
@end
@implementation SuperDeallocThenReleaseIvarClass
- (void)dealloc {
  [super dealloc];
  [_ivar release]; // warn
}
@end
 | 
| 
osx.cocoa.UnusedIvars
(ObjC) 
Warn about private ivars that are never used. | 
@interface MyObj : NSObject {
@private
  id x; // warn
}
@end
@implementation MyObj
@end
 | 
| 
osx.cocoa.VariadicMethodTypes
(ObjC) 
Check for passing non-Objective-C types to variadic collection initialization
methods that expect only Objective-C types. | 
void test() {
  [NSSet setWithObjects:@"Foo", "Bar", nil];
    // warn: argument should be an ObjC pointer type, not 'char *'
}
 | 
| 
osx.coreFoundation.CFError
(C) 
Check usage of  CFErrorRef*parameters. | 
void test(CFErrorRef *error) {
  // warn: function accepting CFErrorRef* should have a
  // non-void return
}
int foo(CFErrorRef *error) {
  *error = 0; // warn: potential null dereference
  return 0;
}
 | 
| 
osx.coreFoundation.CFNumber
(C) 
Check for improper uses of  CFNumberCreate. | 
CFNumberRef test(unsigned char x) {
  return CFNumberCreate(0, kCFNumberSInt16Type, &x);
   // warn: 8 bit integer is used to initialize a 16 bit integer
}
 | 
| 
osx.coreFoundation.CFRetainRelease
(C) 
Check for null arguments to  CFRetain,CFRelease,CFMakeCollectable. | 
void test(CFTypeRef p) {
  if (!p)
    CFRetain(p); // warn
}
void test(int x, CFTypeRef p) {
  if (p)
    return;
  CFRelease(p); // warn
}
 | 
| 
osx.coreFoundation.containers.OutOfBounds
(C) 
Checks for index out-of-bounds when using  CFArrayAPI. | 
void test() {
  CFArrayRef A = CFArrayCreate(0, 0, 0, &kCFTypeArrayCallBacks);
  CFArrayGetValueAtIndex(A, 0); // warn
}
 | 
| 
osx.coreFoundation.containers.PointerSizedValues
(C) 
Warns if  CFArray,CFDictionary,CFSetare
created with non-pointer-size values. | 
void test() {
  int x[] = { 1 };
  CFArrayRef A = CFArrayCreate(0, (const void **)x, 1,
                               &kCFTypeArrayCallBacks); // warn
}
 | 
Security Checkers
| Name, Description | Example | 
| 
security.FloatLoopCounter
(C) 
Warn on using a floating point value as a loop counter (CERT: FLP30-C,
FLP30-CPP). | 
void test() {
  for (float x = 0.1f; x <= 1.0f; x += 0.1f) {} // warn
}
 | 
| 
security.insecureAPI.UncheckedReturn
(C) 
Warn on uses of functions whose return values must be always checked: 
setuid setgid seteuid setegid setreuid setregid | 
void test() {
  setuid(1); // warn
}
 | 
| 
security.insecureAPI.bcmp
(C) 
Warn on uses of the  bcmpfunction. | 
void test() {
  bcmp(ptr0, ptr1, n); // warn
}
 | 
| 
security.insecureAPI.bcopy
(C) 
Warn on uses of the  bcopyfunction. | 
void test() {
  bcopy(src, dst, n); // warn
}
 | 
| 
security.insecureAPI.bzero
(C) 
Warn on uses of the  bzerofunction. | 
void test() {
  bzero(ptr, n); // warn
}
 | 
| 
security.insecureAPI.getpw
(C) 
Warn on uses of the  getpwfunction. | 
void test() {
  char buff[1024];
  getpw(2, buff); // warn
}
 | 
| 
security.insecureAPI.gets
(C) 
Warn on uses of the  getsfunction. | 
void test() {
  char buff[1024];
  gets(buff); // warn
}
 | 
| 
security.insecureAPI.mkstemp
(C) 
Warn when  mktemp,mkstemp,mkstempsormkdtempis passed fewer than 6
X's in the format string. | 
void test() {
  mkstemp("XX"); // warn
}
 | 
| 
security.insecureAPI.mktemp
(C) 
Warn on uses of the  mktempfunction. | 
void test() {
  char *x = mktemp("/tmp/zxcv"); // warn: insecure, use mkstemp
}
 | 
| 
security.insecureAPI.rand
(C) 
Warn on uses of inferior random number generating functions (only if  arc4randomfunction is available):
drand48 erand48 jrand48 lcong48 lrand48 mrand48 nrand48 random rand_r | 
void test() {
  random(); // warn
}
 | 
| 
security.insecureAPI.strcpy
(C) 
Warn on uses of the  strcpyandstrcatfunctions. | 
void test() {
  char x[4];
  char *y = "abcd";
  strcpy(x, y); // warn
}
 | 
| 
security.insecureAPI.vfork
(C) 
Warn on uses of the  vforkfunction. | 
void test() {
  vfork(); // warn
}
 | 
Unix Checkers
| Name, Description | Example | 
| 
unix.API
(C) 
Check calls to various UNIX/POSIX functions: 
open pthread_once calloc malloc realloc alloca 
// Currently the check is performed for apple targets only.
void test(const char *path) {
  int fd = open(path, O_CREAT);
    // warn: call to 'open' requires a third argument when the
    // 'O_CREAT' flag is set
}
void f();
void test() {
  pthread_once_t pred = {0x30B1BCBA, {0}};
  pthread_once(&pred, f);
    // warn: call to 'pthread_once' uses the local variable
}
void test() {
  void *p = malloc(0); // warn: allocation size of 0 bytes
}
void test() {
  void *p = calloc(0, 42); // warn: allocation size of 0 bytes
}
void test() {
  void *p = malloc(1);
  p = realloc(p, 0); // warn: allocation size of 0 bytes
}
void test() {
  void *p = alloca(0); // warn: allocation size of 0 bytes
}
void test() {
  void *p = valloc(0); // warn: allocation size of 0 bytes
}
 | |
| 
unix.Malloc
(C) 
Check for memory leaks, double free, and use-after-free and offset problems
involving  malloc. | 
void test() {
  int *p = malloc(1);
  free(p);
  free(p); // warn: attempt to free released memory
}
void test() {
  int *p = malloc(sizeof(int));
  free(p);
  *p = 1; // warn: use after free
}
void test() {
  int *p = malloc(1);
  if (p)
    return; // warn: memory is never released
}
void test() {
  int a[] = { 1 };
  free(a); // warn: argument is not allocated by malloc
}
void test() {
  int *p = malloc(sizeof(char));
  p = p - 1;
  free(p); // warn: argument to free() is offset by -4 bytes
}
 | 
| 
unix.MallocSizeof
(C) 
Check for dubious  malloc,callocorreallocarguments involvingsizeof. | 
void test() {
  long *p = malloc(sizeof(short));
    // warn: result is converted to 'long *', which is
    // incompatible with operand type 'short'
  free(p);
}
 | 
| 
unix.MismatchedDeallocator
(C, C++, ObjC) 
Check for mismatched deallocators (e.g. passing a pointer allocating
with  newtofree()). | 
// C, C++
void test() {
  int *p = (int *)malloc(sizeof(int));
  delete p; // warn
}
// C, C++
void __attribute((ownership_returns(malloc))) *user_malloc(size_t);
void test() {
  int *p = (int *)user_malloc(sizeof(int));
  delete p; // warn
}
// C, C++
void test() {
  int *p = new int;
  free(p); // warn
}
// C, C++
void test() {
  int *p = new int[1];
  realloc(p, sizeof(long)); // warn
}
// C, C++
template <typename T>
struct SimpleSmartPointer {
  T *ptr;
  explicit SimpleSmartPointer(T *p = 0) : ptr(p) {}
  ~SimpleSmartPointer() {
    delete ptr; // warn
  }
};
void test() {
  SimpleSmartPointer<int> a((int *)malloc(4));
}
// C++
void test() {
  int *p = (int *)operator new(0);
  delete[] p; // warn
}
// Objective-C, C++
void test(NSUInteger dataLength) {
  int *p = new int;
  NSData *d = [NSData dataWithBytesNoCopy:p
               length:sizeof(int) freeWhenDone:1];
    // warn +dataWithBytesNoCopy:length:freeWhenDone: cannot take
    // ownership of memory allocated by 'new'
}
 | 
| 
unix.Vfork
(C) 
Check for proper usage of vfork | 
int test(int x) {
  pid_t pid = vfork(); // warn
  if (pid != 0)
    return 0;
  switch (x) {
  case 0:
    pid = 1;
    execl("", "", 0);
    _exit(1);
    break;
  case 1:
    x = 0; // warn: this assignment is prohibited
    break;
  case 2:
    foo(); // warn: this function call is prohibited
    break;
  default:
    return 0; // warn: return is prohibited
  }
  while(1);
}
 | 
| 
unix.cstring.BadSizeArg
(C) 
Check the size argument passed to  strncatfor common erroneous
patterns. Use-Wno-strncat-sizecompiler option to mute otherstrncat-related compiler warnings. | 
void test() {
  char dest[3];
  strncat(dest, "***", sizeof(dest));
    // warn: potential buffer overflow
}
 | 
| 
unix.cstring.NullArg
(C) 
Check for null pointers being passed as arguments to C string functions: 
strlen strnlen strcpy strncpy strcat strncat strcmp strncmp strcasecmp strncasecmp | 
int test() {
  return strlen(0); // warn
}
 |