| .Dd May 3, 2012 |
| .Os [clang] [3.1] |
| .Dt SCAN-BUILD 1 |
| .Sh NAME |
| .Nm scan-build |
| .Nd Clang static analyzer |
| .Sh SYNOPSIS |
| .Nm |
| .Op Fl ohkvV |
| .Op Fl analyze-headers |
| .Op Fl enable-checker Op Ar checker_name |
| .Op Fl disable-checker Op Ar checker_name |
| .Op Fl -help |
| .Op Fl -html-title Op Ar =title |
| .Op Fl -keep-going |
| .Op Fl -plist |
| .Op Fl -plist-html |
| .Op Fl -status-bugs |
| .Op Fl -use-c++ Op Ar =compiler_path |
| .Op Fl -use-cc Op Ar =compiler_path |
| .Op Fl -view |
| .Op Fl constraints Op Ar model |
| .Op Fl maxloop Ar N |
| .Op Fl no-failure-reports |
| .Op Fl stats |
| .Op Fl store Op Ar model |
| .Ar build_command |
| .Op build_options |
| .\" |
| .\" Sh DESCRIPTION |
| .Sh OPTIONS |
| .Bl -tag -width indent |
| .It Fl analyze-headers |
| Also analyze functions in #included files. |
| .It Fl enable-checker Op Ar checker_name |
| .It Fl disable-checker Op Ar checker_name |
| Enable/disable |
| .Ar checker_name . |
| See |
| .Sx CONTROLLING CHECKERS |
| below. |
| .It Fl h |
| .It Fl -help |
| Display this message |
| .It Fl -html-title Ns Op = Ns Ar title |
| Specify the title used on generated HTML pages. |
| If |
| .Ar title |
| is not specified, a default title is used. |
| .It Fl k |
| .It Fl -keep-going |
| Add a |
| .Dq keep on going |
| option to the specified build command. Currently supports |
| make and xcodebuild. This is a convenience option; one can specify |
| this behavior directly using build options. |
| .It Fl o |
| Target directory for HTML report files. Subdirectories will be |
| created as needed to represent separate |
| .Dq runs |
| of the analyzer. If this option is not specified, a directory is |
| created in /tmp (TMPDIR on Mac OS X) to store the reports. |
| .It Fl -plist |
| Output the results as a set of |
| .Li |
| \.plist |
| files. (By default the output of |
| .Nm |
| is a set of HTML files.) |
| .It Fl -plist-html |
| Output the results as a set of HTML and .plist files |
| .It Fl -status-bugs |
| Set exit status to 1 if it found potential bugs and 0 otherwise. By |
| default the exit status of |
| .Nm |
| is the same as the executed build command. |
| .It Fl -use-c++ Ns Op = Ns Ar compiler_path |
| Guess the default compiler for your C++ and Objective-C++ code. Use this |
| option to specify an alternate compiler. |
| .It Fl -use-cc Ns Op = Ns Ar compiler_path |
| Guess the default compiler for your C and Objective-C code. Use this |
| option to specify an alternate compiler. |
| .It Fl v |
| Verbose output from |
| .Nm |
| and the analyzer. A second and |
| third |
| .Ar v |
| increases verbosity. |
| .It Fl V |
| .It Fl -view |
| View analysis results in a web browser when the build completes. |
| .It Fl constraints Op Ar model |
| Specify the contraint engine used by the analyzer. By default the |
| .Ql range |
| model is used. Specifying |
| .Ql basic |
| uses a simpler, less powerful constraint model used by checker-0.160 |
| and earlier. |
| .It Fl maxloop Ar N |
| Specifiy the number of times a block can be visited before giving |
| up. Default is 4. Increase for more comprehensive coverage at a |
| cost of speed. |
| .It Fl no-failure-reports |
| Do not create a |
| .Ql failures |
| subdirectory that includes analyzer crash reports and preprocessed |
| source files. |
| .It Fl stats |
| Generates visitation statistics for the project being analyzed. |
| .It Fl store Op Ar model |
| Specify the store model used by the analyzer. By default, the |
| .Ql region |
| store model is used. |
| .Ql region |
| specifies a field- |
| sensitive store model. Users can also specify |
| .Ql basic |
| which is far less precise but can more quickly analyze code. |
| .Ql basic |
| was the default store model for checker-0.221 and earlier. |
| .\" |
| .El |
| .Sh RETURN VALUES |
| .Nm |
| returns the value returned by the called compiler unless |
| .Fl -status-bugs |
| is used. |
| .\" |
| .\" Other sections not yet used ... |
| .\" .Sh ENVIRONMENT |
| .\" .Sh FILES |
| .\" .Sh DIAGNOSTICS |
| .\" .Sh COMPATIBILITY |
| .\" .Sh HISTORY |
| .\" .Sh AUTHORS |
| .\" .Sh BUGS |
| .\" |
| .Sh CONTROLLING CHECKERS |
| A default group of checkers are always run unless explicitly disabled. |
| The checkers listed below may be enabled/disabled using the |
| .Fl enable-checker |
| and |
| .Fl disable-checker |
| options. |
| .Bl -tag -width indent |
| .It core.AdjustedReturnValue |
| Check to see if the return value of a function call is different than |
| the caller expects (e.g., from calls through function pointers) |
| .Bq on |
| .It core.AttributeNonNull |
| Check for null pointers passed as arguments to a function whose arguments are marked with the |
| .Qlnonnull' attribute |
| .Bq on |
| .It core.CallAndMessage |
| Check for logical errors for function calls and Objective-C message expressions (e.g., uninitialized arguments, null function pointers) |
| .Bq on |
| .It core.DivideZero |
| Check for division by zero |
| .Bq on |
| .It core.NullDereference |
| Check for dereferences of null pointers |
| .Bq on |
| .It core.StackAddressEscape |
| Check that addresses to stack memory do not escape the function |
| .Bq on |
| .It core.UndefinedBinaryOperatorResult |
| Check for undefined results of binary operators |
| .Bq on |
| .It core.VLASize |
| Check for declarations of VLA of undefined or zero size |
| .Bq on |
| .It core.builtin.BuiltinFunctions |
| Evaluate compiler builtin functions (e.g., alloca()) |
| .Bq on |
| .It core.builtin.NoReturnFunctions Evaluate "panic" functions that are known to not return to the caller |
| .Bq on |
| .It core.uninitialized.ArraySubscript |
| Check for uninitialized values used as array subscripts |
| .Bq on |
| .It core.uninitialized.Assign |
| Check for assigning uninitialized values |
| .Bq on |
| .It core.uninitialized.Bqanch |
| Check for uninitialized values used as branch conditions |
| .Bq on |
| .It core.uninitialized.CapturedBlockVariable |
| Check for blocks that capture uninitialized values |
| .Bq on |
| .It core.uninitialized.UndefReturn Check for uninitialized values being returned to the caller |
| .Bq on |
| .It deadcode.DeadStores |
| Check for values stored to variables that are never read afterwards |
| .Bq off |
| .It debug.DumpCFG |
| Display Control-Flow Graphs |
| .Bq off |
| .It debug.DumpCallGraph |
| Display Call Graph |
| .Bq off |
| .It debug.DumpDominators |
| Print the dominance tree for a given CFG |
| .Bq off |
| .It debug.DumpLiveVars |
| Print results of live variable analysis |
| .Bq off |
| .It debug.Stats |
| Emit warnings with analyzer statistics |
| .Bq off |
| .It debug.TaintTest |
| Mark tainted symbols as such. |
| .Bq off |
| .It debug.ViewCFG |
| View Control-Flow Graphs using GraphViz |
| .Bq off |
| .It debug.ViewCallGraph |
| View Call Graph using GraphViz |
| .Bq off |
| .It llvm.Conventions |
| Check code for LLVM codebase conventions |
| .Bq off |
| .It osx.API |
| Check for proper uses of various Mac OS X APIs |
| .Bq off |
| .It osx.AtomicCAS |
| Evaluate calls to OSAtomic functions |
| .Bq off |
| .It osx.SecKeychainAPI |
| Check for proper uses of Secure Keychain APIs |
| .Bq off |
| .It osx.cocoa.AtSync |
| Check for null pointers used as mutexes for @synchronized |
| .Bq off |
| .It osx.cocoa.ClassRelease |
| Check for sending 'retain', 'release', or 'autorelease' directly to a Class |
| .Bq off |
| .It osx.cocoa.IncompatibleMethodTypes |
| Warn about Objective-C method signatures with type incompatibilities |
| .Bq off |
| .It osx.cocoa.NSAutoreleasePool |
| Warn for suboptimal uses of NSAutoreleasePool in Objective-C GC mode |
| .Bq off |
| .It osx.cocoa.NSError |
| Check usage of NSError** parameters |
| .Bq off |
| .It osx.cocoa.NilArg |
| Check for prohibited nil arguments to ObjC method calls |
| .Bq off |
| .It osx.cocoa.RetainCount |
| Check for leaks and improper reference count management |
| .Bq off |
| .It osx.cocoa.SelfInit |
| Check that 'self' is properly initialized inside an initializer method |
| .Bq off |
| .It osx.cocoa.UnusedIvars |
| Warn about private ivars that are never used |
| .Bq off |
| .It osx.cocoa.VariadicMethodTypes |
| Check for passing non-Objective-C types to variadic methods that expect only Objective-C types |
| .Bq off |
| .It osx.coreFoundation.CFError |
| Check usage of CFErrorRef* parameters |
| .Bq off |
| .It osx.coreFoundation.CFNumber |
| Check for proper uses of CFNumberCreate |
| .Bq off |
| .It osx.coreFoundation.CFRetainRelease |
| Check for null arguments to CFRetain/CFRelease |
| .Bq off |
| .It osx.coreFoundation.containers.OutOfBounds |
| Checks for index out-of-bounds when using 'CFArray' API |
| .Bq off |
| .It osx.coreFoundation.containers.PointerSizedValues |
| Warns if 'CFArray', 'CFDictionary', 'CFSet' are created with non-pointer-size values |
| .Bq off |
| .It security.FloatLoopCounter |
| Warn on using a floating point value as a loop counter (CERT: FLP30-C, FLP30-CPP) |
| .Bq off |
| .It security.insecureAPI.UncheckedReturn |
| Warn on uses of functions whose return values must be always checked |
| .Bq off |
| .It security.insecureAPI.getpw |
| Warn on uses of the 'getpw' function |
| .Bq off |
| .It security.insecureAPI.gets |
| Warn on uses of the 'gets' function |
| .Bq off |
| .It security.insecureAPI.mkstemp |
| Warn when 'mkstemp' is passed fewer than 6 X's in the format string |
| .Bq off |
| .It security.insecureAPI.mktemp |
| Warn on uses of the 'mktemp' function |
| .Bq off |
| .It security.insecureAPI.rand |
| Warn on uses of the 'rand', 'random', and related functions |
| .Bq off |
| .It security.insecureAPI.strcpy |
| Warn on uses of the 'strcpy' and 'strcat' functions |
| .Bq off |
| .It security.insecureAPI.vfork |
| Warn on uses of the 'vfork' function |
| .Bq off |
| .It unix.API |
| Check calls to various UNIX/Posix functions |
| .Bq off |
| .It unix.Malloc |
| Check for memory leaks, double free, and use-after-free problems. |
| .Bq off |
| .It unix.cstring.BadSizeArg |
| Check the size argument passed into C string functions for common erroneous patterns |
| .Bq off |
| .It unix.cstring.NullArg |
| Check for null pointers being passed as arguments to C string functions |
| .Bq off |
| .El |
| .\" |
| .Sh EXAMPLE |
| .Ic scan-build -o /tmp/myhtmldir make -j4 |
| .Pp |
| The above example causes analysis reports to be deposited into |
| a subdirectory of |
| .Ql /tmp/myhtmldir |
| and to run |
| .Ql make |
| with the |
| .Ql -j4 |
| option. |
| A different subdirectory is created each time |
| .Nm |
| analyzes a project. |
| The analyzer should support most parallel builds, but not distributed builds. |
| |
