Re: Using clang-analyzer with PHP: experiences?

I did some additional research and seemed to have decent luck with slamming a construct like this after the includes: #define emalloc malloc #define erealloc realloc #define ecalloc calloc #define estrdup strdup #define estrndup strndup #define efree free One could wrap it around __clang_analyzer__ or such. Unfortunately, this is kinda ugly; it emits compiler warnings, but I suspect this probably belongs in PHP itself or perhaps in some kind of clang-analyzer addon that handles the e* allocation functions as well as things like mismatching them. > On May 21, 2021, at 4:01 PM, Calvin Buckley <calvin@cmpct.info> wrote: > > Hi internals@, > > I maintain an extension and I suspect there are some issues in the code. As such, I’ve been > trying various tools to try to make it easier to catch the issues. (For the curious: I’ve tried > *San, which I feel doesn’t work very well unless you /totally control/ the entire stack, which I > didn’t have the luxury of. I also tried Valgrind, but I need ro revisit this to deal with possible > false positives in the library.) This time, I decided to try static analysis through LLVM. > > Luckily, clang-analyzer is pretty simple. Just prepending “scan-build” to my make > invocation. Easy, right? Unfortunately, I noticed that due to an inconsistency in the codebase (a > use of realloc instead of erealloc), that it doesn’t seem to account for i.e emalloc vs. malloc. > Possible leaks “went away” from the output when I converted them to the PHP memory management > functions. > > Has anyone ever used clang-analyzer with PHP before? I noticed there was some tooling for a > previous PHP transition [1], but I don’t know if anyone’s tackled the low-hanging fruit of > memory functions. I suppose I could just redefine emalloc and friends, but I feel that would > probably be inaccurate with things like zend_string. > > Regards, > Calvin > > [1]: https://github.com/johannes/clang-php-checker > -- > PHP Internals - PHP Runtime Development Mailing List > To unsubscribe, visit: https://www.php.net/unsub.php >