Can Clang Static Analyzer Detect C++ Smart Pointer Issues like Null Dereference or Use-After-Move?

[MingxiuWang]

I'm researching static analysis tools for C++ and I'm particularly interested in their support for detecting issues related to smart pointers (e.g., std::unique_ptr, std::shared_ptr).

Can Clang Static Analyzer detect bugs such as:

Null dereference of smart pointers

Use-after-move

Double deletion or invalid access via smart pointers

If CSA supports these, are there specific checkers, compiler flags, or patterns I should follow to improve detection? Any example reports or references to documentation would be much appreciated.

[llvmbot]

@llvm/issue-subscribers-clang-static-analyzer

Author: Mingxiu Wang (MingxiuWang)

I'm researching static analysis tools for C++ and I'm particularly interested in their support for detecting issues related to smart pointers (e.g., std::unique_ptr, std::shared_ptr).

Can Clang Static Analyzer detect bugs such as:

Null dereference of smart pointers

Use-after-move

Double deletion or invalid access via smart pointers

If CSA supports these, are there specific checkers, compiler flags, or patterns I should follow to improve detection? Any example reports or references to documentation would be much appreciated.

[steakhal]

I'd suggest you to have a look at the list of available checkers, in particular the following 2 entries:

• https://clang.llvm.org/docs/analyzer/checkers.html#alpha-cplusplus-smartptr-c
• https://clang.llvm.org/docs/analyzer/checkers.html#cplusplus-move-c

You can look at the relevant tests if you grep for the checker name under clang/test/Analysis directory to find the appropriate ones.
The name of the test file should tell you if its the one you are looking for or not. There may be multiple.

[Hemkumar247]

Yes, the Clang Static Analyzer (CSA) is quite capable of detecting the bugs you've listed. Here's a breakdown of its support for each category:

1. Null Dereference of Smart Pointers
   CSA can detect null dereferences of smart pointers. The primary checker for this is:

clang-analyzer-core.NullDereference: This is a general-purpose checker that tracks null values and flags dereferences of null pointers, including smart pointers.
2. Use-after-move
CSA has excellent support for detecting use-after-move issues, which is a common problem with std::unique_ptr. The relevant checkers are:

bugprone-use-after-move: This checker from clang-tidy identifies when a moved-from object is used.
clang-analyzer-cplusplus.Move: This is a path-sensitive checker from the static analyzer that can track the state of smart pointers after they have been moved.
3. Double Deletion or Invalid Access via Smart Pointers
CSA can detect several types of invalid memory management with smart pointers, including the common mistake of using a non-array deleter for an array allocation. The key checkers here are:

bugprone-unique-ptr-array-mismatch: Flags cases where std::unique_ptr is initialized with an array but doesn't use the array version (std::unique_ptr<T[]>).
bugprone-shared-ptr-array-mismatch: Similar to the above, but for std::shared_ptr.
clang-analyzer-cplusplus.NewDelete: A more general checker that looks for memory leaks, double-frees, and other memory management issues.
Improving Detection: Flags and Patterns
To get the best results, I recommend using clang-tidy to run the static analyzer checks. It gives you fine-grained control over which checks are enabled. You can enable the relevant checks using the --checks flag. A good starting point is to enable all clang-analyzer-* and bugprone-* checks.

I hope this detailed answer is helpful for your research!

[steakhal]

We can reopen this if there are followups.

[NagyDonat]

I strongly suspect that the comment by Hemkumar247 is AI-generated, because it contains several inaccuracies, including the completely false claim that core.NullDereference handles smart pointers. Please don't copypaste answers from ChatGPT et al, especially not without verifying their claims!

[Snape3058]

Double deletion or invalid access via smart pointers

These are checked via the malloc checker for heap memory, not directly checked by the smart pointer checker.
And since the smart pointer modeler is enabled by default, you do not even need to enable the alpha.cplusplus.SmartPtr checker manually.

$ clang temp.cpp --analyze -Xanalyzer -analyzer-output=text

#include <memory>

int *foo() {
  int *pp = nullptr;
  {
    auto p = std::make_unique<int>(42);
    pp = p.get();
  }
  *pp = 42; // Report use after free here.
}

However, the reports in the destructor of unique_ptr will be suppressed due to in the system headers. Similarly, for the same reason, a *p = 0; after the delete p.get(); below will not be reported either.

#include <memory>

int *foo() {
    auto p = std::make_unique<int>(42);
    delete p.get();
}
// A use-after-free report is suppressed here.

@steakhal I forgot which config can show the report in the second case. Is it a BugReportVisitor enabled by default and not controlled by users?
If so, do you think we need to do something for this issue?

[steakhal]

I strongly suspect that the comment by Hemkumar247 is AI-generated, [...]

So did I.

@steakhal I forgot which config can show the report in the second case. Is it a BugReportVisitor enabled by default and not controlled by users?
If so, do you think we need to do something for this issue?

I hope everyone understands that I only invest so much of my free time into issues as the issue creator. I'm done here.

[Snape3058]

Sorry for that.