1*67e74705SXin Li<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" 2*67e74705SXin Li "http://www.w3.org/TR/html4/strict.dtd"> 3*67e74705SXin Li<html> 4*67e74705SXin Li<head> 5*67e74705SXin Li <title>Clang Static Analyzer</title> 6*67e74705SXin Li <link type="text/css" rel="stylesheet" href="content.css"> 7*67e74705SXin Li <link type="text/css" rel="stylesheet" href="menu.css"> 8*67e74705SXin Li <script type="text/javascript" src="scripts/menu.js"></script> 9*67e74705SXin Li <!-- Generated from: http://www.spiffycorners.com/index.php --> 10*67e74705SXin Li 11*67e74705SXin Li<style type="text/css"> 12*67e74705SXin Li.spiffy{display:block} 13*67e74705SXin Li.spiffy *{ 14*67e74705SXin Li display:block; 15*67e74705SXin Li height:1px; 16*67e74705SXin Li overflow:hidden; 17*67e74705SXin Li font-size:.01em; 18*67e74705SXin Li background:#EBF0FA} 19*67e74705SXin Li.spiffy1{ 20*67e74705SXin Li margin-left:3px; 21*67e74705SXin Li margin-right:3px; 22*67e74705SXin Li padding-left:1px; 23*67e74705SXin Li padding-right:1px; 24*67e74705SXin Li border-left:1px solid #f6f8fc; 25*67e74705SXin Li border-right:1px solid #f6f8fc; 26*67e74705SXin Li background:#f0f3fb} 27*67e74705SXin Li.spiffy2{ 28*67e74705SXin Li margin-left:1px; 29*67e74705SXin Li margin-right:1px; 30*67e74705SXin Li padding-right:1px; 31*67e74705SXin Li padding-left:1px; 32*67e74705SXin Li border-left:1px solid #fdfdfe; 33*67e74705SXin Li border-right:1px solid #fdfdfe; 34*67e74705SXin Li background:#eef2fa} 35*67e74705SXin Li.spiffy3{ 36*67e74705SXin Li margin-left:1px; 37*67e74705SXin Li margin-right:1px; 38*67e74705SXin Li border-left:1px solid #eef2fa; 39*67e74705SXin Li border-right:1px solid #eef2fa;} 40*67e74705SXin Li.spiffy4{ 41*67e74705SXin Li border-left:1px solid #f6f8fc; 42*67e74705SXin Li border-right:1px solid #f6f8fc} 43*67e74705SXin Li.spiffy5{ 44*67e74705SXin Li border-left:1px solid #f0f3fb; 45*67e74705SXin Li border-right:1px solid #f0f3fb} 46*67e74705SXin Li.spiffyfg{ 47*67e74705SXin Li background:#EBF0FA} 48*67e74705SXin Li 49*67e74705SXin Li.spiffyfg h2 { 50*67e74705SXin Li margin:0px; padding:10px; 51*67e74705SXin Li} 52*67e74705SXin Li 53*67e74705SXin Li #left { float:left; } 54*67e74705SXin Li #left h2 { margin:1px; padding-top:0px; } 55*67e74705SXin Li #right { float:left; margin-left:20px; margin-right:20px; padding:0px ;} 56*67e74705SXin Li #right h2 { padding:0px; margin:0px; } 57*67e74705SXin Li #wrappedcontent { padding:15px;} 58*67e74705SXin Li</style> 59*67e74705SXin Li</head> 60*67e74705SXin Li<body> 61*67e74705SXin Li 62*67e74705SXin Li<div id="page"> 63*67e74705SXin Li<!--#include virtual="menu.html.incl"--> 64*67e74705SXin Li<div id="content"> 65*67e74705SXin Li 66*67e74705SXin Li 67*67e74705SXin Li<table style="margin-top:0px" width="100%" border="0" cellpadding="0px" cellspacing="0"> 68*67e74705SXin Li<tr><td> 69*67e74705SXin Li 70*67e74705SXin Li<h1>Clang Static Analyzer</h1> 71*67e74705SXin Li 72*67e74705SXin Li<p>The Clang Static Analyzer is a source code analysis tool that finds bugs in 73*67e74705SXin LiC, C++, and Objective-C programs.</p> 74*67e74705SXin Li 75*67e74705SXin Li<p>Currently it can be run either as a <a href="scan-build.html">standalone 76*67e74705SXin Litool</a> or <a href="xcode.html">within Xcode</a>. The standalone tool is 77*67e74705SXin Liinvoked from the command line, and is intended to be run in tandem with a build 78*67e74705SXin Liof a codebase.</p> 79*67e74705SXin Li 80*67e74705SXin Li<p>The analyzer is 100% open source and is part of the <a 81*67e74705SXin Lihref="http://clang.llvm.org">Clang</a> project. Like the rest of Clang, the 82*67e74705SXin Lianalyzer is implemented as a C++ library that can be used by other tools and 83*67e74705SXin Liapplications.</p> 84*67e74705SXin Li 85*67e74705SXin Li<h2>Download</h2> 86*67e74705SXin Li 87*67e74705SXin Li<div style="padding:0px; font-size: 90%"> 88*67e74705SXin Li <b class="spiffy"> 89*67e74705SXin Li <b class="spiffy1"><b></b></b> 90*67e74705SXin Li <b class="spiffy2"><b></b></b> 91*67e74705SXin Li <b class="spiffy3"></b> 92*67e74705SXin Li <b class="spiffy4"></b> 93*67e74705SXin Li <b class="spiffy5"></b></b> 94*67e74705SXin Li <div class="spiffyfg"> 95*67e74705SXin Li <div style="padding:15px"> 96*67e74705SXin Li <h3 style="margin:0px;padding:0px">Mac OS X</h3> 97*67e74705SXin Li <ul> 98*67e74705SXin Li <li>Latest build (10.7+):<br> 99*67e74705SXin Li <!--#include virtual="latest_checker.html.incl"--> 100*67e74705SXin Li </li> 101*67e74705SXin Li <li><a href="/release_notes.html">Release notes</a></li> 102*67e74705SXin Li <li>This build can be used both from the command line and from within Xcode</li> 103*67e74705SXin Li <li><a href="/installation.html">Installation</a> and <a href="/scan-build.html">usage</a></li> 104*67e74705SXin Li </ul> 105*67e74705SXin Li </div> 106*67e74705SXin Li </div> 107*67e74705SXin Li <b class="spiffy"> 108*67e74705SXin Li <b class="spiffy5"></b> 109*67e74705SXin Li <b class="spiffy4"></b> 110*67e74705SXin Li <b class="spiffy3"></b> 111*67e74705SXin Li <b class="spiffy2"><b></b></b> 112*67e74705SXin Li <b class="spiffy1"><b></b></b></b> 113*67e74705SXin Li</div> 114*67e74705SXin Li 115*67e74705SXin Li<div style="padding:0; margin-top:10px; font-size: 90%"> 116*67e74705SXin Li <b class="spiffy"> 117*67e74705SXin Li <b class="spiffy1"><b></b></b> 118*67e74705SXin Li <b class="spiffy2"><b></b></b> 119*67e74705SXin Li <b class="spiffy3"></b> 120*67e74705SXin Li <b class="spiffy4"></b> 121*67e74705SXin Li <b class="spiffy5"></b></b> 122*67e74705SXin Li <div class="spiffyfg"> 123*67e74705SXin Li <div style="padding:15px"> 124*67e74705SXin Li <h3 style="margin:0px;padding:0px">Other Platforms</h3> 125*67e74705SXin Li <p>For other platforms, please follow the instructions for <a 126*67e74705SXin Li href="/installation#OtherPlatforms">building the analyzer</a> from 127*67e74705SXin Li source code.<p> 128*67e74705SXin Li </div> 129*67e74705SXin Li </div> 130*67e74705SXin Li <b class="spiffy"> 131*67e74705SXin Li <b class="spiffy5"></b> 132*67e74705SXin Li <b class="spiffy4"></b> 133*67e74705SXin Li <b class="spiffy3"></b> 134*67e74705SXin Li <b class="spiffy2"><b></b></b> 135*67e74705SXin Li <b class="spiffy1"><b></b></b></b> 136*67e74705SXin Li</div> 137*67e74705SXin Li 138*67e74705SXin Li 139*67e74705SXin Li</td><td style="padding-left:10px"> 140*67e74705SXin Li<a href="images/analyzer_xcode.png"><img src="images/analyzer_xcode.png" width="450" alt="analyzer in xcode"></a> 141*67e74705SXin Li<div style="text-align:center"><b>Viewing static analyzer results in Xcode</b></div> 142*67e74705SXin Li<a href="images/analyzer_html.png"><img src="images/analyzer_html.png" width="450" alt="analyzer in browser"></a> 143*67e74705SXin Li<div style="text-align:center"><b>Viewing static analyzer results in a web browser</b></div> 144*67e74705SXin Li</td></tr></table> 145*67e74705SXin Li 146*67e74705SXin Li<h2 id="StaticAnalysis">What is Static Analysis?</h2> 147*67e74705SXin Li 148*67e74705SXin Li<p>The term "static analysis" is conflated, but here we use it to mean 149*67e74705SXin Lia collection of algorithms and techniques used to analyze source code in order 150*67e74705SXin Lito automatically find bugs. The idea is similar in spirit to compiler warnings 151*67e74705SXin Li(which can be useful for finding coding errors) but to take that idea a step 152*67e74705SXin Lifurther and find bugs that are traditionally found using run-time debugging 153*67e74705SXin Litechniques such as testing.</p> 154*67e74705SXin Li 155*67e74705SXin Li<p>Static analysis bug-finding tools have evolved over the last several decades 156*67e74705SXin Lifrom basic syntactic checkers to those that find deep bugs by reasoning about 157*67e74705SXin Lithe semantics of code. The goal of the Clang Static Analyzer is to provide a 158*67e74705SXin Liindustrial-quality static analysis framework for analyzing C, C++, and 159*67e74705SXin LiObjective-C programs that is freely available, extensible, and has a high quality of implementation.</p> 160*67e74705SXin Li 161*67e74705SXin Li<h3 id="Clang">Part of Clang and LLVM</h3> 162*67e74705SXin Li 163*67e74705SXin Li<p>As its name implies, the Clang Static Analyzer is built on top of <a 164*67e74705SXin Lihref="http://clang.llvm.org">Clang</a> and <a href="http://llvm.org">LLVM</a>. 165*67e74705SXin LiStrictly speaking, the analyzer is part of Clang, as Clang consists of a set of 166*67e74705SXin Lireusable C++ libraries for building powerful source-level tools. The static 167*67e74705SXin Lianalysis engine used by the Clang Static Analyzer is a Clang library, and has 168*67e74705SXin Lithe capability to be reused in different contexts and by different clients.</p> 169*67e74705SXin Li 170*67e74705SXin Li<h2>Important Points to Consider</h2> 171*67e74705SXin Li 172*67e74705SXin Li<p>While we believe that the static analyzer is already very useful for finding 173*67e74705SXin Libugs, we ask you to bear in mind a few points when using it.</p> 174*67e74705SXin Li 175*67e74705SXin Li<h3>Work-in-Progress</h3> 176*67e74705SXin Li 177*67e74705SXin Li<p>The analyzer is a continuous work-in-progress. There are many planned 178*67e74705SXin Lienhancements to improve both the precision and scope of its analysis algorithms 179*67e74705SXin Lias well as the kinds of bugs it will find. While there are fundamental 180*67e74705SXin Lilimitations to what static analysis can do, we have a long way to go before 181*67e74705SXin Lihitting that wall.</p> 182*67e74705SXin Li 183*67e74705SXin Li<h3>Slower than Compilation</h3> 184*67e74705SXin Li 185*67e74705SXin Li<p>Operationally, using static analysis to 186*67e74705SXin Liautomatically find deep program bugs is about trading CPU time for the hardening 187*67e74705SXin Liof code. Because of the deep analysis performed by state-of-the-art static 188*67e74705SXin Lianalysis tools, static analysis can be much slower than compilation.</p> 189*67e74705SXin Li 190*67e74705SXin Li<p>While the Clang Static Analyzer is being designed to be as fast and 191*67e74705SXin Lilight-weight as possible, please do not expect it to be as fast as compiling a 192*67e74705SXin Liprogram (even with optimizations enabled). Some of the algorithms needed to find 193*67e74705SXin Libugs require in the worst case exponential time.</p> 194*67e74705SXin Li 195*67e74705SXin Li<p>The Clang Static Analyzer runs in a reasonable amount of time by both 196*67e74705SXin Libounding the amount of checking work it will do as well as using clever 197*67e74705SXin Lialgorithms to reduce the amount of work it must do to find bugs.</p> 198*67e74705SXin Li 199*67e74705SXin Li<h3>False Positives</h3> 200*67e74705SXin Li 201*67e74705SXin Li<p>Static analysis is not perfect. It can falsely flag bugs in a program where 202*67e74705SXin Lithe code behaves correctly. Because some code checks require more analysis 203*67e74705SXin Liprecision than others, the frequency of false positives can vary widely between 204*67e74705SXin Lidifferent checks. Our long-term goal is to have the analyzer have a low false 205*67e74705SXin Lipositive rate for most code on all checks.</p> 206*67e74705SXin Li 207*67e74705SXin Li<p>Please help us in this endeavor by <a href="filing_bugs.html">reporting false 208*67e74705SXin Lipositives</a>. False positives cannot be addressed unless we know about 209*67e74705SXin Lithem.</p> 210*67e74705SXin Li 211*67e74705SXin Li<h3>More Checks</h3> 212*67e74705SXin Li 213*67e74705SXin Li<p>Static analysis is not magic; a static analyzer can only find bugs that it 214*67e74705SXin Lihas been specifically engineered to find. If there are specific kinds of bugs 215*67e74705SXin Liyou would like the Clang Static Analyzer to find, please feel free to 216*67e74705SXin Lifile <a href="filing_bugs.html">feature requests</a> or contribute your own 217*67e74705SXin Lipatches.</p> 218*67e74705SXin Li 219*67e74705SXin Li</div> 220*67e74705SXin Li</div> 221*67e74705SXin Li</body> 222*67e74705SXin Li</html> 223*67e74705SXin Li 224
