Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:114600
Content-Type: text/plain;
	charset=utf-8
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.80.0.2.43\))
Date: Tue, 25 May 2021 17:10:16 -0300
References: <194DA850-19F7-41C4-97CF-944F13B57AFD@cmpct.info>
To: internals@lists.php.net
In-Reply-To: <194DA850-19F7-41C4-97CF-944F13B57AFD@cmpct.info>
Message-ID: <7AD8D5D3-C70E-40C3-B55E-A4C9E4ECDA44@cmpct.info>
Subject: Re: [PHP-DEV] Using clang-analyzer with PHP: experiences?
From: calvin@cmpct.info (Calvin Buckley)

I did some additional research and seemed to have decent luck with =
slamming a construct like this after the includes:

#define emalloc  malloc
#define erealloc realloc
#define ecalloc  calloc
#define estrdup  strdup
#define estrndup strndup
#define efree    free

One could wrap it around `__clang_analyzer__` or such. Unfortunately, =
this is kinda ugly; it emits compiler warnings, but I suspect this =
probably belongs in PHP itself or perhaps in some kind of clang-analyzer =
addon that handles the e* allocation functions as well as things like =
mismatching them.

> On May 21, 2021, at 4:01 PM, Calvin Buckley <calvin@cmpct.info> wrote:
>=20
> Hi internals@,
>=20
> I maintain an extension and I suspect there are some issues in the =
code. As such, I=E2=80=99ve been trying various tools to try to make it =
easier to catch the issues. (For the curious: I=E2=80=99ve tried *San, =
which I feel doesn=E2=80=99t work very well unless you /totally control/ =
the entire stack, which I didn=E2=80=99t have the luxury of. I also =
tried Valgrind, but I need ro revisit this to deal with possible false =
positives in the library.) This time, I decided to try static analysis =
through LLVM.
>=20
> Luckily, clang-analyzer is pretty simple. Just prepending =
=E2=80=9Cscan-build=E2=80=9D to my make invocation. Easy, right? =
Unfortunately, I noticed that due to an inconsistency in the codebase (a =
use of realloc instead of erealloc), that it doesn=E2=80=99t seem to =
account for i.e emalloc vs. malloc. Possible leaks =E2=80=9Cwent away=E2=80=
=9D from the output when I converted them to the PHP memory management =
functions.
>=20
> Has anyone ever used clang-analyzer with PHP before? I noticed there =
was some tooling for a previous PHP transition [1], but I don=E2=80=99t =
know if anyone=E2=80=99s tackled the low-hanging fruit of memory =
functions. I suppose I could just redefine emalloc and friends, but I =
feel that would probably be inaccurate with things like zend_string.
>=20
> Regards,
> Calvin
>=20
> [1]: https://github.com/johannes/clang-php-checker
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: https://www.php.net/unsub.php
>=20