Next: Debugging Options, Previous: Warning Options, Up: Invoking GCC
-fanalyzer
This analysis is much more expensive than other GCC warnings.
Enabling this option effectively enables the following warnings:
-Wanalyzer-double-fclose -Wanalyzer-double-free -Wanalyzer-exposure-through-output-file -Wanalyzer-file-leak -Wanalyzer-free-of-non-heap -Wanalyzer-malloc-leak -Wanalyzer-mismatching-deallocation -Wanalyzer-null-argument -Wanalyzer-null-dereference -Wanalyzer-possible-null-argument -Wanalyzer-possible-null-dereference -Wanalyzer-shift-count-negative -Wanalyzer-shift-count-overflow -Wanalyzer-stale-setjmp-buffer -Wanalyzer-unsafe-call-within-signal-handler -Wanalyzer-use-after-free -Wanalyzer-use-of-pointer-in-stale-stack-frame -Wanalyzer-use-of-uninitialized-value -Wanalyzer-write-to-const -Wanalyzer-write-to-string-literal
This option is only available if GCC was configured with analyzer
support enabled.
-Wanalyzer-too-complex
By default, the analysis silently stops if the code is too
complicated for the analyzer to fully explore and it reaches an internal
limit. The -Wanalyzer-too-complex option warns if this occurs.
-Wno-analyzer-double-fclose
This diagnostic warns for paths through the code in which a FILE *
can have fclose
called on it more than once.
-Wno-analyzer-double-free
This diagnostic warns for paths through the code in which a pointer
can have a deallocator called on it more than once, either free
,
or a deallocator referenced by attribute malloc
.
-Wno-analyzer-exposure-through-output-file
This diagnostic warns for paths through the code in which a
security-sensitive value is written to an output file
(such as writing a password to a log file).
-Wno-analyzer-file-leak
This diagnostic warns for paths through the code in which a
<stdio.h>
FILE *
stream object is leaked.
-Wno-analyzer-free-of-non-heap
This diagnostic warns for paths through the code in which free
is called on a non-heap pointer (e.g. an on-stack buffer, or a global).
-Wno-analyzer-malloc-leak
This diagnostic warns for paths through the code in which a
pointer allocated via an allocator is leaked: either malloc
,
or a function marked with attribute malloc
.
-Wno-analyzer-mismatching-deallocation
This diagnostic warns for paths through the code in which the
wrong deallocation function is called on a pointer value, based on
which function was used to allocate the pointer value. The diagnostic
will warn about mismatches between free
, scalar delete
and vector delete[]
, and those marked as allocator/deallocator
pairs using attribute malloc
.
-Wno-analyzer-possible-null-argument
This diagnostic warns for paths through the code in which a
possibly-NULL value is passed to a function argument marked
with __attribute__((nonnull))
as requiring a non-NULL
value.
-Wno-analyzer-possible-null-dereference
This diagnostic warns for paths through the code in which a
possibly-NULL value is dereferenced.
-Wno-analyzer-null-argument
This diagnostic warns for paths through the code in which a
value known to be NULL is passed to a function argument marked
with __attribute__((nonnull))
as requiring a non-NULL
value.
-Wno-analyzer-null-dereference
This diagnostic warns for paths through the code in which a
value known to be NULL is dereferenced.
-Wno-analyzer-shift-count-negative
This diagnostic warns for paths through the code in which a
shift is attempted with a negative count. It is analogous to
the -Wshift-count-negative diagnostic implemented in
the C/C++ front ends, but is implemented based on analyzing
interprocedural paths, rather than merely parsing the syntax tree.
However, the analyzer does not prioritize detection of such paths, so
false negatives are more likely relative to other warnings.
-Wno-analyzer-shift-count-overflow
This diagnostic warns for paths through the code in which a
shift is attempted with a count greater than or equal to the
precision of the operand's type. It is analogous to
the -Wshift-count-overflow diagnostic implemented in
the C/C++ front ends, but is implemented based on analyzing
interprocedural paths, rather than merely parsing the syntax tree.
However, the analyzer does not prioritize detection of such paths, so
false negatives are more likely relative to other warnings.
-Wno-analyzer-stale-setjmp-buffer
This diagnostic warns for paths through the code in which
longjmp
is called to rewind to a jmp_buf
relating
to a setjmp
call in a function that has returned.
When setjmp
is called on a jmp_buf
to record a rewind
location, it records the stack frame. The stack frame becomes invalid
when the function containing the setjmp
call returns. Attempting
to rewind to it via longjmp
would reference a stack frame that
no longer exists, and likely lead to a crash (or worse).
-Wno-analyzer-tainted-allocation-size
This diagnostic warns for paths through the code in which a value that could be under an attacker's control is used as the size of an allocation without being sanitized, so that an attacker could inject an excessively large allocation and potentially cause a denial of service attack.
-Wno-analyzer-tainted-array-index
This diagnostic warns for paths through the code in which a value that could be under an attacker's control is used as the index of an array access without being sanitized, so that an attacker could inject an out-of-bounds access.
-Wno-analyzer-tainted-divisor
This diagnostic warns for paths through the code in which a value
that could be under an attacker's control is used as the divisor
in a division or modulus operation without being sanitized, so that
an attacker could inject a division-by-zero.
-Wno-analyzer-tainted-offset
This diagnostic warns for paths through the code in which a value that could be under an attacker's control is used as a pointer offset without being sanitized, so that an attacker could inject an out-of-bounds access.
-Wno-analyzer-tainted-size
This diagnostic warns for paths through the code in which a value
that could be under an attacker's control is used as the size of
an operation such as memset
without being sanitized, so that an
attacker could inject an out-of-bounds access.
-Wno-analyzer-unsafe-call-within-signal-handler
This diagnostic warns for paths through the code in which a
function known to be async-signal-unsafe (such as fprintf
) is
called from a signal handler.
-Wno-analyzer-use-after-free
This diagnostic warns for paths through the code in which a
pointer is used after a deallocator is called on it: either free
,
or a deallocator referenced by attribute malloc
.
-Wno-analyzer-use-of-pointer-in-stale-stack-frame
This diagnostic warns for paths through the code in which a pointer
is dereferenced that points to a variable in a stale stack frame.
-Wno-analyzer-write-to-const
This diagnostic warns for paths through the code in which the analyzer
detects an attempt to write through a pointer to a const
object.
However, the analyzer does not prioritize detection of such paths, so
false negatives are more likely relative to other warnings.
-Wno-analyzer-write-to-string-literal
This diagnostic warns for paths through the code in which the analyzer
detects an attempt to write through a pointer to a string literal.
However, the analyzer does not prioritize detection of such paths, so
false negatives are more likely relative to other warnings.
-Wno-analyzer-use-of-uninitialized-value
This diagnostic warns for paths through the code in which an uninitialized value is used.
Pertinent parameters for controlling the exploration are: --param analyzer-bb-explosion-factor=value, --param analyzer-max-enodes-per-program-point=value, --param analyzer-max-recursion-depth=value, and --param analyzer-min-snodes-for-call-summary=value.
The following options control the analyzer.
-fanalyzer-call-summaries
If enabled, call summaries are only used for functions with more than one
call site, and that are sufficiently complicated (as per
--param analyzer-min-snodes-for-call-summary=value).
-fanalyzer-checker=
nameSome checkers are disabled by default (even with -fanalyzer),
such as the taint
checker that implements
-Wanalyzer-tainted-array-index, and this option is required
to enable them.
Note: currently, -fanalyzer-checker=taint disables the following warnings from -fanalyzer:
-Wanalyzer-double-fclose -Wanalyzer-double-free -Wanalyzer-exposure-through-output-file -Wanalyzer-file-leak -Wanalyzer-free-of-non-heap -Wanalyzer-malloc-leak -Wanalyzer-mismatching-deallocation -Wanalyzer-null-argument -Wanalyzer-null-dereference -Wanalyzer-possible-null-argument -Wanalyzer-possible-null-dereference -Wanalyzer-unsafe-call-within-signal-handler -Wanalyzer-use-after-free
-fno-analyzer-feasibility
By default the analyzer verifies that there is a feasible control flow path
for each diagnostic it emits: that the conditions that hold are not mutually
exclusive. Diagnostics for which no feasible path can be found are rejected.
This filtering can be suppressed with -fno-analyzer-feasibility, for
debugging issues in this code.
-fanalyzer-fine-grained
Internally the analyzer builds an “exploded graph” that combines control flow graphs with data flow information.
By default, an edge in this graph can contain the effects of a run
of multiple statements within a basic block. With
-fanalyzer-fine-grained, each statement gets its own edge.
-fanalyzer-show-duplicate-count
-fno-analyzer-state-merge
By default the analyzer attempts to simplify analysis by merging
sufficiently similar states at each program point as it builds its
“exploded graph”. With -fno-analyzer-state-merge this
merging can be suppressed, for debugging state-handling issues.
-fno-analyzer-state-purge
By default the analyzer attempts to simplify analysis by purging aspects of state at a program point that appear to no longer be relevant e.g. the values of locals that aren't accessed later in the function and which aren't relevant to leak analysis.
With -fno-analyzer-state-purge this purging of state can
be suppressed, for debugging state-handling issues.
-fanalyzer-transitivity
-fanalyzer-verbose-edges
-fanalyzer-verbose-state-changes
-fanalyzer-verbosity=
levelThe level can be one of:
free
diagnostic,
both calls to free
will be shown.
This level is the default.
-fdump-analyzer
-fdump-analyzer-stderr
-fdump-analyzer-callgraph
-fdump-analyzer-exploded-graph
-fdump-analyzer-exploded-nodes
-fdump-analyzer-exploded-nodes-2
-fdump-analyzer-exploded-nodes-3
-fdump-analyzer-exploded-paths
-fdump-analyzer-feasibility
-fdump-analyzer-json
-fdump-analyzer-state-purge
-fdump-analyzer-supergraph
-fdump-analyzer-untracked