GCC Middle and Back End API Reference
ana Namespace Reference

Namespaces

namespace  evdesc

Data Structures

class  access_diagram
struct  access_operation
struct  access_range
class  alloca_region
class  analysis_plan
class  annotating_context
class  asm_output_svalue
class  bar_chart
class  base_feasible_edge
class  base_feasible_node
class  binding_cluster
class  binding_key
class  binding_map
class  binop_svalue
struct  bit_range
class  bit_range_region
class  bit_size_expr
class  bits_within_svalue
struct  bound
struct  bounded_range
struct  bounded_ranges
class  bounded_ranges_constraint
class  bounded_ranges_manager
class  builtin_known_function
struct  byte_range
struct  call_arg_details
class  call_details
class  call_event
class  call_info
class  call_string
class  call_summary
class  call_summary_replay
class  call_superedge
class  callgraph_superedge
class  callsite_expr
class  cast_region
class  catch_cfg_edge_event
class  cfg_edge_event
class  cfg_superedge
class  checker_event
class  checker_path
class  code_region
struct  complexity
class  compound_svalue
class  concrete_binding
class  conjured_purge
class  conjured_svalue
class  const_fn_result_svalue
class  constant_svalue
class  constraint
class  constraint_manager
class  custom_edge_info
class  custom_event
class  custom_transition
class  debug_event
class  decl_region
class  diagnostic_emission_context
class  diagnostic_manager
class  dot_annotator
class  dynamic_call_info_t
struct  eg_hash_map_traits
struct  eg_point_hash_map_traits
struct  eg_traits
class  eh_dispatch_allowed_cfg_superedge
class  eh_dispatch_cfg_superedge
class  eh_dispatch_try_cfg_superedge
class  element_region
class  end_cfg_edge_event
class  end_consolidated_cfg_edges_event
class  engine
class  equiv_class
class  equiv_class_id
class  errno_region
struct  event_loc_info
struct  exception_node
class  explicit_throw_event
class  exploded_edge
class  exploded_graph
class  exploded_node
class  exploded_path
class  extrinsic_state
class  fact_visitor
class  failed_call_info
class  feasibility_problem
class  feasibility_state
class  feasible_cluster
class  feasible_edge
class  feasible_graph
class  feasible_node
struct  fg_traits
class  field_region
class  format
class  frame_region
class  function_entry_event
class  function_point
class  function_region
class  function_set
class  globals_region
class  heap_allocated_region
class  heap_region
class  impl_region_model_context
class  infeasible_edge
class  infeasible_node
class  initial_svalue
class  inlined_call_event
struct  interesting_t
class  internal_known_function
class  known_function
class  known_function_manager
class  label_region
class  log_scope
class  log_user
class  logger
struct  model_merger
class  noop_region_model_context
class  offset_region
class  one_way_id_map
class  path_context
class  path_var
class  pending_diagnostic
class  pending_diagnostic_subclass
struct  pending_location
class  pending_note
class  pending_note_subclass
struct  per_call_string_data
struct  per_function_data
struct  per_program_point_data
class  placeholder_svalue
class  plugin_analyzer_init_iface
class  point_and_state
class  poisoned_svalue
class  precanned_custom_event
class  private_region
class  program_point
class  program_state
class  pure_known_function_with_default_return
struct  purge_stats
class  range
class  reachability
class  reachable_regions
class  record_layout
class  region
class  region_creation_event
class  region_creation_event_allocation_size
class  region_creation_event_capacity
class  region_creation_event_debug
class  region_creation_event_memory_space
class  region_model
class  region_model_context
class  region_model_context_decorator
class  region_model_manager
class  region_offset
class  region_svalue
class  region_to_value_map
class  rejected_constraint
class  rejected_default_case
class  rejected_op_constraint
class  rejected_ranges_constraint
class  repeated_svalue
class  return_event
class  return_superedge
class  rewind_event
class  rewind_from_longjmp_event
class  rewind_info_t
class  rewind_to_setjmp_event
class  root_region
class  saved_diagnostic
class  saved_uids
class  setjmp_event
struct  setjmp_record
class  setjmp_svalue
class  sized_region
class  sm_context
class  sm_state_map
class  space_region
class  stack_region
class  start_cfg_edge_event
class  start_consolidated_cfg_edges_event
class  state_change_event
class  state_change_visitor
class  state_machine
class  state_purge_annotator
class  state_purge_map
class  state_purge_per_decl
class  state_purge_per_ssa_name
class  state_purge_per_tree
class  statement_event
struct  stats
class  stmt_finder
class  store
class  store_manager
class  string_region
class  strongly_connected_components
class  sub_svalue
class  succeed_or_fail_call_info
class  success_call_info
class  superedge
class  superedge_event
class  supergraph
struct  supergraph_traits
class  supernode
class  svalue
class  switch_cfg_superedge
class  symbol
class  symbolic_binding
class  symbolic_byte_offset
class  symbolic_byte_range
class  symbolic_region
class  tentative_region_model_context
struct  tg_traits
class  thread_local_region
class  throw_event
class  throw_from_call_to_external_fn_event
class  trimmed_cluster
class  trimmed_edge
class  trimmed_graph
class  trimmed_node
class  unaryop_svalue
class  uncertainty_t
class  unknown_region
class  unknown_svalue
class  unmergeable_svalue
class  unwind_event
class  var_arg_region
class  visitor
class  warning_event
class  widening_svalue
class  worklist
class  xml_state

Typedefs

typedef hash_set< const svalue * > svalue_set
typedef offset_int bit_offset_t
typedef offset_int bit_size_t
typedef offset_int byte_offset_t
typedef offset_int byte_size_t
typedef shortest_paths< eg_traits, exploded_pathshortest_exploded_paths
typedef void(* pop_frame_callback) (const region_model *model, const region_model *prev_model, const svalue *retval, region_model_context *ctxt)

Enumerations

enum class  event_kind {
  debug , custom , stmt , region_creation ,
  function_entry , state_change , start_cfg_edge , end_cfg_edge ,
  catch_ , call_edge , return_edge , start_consolidated_cfg_edges ,
  end_consolidated_cfg_edges , inlined_call , setjmp_ , rewind_from_longjmp ,
  rewind_to_setjmp , throw_ , unwind , warning
}
enum class  access_direction { read , write }
enum class  bound_kind { lower , upper }
enum  constraint_op { CONSTRAINT_NE , CONSTRAINT_LT , CONSTRAINT_LE }
enum  point_kind {
  PK_ORIGIN , PK_BEFORE_SUPERNODE , PK_BEFORE_STMT , PK_AFTER_SUPERNODE ,
  PK_EMPTY , PK_DELETED , NUM_POINT_KINDS
}
enum  memory_space {
  MEMSPACE_UNKNOWN , MEMSPACE_CODE , MEMSPACE_GLOBALS , MEMSPACE_STACK ,
  MEMSPACE_HEAP , MEMSPACE_READONLY_DATA , MEMSPACE_THREAD_LOCAL , MEMSPACE_PRIVATE
}
enum  region_kind {
  RK_FRAME , RK_GLOBALS , RK_CODE , RK_FUNCTION ,
  RK_LABEL , RK_STACK , RK_HEAP , RK_THREAD_LOCAL ,
  RK_ROOT , RK_SYMBOLIC , RK_DECL , RK_FIELD ,
  RK_ELEMENT , RK_OFFSET , RK_SIZED , RK_CAST ,
  RK_HEAP_ALLOCATED , RK_ALLOCA , RK_STRING , RK_BIT_RANGE ,
  RK_VAR_ARG , RK_ERRNO , RK_PRIVATE , RK_UNKNOWN
}
enum  edge_kind { SUPEREDGE_CFG_EDGE , SUPEREDGE_CALL , SUPEREDGE_RETURN , SUPEREDGE_INTRAPROCEDURAL_CALL }
enum  supergraph_dot_flags { SUPERGRAPH_DOT_SHOW_BBS = (1 << 0) }
enum  svalue_kind {
  SK_REGION , SK_CONSTANT , SK_UNKNOWN , SK_POISONED ,
  SK_SETJMP , SK_INITIAL , SK_UNARYOP , SK_BINOP ,
  SK_SUB , SK_REPEATED , SK_BITS_WITHIN , SK_UNMERGEABLE ,
  SK_PLACEHOLDER , SK_WIDENING , SK_COMPOUND , SK_CONJURED ,
  SK_ASM_OUTPUT , SK_CONST_FN_RESULT
}
enum class  poison_kind { uninit , freed , deleted , popped_stack }

Functions

const char * event_kind_to_string (enum event_kind ek)
void dump_tree (pretty_printer *pp, tree t)
void dump_quoted_tree (pretty_printer *pp, tree t)
void print_quoted_type (pretty_printer *pp, tree t)
void print_expr_for_user (pretty_printer *pp, tree t)
int readability_comparator (const void *p1, const void *p2)
int tree_cmp (const void *p1, const void *p2)
tree fixup_tree_for_diagnostic (tree)
tree get_diagnostic_tree_for_gassign (const gassign *)
bool int_size_in_bits (const_tree type, bit_size_t *out)
tree get_field_at_bit_offset (tree record_type, bit_offset_t bit_offset)
bool operator< (const region_offset &, const region_offset &)
bool operator<= (const region_offset &, const region_offset &)
bool operator> (const region_offset &, const region_offset &)
bool operator>= (const region_offset &, const region_offset &)
location_t get_stmt_location (const gimple *stmt, function *fun)
bool compat_types_p (tree src_type, tree dst_type)
void register_known_functions (known_function_manager &kfm, region_model_manager &rmm)
void register_known_analyzer_functions (known_function_manager &kfm)
void register_known_fd_functions (known_function_manager &kfm)
void register_known_file_functions (known_function_manager &kfm)
void register_known_functions_lang_cp (known_function_manager &kfm)
void register_varargs_builtins (known_function_manager &kfm)
tree get_stashed_constant_by_name (const char *name)
void log_stashed_constants (logger *logger)
FILE * get_or_create_any_logfile ()
std::unique_ptr< json::valuetree_to_json (tree node)
std::unique_ptr< json::valuediagnostic_event_id_to_json (const diagnostic_event_id_t &)
std::unique_ptr< json::valuebit_offset_to_json (const bit_offset_t &offset)
std::unique_ptr< json::valuebyte_offset_to_json (const byte_offset_t &offset)
tristate compare_constants (tree lhs_const, enum tree_code op, tree rhs_const)
tree get_string_cst_size (const_tree string_cst)
tree get_ssa_default_def (const function &fun, tree var)
const svaluestrip_types (const svalue *sval, region_model_manager &mgr)
region_offset strip_types (const region_offset &offset, region_model_manager &mgr)
tree remove_ssa_names (tree expr)
const char * constraint_op_code (enum constraint_op c_op)
void run_checkers ()
std::unique_ptr< known_functionmake_kf_strlen ()
const char * point_kind_to_string (enum point_kind pk)
bool for_each_state_change (const program_state &src_state, const program_state &dst_state, const extrinsic_state &ext_state, state_change_visitor *visitor)
bool any_pointer_p (tree expr)
bool any_pointer_p (const svalue *sval)
std::vector< std::unique_ptr< state_machine > > make_checkers (logger *logger)
std::unique_ptr< state_machinemake_malloc_state_machine (logger *)
std::unique_ptr< state_machinemake_fileptr_state_machine (logger *)
std::unique_ptr< state_machinemake_taint_state_machine (logger *)
std::unique_ptr< state_machinemake_sensitive_state_machine (logger *)
std::unique_ptr< state_machinemake_signal_state_machine (logger *)
std::unique_ptr< state_machinemake_pattern_test_state_machine (logger *)
std::unique_ptr< state_machinemake_va_list_state_machine (logger *)
std::unique_ptr< state_machinemake_fd_state_machine (logger *)
cgraph_edgesupergraph_call_edge (function *fun, const gimple *stmt)
functionget_ultimate_function_for_cgraph_edge (cgraph_edge *edge)
const char * poison_kind_to_str (enum poison_kind)

Detailed Description

Text art visualizations within -fanalyzer. Copyright (C) 2023-2025 Free Software Foundation, Inc. Contributed by David Malcolm <dmalcolm@redhat.com>. This file is part of GCC. GCC is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version. GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see <http://www.gnu.org/licenses/>.
XML documents for dumping state in an easier-to-read form. Copyright (C) 2025 Free Software Foundation, Inc. Contributed by David Malcolm <dmalcolm@redhat.com>. This file is part of GCC. GCC is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version. GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see <http://www.gnu.org/licenses/>.
A class to encapsulate decisions about how the analysis should happen. Copyright (C) 2019-2025 Free Software Foundation, Inc. Contributed by David Malcolm <dmalcolm@redhat.com>. This file is part of GCC. GCC is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version. GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see <http://www.gnu.org/licenses/>.
Hierarchical log messages for the analyzer. Copyright (C) 2014-2025 Free Software Foundation, Inc. Contributed by David Malcolm <dmalcolm@redhat.com>. This file is part of GCC. GCC is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version. GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see <http://www.gnu.org/licenses/>.
Adapted from jit-logging.h.
Support for plotting bar charts in dumps. Copyright (C) 2020-2025 Free Software Foundation, Inc. Contributed by David Malcolm <dmalcolm@redhat.com>. This file is part of GCC. GCC is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version. GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see <http://www.gnu.org/licenses/>.
Helper class for handling a call with specific arguments. Copyright (C) 2019-2025 Free Software Foundation, Inc. Contributed by David Malcolm <dmalcolm@redhat.com>. This file is part of GCC. GCC is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version. GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see <http://www.gnu.org/licenses/>.
Subclasses of custom_edge_info for describing outcomes of function calls. Copyright (C) 2021-2025 Free Software Foundation, Inc. Contributed by David Malcolm <dmalcolm@redhat.com>. This file is part of GCC. GCC is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version. GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see <http://www.gnu.org/licenses/>.
Call stacks at program points. Copyright (C) 2019-2025 Free Software Foundation, Inc. Contributed by David Malcolm <dmalcolm@redhat.com>. This file is part of GCC. GCC is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version. GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see <http://www.gnu.org/licenses/>.
Classes for working with summaries of function calls. Copyright (C) 2022 David Malcolm <dmalcolm@redhat.com>. This file is part of GCC. GCC is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version. GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see <http://www.gnu.org/licenses/>.
Subclasses of diagnostic_event for analyzer diagnostics. Copyright (C) 2019-2025 Free Software Foundation, Inc. Contributed by David Malcolm <dmalcolm@redhat.com>. This file is part of GCC. GCC is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version. GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see <http://www.gnu.org/licenses/>.
Subclass of diagnostic_path for analyzer diagnostics. Copyright (C) 2019-2025 Free Software Foundation, Inc. Contributed by David Malcolm <dmalcolm@redhat.com>. This file is part of GCC. GCC is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version. GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see <http://www.gnu.org/licenses/>.
Measuring the complexity of svalues/regions. Copyright (C) 2020-2025 Free Software Foundation, Inc. Contributed by David Malcolm <dmalcolm@redhat.com>. This file is part of GCC. GCC is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version. GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see <http://www.gnu.org/licenses/>.
Tracking equivalence classes and constraints at a point on an execution path. Copyright (C) 2019-2025 Free Software Foundation, Inc. Contributed by David Malcolm <dmalcolm@redhat.com>. This file is part of GCC. GCC is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version. GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see <http://www.gnu.org/licenses/>.
Classes for saving, deduplicating, and emitting analyzer diagnostics. Copyright (C) 2019-2025 Free Software Foundation, Inc. Contributed by David Malcolm <dmalcolm@redhat.com>. This file is part of GCC. GCC is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version. GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see <http://www.gnu.org/licenses/>.
The analysis "engine". Copyright (C) 2019-2025 Free Software Foundation, Inc. Contributed by David Malcolm <dmalcolm@redhat.com>. This file is part of GCC. GCC is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version. GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see <http://www.gnu.org/licenses/>.
A bundle of location information for a checker_event. Copyright (C) 2019-2025 Free Software Foundation, Inc. Contributed by David Malcolm <dmalcolm@redhat.com>. This file is part of GCC. GCC is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version. GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see <http://www.gnu.org/licenses/>.
Classes for managing a directed graph of <point, state> pairs. Copyright (C) 2019-2025 Free Software Foundation, Inc. Contributed by David Malcolm <dmalcolm@redhat.com>. This file is part of GCC. GCC is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version. GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see <http://www.gnu.org/licenses/>.
A graph for exploring trees of feasible paths through the egraph. Copyright (C) 2021-2025 Free Software Foundation, Inc. Contributed by David Malcolm <dmalcolm@redhat.com>. This file is part of GCC. GCC is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version. GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see <http://www.gnu.org/licenses/>.
Sets of function names. Copyright (C) 2019-2025 Free Software Foundation, Inc. Contributed by David Malcolm <dmalcolm@redhat.com>. This file is part of GCC. GCC is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version. GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see <http://www.gnu.org/licenses/>.
Support for plugin-supplied behaviors of known functions. Copyright (C) 2022-2025 Free Software Foundation, Inc. Contributed by David Malcolm <dmalcolm@redhat.com>. This file is part of GCC. GCC is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version. GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see <http://www.gnu.org/licenses/>.
Classes for analyzer diagnostics. Copyright (C) 2019-2025 Free Software Foundation, Inc. Contributed by David Malcolm <dmalcolm@redhat.com>. This file is part of GCC. GCC is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version. GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see <http://www.gnu.org/licenses/>.
Classes for representing locations within the program. Copyright (C) 2019-2025 Free Software Foundation, Inc. Contributed by David Malcolm <dmalcolm@redhat.com>. This file is part of GCC. GCC is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version. GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see <http://www.gnu.org/licenses/>.
Symbolic offsets and ranges. Copyright (C) 2023-2025 Free Software Foundation, Inc. Contributed by David Malcolm <dmalcolm@redhat.com>. This file is part of GCC. GCC is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version. GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see <http://www.gnu.org/licenses/>.
Digraph reachability. Copyright (C) 2020-2025 Free Software Foundation, Inc. Contributed by David Malcolm <dmalcolm@redhat.com>. This file is part of GCC. GCC is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version. GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see <http://www.gnu.org/licenses/>.
Declaration of class record_layout. Copyright (C) 2022-2025 Free Software Foundation, Inc. Contributed by David Malcolm <dmalcolm@redhat.com>. This file is part of GCC. GCC is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version. GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see <http://www.gnu.org/licenses/>.
Consolidation of svalues and regions. Copyright (C) 2020-2025 Free Software Foundation, Inc. Contributed by David Malcolm <dmalcolm@redhat.com>. This file is part of GCC. GCC is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version. GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see <http://www.gnu.org/licenses/>.
Finding reachable regions and values. Copyright (C) 2020-2025 Free Software Foundation, Inc. Contributed by David Malcolm <dmalcolm@redhat.com>. This file is part of GCC. GCC is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version. GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see <http://www.gnu.org/licenses/>.
Regions of memory. Copyright (C) 2019-2025 Free Software Foundation, Inc. Contributed by David Malcolm <dmalcolm@redhat.com>. This file is part of GCC. GCC is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version. GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see <http://www.gnu.org/licenses/>.
Modeling API uses and misuses via state machines. Copyright (C) 2019-2025 Free Software Foundation, Inc. Contributed by David Malcolm <dmalcolm@redhat.com>. This file is part of GCC. GCC is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version. GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see <http://www.gnu.org/licenses/>.
Utility functions for use by state machines.
Classes for modeling the state of memory. Copyright (C) 2020-2025 Free Software Foundation, Inc. Contributed by David Malcolm <dmalcolm@redhat.com>. This file is part of GCC. GCC is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version. GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see <http://www.gnu.org/licenses/>.
Implementation of the region-based ternary model described in: "A Memory Model for Static Analysis of C Programs" (Zhongxing Xu, Ted Kremenek, and Jian Zhang) http://lcs.ios.ac.cn/~xuzb/canalyze/memmodel.pdf
The store models memory as a collection of "clusters", where regions are partitioned into clusters via their base region. For example, given: int a, b, c; struct coord { double x; double y; } verts[3]; then "verts[0].y" and "verts[1].x" both have "verts" as their base region. Each of a, b, c, and verts will have their own clusters, so that we know that writes to e.g. "verts[1].x".don't affect e.g. "a". Within each cluster we store a map of bindings to values, where the binding keys can be either concrete or symbolic. Concrete bindings affect a specific range of bits relative to the start of the base region of the cluster, whereas symbolic bindings affect a specific subregion within the cluster. Consider (from the symbolic-1.c testcase): char arr[1024]; arr[2] = a; (1) arr[3] = b; (2) After (1) and (2), the cluster for "arr" has concrete bindings for bits 16-23 and for bits 24-31, with svalues "INIT_VAL(a)" and "INIT_VAL(b)" respectively: cluster: {bits 16-23: "INIT_VAL(a)", bits 24-31: "INIT_VAL(b)"; flags: {}} Attempting to query unbound subregions e.g. arr[4] will return "UNINITIALIZED". "a" and "b" are each in their own clusters, with no explicit bindings, and thus implicitly have value INIT_VAL(a) and INIT_VAL(b). arr[3] = c; (3) After (3), the concrete binding for bits 24-31 is replaced with the svalue "INIT_VAL(c)": cluster: {bits 16-23: "INIT_VAL(a)", (from before) bits 24-31: "INIT_VAL(c)"; (updated) flags: {}} arr[i] = d; (4) After (4), we lose the concrete bindings and replace them with a symbolic binding for "arr[i]", with svalue "INIT_VAL(d)". We also mark the cluster as having been "symbolically touched": future attempts to query the values of subregions other than "arr[i]", such as "arr[3]" are "UNKNOWN", since we don't know if the write to arr[i] affected them. cluster: {symbolic_key(arr[i]): "INIT_VAL(d)"; flags: {TOUCHED}} arr[j] = e; (5) After (5), we lose the symbolic binding for "arr[i]" since we could have overwritten it, and add a symbolic binding for "arr[j]". cluster: {symbolic_key(arr[j]): "INIT_VAL(d)"; (different symbolic flags: {TOUCHED}} binding) arr[3] = f; (6) After (6), we lose the symbolic binding for "arr[j]" since we could have overwritten it, and gain a concrete binding for bits 24-31 again, this time with svalue "INIT_VAL(e)": cluster: {bits 24-31: "INIT_VAL(d)"; flags: {TOUCHED}} The cluster is still flagged as touched, so that we know that accesses to other elements are "UNKNOWN" rather than "UNINITIALIZED". Handling symbolic regions requires us to handle aliasing. In the first example above, each of a, b, c and verts are non-symbolic base regions and so their clusters are "concrete clusters", whereas given: struct coord *p, *q; then "*p" and "*q" are symbolic base regions, and thus "*p" and "*q" have "symbolic clusters". In the above, "verts[i].x" will have a symbolic *binding* within a concrete cluster for "verts", whereas "*p" is a symbolic *cluster*. Writes to concrete clusters can't affect other concrete clusters, but can affect symbolic clusters; e.g. after: verts[0].x = 42; we bind 42 in the cluster for "verts", but the clusters for "b" and "c" can't be affected. Any symbolic clusters for *p and for *q can be affected, *p and *q could alias verts. Writes to a symbolic cluster can affect other clusters, both concrete and symbolic; e.g. after: p->x = 17; we bind 17 within the cluster for "*p". The concrete clusters for a, b, c, and verts could be affected, depending on whether *p aliases them. Similarly, the symbolic cluster to *q could be affected.
Base class for svalues and regions. Copyright (C) 2023-2025 Free Software Foundation, Inc. Contributed by David Malcolm <dmalcolm@redhat.com>. This file is part of GCC. GCC is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version. GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see <http://www.gnu.org/licenses/>.
Trimming an exploded graph to a subset of nodes and edges. Copyright (C) 2021-2025 Free Software Foundation, Inc. Contributed by David Malcolm <dmalcolm@redhat.com>. This file is part of GCC. GCC is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3, or (at your option) any later version. GCC is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GCC; see the file COPYING3. If not see <http://www.gnu.org/licenses/>.

Typedef Documentation

â—† bit_offset_t

typedef offset_int ana::bit_offset_t

â—† bit_size_t

typedef offset_int ana::bit_size_t

â—† byte_offset_t

typedef offset_int ana::byte_offset_t

â—† byte_size_t

typedef offset_int ana::byte_size_t

â—† pop_frame_callback

typedef void(* ana::pop_frame_callback) (const region_model *model, const region_model *prev_model, const svalue *retval, region_model_context *ctxt)

â—† shortest_exploded_paths

Finding the shortest exploded_path within an exploded_graph.

â—† svalue_set

typedef hash_set<const svalue *> ana::svalue_set

Enumeration Type Documentation

â—† access_direction

enum class ana::access_direction
strong
An enum for describing the direction of an access to memory.
Enumerator
read 
write 

â—† bound_kind

enum class ana::bound_kind
strong
Enumerator
lower 
upper 

â—† constraint_op

The various kinds of constraint.
Enumerator
CONSTRAINT_NE 
CONSTRAINT_LT 
CONSTRAINT_LE 

â—† edge_kind

An enum for discriminating between superedge subclasses.
Enumerator
SUPEREDGE_CFG_EDGE 
SUPEREDGE_CALL 
SUPEREDGE_RETURN 
SUPEREDGE_INTRAPROCEDURAL_CALL 

â—† event_kind

enum class ana::event_kind
strong
An enum for discriminating between the concrete subclasses of checker_event.
Enumerator
debug 
custom 
stmt 
region_creation 
function_entry 
state_change 
start_cfg_edge 
end_cfg_edge 
catch_ 
call_edge 
return_edge 
start_consolidated_cfg_edges 
end_consolidated_cfg_edges 
inlined_call 
setjmp_ 
rewind_from_longjmp 
rewind_to_setjmp 
throw_ 
unwind 
warning 

â—† memory_space

An enum for identifying different spaces within memory.
Enumerator
MEMSPACE_UNKNOWN 
MEMSPACE_CODE 
MEMSPACE_GLOBALS 
MEMSPACE_STACK 
MEMSPACE_HEAP 
MEMSPACE_READONLY_DATA 
MEMSPACE_THREAD_LOCAL 
MEMSPACE_PRIVATE 

â—† point_kind

An enum for distinguishing the various kinds of program_point.
Enumerator
PK_ORIGIN 
PK_BEFORE_SUPERNODE 
PK_BEFORE_STMT 
PK_AFTER_SUPERNODE 
PK_EMPTY 
PK_DELETED 
NUM_POINT_KINDS 

â—† poison_kind

enum class ana::poison_kind
strong
An enum describing a particular kind of "poisoned" value.
Enumerator
uninit 
freed 
deleted 
popped_stack 

â—† region_kind

An enum for discriminating between the different concrete subclasses of region.
Enumerator
RK_FRAME 
RK_GLOBALS 
RK_CODE 
RK_FUNCTION 
RK_LABEL 
RK_STACK 
RK_HEAP 
RK_THREAD_LOCAL 
RK_ROOT 
RK_SYMBOLIC 
RK_DECL 
RK_FIELD 
RK_ELEMENT 
RK_OFFSET 
RK_SIZED 
RK_CAST 
RK_HEAP_ALLOCATED 
RK_ALLOCA 
RK_STRING 
RK_BIT_RANGE 
RK_VAR_ARG 
RK_ERRNO 
RK_PRIVATE 
RK_UNKNOWN 

â—† supergraph_dot_flags

Flags for controlling the appearance of .dot dumps.
Enumerator
SUPERGRAPH_DOT_SHOW_BBS 

â—† svalue_kind

An enum for discriminating between the different concrete subclasses of svalue.
Enumerator
SK_REGION 
SK_CONSTANT 
SK_UNKNOWN 
SK_POISONED 
SK_SETJMP 
SK_INITIAL 
SK_UNARYOP 
SK_BINOP 
SK_SUB 
SK_REPEATED 
SK_BITS_WITHIN 
SK_UNMERGEABLE 
SK_PLACEHOLDER 
SK_WIDENING 
SK_COMPOUND 
SK_CONJURED 
SK_ASM_OUTPUT 
SK_CONST_FN_RESULT 

Function Documentation

â—† any_pointer_p() [1/2]

bool ana::any_pointer_p ( const svalue * sval)
extern

â—† any_pointer_p() [2/2]

bool ana::any_pointer_p ( tree expr)
extern

â—† bit_offset_to_json()

std::unique_ptr< json::value > ana::bit_offset_to_json ( const bit_offset_t & offset)
extern

â—† byte_offset_to_json()

std::unique_ptr< json::value > ana::byte_offset_to_json ( const byte_offset_t & offset)
extern

â—† compare_constants()

tristate ana::compare_constants ( tree lhs_const,
enum tree_code op,
tree rhs_const )
extern

â—† compat_types_p()

bool ana::compat_types_p ( tree src_type,
tree dst_type )
extern

â—† constraint_op_code()

const char * ana::constraint_op_code ( enum constraint_op c_op)

â—† diagnostic_event_id_to_json()

std::unique_ptr< json::value > ana::diagnostic_event_id_to_json ( const diagnostic_event_id_t & )
extern

â—† dump_quoted_tree()

void ana::dump_quoted_tree ( pretty_printer * pp,
tree t )
extern

â—† dump_tree()

void ana::dump_tree ( pretty_printer * pp,
tree t )
extern
Forward decls of functions.

â—† event_kind_to_string()

const char * ana::event_kind_to_string ( enum event_kind ek)
extern

â—† fixup_tree_for_diagnostic()

tree ana::fixup_tree_for_diagnostic ( tree )
extern

â—† for_each_state_change()

bool ana::for_each_state_change ( const program_state & src_state,
const program_state & dst_state,
const extrinsic_state & ext_state,
state_change_visitor * visitor )
extern

â—† get_diagnostic_tree_for_gassign()

tree ana::get_diagnostic_tree_for_gassign ( const gassign * )
extern

â—† get_field_at_bit_offset()

tree ana::get_field_at_bit_offset ( tree record_type,
bit_offset_t bit_offset )
extern

References record_type().

â—† get_or_create_any_logfile()

FILE * ana::get_or_create_any_logfile ( )
extern

â—† get_ssa_default_def()

tree ana::get_ssa_default_def ( const function & fun,
tree var )
extern

â—† get_stashed_constant_by_name()

tree ana::get_stashed_constant_by_name ( const char * name)
extern

â—† get_stmt_location()

location_t ana::get_stmt_location ( const gimple * stmt,
function * fun )
extern

References stmt.

â—† get_string_cst_size()

tree ana::get_string_cst_size ( const_tree string_cst)
extern

â—† get_ultimate_function_for_cgraph_edge()

function * ana::get_ultimate_function_for_cgraph_edge ( cgraph_edge * edge)
extern

â—† int_size_in_bits()

bool ana::int_size_in_bits ( const_tree type,
bit_size_t * out )
extern

â—† log_stashed_constants()

void ana::log_stashed_constants ( logger * logger)
extern

â—† make_checkers()

std::vector< std::unique_ptr< state_machine > > ana::make_checkers ( logger * logger)
extern
The various state_machine subclasses are hidden in their respective implementation files.

â—† make_fd_state_machine()

std::unique_ptr< state_machine > ana::make_fd_state_machine ( logger * )
extern

â—† make_fileptr_state_machine()

std::unique_ptr< state_machine > ana::make_fileptr_state_machine ( logger * )
extern

â—† make_kf_strlen()

std::unique_ptr< known_function > ana::make_kf_strlen ( )
extern

â—† make_malloc_state_machine()

std::unique_ptr< state_machine > ana::make_malloc_state_machine ( logger * )
extern

â—† make_pattern_test_state_machine()

std::unique_ptr< state_machine > ana::make_pattern_test_state_machine ( logger * )
extern

â—† make_sensitive_state_machine()

std::unique_ptr< state_machine > ana::make_sensitive_state_machine ( logger * )
extern

â—† make_signal_state_machine()

std::unique_ptr< state_machine > ana::make_signal_state_machine ( logger * )
extern

â—† make_taint_state_machine()

std::unique_ptr< state_machine > ana::make_taint_state_machine ( logger * )
extern

â—† make_va_list_state_machine()

std::unique_ptr< state_machine > ana::make_va_list_state_machine ( logger * )
extern

â—† operator<()

bool ana::operator< ( const region_offset & ,
const region_offset &  )
extern

â—† operator<=()

bool ana::operator<= ( const region_offset & ,
const region_offset &  )
extern

â—† operator>()

bool ana::operator> ( const region_offset & ,
const region_offset &  )
extern

â—† operator>=()

bool ana::operator>= ( const region_offset & ,
const region_offset &  )
extern

â—† point_kind_to_string()

const char * ana::point_kind_to_string ( enum point_kind pk)
extern

â—† poison_kind_to_str()

const char * ana::poison_kind_to_str ( enum poison_kind)
extern

â—† print_expr_for_user()

void ana::print_expr_for_user ( pretty_printer * pp,
tree t )
extern

â—† print_quoted_type()

void ana::print_quoted_type ( pretty_printer * pp,
tree t )
extern

â—† readability_comparator()

int ana::readability_comparator ( const void * p1,
const void * p2 )
extern

â—† register_known_analyzer_functions()

void ana::register_known_analyzer_functions ( known_function_manager & kfm)
extern

â—† register_known_fd_functions()

void ana::register_known_fd_functions ( known_function_manager & kfm)
extern

â—† register_known_file_functions()

void ana::register_known_file_functions ( known_function_manager & kfm)
extern

â—† register_known_functions()

void ana::register_known_functions ( known_function_manager & kfm,
region_model_manager & rmm )
extern

â—† register_known_functions_lang_cp()

void ana::register_known_functions_lang_cp ( known_function_manager & kfm)
extern

â—† register_varargs_builtins()

void ana::register_varargs_builtins ( known_function_manager & kfm)
extern

â—† remove_ssa_names()

tree ana::remove_ssa_names ( tree expr)
extern

â—† run_checkers()

void ana::run_checkers ( )
extern

â—† strip_types() [1/2]

region_offset ana::strip_types ( const region_offset & offset,
region_model_manager & mgr )
extern

â—† strip_types() [2/2]

const svalue * ana::strip_types ( const svalue * sval,
region_model_manager & mgr )
extern

â—† supergraph_call_edge()

cgraph_edge * ana::supergraph_call_edge ( function * fun,
const gimple * stmt )
extern

References stmt.

â—† tree_cmp()

int ana::tree_cmp ( const void * p1,
const void * p2 )
extern

â—† tree_to_json()

std::unique_ptr< json::value > ana::tree_to_json ( tree node)
extern