Next: Debugging Options, Previous: Warning Options, Up: Invoking GCC
-fanalyzerThis analysis is much more expensive than other GCC warnings.
Enabling this option effectively enables the following warnings:
-Wanalyzer-double-fclose
-Wanalyzer-double-free
-Wanalyzer-exposure-through-output-file
-Wanalyzer-file-leak
-Wanalyzer-free-of-non-heap
-Wanalyzer-malloc-leak
-Wanalyzer-mismatching-deallocation
-Wanalyzer-null-argument
-Wanalyzer-null-dereference
-Wanalyzer-possible-null-argument
-Wanalyzer-possible-null-dereference
-Wanalyzer-shift-count-negative
-Wanalyzer-shift-count-overflow
-Wanalyzer-stale-setjmp-buffer
-Wanalyzer-unsafe-call-within-signal-handler
-Wanalyzer-use-after-free
-Wanalyzer-use-of-pointer-in-stale-stack-frame
-Wanalyzer-use-of-uninitialized-value
-Wanalyzer-write-to-const
-Wanalyzer-write-to-string-literal
This option is only available if GCC was configured with analyzer
support enabled.
-Wanalyzer-too-complexBy default, the analysis silently stops if the code is too
complicated for the analyzer to fully explore and it reaches an internal
limit. The -Wanalyzer-too-complex option warns if this occurs.
-Wno-analyzer-double-fcloseThis diagnostic warns for paths through the code in which a FILE *
can have fclose called on it more than once.
-Wno-analyzer-double-freeThis diagnostic warns for paths through the code in which a pointer
can have a deallocator called on it more than once, either free,
or a deallocator referenced by attribute malloc.
-Wno-analyzer-exposure-through-output-fileThis diagnostic warns for paths through the code in which a
security-sensitive value is written to an output file
(such as writing a password to a log file).
-Wno-analyzer-file-leakThis diagnostic warns for paths through the code in which a
<stdio.h> FILE * stream object is leaked.
-Wno-analyzer-free-of-non-heapThis diagnostic warns for paths through the code in which free
is called on a non-heap pointer (e.g. an on-stack buffer, or a global).
-Wno-analyzer-malloc-leakThis diagnostic warns for paths through the code in which a
pointer allocated via an allocator is leaked: either malloc,
or a function marked with attribute malloc.
-Wno-analyzer-mismatching-deallocationThis diagnostic warns for paths through the code in which the
wrong deallocation function is called on a pointer value, based on
which function was used to allocate the pointer value. The diagnostic
will warn about mismatches between free, scalar delete
and vector delete[], and those marked as allocator/deallocator
pairs using attribute malloc.
-Wno-analyzer-possible-null-argumentThis diagnostic warns for paths through the code in which a
possibly-NULL value is passed to a function argument marked
with __attribute__((nonnull)) as requiring a non-NULL
value.
-Wno-analyzer-possible-null-dereferenceThis diagnostic warns for paths through the code in which a
possibly-NULL value is dereferenced.
-Wno-analyzer-null-argumentThis diagnostic warns for paths through the code in which a
value known to be NULL is passed to a function argument marked
with __attribute__((nonnull)) as requiring a non-NULL
value.
-Wno-analyzer-null-dereferenceThis diagnostic warns for paths through the code in which a
value known to be NULL is dereferenced.
-Wno-analyzer-shift-count-negativeThis diagnostic warns for paths through the code in which a
shift is attempted with a negative count. It is analogous to
the -Wshift-count-negative diagnostic implemented in
the C/C++ front ends, but is implemented based on analyzing
interprocedural paths, rather than merely parsing the syntax tree.
However, the analyzer does not prioritize detection of such paths, so
false negatives are more likely relative to other warnings.
-Wno-analyzer-shift-count-overflowThis diagnostic warns for paths through the code in which a
shift is attempted with a count greater than or equal to the
precision of the operand's type. It is analogous to
the -Wshift-count-overflow diagnostic implemented in
the C/C++ front ends, but is implemented based on analyzing
interprocedural paths, rather than merely parsing the syntax tree.
However, the analyzer does not prioritize detection of such paths, so
false negatives are more likely relative to other warnings.
-Wno-analyzer-stale-setjmp-bufferThis diagnostic warns for paths through the code in which
longjmp is called to rewind to a jmp_buf relating
to a setjmp call in a function that has returned.
When setjmp is called on a jmp_buf to record a rewind
location, it records the stack frame. The stack frame becomes invalid
when the function containing the setjmp call returns. Attempting
to rewind to it via longjmp would reference a stack frame that
no longer exists, and likely lead to a crash (or worse).
-Wno-analyzer-tainted-allocation-sizeThis diagnostic warns for paths through the code in which a value that could be under an attacker's control is used as the size of an allocation without being sanitized, so that an attacker could inject an excessively large allocation and potentially cause a denial of service attack.
-Wno-analyzer-tainted-array-indexThis diagnostic warns for paths through the code in which a value that could be under an attacker's control is used as the index of an array access without being sanitized, so that an attacker could inject an out-of-bounds access.
-Wno-analyzer-tainted-divisorThis diagnostic warns for paths through the code in which a value
that could be under an attacker's control is used as the divisor
in a division or modulus operation without being sanitized, so that
an attacker could inject a division-by-zero.
-Wno-analyzer-tainted-offsetThis diagnostic warns for paths through the code in which a value that could be under an attacker's control is used as a pointer offset without being sanitized, so that an attacker could inject an out-of-bounds access.
-Wno-analyzer-tainted-sizeThis diagnostic warns for paths through the code in which a value
that could be under an attacker's control is used as the size of
an operation such as memset without being sanitized, so that an
attacker could inject an out-of-bounds access.
-Wno-analyzer-unsafe-call-within-signal-handlerThis diagnostic warns for paths through the code in which a
function known to be async-signal-unsafe (such as fprintf) is
called from a signal handler.
-Wno-analyzer-use-after-freeThis diagnostic warns for paths through the code in which a
pointer is used after a deallocator is called on it: either free,
or a deallocator referenced by attribute malloc.
-Wno-analyzer-use-of-pointer-in-stale-stack-frameThis diagnostic warns for paths through the code in which a pointer
is dereferenced that points to a variable in a stale stack frame.
-Wno-analyzer-write-to-constThis diagnostic warns for paths through the code in which the analyzer
detects an attempt to write through a pointer to a const object.
However, the analyzer does not prioritize detection of such paths, so
false negatives are more likely relative to other warnings.
-Wno-analyzer-write-to-string-literalThis diagnostic warns for paths through the code in which the analyzer
detects an attempt to write through a pointer to a string literal.
However, the analyzer does not prioritize detection of such paths, so
false negatives are more likely relative to other warnings.
-Wno-analyzer-use-of-uninitialized-valueThis diagnostic warns for paths through the code in which an uninitialized value is used.
Pertinent parameters for controlling the exploration are: --param analyzer-bb-explosion-factor=value, --param analyzer-max-enodes-per-program-point=value, --param analyzer-max-recursion-depth=value, and --param analyzer-min-snodes-for-call-summary=value.
The following options control the analyzer.
-fanalyzer-call-summariesIf enabled, call summaries are only used for functions with more than one
call site, and that are sufficiently complicated (as per
--param analyzer-min-snodes-for-call-summary=value).
-fanalyzer-checker=nameSome checkers are disabled by default (even with -fanalyzer),
such as the taint checker that implements
-Wanalyzer-tainted-array-index, and this option is required
to enable them.
Note: currently, -fanalyzer-checker=taint disables the following warnings from -fanalyzer:
-Wanalyzer-double-fclose
-Wanalyzer-double-free
-Wanalyzer-exposure-through-output-file
-Wanalyzer-file-leak
-Wanalyzer-free-of-non-heap
-Wanalyzer-malloc-leak
-Wanalyzer-mismatching-deallocation
-Wanalyzer-null-argument
-Wanalyzer-null-dereference
-Wanalyzer-possible-null-argument
-Wanalyzer-possible-null-dereference
-Wanalyzer-unsafe-call-within-signal-handler
-Wanalyzer-use-after-free
-fno-analyzer-feasibilityBy default the analyzer verifies that there is a feasible control flow path
for each diagnostic it emits: that the conditions that hold are not mutually
exclusive. Diagnostics for which no feasible path can be found are rejected.
This filtering can be suppressed with -fno-analyzer-feasibility, for
debugging issues in this code.
-fanalyzer-fine-grainedInternally the analyzer builds an “exploded graph” that combines control flow graphs with data flow information.
By default, an edge in this graph can contain the effects of a run
of multiple statements within a basic block. With
-fanalyzer-fine-grained, each statement gets its own edge.
-fanalyzer-show-duplicate-count-fno-analyzer-state-mergeBy default the analyzer attempts to simplify analysis by merging
sufficiently similar states at each program point as it builds its
“exploded graph”. With -fno-analyzer-state-merge this
merging can be suppressed, for debugging state-handling issues.
-fno-analyzer-state-purgeBy default the analyzer attempts to simplify analysis by purging aspects of state at a program point that appear to no longer be relevant e.g. the values of locals that aren't accessed later in the function and which aren't relevant to leak analysis.
With -fno-analyzer-state-purge this purging of state can
be suppressed, for debugging state-handling issues.
-fanalyzer-transitivity-fanalyzer-verbose-edges-fanalyzer-verbose-state-changes-fanalyzer-verbosity=levelThe level can be one of:
free diagnostic,
both calls to free will be shown.
This level is the default.
-fdump-analyzer-fdump-analyzer-stderr-fdump-analyzer-callgraph-fdump-analyzer-exploded-graph-fdump-analyzer-exploded-nodes-fdump-analyzer-exploded-nodes-2-fdump-analyzer-exploded-nodes-3-fdump-analyzer-exploded-paths-fdump-analyzer-feasibility-fdump-analyzer-json-fdump-analyzer-state-purge-fdump-analyzer-supergraph-fdump-analyzer-untracked