1 ; analyzer.opt -- Options for the analyzer.
3 ; Copyright (C) 2019-2022 Free Software Foundation, Inc.
5 ; This file is part of GCC.
7 ; GCC is free software; you can redistribute it and/or modify it under
8 ; the terms of the GNU General Public License as published by the Free
9 ; Software Foundation; either version 3, or (at your option) any later
12 ; GCC is distributed in the hope that it will be useful, but WITHOUT ANY
13 ; WARRANTY; without even the implied warranty of MERCHANTABILITY or
14 ; FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
17 ; You should have received a copy of the GNU General Public License
18 ; along with GCC; see the file COPYING3. If not see
19 ; <http://www.gnu.org/licenses/>.
21 ; See the GCC internals manual for a description of this file's format.
23 ; Please try to keep this file in ASCII collating order.
25 -param=analyzer-bb-explosion-factor=
26 Common Joined UInteger Var(param_analyzer_bb_explosion_factor) Init(5) Param
27 The maximum number of 'after supernode' exploded nodes within the analyzer per supernode, before terminating analysis.
29 -param=analyzer-max-enodes-per-program-point=
30 Common Joined UInteger Var(param_analyzer_max_enodes_per_program_point) Init(8) Param
31 The maximum number of exploded nodes per program point within the analyzer, before terminating analysis of that point.
33 -param=analyzer-max-constraints=
34 Common Joined UInteger Var(param_analyzer_max_constraints) Init(20) Param
35 The maximum number of constraints per state.
37 -param=analyzer-max-infeasible-edges=
38 Common Joined UInteger Var(param_analyzer_max_infeasible_edges) Init(10) Param
39 The maximum number of infeasible edges to reject before declaring a diagnostic as infeasible.
41 -param=analyzer-max-recursion-depth=
42 Common Joined UInteger Var(param_analyzer_max_recursion_depth) Init(2) Param
43 The maximum number of times a callsite can appear in a call stack within the analyzer, before terminating analysis of a call that would recurse deeper.
45 -param=analyzer-max-svalue-depth=
46 Common Joined UInteger Var(param_analyzer_max_svalue_depth) Init(12) Param
47 The maximum depth of a symbolic value, before approximating the value as unknown.
49 -param=analyzer-min-snodes-for-call-summary=
50 Common Joined UInteger Var(param_analyzer_min_snodes_for_call_summary) Init(10) Param
51 The minimum number of supernodes within a function for the analyzer to consider summarizing its effects at call sites.
53 -param=analyzer-max-enodes-for-full-dump=
54 Common Joined UInteger Var(param_analyzer_max_enodes_for_full_dump) Init(200) Param
55 The maximum depth of exploded nodes that should appear in a dot dump before switching to a less verbose format.
57 Wanalyzer-double-fclose
58 Common Var(warn_analyzer_double_fclose) Init(1) Warning
59 Warn about code paths in which a stdio FILE can be closed more than once.
62 Common Var(warn_analyzer_double_free) Init(1) Warning
63 Warn about code paths in which a pointer can be freed more than once.
65 Wanalyzer-exposure-through-output-file
66 Common Var(warn_analyzer_exposure_through_output_file) Init(1) Warning
67 Warn about code paths in which sensitive data is written to a file.
70 Common Var(warn_analyzer_file_leak) Init(1) Warning
71 Warn about code paths in which a stdio FILE is not closed.
73 Wanalyzer-free-of-non-heap
74 Common Var(warn_analyzer_free_of_non_heap) Init(1) Warning
75 Warn about code paths in which a non-heap pointer is freed.
78 Common Var(warn_analyzer_malloc_leak) Init(1) Warning
79 Warn about code paths in which a heap-allocated pointer leaks.
81 Wanalyzer-mismatching-deallocation
82 Common Var(warn_analyzer_mismatching_deallocation) Init(1) Warning
83 Warn about code paths in which the wrong deallocation function is called.
85 Wanalyzer-possible-null-argument
86 Common Var(warn_analyzer_possible_null_argument) Init(1) Warning
87 Warn about code paths in which a possibly-NULL value is passed to a must-not-be-NULL function argument.
89 Wanalyzer-possible-null-dereference
90 Common Var(warn_analyzer_possible_null_dereference) Init(1) Warning
91 Warn about code paths in which a possibly-NULL pointer is dereferenced.
93 Wanalyzer-unsafe-call-within-signal-handler
94 Common Var(warn_analyzer_unsafe_call_within_signal_handler) Init(1) Warning
95 Warn about code paths in which an async-signal-unsafe function is called from a signal handler.
97 Wanalyzer-null-argument
98 Common Var(warn_analyzer_null_argument) Init(1) Warning
99 Warn about code paths in which NULL is passed to a must-not-be-NULL function argument.
101 Wanalyzer-null-dereference
102 Common Var(warn_analyzer_null_dereference) Init(1) Warning
103 Warn about code paths in which a NULL pointer is dereferenced.
105 Wanalyzer-shift-count-negative
106 Common Var(warn_analyzer_shift_count_negative) Init(1) Warning
107 Warn about code paths in which a shift with negative count is attempted.
109 Wanalyzer-shift-count-overflow
110 Common Var(warn_analyzer_shift_count_overflow) Init(1) Warning
111 Warn about code paths in which a shift with count >= width of type is attempted.
113 Wanalyzer-stale-setjmp-buffer
114 Common Var(warn_analyzer_stale_setjmp_buffer) Init(1) Warning
115 Warn about code paths in which a longjmp rewinds to a jmp_buf saved in a stack frame that has returned.
117 Wanalyzer-tainted-allocation-size
118 Common Var(warn_analyzer_tainted_allocation_size) Init(1) Warning
119 Warn about code paths in which an unsanitized value is used as an allocation size.
121 Wanalyzer-tainted-array-index
122 Common Var(warn_analyzer_tainted_array_index) Init(1) Warning
123 Warn about code paths in which an unsanitized value is used as an array index.
125 Wanalyzer-tainted-divisor
126 Common Var(warn_analyzer_tainted_divisor) Init(1) Warning
127 Warn about code paths in which an unsanitized value is used as a divisor.
129 Wanalyzer-tainted-offset
130 Common Var(warn_analyzer_tainted_offset) Init(1) Warning
131 Warn about code paths in which an unsanitized value is used as a pointer offset.
133 Wanalyzer-tainted-size
134 Common Var(warn_analyzer_tainted_size) Init(1) Warning
135 Warn about code paths in which an unsanitized value is used as a size.
137 Wanalyzer-use-after-free
138 Common Var(warn_analyzer_use_after_free) Init(1) Warning
139 Warn about code paths in which a freed value is used.
141 Wanalyzer-use-of-pointer-in-stale-stack-frame
142 Common Var(warn_analyzer_use_of_pointer_in_stale_stack_frame) Init(1) Warning
143 Warn about code paths in which a pointer to a stale stack frame is used.
145 Wanalyzer-write-to-const
146 Common Var(warn_analyzer_write_to_const) Init(1) Warning
147 Warn about code paths which attempt to write to a const object.
149 Wanalyzer-write-to-string-literal
150 Common Var(warn_analyzer_write_to_string_literal) Init(1) Warning
151 Warn about code paths which attempt to write to a string literal.
153 Wanalyzer-use-of-uninitialized-value
154 Common Var(warn_analyzer_use_of_uninitialized_value) Init(1) Warning
155 Warn about code paths in which an uninitialized value is used.
157 Wanalyzer-too-complex
158 Common Var(warn_analyzer_too_complex) Init(0) Warning
159 Warn if the code is too complicated for the analyzer to fully explore.
162 Common Joined RejectNegative Var(flag_analyzer_checker)
163 Restrict the analyzer to run just the named checker.
165 fanalyzer-fine-grained
166 Common Var(flag_analyzer_fine_grained) Init(0)
167 Avoid combining multiple statements into one exploded edge.
169 fanalyzer-feasibility
170 Common Var(flag_analyzer_feasibility) Init(1)
171 Verify that paths are feasible when emitting diagnostics.
173 fanalyzer-show-duplicate-count
174 Common Var(flag_analyzer_show_duplicate_count) Init(0)
175 Issue a note when diagnostics are deduplicated.
177 fanalyzer-state-purge
178 Common Var(flag_analyzer_state_purge) Init(1)
179 Purge unneeded state during analysis.
181 fanalyzer-state-merge
182 Common Var(flag_analyzer_state_merge) Init(1)
183 Merge similar-enough states during analysis.
185 fanalyzer-transitivity
186 Common Var(flag_analyzer_transitivity) Init(0)
187 Enable transitivity of constraints during analysis.
189 fanalyzer-call-summaries
190 Common Var(flag_analyzer_call_summaries) Init(0)
191 Approximate the effect of function calls to simplify analysis.
193 fanalyzer-verbose-edges
194 Common Var(flag_analyzer_verbose_edges) Init(0)
195 Emit more verbose descriptions of control flow in diagnostics.
197 fanalyzer-verbose-state-changes
198 Common Var(flag_analyzer_verbose_state_changes) Init(0)
199 Emit more verbose descriptions of state changes in diagnostics.
202 Common Joined UInteger Var(analyzer_verbosity) Init(2)
203 Control which events are displayed in diagnostic paths.
206 Common RejectNegative Var(flag_dump_analyzer)
207 Dump various analyzer internals to SRCFILE.analyzer.txt.
209 fdump-analyzer-stderr
210 Common RejectNegative Var(flag_dump_analyzer_stderr)
211 Dump various analyzer internals to stderr.
213 fdump-analyzer-callgraph
214 Common RejectNegative Var(flag_dump_analyzer_callgraph)
215 Dump analyzer-specific call graph information to a SRCFILE.callgraph.dot file.
217 fdump-analyzer-exploded-graph
218 Common RejectNegative Var(flag_dump_analyzer_exploded_graph)
219 Dump the analyzer exploded graph to a SRCFILE.eg.dot file.
221 fdump-analyzer-exploded-nodes
222 Common RejectNegative Var(flag_dump_analyzer_exploded_nodes)
223 Emit diagnostics showing the location of nodes in the exploded graph.
225 fdump-analyzer-exploded-nodes-2
226 Common RejectNegative Var(flag_dump_analyzer_exploded_nodes_2)
227 Dump a textual representation of the exploded graph to SRCFILE.eg.txt.
229 fdump-analyzer-exploded-nodes-3
230 Common RejectNegative Var(flag_dump_analyzer_exploded_nodes_3)
231 Dump a textual representation of the exploded graph to SRCFILE.eg-ID.txt.
233 fdump-analyzer-exploded-paths
234 Common RejectNegative Var(flag_dump_analyzer_exploded_paths)
235 Dump a textual representation of each diagnostic's exploded path to SRCFILE.IDX.KIND.epath.txt.
237 fdump-analyzer-feasibility
238 Common RejectNegative Var(flag_dump_analyzer_feasibility)
239 Dump various analyzer internals to SRCFILE.*.fg.dot and SRCFILE.*.tg.dot.
242 Common RejectNegative Var(flag_dump_analyzer_json)
243 Dump analyzer-specific data to a SRCFILE.analyzer.json.gz file.
245 fdump-analyzer-state-purge
246 Common RejectNegative Var(flag_dump_analyzer_state_purge)
247 Dump state-purging information to a SRCFILE.state-purge.dot file.
249 fdump-analyzer-supergraph
250 Common RejectNegative Var(flag_dump_analyzer_supergraph)
251 Dump the analyzer supergraph to a SRCFILE.supergraph.dot file.
253 fdump-analyzer-untracked
254 Common RejectNegative Var(flag_dump_analyzer_untracked)
255 Emit custom warnings with internal details intended for analyzer developers.
257 ; This comment is to ensure we retain the blank line above.