0
TL:DR

Can you generate clang debugging information(CFGs, PDGs) when the original source file have DEPENDENCY errors from missing header files that cause compilation issues such as undeclared identifiers and unknown types? The files are syntactically correct. Is there a flag that maybe set all undeclared identifiers to INTs for debugging?

I am using Clang to analyze source code packages. Usually, I modify the makefile so clang generates debugging information using the command below 

clang -emit-llvm -g -S -ferror-limit=0 -I somefile some_c_file

However, this approach is very makefile focused and if developer does not support Clang in that given build version, I have to figure out how to generate the debugging information.

This is not good for automation. For things such as OpenSSL where they include dozen of files(headers) and custom configurations for the given platform, this is not practical. I want to suppress or ignore the errors if possible since I know the build version's file under test is syntactically correct.

Thanks!

Nurjan
  • 5,889
  • 5
  • 34
  • 54
Quentin Mayo
  • 390
  • 4
  • 11
  • 2
    I don't think it's possible. To generate the code, the compiler needs information that is located in include files. – Stargateur Dec 21 '16 at 04:14
  • Maybe so. However, I was hoping someone could teach me the tricks of the trade. Either there is a "trick of the trade" when it comes to security and source analysis or there is a lot security papers that are FULL of bologna. – Quentin Mayo Dec 21 '16 at 04:19
  • Notice that usually you don't need to manually patch the makefiles - a few environment variables, and, in the worst case, PATH tricks and appropriately-named scripts can go a long way. Stuff like `scanbuild` can mostly automate this with the clang static analyzer. Also, nowadays if it compiles in gcc you can usually manage to make clang compile it - often the worst you need are just a couple of defines to make the code think it's gcc. Finally, there are tools like Psyche-c that are being developed, but they are still highly experimental. – Matteo Italia Dec 21 '16 at 07:18

1 Answers1

1

Recently I used clang-tidy for source code analysis of one of our projects. The project uses GNU compiler and we didn't wanted to move away from that. So the process that I followed was below:

1) Use bear to generate the compilation database i.e. compile_commands.json which is used by clang-tidy

2) By pass the include files that we don't want to analyze by including them as system files i.e. use --isystem for their inclusion and project specific files using -I. (If you can't change the Make files you could change the compile_commands.json by a simple find and replace)

Hope this helps

A.N
  • 541
  • 2
  • 13