[clang-tidy] Added DefaultOperatorNewCheck.

[balazske]

Summary

Added new checker 'cert-default-operator-new' that checks for
CERT rule MEM57-CPP. Simple version.

[lebedev.ri]

Some thoughts:

1. Docs missing
2. How does this play with C++17 aligned new? Assuming compiler/library support for that isn't broken ('bye, OSX!', ?), i'm not sure why it would be UB for C++17, see https://godbolt.org/z/kwxRbu vs https://godbolt.org/z/om-bR2
3. I'm not sure what's getCharAlign() has to do with anything here? You want to check the alignment requirement against the __STDCPP_DEFAULT_NEW_ALIGNMENT__ (i don't recall how to get it inside of clang) i would think?

[martong]

clang-tools-extra/clang-tidy/cert/DefaultOperatorNewCheck.cpp

26 ↗

(On Diff #220073)

Perhaps we should add in the docs that placement new is not supported. Or add a fixme here.
Anyway, I feel this code simply could work with placement new as well. What is the reason you disabled it for placement new?

41 ↗

(On Diff #220073)

This might not be what we want... getCharAlign() theoretically could return even with 1, I think, though it would be a very strange architecture.
Perhaps we should use getSuitableAlign() instead?

Also, I think we should call the variable as FundamentalAlignment. Fundamental and default alignment can differ, I guess.

49 ↗

(On Diff #220073)

I think it would be useful to add the value of the fundamental alignment to the diagnostics too.

clang-tools-extra/docs/clang-tidy/checks/list.rst

110–112

Why do we have these changes? Seems to be unrelated.

[balazske]

C++17 makes things more difficult because the align is probably handled by operator new, probably not, depending on the defined allocation functions. This can be observed only with a non clang-tidy checker (we could compute the used alignment?). Probably the CERT rule is from the time before C++17. It looks like that by default the alignment is handled correctly in C++17 so the whole check is out of scope for that language version.

clang-tools-extra/clang-tidy/cert/DefaultOperatorNewCheck.cpp

26 ↗

(On Diff #220073)

Placement new provides already a memory location that is specified by the user (or some custom allocation function) so this is not a default case for which the warning should be provided.

41 ↗

(On Diff #220073)

I wanted to use Context.getTargetInfo().getNewAlign() here, is it correct? (Or getNewAlign()/getCharWidth()?)

clang-tools-extra/docs/clang-tidy/checks/list.rst

110–112

I used the add_new_check.py script, do not know why these changes appeared. (Probably issue with the diff or rebase?)

[balazske]

clang-tools-extra/clang-tidy/cert/CERTTidyModule.cpp

53

The checker should be renamed to cert-mem57-cpp to comply with the others.

[balazske]

clang-tools-extra/clang-tidy/cert/DefaultOperatorNewCheck.cpp

49 ↗

(On Diff #220073)

Should be this the correct error message? "Allocation with standard new: too long alignment for a user type." Or "Allocation with standard new: too long alignment (user_align) for a user type, default is default_align."

[aaron.ballman]

Thank you for working on this check!

In D67545#1672106, @balazske wrote:

C++17 makes things more difficult because the align is probably handled by operator new, probably not, depending on the defined allocation functions.

Correct.

This can be observed only with a non clang-tidy checker (we could compute the used alignment?).

I'm less certain of this. We should be able to look up which operator new overload was selected for the new expression and check to see if it has an alignment parameter. If it does, I think it's reasonable to assume that the function behaves correctly wrt alignment.

Probably the CERT rule is from the time before C++17. It looks like that by default the alignment is handled correctly in C++17 so the whole check is out of scope for that language version.

Yeah, the CERT C++ rules were written for C++14: https://wiki.sei.cmu.edu/confluence/display/cplusplus/Scope

The check may be out of scope for C++17, I've not analyzed it for that. There are times when new with align is not called (http://eel.is/c++draft/cpp.predefined#1.6) and user overloads to consider as well, but I think those should be trying to call the aligned new version when given an over-aligned type.

clang-tools-extra/clang-tidy/cert/CERTTidyModule.cpp

53

Yes, please. It should also be moved under a // MEM comment instead of OOP (and kept in alphabetical order).

clang-tools-extra/clang-tidy/cert/DefaultOperatorNewCheck.cpp

26 ↗

(On Diff #220073)

That would correspond to MEM54-CPP: https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM54-CPP.+Provide+placement+new+with+properly+aligned+pointers+to+sufficient+storage+capacity

I think this should be hoisted into a local AST matcher rather than be part of the check() call. Something like unless(isPlacementNew()) when registering the check.

41 ↗

(On Diff #220073)

I think getNewAlign() is the correct thing to use here. If the alignment requirements of the allocated type are greater than what getNewAlign() returns, there are problems (unless calling the C++17 aligned allocation operator).

49 ↗

(On Diff #220073)

I'd go with: allocation function returns a pointer with alignment %0 but the over-aligned type being allocated requires alignment %1

clang-tools-extra/clang-tidy/cert/DefaultOperatorNewCheck.h

18 ↗

(On Diff #220073)

FIXME needs fixing.

clang-tools-extra/docs/ReleaseNotes.rst

85

You should fix this fixme.

clang-tools-extra/docs/clang-tidy/checks/cert-default-operator-new.rst

6 ↗

(On Diff #220073)

This one too -- you should model it after the other CERT check documentation, with a link back to the CERT check.

clang-tools-extra/docs/clang-tidy/checks/list.rst

110–112

Something got messed up -- you should back out these changes.

[balazske]

clang-tools-extra/clang-tidy/cert/CERTTidyModule.cpp

53

I will move it, but should I change the order of the commented sections? These are currently not in alphabetic order.

[aaron.ballman]

clang-tools-extra/clang-tidy/cert/CERTTidyModule.cpp

53

Not for this patch, but that could be done in a separate patch (as an NFC change).

[balazske]

Rebase and update according to comments.
C++17 related changes not implemented yet (possible check for the called allocation function).

[balazske]

Fixed the test, fixed problems in list.rst.

[martong]

clang-tools-extra/clang-tidy/cert/DefaultOperatorNewCheck.cpp

38 ↗

(On Diff #220628)

Would it make sense to early return here if the language dialect is >= C++17 ?

51 ↗

(On Diff #220628)

What is the difference between "default" and "fundamental" alignment? Are they the same? Can they differ in any architecture?

https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM57-CPP.+Avoid+using+default+operator+new+for+over-aligned+types
Here there is no wording of "default alignment" only "fundamental alignment" is mentioned. Based on this I'd call this as FundamentalAligment.

[martong]

clang-tools-extra/clang-tidy/cert/DefaultOperatorNewCheck.cpp

51 ↗

(On Diff #220628)

What is the difference between "default" and "fundamental" alignment? Are they the same?

fundamental alignment of any type is the alignment of std::max_align_t. I.e. alignof(std::max_align_t).
See C++17 6.11.2.

On the other hand, default alignment is the value in __STDCPP_DEFAULT_NEW_ALIGNMENT__ which may be predefined with fnew-alignment
See https://www.bfilipek.com/2019/08/newnew-align.html

These values can differ: https://wandbox.org/permlink/yIwjiNMw9KyXEQan

Thus, I think we should use the fundamental alignment here, not the default alignment.
So, getNewAlign() does not seem right to me.
@aaron.ballman What do you think?

[lebedev.ri]

clang-tools-extra/clang-tidy/cert/DefaultOperatorNewCheck.cpp

51 ↗

(On Diff #220628)

Thus, I think we should use the fundamental alignment here, not the default alignment.

I have the exact opposite view.
If as per getNewAlign() the alignment would be okay, why should we not trust it?

[aaron.ballman]

clang-tools-extra/clang-tidy/cert/DefaultOperatorNewCheck.cpp

51 ↗

(On Diff #220628)

The comment on getNewAlign() is:

/// Return the largest alignment for which a suitably-sized allocation with
/// '::operator new(size_t)' is guaranteed to produce a correctly-aligned
/// pointer.

I read that as saying any alignment larger than what is returned by getNewAlign() must call the over-aligned operator new variant in C++17 if available. So if the actual call target doesn't have an alignment specifier, it's probably getting the alignment wrong and would be worth diagnosing on.

[martong]

clang-tools-extra/clang-tidy/cert/DefaultOperatorNewCheck.cpp

51 ↗

(On Diff #220628)

I have the exact opposite view.
If as per getNewAlign() the alignment would be okay, why should we not trust it?

That could lead to a false positive diagnostic if -fnew-alignment=8 and alignas(16) , because alignof(max_align_t) is still 16.

See the definidion of getNewAlign() which will return with 8 in this case I suppose:

unsigned getNewAlign() const {
  return NewAlign ? NewAlign : std::max(LongDoubleAlign, LongLongAlign);
}

[martong]

clang-tools-extra/clang-tidy/cert/DefaultOperatorNewCheck.cpp

51 ↗

(On Diff #220628)

So if the actual call target doesn't have an alignment specifier, it's probably getting the alignment wrong and would be worth diagnosing on.

I agree, but then we are implementing a checker which is different from the description given in cert-mem57.
So it is not a CERT checker anymore, perhaps we should rename then.
There is no mention of STDCPP_DEFAULT_NEW_ALIGNMENT in https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM57-CPP.+Avoid+using+default+operator+new+for+over-aligned+types
It clearly references the "fundamental alignement".

[aaron.ballman]

clang-tools-extra/clang-tidy/cert/DefaultOperatorNewCheck.cpp

51 ↗

(On Diff #220628)

Why do you believe that to be a false positive? That seems like exactly the behavior we'd want -- if the user says that their allocation function guarantees a particular max alignment by using -fnew-alignment, we should honor that.

[martong]

clang-tools-extra/clang-tidy/cert/DefaultOperatorNewCheck.cpp

51 ↗

(On Diff #220628)

Why do you believe that to be a false positive? That seems like exactly the behavior we'd want -- if the user says that their allocation function guarantees a particular max alignment by using -fnew-alignment, we should honor that.

Okay, giving it more thought, that makes perfect sense.
Anyway, thanks for trying to understand my concerns :)

[aaron.ballman]

clang-tools-extra/clang-tidy/cert/DefaultOperatorNewCheck.cpp

51 ↗

(On Diff #220628)

That's because the CERT rule was written to target C++14 and earlier, which did not have __STDCPP_DEFAULT_NEW_ALIGNMENT__.

We can solve this in one of two ways: don't enable the check in C++17 mode, or do the right thing in C++17 mode. I think we should do the right thing, which is to check which overload is selected (if the aligned overload is selected, we don't diagnose because it's doing the right thing for the user) and compare against getNewAlign() (if the alignment requested is stricter than what we can guarantee through getNewAlign() and we've verified we're not calling an aligned overload, there is a real chance the pointer value will be incorrectly aligned). To me, that meets the spirit of what the CERT rule is trying to convey while still being useful in C++17.

[aaron.ballman]

clang-tools-extra/clang-tidy/cert/DefaultOperatorNewCheck.cpp

51 ↗

(On Diff #220628)

Okay, giving it more thought, that makes perfect sense.
Anyway, thanks for trying to understand my concerns :)

Thank you for the good discussion on them!

[balazske]

clang-tools-extra/clang-tidy/cert/DefaultOperatorNewCheck.cpp

51 ↗

(On Diff #220628)

I am not sure about if really any warning is needed in C++17. Because if the non-aligned operator new is selected it is already an user-provided one (the system-provided allocation function should take the alignment argument). And for user-defined operator new we do not want any warning (even if it looks like wrong but may be it is not).

[aaron.ballman]

clang-tools-extra/clang-tidy/cert/DefaultOperatorNewCheck.cpp

51 ↗

(On Diff #220628)

I think this makes sense. If the user had replaced the global operator new but not the aligned one, the aligned one would still be found by overload resolution when it matters. So it seems fine to ignore C++17 for the check for now.

[lebedev.ri]

clang-tools-extra/clang-tidy/cert/DefaultOperatorNewCheck.cpp

51 ↗

(On Diff #220628)

Tangentially-related rant:
The operator new/malloc&friend alignment assumptions question isn't new,
it was brought up on the list several times, and i think it will be approached once more.
Right now clang, even though it knows about those alignments, it does not annotate
them (operator new, ...) with alignment assumption, thus both pessimizing middle-end
(knowing that some pointer has some big alignment is useful!),
and "disabling" the appropriate UBSan check.

[lebedev.ri]

clang-tools-extra/clang-tidy/cert/CERTTidyModule.cpp

68

I find DefaultOperatorNewCheck to be insufficiently explanative.
Maybe DefaultOperatorNewAlignmentCheck ?

[balazske]

• Rename to DefaultOperatorNewAlignmentCheck.

[aaron.ballman]

clang-tools-extra/clang-tidy/cert/CERTTidyModule.cpp

67–69

The MEM section should come before MSC.

clang-tools-extra/clang-tidy/cert/DefaultOperatorNewAlignmentCheck.cpp

25

Didn't we decide the check should not diagnose in C++17 or later?

30–31

I think this should be hoisted into a local AST matcher rather than be part of the check() call. Something like unless(isPlacementNew()) when registering the check.

48

Please drop top-level const on anything that's not a pointer or a reference (that's not a style we typically follow).

60

Commented-out code?

[lebedev.ri]

(outstanding unaddressed review notes)

[balazske]

• Fixes from review comments, added C++ version test.

[aaron.ballman]

LGTM aside from a minor issue.

clang-tools-extra/clang-tidy/cert/DefaultOperatorNewAlignmentCheck.cpp

31–32

This should be in the registerMatchers() function so that we don't even bother trying to match anything. You don't need to do the || either; if 2a is enabled, that automatically enables all previous modes as well.

[balazske]

• Improved check for C++17.

[lebedev.ri]

Land this?

[balazske]

Ping. It should be accepted before I can land it.

[lebedev.ri]

In D67545#1749561, @balazske wrote:

Ping. It should be accepted before I can land it.

@aaron.ballman already accepted.

[aaron.ballman]

In D67545#1749579, @lebedev.ri wrote:

In D67545#1749561, @balazske wrote:

Ping. It should be accepted before I can land it.

@aaron.ballman already accepted.

And I'm happy to re-affirm my acceptance. :-D

clang-tools-extra/clang-tidy/cert/CERTTidyModule.cpp

 #include "../google/UnnamedNamespaceInHeaderCheck.h"
 #include "../misc/NewDeleteOverloadsCheck.h"
 #include "../misc/NonCopyableObjects.h"
 #include "../misc/StaticAssertCheck.h"
 #include "../misc/ThrowByValueCatchByReferenceCheck.h"
 #include "../performance/MoveConstructorInitCheck.h"
 #include "../readability/UppercaseLiteralSuffixCheck.h"
 #include "CommandProcessorCheck.h"
+#include "DefaultOperatorNewAlignmentCheck.h"
 #include "DontModifyStdNamespaceCheck.h"
 #include "FloatLoopCounter.h"
 #include "LimitedRandomnessCheck.h"
 #include "PostfixOperatorCheck.h"
 #include "ProperlySeededRandomGeneratorCheck.h"
 #include "SetLongJmpCheck.h"
 #include "StaticObjectExceptionCheck.h"
 #include "StrToNumCheck.h"
CheckFactories.registerCheck<PostfixOperatorCheck>(
         "cert-dcl21-cpp");
     CheckFactories.registerCheck<VariadicFunctionDefCheck>("cert-dcl50-cpp");
     CheckFactories.registerCheck<misc::NewDeleteOverloadsCheck>(
         "cert-dcl54-cpp");
     CheckFactories.registerCheck<DontModifyStdNamespaceCheck>(
         "cert-dcl58-cpp");
     CheckFactories.registerCheck<google::build::UnnamedNamespaceInHeaderCheck>(
         "cert-dcl59-cpp");
-    // OOP
-    CheckFactories.registerCheck<performance::MoveConstructorInitCheck>(
-        "cert-oop11-cpp");
-    CheckFactories.registerCheck<bugprone::UnhandledSelfAssignmentCheck>(
-        "cert-oop54-cpp");
     // ERR
     CheckFactories.registerCheck<misc::ThrowByValueCatchByReferenceCheck>(
         "cert-err09-cpp");
     CheckFactories.registerCheck<SetLongJmpCheck>("cert-err52-cpp");
     CheckFactories.registerCheck<StaticObjectExceptionCheck>("cert-err58-cpp");
     CheckFactories.registerCheck<ThrownExceptionTypeCheck>("cert-err60-cpp");
     CheckFactories.registerCheck<misc::ThrowByValueCatchByReferenceCheck>(
         "cert-err61-cpp");
+    // MEM
+    CheckFactories.registerCheck<DefaultOperatorNewAlignmentCheck>(
+        "cert-mem57-cpp");
     // MSC
     CheckFactories.registerCheck<LimitedRandomnessCheck>("cert-msc50-cpp");
     CheckFactories.registerCheck<ProperlySeededRandomGeneratorCheck>(
         "cert-msc51-cpp");
+    // OOP
+    CheckFactories.registerCheck<performance::MoveConstructorInitCheck>(
+        "cert-oop11-cpp");
+    CheckFactories.registerCheck<bugprone::UnhandledSelfAssignmentCheck>(
+        "cert-oop54-cpp");
 
     // C checkers
     // DCL
     CheckFactories.registerCheck<misc::StaticAssertCheck>("cert-dcl03-c");
     CheckFactories.registerCheck<readability::UppercaseLiteralSuffixCheck>(
         "cert-dcl16-c");
     // ENV
     CheckFactories.registerCheck<CommandProcessorCheck>("cert-env33-c");

clang-tools-extra/clang-tidy/cert/CMakeLists.txt

 set(LLVM_LINK_COMPONENTS support)
 
 add_clang_library(clangTidyCERTModule
   CERTTidyModule.cpp
   CommandProcessorCheck.cpp
+  DefaultOperatorNewAlignmentCheck.cpp
   DontModifyStdNamespaceCheck.cpp
   FloatLoopCounter.cpp
   LimitedRandomnessCheck.cpp
   PostfixOperatorCheck.cpp
   ProperlySeededRandomGeneratorCheck.cpp
   SetLongJmpCheck.cpp
   StaticObjectExceptionCheck.cpp
   StrToNumCheck.cpp

clang-tools-extra/clang-tidy/cert/DefaultOperatorNewAlignmentCheck.h

+//===--- DefaultOperatorNewCheck.h - clang-tidy -----------------*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_CERT_DEFAULTOPERATORNEWALIGNMENTCHECK_H
+#define LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_CERT_DEFAULTOPERATORNEWALIGNMENTCHECK_H
+
+#include "../ClangTidyCheck.h"
+
+namespace clang {
+namespace tidy {
+namespace cert {
+
+/// Checks if an object of type with extended alignment is allocated by using
+/// the default operator new.
+///
+/// For the user-facing documentation see:
+/// http://clang.llvm.org/extra/clang-tidy/checks/cert-mem57-cpp.html
+class DefaultOperatorNewAlignmentCheck : public ClangTidyCheck {
+public:
+  DefaultOperatorNewAlignmentCheck(StringRef Name, ClangTidyContext *Context)
+      : ClangTidyCheck(Name, Context) {}
+  void registerMatchers(ast_matchers::MatchFinder *Finder) override;
+  void check(const ast_matchers::MatchFinder::MatchResult &Result) override;
+};
+
+} // namespace cert
+} // namespace tidy
+} // namespace clang
+
+#endif // LLVM_CLANG_TOOLS_EXTRA_CLANG_TIDY_CERT_DEFAULTOPERATORNEWALIGNMENTCHECK_H

clang-tools-extra/clang-tidy/cert/DefaultOperatorNewAlignmentCheck.cpp

+//===--- DefaultOperatorNewCheck.cpp - clang-tidy --------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#include "DefaultOperatorNewAlignmentCheck.h"
+#include "clang/AST/ASTContext.h"
+#include "clang/ASTMatchers/ASTMatchFinder.h"
+
+using namespace clang::ast_matchers;
+
+namespace clang {
+namespace tidy {
+namespace cert {
+
+AST_MATCHER(CXXNewExpr, isPlacementNew) {
+  return Node.getNumPlacementArgs() > 0;
+}
+
+void DefaultOperatorNewAlignmentCheck::registerMatchers(MatchFinder *Finder) {
+  // Check not applicable in C++17 (or newer).
+  if (getLangOpts().CPlusPlus17)
+    return;
+
+  Finder->addMatcher(cxxNewExpr(unless(isPlacementNew())).bind("new"), this);
+}
+
+void DefaultOperatorNewAlignmentCheck::check(
+    const MatchFinder::MatchResult &Result) {
+  // Get the found 'new' expression.
+  const auto *NewExpr = Result.Nodes.getNodeAs<CXXNewExpr>("new");
+
+  QualType T = NewExpr->getAllocatedType();
+  // Dependent types do not have fixed alignment.
+  if (T->isDependentType())
+    return;
+  const TagDecl *D = T->getAsTagDecl();
+  // Alignment can not be obtained for undefined type.
+  if (!D || !D->getDefinition() || !D->isCompleteDefinition())
+    return;
+
+  ASTContext &Context = D->getASTContext();
+
+  // Check if no alignment was specified for the type.
+  if (!Context.isAlignmentRequired(T))
+    return;
+
+  // The user-specified alignment (in bits).
+  unsigned SpecifiedAlignment = D->getMaxAlignment();
+  // Double-check if no alignment was specified.
+  if (!SpecifiedAlignment)
+    return;
+  // The alignment used by default 'operator new' (in bits).
+  unsigned DefaultNewAlignment = Context.getTargetInfo().getNewAlign();
+
+  bool OverAligned = SpecifiedAlignment > DefaultNewAlignment;
+  bool HasDefaultOperatorNew =
+      !NewExpr->getOperatorNew() || NewExpr->getOperatorNew()->isImplicit();
+
+  unsigned CharWidth = Context.getTargetInfo().getCharWidth();
+  if (HasDefaultOperatorNew && OverAligned)
+    diag(NewExpr->getBeginLoc(),
+         "allocation function returns a pointer with alignment %0 but the "
+         "over-aligned type being allocated requires alignment %1")
+        << (DefaultNewAlignment / CharWidth)
+        << (SpecifiedAlignment / CharWidth);
+}
+
+} // namespace cert
+} // namespace tidy
+} // namespace clang

clang-tools-extra/docs/ReleaseNotes.rst

- New :doc:`bugprone-dynamic-static-initializers
   <clang-tidy/checks/bugprone-dynamic-static-initializers>` check.
 
   Finds instances where variables with static storage are initialized
   dynamically in header files.
 
 - New :doc:`bugprone-infinite-loop
   <clang-tidy/checks/bugprone-infinite-loop>` check.
 
   Finds obvious infinite loops (loops where the condition variable is not
   changed at all).
 
 - New :doc:`bugprone-not-null-terminated-result
   <clang-tidy/checks/bugprone-not-null-terminated-result>` check
 
   Finds function calls where it is possible to cause a not null-terminated
   result. Usually the proper length of a string is ``strlen(str) + 1`` or equal
   length of this expression, because the null terminator needs an extra space.
   Without the null terminator it can result in undefined behaviour when the
   string is read.
 
+- New :doc:`cert-mem57-cpp
+  <clang-tidy/checks/cert-mem57-cpp>` check.
+
+  Checks if an object of type with extended alignment is allocated by using
+  the default ``operator new``.
+
 - New alias :doc:`cert-pos44-c
   <clang-tidy/checks/cert-pos44-c>` to
   :doc:`bugprone-bad-signal-to-kill-thread
   <clang-tidy/checks/bugprone-bad-signal-to-kill-thread>` was added.
 
 - New :doc:`cppcoreguidelines-init-variables
   <clang-tidy/checks/cppcoreguidelines-init-variables>` check.
 

clang-tools-extra/docs/clang-tidy/checks/cert-mem57-cpp.rst

+.. title:: clang-tidy - cert-mem57-cpp
+
+cert-mem57-cpp
+==============
+
+This check flags uses of default ``operator new`` where the type has extended
+alignment (an alignment greater than the fundamental alignment). (The default
+``operator new`` is guaranteed to provide the correct alignmment if the
+requested alignment is less or equal to the fundamental alignment).
+Only cases are detected (by design) where the ``operator new`` is not
+user-defined and is not a placement new (the reason is that in these cases we
+assume that the user provided the correct memory allocation).
+
+This check corresponds to the CERT C++ Coding Standard rule
+`MEM57-CPP. Avoid using default operator new for over-aligned types
+<https://wiki.sei.cmu.edu/confluence/display/cplusplus/MEM57-CPP.+Avoid+using+default+operator+new+for+over-aligned+types>`_.

clang-tools-extra/docs/clang-tidy/checks/list.rst

.. toctree::
    cert-err09-cpp (redirects to misc-throw-by-value-catch-by-reference) <cert-err09-cpp>
    cert-err34-c
    cert-err52-cpp
    cert-err58-cpp
    cert-err60-cpp
    cert-err61-cpp (redirects to misc-throw-by-value-catch-by-reference) <cert-err61-cpp>
    cert-fio38-c (redirects to misc-non-copyable-objects) <cert-fio38-c>
    cert-flp30-c
+   cert-mem57-cpp
    cert-msc30-c (redirects to cert-msc50-cpp) <cert-msc30-c>
    cert-msc32-c (redirects to cert-msc51-cpp) <cert-msc32-c>
    cert-msc50-cpp
    cert-msc51-cpp
    cert-oop11-cpp (redirects to performance-move-constructor-init) <cert-oop11-cpp>
    cert-oop54-cpp (redirects to bugprone-unhandled-self-assignment) <cert-oop54-cpp>
    cert-pos44-c (redirects to bugprone-bad-signal-to-kill-thread) <cert-pos44-c>
    clang-analyzer-core.CallAndMessage (redirects to https://clang.llvm.org/docs/analyzer/checkers) <clang-analyzer-core.CallAndMessage>
    clang-analyzer-core.DivideZero (redirects to https://clang.llvm.org/docs/analyzer/checkers) <clang-analyzer-core.DivideZero>
    clang-analyzer-core.DynamicTypePropagation
    clang-analyzer-core.NonNullParamChecker (redirects to https://clang.llvm.org/docs/analyzer/checkers) <clang-analyzer-core.NonNullParamChecker>
    clang-analyzer-core.NullDereference (redirects to https://clang.llvm.org/docs/analyzer/checkers) <clang-analyzer-core.NullDereference>
    clang-analyzer-core.StackAddressEscape (redirects to https://clang.llvm.org/docs/analyzer/checkers) <clang-analyzer-core.StackAddressEscape>
    clang-analyzer-core.UndefinedBinaryOperatorResult (redirects to https://clang.llvm.org/docs/analyzer/checkers) <clang-analyzer-core.UndefinedBinaryOperatorResult>
    clang-analyzer-core.VLASize (redirects to https://clang.llvm.org/docs/analyzer/checkers) <clang-analyzer-core.VLASize>
    clang-analyzer-core.uninitialized.ArraySubscript (redirects to https://clang.llvm.org/docs/analyzer/checkers) <clang-analyzer-core.uninitialized.ArraySubscript>
    clang-analyzer-core.uninitialized.Assign (redirects to https://clang.llvm.org/docs/analyzer/checkers) <clang-analyzer-core.uninitialized.Assign>

clang-tools-extra/test/clang-tidy/cert-mem57-cpp-cpp17.cpp

+// RUN: %check_clang_tidy %s -std=c++14 cert-mem57-cpp %t
+// RUN: clang-tidy --extra-arg='-std=c++17' -checks='-*,cert-mem57-cpp' --warnings-as-errors='*' %s
+// RUN: clang-tidy --extra-arg='-std=c++2a' -checks='-*,cert-mem57-cpp' --warnings-as-errors='*' %s
+
+struct alignas(32) Vector {
+  char Elems[32];
+};
+
+void f() {
+  auto *V1 = new Vector;        // CHECK-MESSAGES: warning: allocation function returns a pointer with alignment 16 but the over-aligned type being allocated requires alignment 32 [cert-mem57-cpp]
+  auto *V1_Arr = new Vector[2]; // CHECK-MESSAGES: warning: allocation function returns a pointer with alignment 16 but the over-aligned type being allocated requires alignment 32 [cert-mem57-cpp]
+}

clang-tools-extra/test/clang-tidy/cert-mem57-cpp.cpp

+// RUN: %check_clang_tidy %s -std=c++14 cert-mem57-cpp %t
+
+namespace std {
+typedef __typeof(sizeof(int)) size_t;
+void *aligned_alloc(size_t, size_t);
+void free(void *);
+} // namespace std
+
+struct alignas(32) Vector1 {
+  char elems[32];
+};
+
+struct Vector2 {
+  char elems[32];
+};
+
+struct alignas(32) Vector3 {
+  char elems[32];
+  static void *operator new(std::size_t nbytes) noexcept(true) {
+    return std::aligned_alloc(alignof(Vector3), nbytes);
+  }
+  static void operator delete(void *p) {
+    std::free(p);
+  }
+};
+
+struct alignas(8) Vector4 {
+  char elems[32];
+};
+
+void f() {
+  auto *V1 = new Vector1;
+  // CHECK-MESSAGES: :[[@LINE-1]]:14: warning: allocation function returns a pointer with alignment 16 but the over-aligned type being allocated requires alignment 32 [cert-mem57-cpp]
+  auto *V2 = new Vector2;
+  auto *V3 = new Vector3;
+  auto *V4 = new Vector4;
+  auto *V1_Arr = new Vector1[2];
+  // CHECK-MESSAGES: :[[@LINE-1]]:18: warning: allocation function returns a pointer with alignment 16 but the over-aligned type being allocated requires alignment 32 [cert-mem57-cpp]
+}