llvm / llvm/llvm-project

[Compiler-RT] CodeQL Violations

Open
#159,273 0 comments 0 reactions 0 assignees View on GitHub
code-quality compiler-rt github:security
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

### **Description**

CodeQL analysis has flagged violations in the codebase of compiler-rt. These issues may impact code quality, security, or maintainability and should be reviewed and addressed.

Some violations are addressed in PR [154937](https://github.com/llvm/llvm-project/pull/154937) & PR [159097](https://github.com/llvm/llvm-project/pull/159097).

### **Pending severe violations**

- **cpp/pointer-overflow-check**
In _compiler-rt/lib/safestack/safestack.cpp_ at line 126 ,127
- **cpp/command-line-injection**
In _fuzzer/FuzzerUtilLinux.cpp_ at line 27
- **cpp/incorrect-string-type-conversion**
In _sanitizer_common/sanitizer_common_interceptors_format.inc_ at line 355
- **cpp/uncontrolled-allocation-size**
In _profile/InstrProfilingFile.c_ at line 383

[Violation Summary Report](https://github.com/user-attachments/files/22377574/results.html)
[Detailed Violation Summary Report](https://github.com/user-attachments/files/22377561/results.csv)

### **Steps to Reproduce**

1. [Download CodeQL and Configuration](https://docs.github.com/en/code-security/codeql-cli/getting-started-with-the-codeql-cli/setting-up-the-codeql-cli#1-download-the-codeql-cli-tar-archive)
2. [Create/Build the CodeQL database](https://docs.github.com/en/code-security/codeql-cli/codeql-cli-manual/database-create#synopsis) for **compiler-rt**
```
codeql database create /path/to/dir/CODEQL_DB --language=cpp --source-root="llvm-project" --command="ninja -C /path/to/build/dir/compiler-rt"
```
**Note**. Please Clean the build directory of compile-rt using ```ninja clean``` before running above command.
3. [Analyze the CodeQL database](https://docs.github.com/en/code-security/codeql-cli/getting-started-with-the-codeql-cli/analyzing-your-code-with-codeql-queries#running-codeql-database-analyze)
```
codeql database analyze /path/to/dir/CODEQL_DB --format=sarif-latest --output="results.sarif" cpp-security-extended.qls
```
4. Generate report in html using [sarif](https://github.com/microsoft/sarif-tools) tool
```
sarif html -o results.html results.sarif
```

### **Environment**

LLVM version: 22.0.0
OS: Ubuntu 22.04
Architecture: x86_64
LLVM Branch: main
Commit HEAD: 2155f17d39f3969ef841c85ef1102a214ab22b30

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.