[Compiler-RT] CodeQL Violations
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
### **Description**
CodeQL analysis has flagged violations in the codebase of compiler-rt. These issues may impact code quality, security, or maintainability and should be reviewed and addressed.
Some violations are addressed in PR [154937](https://github.com/llvm/llvm-project/pull/154937) & PR [159097](https://github.com/llvm/llvm-project/pull/159097).
### **Pending severe violations**
- **cpp/pointer-overflow-check**
In _compiler-rt/lib/safestack/safestack.cpp_ at line 126 ,127
- **cpp/command-line-injection**
In _fuzzer/FuzzerUtilLinux.cpp_ at line 27
- **cpp/incorrect-string-type-conversion**
In _sanitizer_common/sanitizer_common_interceptors_format.inc_ at line 355
- **cpp/uncontrolled-allocation-size**
In _profile/InstrProfilingFile.c_ at line 383
[Violation Summary Report](https://github.com/user-attachments/files/22377574/results.html)
[Detailed Violation Summary Report](https://github.com/user-attachments/files/22377561/results.csv)
### **Steps to Reproduce**
1. [Download CodeQL and Configuration](https://docs.github.com/en/code-security/codeql-cli/getting-started-with-the-codeql-cli/setting-up-the-codeql-cli#1-download-the-codeql-cli-tar-archive)
2. [Create/Build the CodeQL database](https://docs.github.com/en/code-security/codeql-cli/codeql-cli-manual/database-create#synopsis) for **compiler-rt**
```
codeql database create /path/to/dir/CODEQL_DB --language=cpp --source-root="llvm-project" --command="ninja -C /path/to/build/dir/compiler-rt"
```
**Note**. Please Clean the build directory of compile-rt using ```ninja clean``` before running above command.
3. [Analyze the CodeQL database](https://docs.github.com/en/code-security/codeql-cli/getting-started-with-the-codeql-cli/analyzing-your-code-with-codeql-queries#running-codeql-database-analyze)
```
codeql database analyze /path/to/dir/CODEQL_DB --format=sarif-latest --output="results.sarif" cpp-security-extended.qls
```
4. Generate report in html using [sarif](https://github.com/microsoft/sarif-tools) tool
```
sarif html -o results.html results.sarif
```
### **Environment**
LLVM version: 22.0.0
OS: Ubuntu 22.04
Architecture: x86_64
LLVM Branch: main
Commit HEAD: 2155f17d39f3969ef841c85ef1102a214ab22b30
Contributor guide
Assessment
This issue has not been assessed yet.