False negative caused by alloca/atol or type conversion
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
version: clang/llvm
git rev-parse HEAD
6dda3b1848435a62bdb84edb6474e69369ce6e8c
2025-10-20 20:10:22 +0530
This case requires an input value, which I set to **128**.
Line 22 triggers a null pointer dereference bug, but CSA fails to detect this bug.
https://godbolt.org/z/PT5Gv55GP
If this line can be commented out, CSA can discover bugs normally:
a_2 = (char*) alloca(sizeof(char));
If the 14th line is changed to this, CSA can also detect the bug:
if (((char)*p_2) > 0) {
Contributor guide
Research direction
Start with the Godbolt reproducer linked in the issue, using LLVM revision 6dda3b1848435a62bdb84edb6474e69369ce6e8c and input 128. Run CSA, then compare the behavior with the alloca line removed and with the cast condition changed. The issue names no repository file or test; done means identifying and fixing the false negative, with a regression test for the reproduced null dereference.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100