llvm / llvm/llvm-project

False negative caused by alloca/atol or type conversion

Open
#164,937 2 comments 0 reactions 0 assignees View on GitHub
clang:static analyzer false-negative
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

version: clang/llvm
git rev-parse HEAD
6dda3b1848435a62bdb84edb6474e69369ce6e8c
2025-10-20 20:10:22 +0530

This case requires an input value, which I set to **128**.
Line 22 triggers a null pointer dereference bug, but CSA fails to detect this bug.
https://godbolt.org/z/PT5Gv55GP

If this line can be commented out, CSA can discover bugs normally:
a_2 = (char*) alloca(sizeof(char));

If the 14th line is changed to this, CSA can also detect the bug:
if (((char)*p_2) > 0) {

Contributor guide

Open the contributing guide

Research direction

Start with the Godbolt reproducer linked in the issue, using LLVM revision 6dda3b1848435a62bdb84edb6474e69369ce6e8c and input 128. Run CSA, then compare the behavior with the alloca line removed and with the cast condition changed. The issue names no repository file or test; done means identifying and fixing the false negative, with a regression test for the reproduced null dereference.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.