Skip to content

clang-tidy safety/security reports#375

Draft
greenc-FNAL wants to merge 4 commits intomainfrom
maintenance/clang-tidy-security-safety-1
Draft

clang-tidy safety/security reports#375
greenc-FNAL wants to merge 4 commits intomainfrom
maintenance/clang-tidy-security-safety-1

Conversation

@greenc-FNAL
Copy link
Contributor

@greenc-FNAL greenc-FNAL commented Feb 27, 2026

  • Checks run:
    • bugprone-unsafe-functions
    • clang-analyzer-core.BitwiseShift
    • clang-analyzer-core.CallAndMessage
    • clang-analyzer-core.CallAndMessageModeling
    • clang-analyzer-core.DereferenceModeling
    • clang-analyzer-core.DivideZero
    • clang-analyzer-core.DynamicTypePropagation
    • clang-analyzer-core.FixedAddressDereference
    • clang-analyzer-core.NonNullParamChecker
    • clang-analyzer-core.NonnilStringConstants
    • clang-analyzer-core.NullDereference
    • clang-analyzer-core.StackAddrEscapeBase
    • clang-analyzer-core.StackAddressEscape
    • clang-analyzer-core.UndefinedBinaryOperatorResult
    • clang-analyzer-core.VLASize
    • clang-analyzer-core.builtin.AssumeModeling
    • clang-analyzer-core.builtin.BuiltinFunctions
    • clang-analyzer-core.builtin.NoReturnFunctions
    • clang-analyzer-core.uninitialized.ArraySubscript
    • clang-analyzer-core.uninitialized.Assign
    • clang-analyzer-core.uninitialized.Branch
    • clang-analyzer-core.uninitialized.CapturedBlockVariable
    • clang-analyzer-core.uninitialized.NewArraySize
    • clang-analyzer-core.uninitialized.UndefReturn
    • clang-analyzer-security.ArrayBound
    • clang-analyzer-security.FloatLoopCounter
    • clang-analyzer-security.MmapWriteExec
    • clang-analyzer-security.PointerSub
    • clang-analyzer-security.PutenvStackArray
    • clang-analyzer-security.SetgidSetuidOrder
    • clang-analyzer-security.cert.env.InvalidPtr
    • clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling
    • clang-analyzer-security.insecureAPI.SecuritySyntaxChecker
    • clang-analyzer-security.insecureAPI.UncheckedReturn
    • clang-analyzer-security.insecureAPI.bcmp
    • clang-analyzer-security.insecureAPI.bcopy
    • clang-analyzer-security.insecureAPI.bzero
    • clang-analyzer-security.insecureAPI.decodeValueOfObjCType
    • clang-analyzer-security.insecureAPI.getpw
    • clang-analyzer-security.insecureAPI.gets
    • clang-analyzer-security.insecureAPI.mkstemp
    • clang-analyzer-security.insecureAPI.mktemp
    • clang-analyzer-security.insecureAPI.rand
    • clang-analyzer-security.insecureAPI.strcpy
    • clang-analyzer-security.insecureAPI.vfork
    • concurrency-mt-unsafe

Initial report:

[310/437] Building CXX object phlex/app/CMakeFiles/run_phlex.dir/load_module.cpp.o
/phlex-src/phlex/app/load_module.cpp:32:37: warning: function is not thread safe [concurrency-mt-unsafe]
   32 |       char const* plugin_path_ptr = std::getenv("PHLEX_PLUGIN_PATH");
      |                                     ^
[332/437] Building CXX object test/CMakeFiles/hierarchical_nodes.dir/hierarchical_nodes.cpp.o
/phlex-src/test/hierarchical_nodes.cpp:70:26: warning: function is not thread safe [concurrency-mt-unsafe]
   70 |     std::strncpy(buffer, std::ctime(&tm), 26);
      |                          ^
[344/437] Building CXX object test/form/CMakeFiles/WriteVector.dir/toy_tracker.cpp.o
/phlex-src/test/form/toy_tracker.cpp:22:15: warning: function is not thread safe [concurrency-mt-unsafe]
   22 |   int rand1 = rand() % 32768;
      |               ^
/phlex-src/test/form/toy_tracker.cpp:23:15: warning: function is not thread safe [concurrency-mt-unsafe]
   23 |   int rand2 = rand() % 32768;
      |               ^
[364/437] Building CXX object test/form/CMakeFiles/WriteVector.dir/writer.cpp.o
/phlex-src/test/form/writer.cpp:23:15: warning: function is not thread safe [concurrency-mt-unsafe]
   23 |   int rand1 = rand() % 32768;
      |               ^
/phlex-src/test/form/writer.cpp:24:15: warning: function is not thread safe [concurrency-mt-unsafe]
   24 |   int rand2 = rand() % 32768;
      |               ^
/phlex-src/test/form/writer.cpp:27:17: warning: function is not thread safe [concurrency-mt-unsafe]
   27 |     int rand1 = rand() % 32768;
      |                 ^
/phlex-src/test/form/writer.cpp:28:17: warning: function is not thread safe [concurrency-mt-unsafe]
   28 |     int rand2 = rand() % 32768;
      |                 ^

No automatic fixes available.

- Checks run:
  - `clang-analyzer-security-*`
  - `bugprone-unsafe-functions`
  - `concurrency-mt-unsafe`

```console
[310/437] Building CXX object phlex/app/CMakeFiles/run_phlex.dir/load_module.cpp.o
/phlex-src/phlex/app/load_module.cpp:32:37: warning: function is not thread safe [concurrency-mt-unsafe]
   32 |       char const* plugin_path_ptr = std::getenv("PHLEX_PLUGIN_PATH");
      |                                     ^
[332/437] Building CXX object test/CMakeFiles/hierarchical_nodes.dir/hierarchical_nodes.cpp.o
/phlex-src/test/hierarchical_nodes.cpp:70:26: warning: function is not thread safe [concurrency-mt-unsafe]
   70 |     std::strncpy(buffer, std::ctime(&tm), 26);
      |                          ^
[344/437] Building CXX object test/form/CMakeFiles/WriteVector.dir/toy_tracker.cpp.o
/phlex-src/test/form/toy_tracker.cpp:22:15: warning: function is not thread safe [concurrency-mt-unsafe]
   22 |   int rand1 = rand() % 32768;
      |               ^
/phlex-src/test/form/toy_tracker.cpp:23:15: warning: function is not thread safe [concurrency-mt-unsafe]
   23 |   int rand2 = rand() % 32768;
      |               ^
[364/437] Building CXX object test/form/CMakeFiles/WriteVector.dir/writer.cpp.o
/phlex-src/test/form/writer.cpp:23:15: warning: function is not thread safe [concurrency-mt-unsafe]
   23 |   int rand1 = rand() % 32768;
      |               ^
/phlex-src/test/form/writer.cpp:24:15: warning: function is not thread safe [concurrency-mt-unsafe]
   24 |   int rand2 = rand() % 32768;
      |               ^
/phlex-src/test/form/writer.cpp:27:17: warning: function is not thread safe [concurrency-mt-unsafe]
   27 |     int rand1 = rand() % 32768;
      |                 ^
/phlex-src/test/form/writer.cpp:28:17: warning: function is not thread safe [concurrency-mt-unsafe]
   28 |     int rand2 = rand() % 32768;
      |                 ^
```

No automatic fixes
@greenc-FNAL greenc-FNAL changed the title maintenance/clang tidy security safety 1 clang-tidy safety/security reports Feb 27, 2026
- Surgical suppression of each check after verification.
@greenc-FNAL
Copy link
Contributor Author

@phlexbot clang-fix

@github-actions
Copy link
Contributor

Automatic clang-format fixes pushed (commit 19ef651).
⚠️ Note: Some issues may require manual review and fixing.

@codecov
Copy link

codecov bot commented Feb 27, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.

@@            Coverage Diff             @@
##             main     #375      +/-   ##
==========================================
- Coverage   85.36%   85.25%   -0.12%     
==========================================
  Files         122      122              
  Lines        2433     2434       +1     
  Branches      389      389              
==========================================
- Hits         2077     2075       -2     
  Misses        233      233              
- Partials      123      126       +3     
Flag Coverage Δ
unittests 85.25% <100.00%> (-0.12%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines Coverage Δ
phlex/app/load_module.cpp 83.72% <100.00%> (+0.38%) ⬆️

... and 3 files with indirect coverage changes


Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 8759264...19ef651. Read the comment docs.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant