[all-commits] [llvm/llvm-project] 3a85bd: [analyzer] Fix security.VAList false positives wit...

[Björn Svensson via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: 3a85bd776903ec83334276762de27b453be04f21
      https://github.com/llvm/llvm-project/commit/3a85bd776903ec83334276762de27b453be04f21
  Author: Björn Svensson <bjorn.a.svensson at est.tech>
  Date:   2026-05-06 (Wed, 06 May 2026)

  Changed paths:
    M clang/docs/ReleaseNotes.rst
    M clang/lib/StaticAnalyzer/Checkers/VAListChecker.cpp
    A clang/test/Analysis/Inputs/system-header-simulator-for-valist-c23.h
    M clang/test/Analysis/valist-uninitialized.c
    M clang/test/Analysis/valist-unterminated.c

  Log Message:
  -----------
  [analyzer] Fix security.VAList false positives with C23 va_start (#192024)

The `security.VAList` checker only recognized `__builtin_va_start` when
matching `va_start` calls.
In C23, `va_start` was changed to expand to `__builtin_c23_va_start`
instead, causing the checker to never see the initialization. This
resulted in false positives for every use of `va_arg`, `va_end`,
`va_copy`, and functions like `vsnprintf` on any `va_list` initialized
with the C23 `va_start`.

Add a CallDescription for `__builtin_c23_va_start` and match it
alongside the existing `__builtin_va_start`.

---------

Signed-off-by: Björn Svensson <bjorn.a.svensson at est.tech>



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications