[all-commits] [llvm/llvm-project] babcc2: [SSAF] Close unsafe-buffer reachability over overr...

[Balázs Benics via All-commits]

  Branch: refs/heads/users/steakhal/ssaf/virtual-method-family-closure
  Home:   https://github.com/llvm/llvm-project
  Commit: babcc2b0c839cb6da8777c9049b8a49f99a9e205
      https://github.com/llvm/llvm-project/commit/babcc2b0c839cb6da8777c9049b8a49f99a9e205
  Author: Balazs Benics <benicsbalazs at gmail.com>
  Date:   2026-09-26 (Sat, 26 Sep 2026)

  Changed paths:
    M clang/lib/ScalableStaticAnalysis/Analyses/UnsafeBufferUsage/UnsafeBufferUsageAnalysis.cpp
    M clang/unittests/ScalableStaticAnalysis/WholeProgramAnalysis/UnsafeBufferReachableAnalysisTest.cpp

  Log Message:
  -----------
  [SSAF] Close unsafe-buffer reachability over override families

An unsafe pointer reaching one override's parameter is equally unsafe in every
sibling and base override of that method, because the call site picks the
target dynamically. Without closing over the families, reachability depended
on which override the extractor happened to see the flow through, so a fix
suggested for the base could be contradicted by a derived override.

- Mirroring is level-preserving: families relate slot entities, so a reachable
  EPL propagates only to the same pointer level on its family members.
- Mirroring happens inside the pointer-flow search, so flows out of a mirrored
  EPL are followed too.
- Type-constrained slots are never mirrored onto, so C3 still holds.

§4 of rdar://179151603

Assisted-By: claude



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications