[clang] [clang][analyzer] Improved message of CallAndMessageChecker at calls with uninitialized argument (PR #211038)

Balázs Benics via cfe-commits cfe-commits at lists.llvm.org
Wed Jul 22 05:39:35 PDT 2026


================
@@ -30,7 +30,7 @@ extern time_t mktime(struct tm *timeptr);
 
 void uninit_mbrlen(const char *mbs) {
   mbstate_t state;
-  mbrlen(mbs, 1, &state); // expected-warning{{3rd function call argument points to an uninitialized value}}
+  mbrlen(mbs, 1, &state); // expected-warning{{3rd function call argument points to an uninitialized value; Function 'mbrlen' expects memory pointed to by this argument to be initialized}}
----------------
steakhal wrote:

I guess in this case because the function is likely not going to be a function pointer, thus I'd not need to worry about this too much, but this is what I had in mind when I mentioned the concern about uniqueing:

```
auto p = &mbrlen;
if (coin)
  p = &someotherfunction_similar_to_mbrlen;
p(arg);
```

The question is here: if we report both variants of `p(arg)` (one with `p==mbrlen`, and one where it's `someotherfunction_similar_to_mbrlen`); are these two separate or the same bug?
If we include the suffix in the message, then they are counted as separate bugs. While if that part is a Note, then they are the same bug.

This is kinda theoretical, given the context, but the question remains to be answered.

https://github.com/llvm/llvm-project/pull/211038


More information about the cfe-commits mailing list