{
"lstrlib.c": [
{
"column": 53,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 88,
"message": "Variable 'l' is used uninitialized",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'l' before use, e.g., at its declaration"
},
{
"column": 38,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 101,
"message": "Variable 'l' is used uninitialized",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'l' before use, e.g., at its declaration"
},
{
"column": 5,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 103,
"message": "Potential null pointer dereference in array access of variable 'p'",
"rule_id": "EXP34-C",
"severity": "High",
"suggestion": "Check if 'p' is not NULL before array access"
},
{
"column": 12,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 103,
"message": "Potential null pointer dereference in array access of variable 's'",
"rule_id": "EXP34-C",
"severity": "High",
"suggestion": "Check if 's' is not NULL before array access"
},
{
"column": 38,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 114,
"message": "Variable 'l' is used uninitialized",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'l' before use, e.g., at its declaration"
},
{
"column": 5,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 116,
"message": "Potential null pointer dereference in array access of variable 'p'",
"rule_id": "EXP34-C",
"severity": "High",
"suggestion": "Check if 'p' is not NULL before array access"
},
{
"column": 30,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 116,
"message": "Argument to 'tolower()' is not cast to unsigned char. This can cause undefined behavior if the argument has a negative value.",
"rule_id": "STR37-C",
"severity": "Medium",
"suggestion": "Cast the argument to unsigned char: 'tolower((unsigned char)...)'"
},
{
"column": 41,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 116,
"message": "Potential null pointer dereference in array access of variable 's'",
"rule_id": "EXP34-C",
"severity": "High",
"suggestion": "Check if 's' is not NULL before array access"
},
{
"column": 38,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 127,
"message": "Variable 'l' is used uninitialized",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'l' before use, e.g., at its declaration"
},
{
"column": 5,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 129,
"message": "Potential null pointer dereference in array access of variable 'p'",
"rule_id": "EXP34-C",
"severity": "High",
"suggestion": "Check if 'p' is not NULL before array access"
},
{
"column": 30,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 129,
"message": "Argument to 'toupper()' is not cast to unsigned char. This can cause undefined behavior if the argument has a negative value.",
"rule_id": "STR37-C",
"severity": "Medium",
"suggestion": "Cast the argument to unsigned char: 'toupper((unsigned char)...)'"
},
{
"column": 41,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 129,
"message": "Potential null pointer dereference in array access of variable 's'",
"rule_id": "EXP34-C",
"severity": "High",
"suggestion": "Check if 's' is not NULL before array access"
},
{
"column": 18,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 144,
"message": "Variable 'len' is used uninitialized",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'len' before use, e.g., at its declaration"
},
{
"column": 18,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 144,
"message": "Variable 'len' used with both bitwise and arithmetic operations (reduces code readability)",
"rule_id": "INT14-C",
"severity": "Medium",
"suggestion": "Use separate variables for bitwise and arithmetic operations, or refactor to use only arithmetic operators"
},
{
"column": 18,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 144,
"message": "Variable 'lsep' used with both bitwise and arithmetic operations (reduces code readability)",
"rule_id": "INT14-C",
"severity": "Medium",
"suggestion": "Use separate variables for bitwise and arithmetic operations, or refactor to use only arithmetic operators"
},
{
"column": 24,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 144,
"message": "Variable 'lsep' is used uninitialized",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'lsep' before use, e.g., at its declaration"
},
{
"column": 7,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 154,
"message": "Function 'memcpy' called with potentially invalid size calculation",
"rule_id": "ARR38-C",
"severity": "High",
"suggestion": "Ensure size argument does not exceed buffer bounds"
},
{
"column": 14,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 154,
"message": "Do not cast away const qualification: 'p'",
"rule_id": "EXP05-C",
"severity": "Medium",
"suggestion": "Ensure const-qualified objects are not modified through cast-away pointers"
},
{
"column": 14,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 154,
"message": "Passing potentially null pointer 'p' to function",
"rule_id": "EXP34-C",
"severity": "High",
"suggestion": "Check if 'p' is not NULL before passing to function"
},
{
"column": 17,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 154,
"message": "Passing potentially null pointer 's' to function",
"rule_id": "EXP34-C",
"severity": "High",
"suggestion": "Check if 's' is not NULL before passing to function"
},
{
"column": 9,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 156,
"message": "Function 'memcpy' called with potentially invalid size calculation",
"rule_id": "ARR38-C",
"severity": "High",
"suggestion": "Ensure size argument does not exceed buffer bounds"
},
{
"column": 16,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 156,
"message": "Do not cast away const qualification: 'p'",
"rule_id": "EXP05-C",
"severity": "Medium",
"suggestion": "Ensure const-qualified objects are not modified through cast-away pointers"
},
{
"column": 19,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 156,
"message": "Passing potentially null pointer 'sep' to function",
"rule_id": "EXP34-C",
"severity": "High",
"suggestion": "Check if 'sep' is not NULL before passing to function"
},
{
"column": 5,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 159,
"message": "Function 'memcpy' called with potentially invalid size calculation",
"rule_id": "ARR38-C",
"severity": "High",
"suggestion": "Ensure size argument does not exceed buffer bounds"
},
{
"column": 12,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 159,
"message": "Do not cast away const qualification: 'p'",
"rule_id": "EXP05-C",
"severity": "Medium",
"suggestion": "Ensure const-qualified objects are not modified through cast-away pointers"
},
{
"column": 3,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 169,
"message": "Variable 'pi' is initialized but never modified, consider const-qualifying it",
"rule_id": "DCL00-C",
"severity": "Medium",
"suggestion": "Add 'const' qualifier: const pi = ..."
},
{
"column": 31,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 170,
"message": "Variable 'l' is used uninitialized",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'l' before use, e.g., at its declaration"
},
{
"column": 13,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 176,
"message": "Unsigned subtraction 'pose - posi' without guard assumes non-negative result",
"rule_id": "INT00-C",
"severity": "Medium",
"suggestion": "Add a guard: if (a >= b) before unsigned subtraction a - b"
},
{
"column": 35,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 179,
"message": "Potential null pointer dereference in array access of variable 's'",
"rule_id": "EXP34-C",
"severity": "High",
"suggestion": "Check if 's' is not NULL before array access"
},
{
"column": 5,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 190,
"message": "Variable 'c' is initialized but never modified, consider const-qualifying it",
"rule_id": "DCL00-C",
"severity": "Medium",
"suggestion": "Add 'const' qualifier: const c = ..."
},
{
"column": 5,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 192,
"message": "Potential null pointer dereference in array access of variable 'p'",
"rule_id": "EXP34-C",
"severity": "High",
"suggestion": "Check if 'p' is not NULL before array access"
},
{
"column": 7,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 192,
"message": "Signed integer subtraction 'i - 1' may overflow without proper checking",
"rule_id": "INT32-C",
"severity": "High",
"suggestion": "Add overflow check: if ((b < 0 && a > INT_MAX + b) || (b > 0 && a < INT_MIN + b)) { /* handle error */ }"
},
{
"column": 45,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 211,
"message": "Pointer parameter should use conformant array syntax",
"rule_id": "API05-C",
"severity": "High",
"suggestion": "Use conformant array parameter syntax (e.g., 'char p[n]') with the size parameter declared before the array"
},
{
"column": 67,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 211,
"message": "Pointer parameter should use conformant array syntax",
"rule_id": "API05-C",
"severity": "High",
"suggestion": "Use conformant array parameter syntax (e.g., 'char p[n]') with the size parameter declared before the array"
},
{
"column": 6,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 217,
"message": "Direct NULL check for pointer validation. Define and use a dedicated pointer validation function instead of ad-hoc NULL checks. This centralizes validation logic and allows platform-specific enhancements.",
"rule_id": "MEM10-C",
"severity": "Medium",
"suggestion": "Create a validation function like 'int valid(void *ptr)' and use 'if (!valid(ptr))' instead of 'if (ptr == NULL)'"
},
{
"column": 23,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 252,
"message": "Array declaration 'stringmetamethods[]' has implicit bounds; specify explicit size",
"rule_id": "ARR02-C",
"severity": "Medium",
"suggestion": "Explicitly specify array bounds even when using an initializer"
},
{
"column": 54,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 267,
"message": "Variable 'len' is used uninitialized",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'len' before use, e.g., at its declaration"
},
{
"column": 5,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 283,
"message": "Multiple function calls with potential side effects in unsequenced arguments",
"rule_id": "EXP30-C",
"severity": "High",
"suggestion": "Evaluate function calls in separate statements to guarantee ordering"
},
{
"column": 5,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 294,
"message": "Function 'trymt' called with overlapping memory regions. If parameters are restrict-qualified, this causes undefined behavior.",
"rule_id": "EXP43-C",
"severity": "High",
"suggestion": "Ensure memory regions do not overlap when using restrict pointers"
},
{
"column": 23,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 332,
"message": "Array declaration 'stringmetamethods[]' has implicit bounds; specify explicit size",
"rule_id": "ARR02-C",
"severity": "Medium",
"suggestion": "Explicitly specify array bounds even when using an initializer"
},
{
"column": 38,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 388,
"message": "Pointer parameter 'ms' is not modified and should be declared const",
"rule_id": "DCL13-C",
"severity": "Low",
"suggestion": "Declare parameter as 'const <type> *ms'"
},
{
"column": 41,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 397,
"message": "Pointer parameter 'ms' is not modified and should be declared const",
"rule_id": "DCL13-C",
"severity": "Low",
"suggestion": "Declare parameter as 'const <type> *ms'"
},
{
"column": 41,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 405,
"message": "Pointer parameter 'ms' is not modified and should be declared const",
"rule_id": "DCL13-C",
"severity": "Low",
"suggestion": "Declare parameter as 'const <type> *ms'"
},
{
"column": 2,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 406,
"message": "Dereferencing pointer in switch statement may create double-fetch vulnerability",
"rule_id": "CON43-C",
"severity": "High",
"suggestion": "Store dereferenced value in a local variable or use atomic operations"
},
{
"column": 13,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 417,
"message": "Variable(s) 'p' modified and accessed without sequence point",
"rule_id": "EXP30-C",
"severity": "High",
"suggestion": "Separate the modification into a separate statement"
},
{
"column": 19,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 431,
"message": "Argument to 'tolower()' is not cast to unsigned char. This can cause undefined behavior if the argument has a negative value.",
"rule_id": "STR37-C",
"severity": "Medium",
"suggestion": "Cast the argument to unsigned char: 'tolower((unsigned char)...)'"
},
{
"column": 30,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 432,
"message": "Argument to 'isalpha()' is not cast to unsigned char. This can cause undefined behavior if the argument has a negative value.",
"rule_id": "STR37-C",
"severity": "Medium",
"suggestion": "Cast the argument to unsigned char: 'isalpha((unsigned char)...)'"
},
{
"column": 30,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 433,
"message": "Argument to 'iscntrl()' is not cast to unsigned char. This can cause undefined behavior if the argument has a negative value.",
"rule_id": "STR37-C",
"severity": "Medium",
"suggestion": "Cast the argument to unsigned char: 'iscntrl((unsigned char)...)'"
},
{
"column": 30,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 434,
"message": "Argument to 'isdigit()' is not cast to unsigned char. This can cause undefined behavior if the argument has a negative value.",
"rule_id": "STR37-C",
"severity": "Medium",
"suggestion": "Cast the argument to unsigned char: 'isdigit((unsigned char)...)'"
},
{
"column": 30,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 435,
"message": "Argument to 'isgraph()' is not cast to unsigned char. This can cause undefined behavior if the argument has a negative value.",
"rule_id": "STR37-C",
"severity": "Medium",
"suggestion": "Cast the argument to unsigned char: 'isgraph((unsigned char)...)'"
},
{
"column": 30,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 436,
"message": "Argument to 'islower()' is not cast to unsigned char. This can cause undefined behavior if the argument has a negative value.",
"rule_id": "STR37-C",
"severity": "Medium",
"suggestion": "Cast the argument to unsigned char: 'islower((unsigned char)...)'"
},
{
"column": 30,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 437,
"message": "Argument to 'ispunct()' is not cast to unsigned char. This can cause undefined behavior if the argument has a negative value.",
"rule_id": "STR37-C",
"severity": "Medium",
"suggestion": "Cast the argument to unsigned char: 'ispunct((unsigned char)...)'"
},
{
"column": 30,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 438,
"message": "Argument to 'isspace()' is not cast to unsigned char. This can cause undefined behavior if the argument has a negative value.",
"rule_id": "STR37-C",
"severity": "Medium",
"suggestion": "Cast the argument to unsigned char: 'isspace((unsigned char)...)'"
},
{
"column": 30,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 439,
"message": "Argument to 'isupper()' is not cast to unsigned char. This can cause undefined behavior if the argument has a negative value.",
"rule_id": "STR37-C",
"severity": "Medium",
"suggestion": "Cast the argument to unsigned char: 'isupper((unsigned char)...)'"
},
{
"column": 30,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 440,
"message": "Argument to 'isalnum()' is not cast to unsigned char. This can cause undefined behavior if the argument has a negative value.",
"rule_id": "STR37-C",
"severity": "Medium",
"suggestion": "Cast the argument to unsigned char: 'isalnum((unsigned char)...)'"
},
{
"column": 31,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 441,
"message": "Argument to 'isxdigit()' is not cast to unsigned char. This can cause undefined behavior if the argument has a negative value.",
"rule_id": "STR37-C",
"severity": "Medium",
"suggestion": "Cast the argument to unsigned char: 'isxdigit((unsigned char)...)'"
},
{
"column": 19,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 445,
"message": "Argument to 'islower()' is not cast to unsigned char. This can cause undefined behavior if the argument has a negative value.",
"rule_id": "STR37-C",
"severity": "Medium",
"suggestion": "Cast the argument to unsigned char: 'islower((unsigned char)...)'"
},
{
"column": 36,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 472,
"message": "Pointer parameter 'ms' is not modified and should be declared const",
"rule_id": "DCL13-C",
"severity": "Low",
"suggestion": "Declare parameter as 'const <type> *ms'"
},
{
"column": 5,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 477,
"message": "Variable 'c' is initialized but never modified, consider const-qualifying it",
"rule_id": "DCL00-C",
"severity": "Medium",
"suggestion": "Add 'const' qualifier: const c = ..."
},
{
"column": 24,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 477,
"message": "Pointer dereference '*s' (char type) converted without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 24,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 477,
"message": "Pointer dereference '*s' (char type) converted without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 25,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 477,
"message": "'s' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 25,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 477,
"message": "'s' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 4,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 478,
"message": "Dereferencing pointer in switch statement may create double-fetch vulnerability",
"rule_id": "CON43-C",
"severity": "High",
"suggestion": "Store dereferenced value in a local variable or use atomic operations"
},
{
"column": 45,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 488,
"message": "Pointer parameter 'ms' is not modified and should be declared const",
"rule_id": "DCL13-C",
"severity": "Low",
"suggestion": "Declare parameter as 'const <type> *ms'"
},
{
"column": 13,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 494,
"message": "Pointer dereference '*p' (char type) converted without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 13,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 494,
"message": "Pointer dereference '*p' (char type) assigned without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before assignment to larger type"
},
{
"column": 13,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 494,
"message": "Pointer dereference '*p' (char type) converted without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 13,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 494,
"message": "Pointer dereference '*p' (char type) assigned without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before assignment to larger type"
},
{
"column": 14,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 494,
"message": "'p' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 14,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 494,
"message": "'p' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 5,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 495,
"message": "Variable 'e' is initialized but never modified, consider const-qualifying it",
"rule_id": "DCL00-C",
"severity": "Medium",
"suggestion": "Add 'const' qualifier: const e = ..."
},
{
"column": 15,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 495,
"message": "'p' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 15,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 495,
"message": "'p' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 508,
"message": "Function 'max_expand' participates in indirect recursion: max_expand -> match -> max_expand",
"rule_id": "MSC04-C",
"severity": "Medium",
"suggestion": "Refactor to eliminate the recursion cycle"
},
{
"column": 23,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 515,
"message": "Static variable 'match' used without explicit initialization",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'match' before use, e.g., at its declaration"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 523,
"message": "Function 'min_expand' participates in indirect recursion: min_expand -> match -> min_expand",
"rule_id": "MSC04-C",
"severity": "Medium",
"suggestion": "Refactor to eliminate the recursion cycle"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 523,
"message": "Non-void function may reach end without returning a value. Ensure all execution paths have explicit return statements.",
"rule_id": "MSC37-C",
"severity": "Medium",
"suggestion": "Add return statements to ensure all execution paths return a value"
},
{
"column": 23,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 526,
"message": "Static variable 'match' used without explicit initialization",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'match' before use, e.g., at its declaration"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 536,
"message": "Function 'start_capture' participates in indirect recursion: start_capture -> match -> start_capture",
"rule_id": "MSC04-C",
"severity": "Medium",
"suggestion": "Refactor to eliminate the recursion cycle"
},
{
"column": 12,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 544,
"message": "Static variable 'match' used without explicit initialization",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'match' before use, e.g., at its declaration"
},
{
"column": 3,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 546,
"message": "Function returns pointer to local variable 'res' with automatic storage duration",
"rule_id": "DCL30-C",
"severity": "High",
"suggestion": "Use static storage, allocated memory, or pass output buffer as parameter"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 550,
"message": "Function 'end_capture' participates in indirect recursion: end_capture -> match -> end_capture",
"rule_id": "MSC04-C",
"severity": "Medium",
"suggestion": "Refactor to eliminate the recursion cycle"
},
{
"column": 14,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 555,
"message": "Static variable 'match' used without explicit initialization",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'match' before use, e.g., at its declaration"
},
{
"column": 3,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 557,
"message": "Function returns pointer to local variable 'res' with automatic storage duration",
"rule_id": "DCL30-C",
"severity": "High",
"suggestion": "Use static storage, allocated memory, or pass output buffer as parameter"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 572,
"message": "Function 'match' calls itself directly (direct recursion)",
"rule_id": "MSC04-C",
"severity": "Medium",
"suggestion": "Refactor to use iteration instead of recursion"
},
{
"column": 4,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 577,
"message": "Dereferencing pointer in switch statement may create double-fetch vulnerability",
"rule_id": "CON43-C",
"severity": "High",
"suggestion": "Store dereferenced value in a local variable or use atomic operations"
},
{
"column": 8,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 596,
"message": "Dereferencing pointer in switch statement may create double-fetch vulnerability",
"rule_id": "CON43-C",
"severity": "High",
"suggestion": "Store dereferenced value in a local variable or use atomic operations"
},
{
"column": 10,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 642,
"message": "Dereferencing pointer in switch statement may create double-fetch vulnerability",
"rule_id": "CON43-C",
"severity": "High",
"suggestion": "Store dereferenced value in a local variable or use atomic operations"
},
{
"column": 26,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 645,
"message": "Static variable 'match' used without explicit initialization",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'match' before use, e.g., at its declaration"
},
{
"column": 41,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 675,
"message": "Pointer parameter should use conformant array syntax",
"rule_id": "API05-C",
"severity": "High",
"suggestion": "Use conformant array parameter syntax (e.g., 'char p[n]') with the size parameter declared before the array"
},
{
"column": 43,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 676,
"message": "Pointer parameter should use conformant array syntax",
"rule_id": "API05-C",
"severity": "High",
"suggestion": "Use conformant array parameter syntax (e.g., 'char p[n]') with the size parameter declared before the array"
},
{
"column": 18,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 685,
"message": "Passing potentially null pointer 'init' to function",
"rule_id": "EXP34-C",
"severity": "High",
"suggestion": "Check if 'init' is not NULL before passing to function"
},
{
"column": 45,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 704,
"message": "Pointer parameter 'ms' is not modified and should be declared const",
"rule_id": "DCL13-C",
"severity": "Low",
"suggestion": "Declare parameter as 'const <type> *ms'"
},
{
"column": 5,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 709,
"message": "Pointer dereference '*cap' (char type) assigned without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before assignment to larger type"
},
{
"column": 13,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 710,
"message": "Pointer subtraction between pointers from different arrays: 'param:e' and 'param:s'",
"rule_id": "ARR36-C",
"severity": "High",
"suggestion": "Ensure both pointers refer to the same array before subtraction"
},
{
"column": 5,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 714,
"message": "Pointer dereference '*cap' (char type) assigned without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before assignment to larger type"
},
{
"column": 39,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 731,
"message": "'s' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 39,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 731,
"message": "'s' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 42,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 731,
"message": "'e' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 45,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 731,
"message": "Pointer dereference '*cap' (char type) converted without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 46,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 731,
"message": "'cap' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 28,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 733,
"message": "Variable 'cap' is used uninitialized",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'cap' before use, e.g., at its declaration"
},
{
"column": 36,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 740,
"message": "'s' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 36,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 740,
"message": "'s' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 35,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 749,
"message": "Pointer parameter should use conformant array syntax",
"rule_id": "API05-C",
"severity": "High",
"suggestion": "Use conformant array parameter syntax (e.g., 'char p[n]') with the size parameter declared before the array"
},
{
"column": 50,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 763,
"message": "Pointer parameter 'L' is not modified and should be declared const",
"rule_id": "DCL13-C",
"severity": "Low",
"suggestion": "Declare parameter as 'const <type> *L'"
},
{
"column": 35,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 764,
"message": "Pointer parameter should use conformant array syntax",
"rule_id": "API05-C",
"severity": "High",
"suggestion": "Use conformant array parameter syntax (e.g., 'char p[n]') with the size parameter declared before the array"
},
{
"column": 61,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 764,
"message": "Pointer parameter should use conformant array syntax",
"rule_id": "API05-C",
"severity": "High",
"suggestion": "Use conformant array parameter syntax (e.g., 'char p[n]') with the size parameter declared before the array"
},
{
"column": 53,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 786,
"message": "Variable 'ls' is used uninitialized",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'ls' before use, e.g., at its declaration"
},
{
"column": 53,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 792,
"message": "Variable 'lp' is used uninitialized",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'lp' before use, e.g., at its declaration"
},
{
"column": 19,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 804,
"message": "Potential null pointer dereference of variable 'p'",
"rule_id": "EXP34-C",
"severity": "High",
"suggestion": "Check if 'p' is not NULL before dereferencing"
},
{
"column": 19,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 804,
"message": "Pointer dereference '*p' (char type) converted without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 19,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 804,
"message": "Pointer dereference '*p' (char type) converted without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 20,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 804,
"message": "'p' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 20,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 804,
"message": "'p' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 16,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 812,
"message": "Static variable 'match' used without explicit initialization",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'match' before use, e.g., at its declaration"
},
{
"column": 3,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 850,
"message": "Potential null pointer dereference in member access of variable 'gm'",
"rule_id": "EXP34-C",
"severity": "High",
"suggestion": "Check if 'gm' is not NULL before member access"
},
{
"column": 9,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 854,
"message": "Variable(s) 'e' modified and accessed without sequence point",
"rule_id": "EXP30-C",
"severity": "High",
"suggestion": "Separate the modification into a separate statement"
},
{
"column": 14,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 854,
"message": "Static variable 'match' used without explicit initialization",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'match' before use, e.g., at its declaration"
},
{
"column": 53,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 854,
"message": "Variable 'e' is used uninitialized",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'e' before use, e.g., at its declaration"
},
{
"column": 53,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 867,
"message": "Variable 'ls' is used uninitialized",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'ls' before use, e.g., at its declaration"
},
{
"column": 14,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 873,
"message": "Potential null pointer dereference in member access of variable 'gm'",
"rule_id": "EXP34-C",
"severity": "High",
"suggestion": "Check if 'gm' is not NULL before member access"
},
{
"column": 35,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 873,
"message": "Variable 'lp' is used uninitialized",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'lp' before use, e.g., at its declaration"
},
{
"column": 3,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 886,
"message": "Unbounded while loop with pointer increment. Loop increments 'p' without size/length bounds checking.",
"rule_id": "ARR30-C",
"severity": "High",
"suggestion": "Add bounds checking to while condition (e.g., counter < max_size)"
},
{
"column": 43,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 886,
"message": "Variable 'l' may be used uninitialized (not assigned on all paths)",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'l' before use, e.g., at its declaration"
},
{
"column": 9,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 889,
"message": "Potential null pointer dereference of variable 'p'",
"rule_id": "EXP34-C",
"severity": "High",
"suggestion": "Check if 'p' is not NULL before dereferencing"
},
{
"column": 42,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 892,
"message": "Pointer subtraction between pointers from different arrays: 'param:e' and 'param:s'",
"rule_id": "ARR36-C",
"severity": "High",
"suggestion": "Ensure both pointers refer to the same array before subtraction"
},
{
"column": 22,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 893,
"message": "Argument to 'isdigit()' is not cast to unsigned char. This can cause undefined behavior if the argument has a negative value.",
"rule_id": "STR37-C",
"severity": "Medium",
"suggestion": "Cast the argument to unsigned char: 'isdigit((unsigned char)...)'"
},
{
"column": 19,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 894,
"message": "Variable 'cap' is used uninitialized",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'cap' before use, e.g., at its declaration"
},
{
"column": 43,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 895,
"message": "Pointer dereference '*p' (char type) converted without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 43,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 895,
"message": "Pointer dereference '*p' (char type) converted without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 44,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 895,
"message": "'p' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 44,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 895,
"message": "'p' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 53,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 895,
"message": "'s' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 53,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 895,
"message": "'s' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 56,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 895,
"message": "'e' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 59,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 895,
"message": "Pointer dereference '*cap' (char type) converted without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 60,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 895,
"message": "'cap' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 38,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 938,
"message": "Pointer subtraction between pointers from different arrays: 'param:e' and 'param:s'",
"rule_id": "ARR36-C",
"severity": "High",
"suggestion": "Ensure both pointers refer to the same array before subtraction"
},
{
"column": 55,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 958,
"message": "Variable 'srcl' is used uninitialized",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'srcl' before use, e.g., at its declaration"
},
{
"column": 17,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 959,
"message": "Potential null pointer dereference of variable 'p'",
"rule_id": "EXP34-C",
"severity": "High",
"suggestion": "Check if 'p' is not NULL before dereferencing"
},
{
"column": 17,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 959,
"message": "Pointer dereference '*p' (char type) converted without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 17,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 959,
"message": "Pointer dereference '*p' (char type) converted without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 18,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 959,
"message": "'p' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 18,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 959,
"message": "'p' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 35,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 971,
"message": "Variable 'lp' is used uninitialized",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'lp' before use, e.g., at its declaration"
},
{
"column": 9,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 975,
"message": "Variable(s) 'e' modified and accessed without sequence point",
"rule_id": "EXP30-C",
"severity": "High",
"suggestion": "Separate the modification into a separate statement"
},
{
"column": 14,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 975,
"message": "Static variable 'match' used without explicit initialization",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'match' before use, e.g., at its declaration"
},
{
"column": 45,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 975,
"message": "Variable 'e' is used uninitialized",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'e' before use, e.g., at its declaration"
},
{
"column": 3,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1029,
"message": "Potentially unsafe array access with unvalidated function parameter index 'n'",
"rule_id": "ARR30-C",
"severity": "High",
"suggestion": "Add bounds checking for function parameter before using as array index."
},
{
"column": 29,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1051,
"message": "Variable 'L_NBFD' used with both bitwise and arithmetic operations (reduces code readability)",
"rule_id": "INT14-C",
"severity": "Medium",
"suggestion": "Use separate variables for bitwise and arithmetic operations, or refactor to use only arithmetic operators"
},
{
"column": 34,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1051,
"message": "Shift operation '1 << L_NBFD' by 'L_NBFD' without validating shift amount is non-negative and within type width",
"rule_id": "INT34-C",
"severity": "Medium",
"suggestion": "Check that 'L_NBFD' is >= 0 and < the bit width of the operand before shifting"
},
{
"column": 5,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1052,
"message": "Variable 'e' is used uninitialized",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'e' before use, e.g., at its declaration"
},
{
"column": 5,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1059,
"message": "Using sprintf return value without error checking; use sprintf_m or check for negative return",
"rule_id": "ERR02-C",
"severity": "Medium",
"suggestion": "Check return value for errors before using it"
},
{
"column": 40,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1059,
"message": "Unsigned subtraction 'sz - n' without guard assumes non-negative result",
"rule_id": "INT00-C",
"severity": "Medium",
"suggestion": "Add a guard: if (a >= b) before unsigned subtraction a - b"
},
{
"column": 22,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1068,
"message": "'buff' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 35,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1072,
"message": "Argument to 'toupper()' is not cast to unsigned char. This can cause undefined behavior if the argument has a negative value.",
"rule_id": "STR37-C",
"severity": "Medium",
"suggestion": "Cast the argument to unsigned char: 'toupper((unsigned char)...)'"
},
{
"column": 51,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1132,
"message": "Pointer parameter should use conformant array syntax",
"rule_id": "API05-C",
"severity": "High",
"suggestion": "Use conformant array parameter syntax (e.g., 'char p[n]') with the size parameter declared before the array"
},
{
"column": 22,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1139,
"message": "Argument to 'iscntrl()' is not cast to unsigned char. This can cause undefined behavior if the argument has a negative value.",
"rule_id": "STR37-C",
"severity": "Medium",
"suggestion": "Cast the argument to unsigned char: 'iscntrl((unsigned char)...)'"
},
{
"column": 20,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1141,
"message": "Argument to 'isdigit()' is not cast to unsigned char. This can cause undefined behavior if the argument has a negative value.",
"rule_id": "STR37-C",
"severity": "Medium",
"suggestion": "Cast the argument to unsigned char: 'isdigit((unsigned char)...)'"
},
{
"column": 34,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1170,
"message": "'buff' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 19,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1176,
"message": "Pointer dereference '*ppoint' (char type) assigned without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before assignment to larger type"
},
{
"column": 15,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1221,
"message": "Argument to 'isdigit()' is not cast to unsigned char. This can cause undefined behavior if the argument has a negative value.",
"rule_id": "STR37-C",
"severity": "Medium",
"suggestion": "Cast the argument to unsigned char: 'isdigit((unsigned char)...)'"
},
{
"column": 17,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1223,
"message": "Argument to 'isdigit()' is not cast to unsigned char. This can cause undefined behavior if the argument has a negative value.",
"rule_id": "STR37-C",
"severity": "Medium",
"suggestion": "Cast the argument to unsigned char: 'isdigit((unsigned char)...)'"
},
{
"column": 9,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1241,
"message": "Potential null pointer dereference of variable 'spec'",
"rule_id": "EXP34-C",
"severity": "High",
"suggestion": "Check if 'spec' is not NULL before dereferencing"
},
{
"column": 7,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1242,
"message": "Variable 'spec' of type char used in numeric operation. Use explicit 'signed char' or 'unsigned char' for numeric values.",
"rule_id": "INT07-C",
"severity": "Medium",
"suggestion": "Change declaration of 'spec' from 'char' to 'signed char' or 'unsigned char'"
},
{
"column": 16,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1246,
"message": "Argument to 'isalpha()' is not cast to unsigned char. This can cause undefined behavior if the argument has a negative value.",
"rule_id": "STR37-C",
"severity": "Medium",
"suggestion": "Cast the argument to unsigned char: 'isalpha((unsigned char)...)'"
},
{
"column": 23,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1258,
"message": "'strfrmt' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 3,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1263,
"message": "Pointer dereference '*(form++)' (char type) assigned without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before assignment to larger type"
},
{
"column": 3,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1264,
"message": "Function 'memcpy' called with potentially invalid size calculation",
"rule_id": "ARR38-C",
"severity": "High",
"suggestion": "Ensure size argument does not exceed buffer bounds"
},
{
"column": 3,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1264,
"message": "memcpy used for string copying may not include null terminator",
"rule_id": "STR31-C",
"severity": "Medium",
"suggestion": "Use strcpy/strncpy or memcpy with size+1 for null terminator"
},
{
"column": 21,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1274,
"message": "'form' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 22,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1275,
"message": "'lenmod' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 3,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1277,
"message": "Potential buffer overflow with strcpy(). Cannot verify destination buffer is large enough.",
"rule_id": "STR31-C",
"severity": "Medium",
"suggestion": "Use strncpy() with explicit size limit or verify buffer size"
},
{
"column": 10,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1277,
"message": "Do not cast away const qualification: 'form + l - 1'",
"rule_id": "EXP05-C",
"severity": "Medium",
"suggestion": "Ensure const-qualified objects are not modified through cast-away pointers"
},
{
"column": 37,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1288,
"message": "Variable 'sfl' is used uninitialized",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'sfl' before use, e.g., at its declaration"
},
{
"column": 9,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1293,
"message": "Potential null pointer dereference of variable 'strfrmt'",
"rule_id": "EXP34-C",
"severity": "High",
"suggestion": "Check if 'strfrmt' is not NULL before dereferencing"
},
{
"column": 7,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1298,
"message": "Fixed-size buffer may be used with environment variable",
"rule_id": "ENV01-C",
"severity": "High",
"suggestion": "Use dynamic allocation based on strlen() of getenv() result"
},
{
"column": 6,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1305,
"message": "Dereferencing pointer in switch statement may create double-fetch vulnerability",
"rule_id": "CON43-C",
"severity": "High",
"suggestion": "Store dereferenced value in a local variable or use atomic operations"
},
{
"column": 42,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1365,
"message": "Passing potentially null pointer 's' to function",
"rule_id": "EXP34-C",
"severity": "High",
"suggestion": "Check if 's' is not NULL before passing to function"
},
{
"column": 34,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1459,
"message": "Pointer parameter should use conformant array syntax",
"rule_id": "API05-C",
"severity": "High",
"suggestion": "Use conformant array parameter syntax (e.g., 'char p[n]') with the size parameter declared before the array"
},
{
"column": 37,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1476,
"message": "Pointer parameter 'h' is not modified and should be declared const",
"rule_id": "DCL13-C",
"severity": "Low",
"suggestion": "Declare parameter as 'const <type> *h'"
},
{
"column": 52,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1476,
"message": "Pointer parameter should use conformant array syntax",
"rule_id": "API05-C",
"severity": "High",
"suggestion": "Use conformant array parameter syntax (e.g., 'char p[n]') with the size parameter declared before the array"
},
{
"column": 22,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1477,
"message": "'fmt' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 35,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1488,
"message": "Pointer parameter 'L' is not modified and should be declared const",
"rule_id": "DCL13-C",
"severity": "Low",
"suggestion": "Declare parameter as 'const <type> *L'"
},
{
"column": 49,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1498,
"message": "Pointer parameter should use conformant array syntax",
"rule_id": "API05-C",
"severity": "High",
"suggestion": "Use conformant array parameter syntax (e.g., 'char p[n]') with the size parameter declared before the array"
},
{
"column": 13,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1501,
"message": "Pointer dereference '*fmt' (char type) converted without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 13,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1501,
"message": "Pointer dereference '*((*fmt)++)' (char type) assigned without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before assignment to larger type"
},
{
"column": 16,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1501,
"message": "Pointer dereference '*fmt' (char type) converted without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 17,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1501,
"message": "'fmt' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 68,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1551,
"message": "Pointer parameter should use conformant array syntax",
"rule_id": "API05-C",
"severity": "High",
"suggestion": "Use conformant array parameter syntax (e.g., 'char p[n]') with the size parameter declared before the array"
},
{
"column": 52,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1552,
"message": "Pointer parameter should use conformant array syntax",
"rule_id": "API05-C",
"severity": "High",
"suggestion": "Use conformant array parameter syntax (e.g., 'char p[n]') with the size parameter declared before the array"
},
{
"column": 35,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1570,
"message": "Variable 'align' used with both bitwise and arithmetic operations (reduces code readability)",
"rule_id": "INT14-C",
"severity": "Medium",
"suggestion": "Use separate variables for bitwise and arithmetic operations, or refactor to use only arithmetic operators"
},
{
"column": 29,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1571,
"message": "Variable 'szmoda' used with both bitwise and arithmetic operations (reduces code readability)",
"rule_id": "INT14-C",
"severity": "Medium",
"suggestion": "Use separate variables for bitwise and arithmetic operations, or refactor to use only arithmetic operators"
},
{
"column": 30,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1571,
"message": "Unsigned subtraction 'align - szmoda' without guard assumes non-negative result",
"rule_id": "INT00-C",
"severity": "Medium",
"suggestion": "Add a guard: if (a >= b) before unsigned subtraction a - b"
},
{
"column": 3,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1588,
"message": "Potential null pointer dereference in array access of variable 'buff'",
"rule_id": "EXP34-C",
"severity": "High",
"suggestion": "Check if 'buff' is not NULL before array access"
},
{
"column": 42,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1588,
"message": "Bitwise operator '&' used on signed operand 'n' of type 'int'. Use unsigned types for bitwise operations",
"rule_id": "INT13-C",
"severity": "Medium",
"suggestion": "Change 'n' to an unsigned type (e.g., 'unsigned int' instead of 'int')"
},
{
"column": 48,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1591,
"message": "Bitwise operator '&' used on signed operand 'n' of type 'int'. Use unsigned types for bitwise operations",
"rule_id": "INT13-C",
"severity": "Medium",
"suggestion": "Change 'n' to an unsigned type (e.g., 'unsigned int' instead of 'int')"
},
{
"column": 7,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1612,
"message": "Direct assignment of flexible array structure instances. Use memcpy() for dynamic copying.",
"rule_id": "MEM33-C",
"severity": "High",
"suggestion": "Use memcpy() to copy the structure and its flexible array member"
},
{
"column": 7,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1612,
"message": "Pointer dereference '*(dest--)' (char type) assigned without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before assignment to larger type"
},
{
"column": 19,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1612,
"message": "Pointer dereference '*src' (char type) assigned to larger type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before assignment: (unsigned char)*ptr"
},
{
"column": 19,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1612,
"message": "Pointer dereference '*(src++)' (char type) assigned without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before assignment to larger type"
},
{
"column": 22,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1630,
"message": "Variable 'size' is used uninitialized",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'size' before use, e.g., at its declaration"
},
{
"column": 22,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1630,
"message": "Variable 'size' used with both bitwise and arithmetic operations (reduces code readability)",
"rule_id": "INT14-C",
"severity": "Medium",
"suggestion": "Use separate variables for bitwise and arithmetic operations, or refactor to use only arithmetic operators"
},
{
"column": 29,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1630,
"message": "Variable 'ntoalign' is used uninitialized",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'ntoalign' before use, e.g., at its declaration"
},
{
"column": 9,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1638,
"message": "Identifier 'n' at line 1638 is visually similar to 'h' at line 1619 (normalized: 'n')",
"rule_id": "DCL02-C",
"severity": "Low",
"suggestion": "Use a more distinct identifier name that doesn't rely on visually similar characters"
},
{
"column": 29,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1640,
"message": "Shift operation '(lua_Integer)1 << ((size * NB) - 1)' by '((size * NB) - 1)' without validating shift amount is non-negative and within type width",
"rule_id": "INT34-C",
"severity": "Medium",
"suggestion": "Check that '((size * NB) - 1)' is >= 0 and < the bit width of the operand before shifting"
},
{
"column": 9,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1647,
"message": "Identifier 'n' at line 1647 is visually similar to 'h' at line 1619 (normalized: 'n')",
"rule_id": "DCL02-C",
"severity": "Low",
"suggestion": "Use a more distinct identifier name that doesn't rely on visually similar characters"
},
{
"column": 47,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1649,
"message": "Shift operation '(lua_Unsigned)1 << (size * NB)' by '(size * NB)' without validating shift amount is non-negative and within type width",
"rule_id": "INT34-C",
"severity": "Medium",
"suggestion": "Check that '(size * NB)' is >= 0 and < the bit width of the operand before shifting"
},
{
"column": 19,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1655,
"message": "Floating-point conversion to 'float' without range checking",
"rule_id": "FLP34-C",
"severity": "Medium",
"suggestion": "Check for isnan(), compare with FLT_MAX/FLT_MIN or DBL_MAX/DBL_MIN before conversion"
},
{
"column": 20,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1671,
"message": "Floating-point conversion to 'double' without range checking",
"rule_id": "FLP34-C",
"severity": "Medium",
"suggestion": "Check for isnan(), compare with FLT_MAX/FLT_MIN or DBL_MAX/DBL_MIN before conversion"
},
{
"column": 18,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1686,
"message": "Passing potentially null pointer 'buff' to function",
"rule_id": "EXP34-C",
"severity": "High",
"suggestion": "Check if 'buff' is not NULL before passing to function"
},
{
"column": 33,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1695,
"message": "Shift operation '(lua_Unsigned)1 << (size * NB)' by '(size * NB)' without validating shift amount is non-negative and within type width",
"rule_id": "INT34-C",
"severity": "Medium",
"suggestion": "Check that '(size * NB)' is >= 0 and < the bit width of the operand before shifting"
},
{
"column": 33,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1706,
"message": "Passing potentially null pointer 's' to function",
"rule_id": "EXP34-C",
"severity": "High",
"suggestion": "Check if 's' is not NULL before passing to function"
},
{
"column": 5,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1734,
"message": "Variable 'size' is used uninitialized",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'size' before use, e.g., at its declaration"
},
{
"column": 13,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1734,
"message": "Variable 'ntoalign' is used uninitialized",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'ntoalign' before use, e.g., at its declaration"
},
{
"column": 5,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1758,
"message": "Variable 'res' used with both bitwise and arithmetic operations (reduces code readability)",
"rule_id": "INT14-C",
"severity": "Medium",
"suggestion": "Use separate variables for bitwise and arithmetic operations, or refactor to use only arithmetic operators"
},
{
"column": 60,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1759,
"message": "Variable 'size' used with both bitwise and arithmetic operations (reduces code readability)",
"rule_id": "INT14-C",
"severity": "Medium",
"suggestion": "Use separate variables for bitwise and arithmetic operations, or refactor to use only arithmetic operators"
},
{
"column": 27,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1763,
"message": "Shift operation '(lua_Unsigned)1 << (size*NB - 1)' by '(size*NB - 1)' without validating shift amount is non-negative and within type width",
"rule_id": "INT34-C",
"severity": "Medium",
"suggestion": "Check that '(size*NB - 1)' is >= 0 and < the bit width of the operand before shifting"
},
{
"column": 14,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1764,
"message": "Variable 'mask' used with both bitwise and arithmetic operations (reduces code readability)",
"rule_id": "INT14-C",
"severity": "Medium",
"suggestion": "Use separate variables for bitwise and arithmetic operations, or refactor to use only arithmetic operators"
},
{
"column": 21,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1764,
"message": "Bitwise operator '^' used on signed operand 'mask' of type 'int'. Use unsigned types for bitwise operations",
"rule_id": "INT13-C",
"severity": "Medium",
"suggestion": "Change 'mask' to an unsigned type (e.g., 'unsigned int' instead of 'int')"
},
{
"column": 52,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1783,
"message": "Variable 'ld' is used uninitialized",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'ld' before use, e.g., at its declaration"
},
{
"column": 3,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1784,
"message": "Identifier 'n' at line 1784 is visually similar to 'h' at line 1779 (normalized: 'n')",
"rule_id": "DCL02-C",
"severity": "Low",
"suggestion": "Use a more distinct identifier name that doesn't rely on visually similar characters"
},
{
"column": 22,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1791,
"message": "Variable 'ntoalign' is used uninitialized",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'ntoalign' before use, e.g., at its declaration"
},
{
"column": 33,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1791,
"message": "Variable 'size' is used uninitialized",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'size' before use, e.g., at its declaration"
},
{
"column": 29,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1836,
"message": "'data' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 23,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1856,
"message": "Array declaration 'strlib[]' has implicit bounds; specify explicit size",
"rule_id": "ARR02-C",
"severity": "Medium",
"suggestion": "Explicitly specify array bounds even when using an initializer"
},
{
"column": 3,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1887,
"message": "Passing string literal to function 'lua_setfield' which may modify it",
"rule_id": "STR30-C",
"severity": "High",
"suggestion": "Use a modifiable array instead of a string literal"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1895,
"message": "Function 'luaopen_string' does not validate pointer parameter 'L' before use",
"rule_id": "API00-C",
"severity": "Medium",
"suggestion": "Add validation check for 'L' at the start of the function, e.g., 'if (!L) { return error_code; }'"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lstrlib.c",
"line": 1895,
"message": "Function 'luaopen_string' should be declared static if it doesn't need external linkage",
"rule_id": "DCL15-C",
"severity": "Low",
"suggestion": "Add 'static' storage-class specifier: static LUAMOD_API luaopen_string"
}
]
}