{
"lbaselib.c": [
{
"column": 24,
"file": "/home/brandon/toolchain/lua/lbaselib.c",
"line": 33,
"message": "Variable 'l' is used uninitialized",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'l' before use, e.g., at its declaration"
},
{
"column": 16,
"file": "/home/brandon/toolchain/lua/lbaselib.c",
"line": 67,
"message": "Argument to 'isalnum()' is not cast to unsigned char. This can cause undefined behavior if the argument has a negative value.",
"rule_id": "STR37-C",
"severity": "Medium",
"suggestion": "Cast the argument to unsigned char: 'isalnum((unsigned char)...)'"
},
{
"column": 40,
"file": "/home/brandon/toolchain/lua/lbaselib.c",
"line": 70,
"message": "Argument to 'isdigit()' is not cast to unsigned char. This can cause undefined behavior if the argument has a negative value.",
"rule_id": "STR37-C",
"severity": "Medium",
"suggestion": "Cast the argument to unsigned char: 'isdigit((unsigned char)...)'"
},
{
"column": 43,
"file": "/home/brandon/toolchain/lua/lbaselib.c",
"line": 72,
"message": "Argument to 'toupper()' is not cast to unsigned char. This can cause undefined behavior if the argument has a negative value.",
"rule_id": "STR37-C",
"severity": "Medium",
"suggestion": "Cast the argument to unsigned char: 'toupper((unsigned char)...)'"
},
{
"column": 20,
"file": "/home/brandon/toolchain/lua/lbaselib.c",
"line": 76,
"message": "Argument to 'isalnum()' is not cast to unsigned char. This can cause undefined behavior if the argument has a negative value.",
"rule_id": "STR37-C",
"severity": "Medium",
"suggestion": "Cast the argument to unsigned char: 'isalnum((unsigned char)...)'"
},
{
"column": 52,
"file": "/home/brandon/toolchain/lua/lbaselib.c",
"line": 92,
"message": "Variable 'l' is used uninitialized",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'l' before use, e.g., at its declaration"
},
{
"column": 32,
"file": "/home/brandon/toolchain/lua/lbaselib.c",
"line": 163,
"message": "Function 'lua_rawlen' is called without prior declaration",
"rule_id": "DCL31-C",
"severity": "Low",
"suggestion": "Declare the function before calling it or include the appropriate header"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lbaselib.c",
"line": 199,
"message": "Macro parameter 'res' is not parenthesized in replacement text. This can cause operator precedence issues.",
"rule_id": "PRE01-C",
"severity": "Medium",
"suggestion": "Wrap parameter 'res' in parentheses: (res) instead of res"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lbaselib.c",
"line": 199,
"message": "Macro replacement list should be parenthesized to prevent operator precedence issues.",
"rule_id": "PRE02-C",
"severity": "Medium",
"suggestion": "Wrap the entire replacement list in parentheses: ({ if (res == -1) break; })"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lbaselib.c",
"line": 199,
"message": "Multistatement macro 'checkvalres' is not wrapped in a do-while loop. This can cause issues when used in if statements without braces",
"rule_id": "PRE10-C",
"severity": "Medium",
"suggestion": "Wrap the macro body in: do { /* statements */ } while (0)"
},
{
"column": 28,
"file": "/home/brandon/toolchain/lua/lbaselib.c",
"line": 202,
"message": "Array declaration 'opts[]' has implicit bounds; specify explicit size",
"rule_id": "ARR02-C",
"severity": "Medium",
"suggestion": "Explicitly specify array bounds even when using an initializer"
},
{
"column": 21,
"file": "/home/brandon/toolchain/lua/lbaselib.c",
"line": 205,
"message": "Array declaration 'optsnum[]' has implicit bounds; specify explicit size",
"rule_id": "ARR02-C",
"severity": "Medium",
"suggestion": "Explicitly specify array bounds even when using an initializer"
},
{
"column": 53,
"file": "/home/brandon/toolchain/lua/lbaselib.c",
"line": 208,
"message": "'opts' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 32,
"file": "/home/brandon/toolchain/lua/lbaselib.c",
"line": 237,
"message": "Array declaration 'params[]' has implicit bounds; specify explicit size",
"rule_id": "ARR02-C",
"severity": "Medium",
"suggestion": "Explicitly specify array bounds even when using an initializer"
},
{
"column": 25,
"file": "/home/brandon/toolchain/lua/lbaselib.c",
"line": 240,
"message": "Array declaration 'pnum[]' has implicit bounds; specify explicit size",
"rule_id": "ARR02-C",
"severity": "Medium",
"suggestion": "Explicitly specify array bounds even when using an initializer"
},
{
"column": 49,
"file": "/home/brandon/toolchain/lua/lbaselib.c",
"line": 243,
"message": "'params' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 33,
"file": "/home/brandon/toolchain/lua/lbaselib.c",
"line": 280,
"message": "Pointer parameter 'L' is not modified and should be declared const",
"rule_id": "DCL13-C",
"severity": "Low",
"suggestion": "Declare parameter as 'const <type> *L'"
},
{
"column": 3,
"file": "/home/brandon/toolchain/lua/lbaselib.c",
"line": 348,
"message": "Function returns pointer to local variable 'mode' with automatic storage duration",
"rule_id": "DCL30-C",
"severity": "High",
"suggestion": "Use static storage, allocated memory, or pass output buffer as parameter"
},
{
"column": 34,
"file": "/home/brandon/toolchain/lua/lbaselib.c",
"line": 356,
"message": "'fname' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 41,
"file": "/home/brandon/toolchain/lua/lbaselib.c",
"line": 356,
"message": "'mode' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 55,
"file": "/home/brandon/toolchain/lua/lbaselib.c",
"line": 371,
"message": "Pointer parameter should use conformant array syntax",
"rule_id": "API05-C",
"severity": "High",
"suggestion": "Use conformant array parameter syntax (e.g., 'char p[n]') with the size parameter declared before the array"
},
{
"column": 55,
"file": "/home/brandon/toolchain/lua/lbaselib.c",
"line": 371,
"message": "Pointer parameter 'ud' is not modified and should be declared const",
"rule_id": "DCL13-C",
"severity": "Low",
"suggestion": "Declare parameter as 'const <type> *ud'"
},
{
"column": 37,
"file": "/home/brandon/toolchain/lua/lbaselib.c",
"line": 398,
"message": "Variable 'l' is used uninitialized",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'l' before use, e.g., at its declaration"
},
{
"column": 23,
"file": "/home/brandon/toolchain/lua/lbaselib.c",
"line": 509,
"message": "Array declaration 'base_funcs[]' has implicit bounds; specify explicit size",
"rule_id": "ARR02-C",
"severity": "Medium",
"suggestion": "Explicitly specify array bounds even when using an initializer"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lbaselib.c",
"line": 540,
"message": "Function 'luaopen_base' does not validate pointer parameter 'L' before use",
"rule_id": "API00-C",
"severity": "Medium",
"suggestion": "Add validation check for 'L' at the start of the function, e.g., 'if (!L) { return error_code; }'"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lbaselib.c",
"line": 540,
"message": "Function 'luaopen_base' should be declared static if it doesn't need external linkage",
"rule_id": "DCL15-C",
"severity": "Low",
"suggestion": "Add 'static' storage-class specifier: static LUAMOD_API luaopen_base"
},
{
"column": 3,
"file": "/home/brandon/toolchain/lua/lbaselib.c",
"line": 549,
"message": "Passing string literal to function 'lua_setfield' which may modify it",
"rule_id": "STR30-C",
"severity": "High",
"suggestion": "Use a modifiable array instead of a string literal"
}
],
"llex.c": [
{
"column": 1,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 32,
"message": "Function-like macro 'next' evaluates parameter(s) multiple times; prefer inline or static functions for type safety",
"rule_id": "PRE00-C",
"severity": "Low",
"suggestion": null
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 32,
"message": "Macro parameter 'ls' is not parenthesized in replacement text. This can cause operator precedence issues.",
"rule_id": "PRE01-C",
"severity": "Medium",
"suggestion": "Wrap parameter 'ls' in parentheses: (ls) instead of ls"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 32,
"message": "Macro evaluates parameter 'ls' multiple times; use inline function instead",
"rule_id": "PRE12-C",
"severity": "Medium",
"suggestion": "Replace macro with inline function to avoid multiple evaluation"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 41,
"message": "Function-like macro 'currIsNewline' evaluates parameter(s) multiple times; prefer inline or static functions for type safety",
"rule_id": "PRE00-C",
"severity": "Low",
"suggestion": null
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 41,
"message": "Macro parameter 'ls' is not parenthesized in replacement text. This can cause operator precedence issues.",
"rule_id": "PRE01-C",
"severity": "Medium",
"suggestion": "Wrap parameter 'ls' in parentheses: (ls) instead of ls"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 41,
"message": "Macro evaluates parameter 'ls' multiple times; use inline function instead",
"rule_id": "PRE12-C",
"severity": "Medium",
"suggestion": "Replace macro with inline function to avoid multiple evaluation"
},
{
"column": 26,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 45,
"message": "Array declaration 'luaX_tokens []' has implicit bounds; specify explicit size",
"rule_id": "ARR02-C",
"severity": "Medium",
"suggestion": "Explicitly specify array bounds even when using an initializer"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 56,
"message": "Function-like macro 'save_and_next' evaluates parameter(s) multiple times; prefer inline or static functions for type safety",
"rule_id": "PRE00-C",
"severity": "Low",
"suggestion": null
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 56,
"message": "Macro parameter 'ls' is not parenthesized in replacement text. This can cause operator precedence issues.",
"rule_id": "PRE01-C",
"severity": "Medium",
"suggestion": "Wrap parameter 'ls' in parentheses: (ls) instead of ls"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 56,
"message": "Macro evaluates parameter 'ls' multiple times; use inline function instead",
"rule_id": "PRE12-C",
"severity": "Medium",
"suggestion": "Replace macro with inline function to avoid multiple evaluation"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 62,
"message": "Function 'save' participates in indirect recursion: save -> lexerror -> txtToken -> save",
"rule_id": "MSC04-C",
"severity": "Medium",
"suggestion": "Refactor to eliminate the recursion cycle"
},
{
"column": 5,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 68,
"message": "Variable 'newsize' used with both bitwise and arithmetic operations (reduces code readability)",
"rule_id": "INT14-C",
"severity": "Medium",
"suggestion": "Use separate variables for bitwise and arithmetic operations, or refactor to use only arithmetic operators"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 75,
"message": "Function 'luaX_init' does not validate pointer parameter 'L' before use",
"rule_id": "API00-C",
"severity": "Medium",
"suggestion": "Add validation check for 'L' at the start of the function, e.g., 'if (!L) { return error_code; }'"
},
{
"column": 3,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 77,
"message": "Variable 'e' is initialized but never modified, consider const-qualifying it",
"rule_id": "DCL00-C",
"severity": "Medium",
"suggestion": "Add 'const' qualifier: const e = ..."
},
{
"column": 19,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 80,
"message": "Memory allocated with 'luaS_new' for variable 'ts' is not freed",
"rule_id": "MEM31-C",
"severity": "High",
"suggestion": "Add 'free(ts)' before the variable goes out of scope"
},
{
"column": 5,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 82,
"message": "Potential null pointer dereference in member access of variable 'ts'",
"rule_id": "EXP34-C",
"severity": "High",
"suggestion": "Check if 'ts' is not NULL before member access"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 87,
"message": "Function 'luaX_token2str' does not validate pointer parameter 'ls' before use",
"rule_id": "API00-C",
"severity": "Medium",
"suggestion": "Add validation check for 'ls' at the start of the function, e.g., 'if (!ls) { return error_code; }'"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 87,
"message": "Non-void function may reach end without returning a value. Ensure all execution paths have explicit return statements.",
"rule_id": "MSC37-C",
"severity": "Medium",
"suggestion": "Add return statements to ensure all execution paths return a value"
},
{
"column": 38,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 87,
"message": "Pointer parameter 'ls' is not modified and should be declared const",
"rule_id": "DCL13-C",
"severity": "Low",
"suggestion": "Declare parameter as 'const <type> *ls'"
},
{
"column": 14,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 99,
"message": "Returning pointer to local array 's' which will be destroyed when function returns, creating a dangling pointer.",
"rule_id": "ARR00-C",
"severity": "Medium",
"suggestion": "Consider allocating the array dynamically (malloc/calloc), declaring it as static, or passing a buffer as a parameter."
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 104,
"message": "Function 'txtToken' participates in indirect recursion: txtToken -> save -> lexerror -> txtToken",
"rule_id": "MSC04-C",
"severity": "Medium",
"suggestion": "Refactor to eliminate the recursion cycle"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 116,
"message": "Function 'lexerror' participates in indirect recursion: lexerror -> txtToken -> save -> lexerror",
"rule_id": "MSC04-C",
"severity": "Medium",
"suggestion": "Refactor to eliminate the recursion cycle"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 116,
"message": "Non-void function has no return statement. Control reaching the end of a non-void function without returning a value is undefined behavior.",
"rule_id": "MSC37-C",
"severity": "Medium",
"suggestion": "Add a return statement on all execution paths of this function"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 124,
"message": "Function 'luaX_syntaxerror' does not validate pointer parameter 'ls' before use",
"rule_id": "API00-C",
"severity": "Medium",
"suggestion": "Add validation check for 'ls' at the start of the function, e.g., 'if (!ls) { return error_code; }'"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 124,
"message": "Function 'luaX_syntaxerror' does not validate pointer parameter 'msg' before use",
"rule_id": "API00-C",
"severity": "Medium",
"suggestion": "Add validation check for 'msg' at the start of the function, e.g., 'if (!msg) { return error_code; }'"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 124,
"message": "Non-void function has no return statement. Control reaching the end of a non-void function without returning a value is undefined behavior.",
"rule_id": "MSC37-C",
"severity": "Medium",
"suggestion": "Add a return statement on all execution paths of this function"
},
{
"column": 37,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 135,
"message": "Pointer parameter 'ls' is not modified and should be declared const",
"rule_id": "DCL13-C",
"severity": "Low",
"suggestion": "Declare parameter as 'const <type> *ls'"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 156,
"message": "Function 'luaX_newstring' does not validate pointer parameter 'ls' before use",
"rule_id": "API00-C",
"severity": "Medium",
"suggestion": "Add validation check for 'ls' at the start of the function, e.g., 'if (!ls) { return error_code; }'"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 156,
"message": "Function 'luaX_newstring' does not validate pointer parameter 'str' before use",
"rule_id": "API00-C",
"severity": "Medium",
"suggestion": "Add validation check for 'str' at the start of the function, e.g., 'if (!str) { return error_code; }'"
},
{
"column": 51,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 156,
"message": "Pointer parameter should use conformant array syntax",
"rule_id": "API05-C",
"severity": "High",
"suggestion": "Use conformant array parameter syntax (e.g., 'char p[n]') with the size parameter declared before the array"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 176,
"message": "Function 'luaX_setinput' does not validate pointer parameter 'L' before use",
"rule_id": "API00-C",
"severity": "Medium",
"suggestion": "Add validation check for 'L' at the start of the function, e.g., 'if (!L) { return error_code; }'"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 176,
"message": "Function 'luaX_setinput' does not validate pointer parameter 'ls' before use",
"rule_id": "API00-C",
"severity": "Medium",
"suggestion": "Add validation check for 'ls' at the start of the function, e.g., 'if (!ls) { return error_code; }'"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 176,
"message": "Function 'luaX_setinput' does not validate pointer parameter 'z' before use",
"rule_id": "API00-C",
"severity": "Medium",
"suggestion": "Add validation check for 'z' at the start of the function, e.g., 'if (!z) { return error_code; }'"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 176,
"message": "Function 'luaX_setinput' does not validate pointer parameter 'source' before use",
"rule_id": "API00-C",
"severity": "Medium",
"suggestion": "Add validation check for 'source' at the start of the function, e.g., 'if (!source) { return error_code; }'"
},
{
"column": 53,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 176,
"message": "Pointer parameter 'z' is not modified and should be declared const",
"rule_id": "DCL13-C",
"severity": "Low",
"suggestion": "Declare parameter as 'const <type> *z'"
},
{
"column": 65,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 176,
"message": "Pointer parameter 'source' is not modified and should be declared const",
"rule_id": "DCL13-C",
"severity": "Low",
"suggestion": "Declare parameter as 'const <type> *source'"
},
{
"column": 3,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 353,
"message": "Variable 'r' is initialized but never modified, consider const-qualifying it",
"rule_id": "DCL00-C",
"severity": "Medium",
"suggestion": "Add 'const' qualifier: const r = ..."
},
{
"column": 7,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 354,
"message": "Variable 'r' used with both bitwise and arithmetic operations (reduces code readability)",
"rule_id": "INT14-C",
"severity": "Medium",
"suggestion": "Use separate variables for bitwise and arithmetic operations, or refactor to use only arithmetic operators"
},
{
"column": 8,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 354,
"message": "Bitwise operator '<<' used on signed operand 'r' of type 'int'. Use unsigned types for bitwise operations",
"rule_id": "INT13-C",
"severity": "Medium",
"suggestion": "Change 'r' to an unsigned type (e.g., 'unsigned int' instead of 'int')"
},
{
"column": 9,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 374,
"message": "Variable 'r' used with both bitwise and arithmetic operations (reduces code readability)",
"rule_id": "INT14-C",
"severity": "Medium",
"suggestion": "Use separate variables for bitwise and arithmetic operations, or refactor to use only arithmetic operators"
},
{
"column": 10,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 374,
"message": "Bitwise operator '<<' used on signed operand 'r' of type 'int'. Use unsigned types for bitwise operations",
"rule_id": "INT13-C",
"severity": "Medium",
"suggestion": "Change 'r' to an unsigned type (e.g., 'unsigned int' instead of 'int')"
},
{
"column": 14,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 387,
"message": "Reading from uninitialized array 'buff' inside a loop. Array was declared but never initialized before being read.",
"rule_id": "ARR00-C",
"severity": "Medium",
"suggestion": "Initialize array 'buff' before reading: int buff[N] = {0}; or assign values before use"
},
{
"column": 14,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 387,
"message": "Reading from 'buff' which may contain uninitialized data",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize the contents of 'buff' before reading"
},
{
"column": 3,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 393,
"message": "Variable 'r' is initialized but never modified, consider const-qualifying it",
"rule_id": "DCL00-C",
"severity": "Medium",
"suggestion": "Add 'const' qualifier: const r = ..."
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 467,
"message": "Non-void function may reach end without returning a value. Ensure all execution paths have explicit return statements.",
"rule_id": "MSC37-C",
"severity": "Medium",
"suggestion": "Add return statements to ensure all execution paths return a value"
},
{
"column": 16,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 568,
"message": "Multiple function calls with potential side effects in unsequenced arguments",
"rule_id": "EXP30-C",
"severity": "High",
"suggestion": "Evaluate function calls in separate statements to guarantee ordering"
},
{
"column": 11,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 578,
"message": "Variable 'c' is initialized but never modified, consider const-qualifying it",
"rule_id": "DCL00-C",
"severity": "Medium",
"suggestion": "Add 'const' qualifier: const c = ..."
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 588,
"message": "Function 'luaX_next' does not validate pointer parameter 'ls' before use",
"rule_id": "API00-C",
"severity": "Medium",
"suggestion": "Add validation check for 'ls' at the start of the function, e.g., 'if (!ls) { return error_code; }'"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/llex.c",
"line": 599,
"message": "Function 'luaX_lookahead' does not validate pointer parameter 'ls' before use",
"rule_id": "API00-C",
"severity": "Medium",
"suggestion": "Add validation check for 'ls' at the start of the function, e.g., 'if (!ls) { return error_code; }'"
}
],
"lobject.c": [
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 37,
"message": "Function 'luaO_ceillog2' does not validate integer parameter 'x' for overflow before arithmetic operations",
"rule_id": "API00-C",
"severity": "Medium",
"suggestion": "Add overflow validation for 'x' before arithmetic, e.g., check against INT_MAX/INT_MIN or use __builtin_*_overflow()"
},
{
"column": 30,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 50,
"message": "Variable 'x' used with both bitwise and arithmetic operations (reduces code readability)",
"rule_id": "INT14-C",
"severity": "Medium",
"suggestion": "Use separate variables for bitwise and arithmetic operations, or refactor to use only arithmetic operators"
},
{
"column": 24,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 51,
"message": "Array subscript uses function parameter 'x' without bounds checking. Caller could pass invalid index.",
"rule_id": "ARR00-C",
"severity": "Medium",
"suggestion": "Add bounds checking for 'x' before using it as an array index"
},
{
"column": 12,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 63,
"message": "Variable 'lu_mem' used with both bitwise and arithmetic operations (reduces code readability)",
"rule_id": "INT14-C",
"severity": "Medium",
"suggestion": "Use separate variables for bitwise and arithmetic operations, or refactor to use only arithmetic operators"
},
{
"column": 12,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 63,
"message": "Variable 'cast' used with both bitwise and arithmetic operations (reduces code readability)",
"rule_id": "INT14-C",
"severity": "Medium",
"suggestion": "Use separate variables for bitwise and arithmetic operations, or refactor to use only arithmetic operators"
},
{
"column": 9,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 66,
"message": "Variable 'p' used with both bitwise and arithmetic operations (reduces code readability)",
"rule_id": "INT14-C",
"severity": "Medium",
"suggestion": "Use separate variables for bitwise and arithmetic operations, or refactor to use only arithmetic operators"
},
{
"column": 24,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 74,
"message": "Variable 'log' used with both bitwise and arithmetic operations (reduces code readability)",
"rule_id": "INT14-C",
"severity": "Medium",
"suggestion": "Use separate variables for bitwise and arithmetic operations, or refactor to use only arithmetic operators"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 89,
"message": "Non-void function may reach end without returning a value. Ensure all execution paths have explicit return statements.",
"rule_id": "MSC37-C",
"severity": "Medium",
"suggestion": "Add return statements to ensure all execution paths return a value"
},
{
"column": 3,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 91,
"message": "Variable 'e' is initialized but never modified, consider const-qualifying it",
"rule_id": "DCL00-C",
"severity": "Medium",
"suggestion": "Add 'const' qualifier: const e = ..."
},
{
"column": 5,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 94,
"message": "Variable 'm' used with both bitwise and arithmetic operations (reduces code readability)",
"rule_id": "INT14-C",
"severity": "Medium",
"suggestion": "Use separate variables for bitwise and arithmetic operations, or refactor to use only arithmetic operators"
},
{
"column": 3,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 96,
"message": "Variable 'e' used with both bitwise and arithmetic operations (reduces code readability)",
"rule_id": "INT14-C",
"severity": "Medium",
"suggestion": "Use separate variables for bitwise and arithmetic operations, or refactor to use only arithmetic operators"
},
{
"column": 13,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 98,
"message": "Use parentheses to clarify operator precedence: '(MAX_LMEM / 0x1F) >> e'",
"rule_id": "EXP00-C",
"severity": "Low",
"suggestion": "Add parentheses to enforce the intended order of operations"
},
{
"column": 13,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 98,
"message": "Variable 'MAX_LMEM' used with both bitwise and arithmetic operations (reduces code readability)",
"rule_id": "INT14-C",
"severity": "Medium",
"suggestion": "Use separate variables for bitwise and arithmetic operations, or refactor to use only arithmetic operators"
},
{
"column": 34,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 98,
"message": "Bitwise operator '>>' used on signed operand 'e' of type 'int'. Use unsigned types for bitwise operations",
"rule_id": "INT13-C",
"severity": "Medium",
"suggestion": "Change 'e' to an unsigned type (e.g., 'unsigned int' instead of 'int')"
},
{
"column": 14,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 99,
"message": "Variable 'x' used with both bitwise and arithmetic operations (reduces code readability)",
"rule_id": "INT14-C",
"severity": "Medium",
"suggestion": "Use separate variables for bitwise and arithmetic operations, or refactor to use only arithmetic operators"
},
{
"column": 25,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 99,
"message": "Bitwise operator '<<' used on signed operand 'e' of type 'int'. Use unsigned types for bitwise operations",
"rule_id": "INT13-C",
"severity": "Medium",
"suggestion": "Change 'e' to an unsigned type (e.g., 'unsigned int' instead of 'int')"
},
{
"column": 14,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 106,
"message": "Input operation on file stream '(x * m)' follows output without intervening positioning call (fflush, fseek, fsetpos, or rewind)",
"rule_id": "FIO50-C",
"severity": "Low",
"suggestion": "Insert fflush() or a positioning function (fseek, fsetpos, rewind) between output and input operations"
},
{
"column": 14,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 106,
"message": "Input operation on file stream '(x * m)' follows output without intervening positioning call (fflush, fseek, fsetpos, or rewind)",
"rule_id": "FIO50-C",
"severity": "Low",
"suggestion": "Insert fflush() or a positioning function (fseek, fsetpos, rewind) between output and input operations"
},
{
"column": 25,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 106,
"message": "Bitwise operator '>>' used on signed operand 'e' of type 'int'. Use unsigned types for bitwise operations",
"rule_id": "INT13-C",
"severity": "Medium",
"suggestion": "Change 'e' to an unsigned type (e.g., 'unsigned int' instead of 'int')"
},
{
"column": 20,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 107,
"message": "Bitwise operator '>>' used on signed operand 'e' of type 'int'. Use unsigned types for bitwise operations",
"rule_id": "INT13-C",
"severity": "Medium",
"suggestion": "Change 'e' to an unsigned type (e.g., 'unsigned int' instead of 'int')"
},
{
"column": 20,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 108,
"message": "Bitwise operator '>>' used on signed operand 'e' of type 'int'. Use unsigned types for bitwise operations",
"rule_id": "INT13-C",
"severity": "Medium",
"suggestion": "Change 'e' to an unsigned type (e.g., 'unsigned int' instead of 'int')"
},
{
"column": 24,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 175,
"message": "Multiple function calls with potential side effects in unsequenced arguments",
"rule_id": "EXP30-C",
"severity": "High",
"suggestion": "Evaluate function calls in separate statements to guarantee ordering"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 188,
"message": "Function 'luaO_arith' does not validate integer parameter 'op' for overflow before arithmetic operations",
"rule_id": "API00-C",
"severity": "Medium",
"suggestion": "Add overflow validation for 'op' before arithmetic, e.g., check against INT_MAX/INT_MIN or use __builtin_*_overflow()"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 197,
"message": "Function 'luaO_hexavalue' does not validate integer parameter 'c' for overflow before arithmetic operations",
"rule_id": "API00-C",
"severity": "Medium",
"suggestion": "Add overflow validation for 'c' before arithmetic, e.g., check against INT_MAX/INT_MIN or use __builtin_*_overflow()"
},
{
"column": 37,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 199,
"message": "Variable 'c' of type char used in numeric operation. Use explicit 'signed char' or 'unsigned char' for numeric values.",
"rule_id": "INT07-C",
"severity": "Medium",
"suggestion": "Change declaration of 'c' from 'char' to 'signed char' or 'unsigned char'"
},
{
"column": 37,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 199,
"message": "Arithmetic expression involving 'c' (narrow type 'char') without proper overflow protection",
"rule_id": "INT08-C",
"severity": "Medium",
"suggestion": "Use a wider type (e.g., 'long' instead of 'char') or add overflow checks before the operation"
},
{
"column": 25,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 200,
"message": "Arithmetic expression involving 'c' (narrow type 'char') without proper overflow protection",
"rule_id": "INT08-C",
"severity": "Medium",
"suggestion": "Use a wider type (e.g., 'long' instead of 'char') or add overflow checks before the operation"
},
{
"column": 3,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 230,
"message": "Variable 'r' is initialized but never modified, consider const-qualifying it",
"rule_id": "DCL00-C",
"severity": "Medium",
"suggestion": "Add 'const' qualifier: const r = ..."
},
{
"column": 3,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 233,
"message": "Variable 'e' is initialized but never modified, consider const-qualifying it",
"rule_id": "DCL00-C",
"severity": "Medium",
"suggestion": "Add 'const' qualifier: const e = ..."
},
{
"column": 3,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 236,
"message": "Pointer dereference '*endptr' (char type) assigned without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before assignment to larger type"
},
{
"column": 3,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 258,
"message": "Pointer dereference '*endptr' (char type) assigned without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before assignment to larger type"
},
{
"column": 5,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 271,
"message": "Pointer dereference '*endptr' (char type) assigned without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before assignment to larger type"
},
{
"column": 30,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 296,
"message": "Potential null pointer dereference of variable 'endptr'",
"rule_id": "EXP34-C",
"severity": "High",
"suggestion": "Check if 'endptr' is not NULL before dereferencing"
},
{
"column": 14,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 317,
"message": "'pmode' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 42,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 317,
"message": "Pointer dereference '*pmode' (char type) converted without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 43,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 317,
"message": "'pmode' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 5,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 322,
"message": "Fixed-size buffer may be used with environment variable",
"rule_id": "ENV01-C",
"severity": "High",
"suggestion": "Use dynamic allocation based on strlen() of getenv() result"
},
{
"column": 5,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 322,
"message": "Variable-length array with runtime-sized allocation; use malloc instead",
"rule_id": "MEM05-C",
"severity": "Medium",
"suggestion": "Use malloc/calloc for dynamic allocation"
},
{
"column": 18,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 326,
"message": "Do not cast away const qualification: 's'",
"rule_id": "EXP05-C",
"severity": "Medium",
"suggestion": "Ensure const-qualified objects are not modified through cast-away pointers"
},
{
"column": 21,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 330,
"message": "Pointer subtraction between pointers from different arrays: 'param:s' and 'buff'",
"rule_id": "ARR36-C",
"severity": "High",
"suggestion": "Ensure both pointers refer to the same array before subtraction"
},
{
"column": 3,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 332,
"message": "Function returns pointer to local variable 'endptr' with automatic storage duration",
"rule_id": "DCL30-C",
"severity": "High",
"suggestion": "Use static storage, allocated memory, or pass output buffer as parameter"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 336,
"message": "Macro replacement list should be parenthesized to prevent operator precedence issues.",
"rule_id": "PRE02-C",
"severity": "Medium",
"suggestion": "Wrap the entire replacement list in parentheses: (cast(lua_Unsigned, LUA_MAXINTEGER / 10))"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 337,
"message": "Macro replacement list should be parenthesized to prevent operator precedence issues.",
"rule_id": "PRE02-C",
"severity": "Medium",
"suggestion": "Wrap the entire replacement list in parentheses: (cast_int(LUA_MAXINTEGER % 10))"
},
{
"column": 15,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 355,
"message": "Pointer dereference '*s' (char type) converted without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 16,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 355,
"message": "'s' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 18,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 375,
"message": "Variable 'i' is used uninitialized",
"rule_id": "EXP33-C",
"severity": "High",
"suggestion": "Initialize 'i' before use, e.g., at its declaration"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 386,
"message": "Function 'luaO_utf8esc' does not validate pointer parameter 'buff' before use",
"rule_id": "API00-C",
"severity": "Medium",
"suggestion": "Add validation check for 'buff' at the start of the function, e.g., 'if (!buff) { return error_code; }'"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 386,
"message": "Function 'luaO_utf8esc' should be declared static if it doesn't need external linkage",
"rule_id": "DCL15-C",
"severity": "Low",
"suggestion": "Add 'static' storage-class specifier: static int luaO_utf8esc"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 386,
"message": "Function 'luaO_utf8esc' is only used within this file. It should be declared static to minimize scope.",
"rule_id": "DCL19-C",
"severity": "Low",
"suggestion": "Add 'static' storage class to function 'luaO_utf8esc'"
},
{
"column": 7,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 395,
"message": "Shift operation on signed integer 'x' may be used for arithmetic optimization (use explicit arithmetic instead)",
"rule_id": "INT14-C",
"severity": "Medium",
"suggestion": "Use explicit arithmetic operations like * or / instead of shift operations on signed integers"
},
{
"column": 23,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 429,
"message": "'buff' (signed/plain char) converted to larger integer type without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before conversion to larger type"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 449,
"message": "Function 'luaO_tostringbuff' does not validate pointer parameter 'obj' before use",
"rule_id": "API00-C",
"severity": "Medium",
"suggestion": "Add validation check for 'obj' at the start of the function, e.g., 'if (!obj) { return error_code; }'"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 464,
"message": "Function 'luaO_tostring' does not validate pointer parameter 'L' before use",
"rule_id": "API00-C",
"severity": "Medium",
"suggestion": "Add validation check for 'L' at the start of the function, e.g., 'if (!L) { return error_code; }'"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 464,
"message": "Function 'luaO_tostring' does not validate pointer parameter 'obj' before use",
"rule_id": "API00-C",
"severity": "Medium",
"suggestion": "Add validation check for 'obj' at the start of the function, e.g., 'if (!obj) { return error_code; }'"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 484,
"message": "Macro replacement list should be parenthesized to prevent operator precedence issues.",
"rule_id": "PRE02-C",
"severity": "Medium",
"suggestion": "Wrap the entire replacement list in parentheses: (cast_uint(LUA_IDSIZE + LUA_N2SBUFFSZ + 95))"
},
{
"column": 33,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 500,
"message": "Pointer parameter 'L' is not modified and should be declared const",
"rule_id": "DCL13-C",
"severity": "Low",
"suggestion": "Declare parameter as 'const <type> *L'"
},
{
"column": 20,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 503,
"message": "sizeof applied to pointer/array parameter 'buff' which has decayed to a pointer",
"rule_id": "ARR01-C",
"severity": "High",
"suggestion": "Do not use 'sizeof(buff->space)'. Array/pointer parameters decay to pointers. Pass the array size as a separate parameter instead."
},
{
"column": 42,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 513,
"message": "Pointer parameter 'ud' is not modified and should be declared const",
"rule_id": "DCL13-C",
"severity": "Low",
"suggestion": "Declare parameter as 'const <type> *ud'"
},
{
"column": 9,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 521,
"message": "Potential buffer overflow with strcpy(). Cannot verify destination buffer is large enough.",
"rule_id": "STR31-C",
"severity": "Medium",
"suggestion": "Use strncpy() with explicit size limit or verify buffer size"
},
{
"column": 9,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 523,
"message": "Potential buffer overflow with strcpy(). Cannot verify destination buffer is large enough.",
"rule_id": "STR31-C",
"severity": "Medium",
"suggestion": "Use strncpy() with explicit size limit or verify buffer size"
},
{
"column": 3,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 545,
"message": "Function returns pointer to local variable 'res' with automatic storage duration",
"rule_id": "DCL30-C",
"severity": "High",
"suggestion": "Use static storage, allocated memory, or pass output buffer as parameter"
},
{
"column": 51,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 549,
"message": "Pointer parameter should use conformant array syntax",
"rule_id": "API05-C",
"severity": "High",
"suggestion": "Use conformant array parameter syntax (e.g., 'char p[n]') with the size parameter declared before the array"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 596,
"message": "Function 'luaO_pushvfstring' does not validate pointer parameter 'L' before use",
"rule_id": "API00-C",
"severity": "Medium",
"suggestion": "Add validation check for 'L' at the start of the function, e.g., 'if (!L) { return error_code; }'"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 596,
"message": "Function 'luaO_pushvfstring' does not validate pointer parameter 'fmt' before use",
"rule_id": "API00-C",
"severity": "Medium",
"suggestion": "Add validation check for 'fmt' at the start of the function, e.g., 'if (!fmt) { return error_code; }'"
},
{
"column": 63,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 596,
"message": "Function takes 'va_list argp' by value and calls va_arg() on it. This makes the caller's va_list indeterminate after the function returns.",
"rule_id": "MSC39-C",
"severity": "Low",
"suggestion": "Change parameter 'argp' to 'va_list *argp' and use va_copy() to create a local copy before calling va_arg()."
},
{
"column": 4,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 602,
"message": "Dereferencing pointer in switch statement may create double-fetch vulnerability",
"rule_id": "CON43-C",
"severity": "High",
"suggestion": "Store dereferenced value in a local variable or use atomic operations"
},
{
"column": 25,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 604,
"message": "va_arg called with type 'char' which undergoes default argument promotion; use 'int' instead",
"rule_id": "EXP47-C",
"severity": "Medium",
"suggestion": "Change va_arg type to 'int' and cast the result if needed: (char)va_arg(ap, int)"
},
{
"column": 9,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 610,
"message": "Variable 'c' is initialized but never modified, consider const-qualifying it",
"rule_id": "DCL00-C",
"severity": "Medium",
"suggestion": "Add 'const' qualifier: const c = ..."
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 662,
"message": "Function 'luaO_pushfstring' does not validate pointer parameter 'L' before use",
"rule_id": "API00-C",
"severity": "Medium",
"suggestion": "Add validation check for 'L' at the start of the function, e.g., 'if (!L) { return error_code; }'"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 662,
"message": "Function 'luaO_pushfstring' does not validate pointer parameter 'fmt' before use",
"rule_id": "API00-C",
"severity": "Medium",
"suggestion": "Add validation check for 'fmt' at the start of the function, e.g., 'if (!fmt) { return error_code; }'"
},
{
"column": 3,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 670,
"message": "Function returns pointer to local variable 'msg' with automatic storage duration",
"rule_id": "DCL30-C",
"severity": "High",
"suggestion": "Use static storage, allocated memory, or pass output buffer as parameter"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 680,
"message": "Function-like macro 'addstr' evaluates parameter(s) multiple times; prefer inline or static functions for type safety",
"rule_id": "PRE00-C",
"severity": "Low",
"suggestion": null
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 680,
"message": "Macro parameter 'a' is not parenthesized in replacement text. This can cause operator precedence issues.",
"rule_id": "PRE01-C",
"severity": "Medium",
"suggestion": "Wrap parameter 'a' in parentheses: (a) instead of a"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 680,
"message": "Macro evaluates parameter 'a' multiple times; use inline function instead",
"rule_id": "PRE12-C",
"severity": "Medium",
"suggestion": "Replace macro with inline function to avoid multiple evaluation"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 682,
"message": "Function 'luaO_chunkid' does not validate pointer parameter 'out' before use",
"rule_id": "API00-C",
"severity": "Medium",
"suggestion": "Add validation check for 'out' at the start of the function, e.g., 'if (!out) { return error_code; }'"
},
{
"column": 1,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 682,
"message": "Function 'luaO_chunkid' does not validate pointer parameter 'source' before use",
"rule_id": "API00-C",
"severity": "Medium",
"suggestion": "Add validation check for 'source' at the start of the function, e.g., 'if (!source) { return error_code; }'"
},
{
"column": 25,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 682,
"message": "Pointer parameter should use conformant array syntax",
"rule_id": "API05-C",
"severity": "High",
"suggestion": "Use conformant array parameter syntax (e.g., 'char p[n]') with the size parameter declared before the array"
},
{
"column": 42,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 682,
"message": "Pointer parameter should use conformant array syntax",
"rule_id": "API05-C",
"severity": "High",
"suggestion": "Use conformant array parameter syntax (e.g., 'char p[n]') with the size parameter declared before the array"
},
{
"column": 7,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 686,
"message": "Function 'memcpy' called with potentially invalid size calculation",
"rule_id": "ARR38-C",
"severity": "High",
"suggestion": "Ensure size argument does not exceed buffer bounds"
},
{
"column": 7,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 689,
"message": "Pointer dereference '*out' (char type) assigned without cast to 'unsigned char' - may cause sign extension",
"rule_id": "STR34-C",
"severity": "Medium",
"suggestion": "Cast to 'unsigned char' before assignment to larger type"
},
{
"column": 7,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 694,
"message": "Function 'memcpy' called with potentially invalid size calculation",
"rule_id": "ARR38-C",
"severity": "High",
"suggestion": "Ensure size argument does not exceed buffer bounds"
},
{
"column": 7,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 698,
"message": "Function 'memcpy' called with potentially invalid size calculation",
"rule_id": "ARR38-C",
"severity": "High",
"suggestion": "Ensure size argument does not exceed buffer bounds"
},
{
"column": 5,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 715,
"message": "Function 'memcpy' called with potentially invalid size calculation",
"rule_id": "ARR38-C",
"severity": "High",
"suggestion": "Ensure size argument does not exceed buffer bounds"
},
{
"column": 5,
"file": "/home/brandon/toolchain/lua/lobject.c",
"line": 715,
"message": "memcpy() size argument contains arithmetic that may overflow: '(LL(POS) + 1) * sizeof(char)'",
"rule_id": "INT32-C",
"severity": "High",
"suggestion": "Validate size calculations before passing to memory functions"
}
]
}