{
"ground_truth": [],
"labels": [
{"rule":"EXP33-C","file":"lbaselib.c","line":33,"verdict":"FP","confidence":"high","reason":"l filled by luaL_tolstring output param; always initialized on non-NULL return"},
{"rule":"STR37-C","file":"lbaselib.c","line":67,"verdict":"FP","confidence":"high","reason":"cast_uchar(*s) already wraps to unsigned char before isalnum call"},
{"rule":"STR37-C","file":"lbaselib.c","line":70,"verdict":"FP","confidence":"high","reason":"cast_uchar(*s) already wraps to unsigned char before isdigit call"},
{"rule":"STR37-C","file":"lbaselib.c","line":72,"verdict":"FP","confidence":"high","reason":"cast_uchar(*s) already wraps to unsigned char before toupper call"},
{"rule":"STR37-C","file":"lbaselib.c","line":76,"verdict":"FP","confidence":"high","reason":"cast_uchar(*s) already wraps to unsigned char before isalnum call"},
{"rule":"EXP33-C","file":"lbaselib.c","line":92,"verdict":"FP","confidence":"high","reason":"l filled by lua_tolstring output param; initialized when s is non-NULL"},
{"rule":"DCL31-C","file":"lbaselib.c","line":163,"verdict":"FP","confidence":"high","reason":"lua_rawlen declared in lua.h which is included"},
{"rule":"PRE01-C","file":"lbaselib.c","line":199,"verdict":"FP","confidence":"high","reason":"checkvalres macro arg res is always a plain int variable, no precedence risk"},
{"rule":"PRE02-C","file":"lbaselib.c","line":199,"verdict":"FP","confidence":"high","reason":"checkvalres is an if-break control-flow macro, outer parens not required"},
{"rule":"PRE10-C","file":"lbaselib.c","line":199,"verdict":"FP","confidence":"high","reason":"checkvalres is used as a break-from-switch stmt in a switch body, do-while not needed"},
{"rule":"ARR02-C","file":"lbaselib.c","line":202,"verdict":"FP","confidence":"high","reason":"implicit array bounds advisory; string-terminated tables are safe C idiom"},
{"rule":"ARR02-C","file":"lbaselib.c","line":205,"verdict":"FP","confidence":"high","reason":"implicit array bounds advisory; parallel array indexed by luaL_checkoption result"},
{"rule":"STR34-C","file":"lbaselib.c","line":208,"verdict":"FP","confidence":"high","reason":"opts is char array used as index into optsnum via luaL_checkoption; no sign-extension risk"},
{"rule":"ARR02-C","file":"lbaselib.c","line":237,"verdict":"FP","confidence":"high","reason":"implicit array bounds advisory; string-terminated table"},
{"rule":"ARR02-C","file":"lbaselib.c","line":240,"verdict":"FP","confidence":"high","reason":"implicit array bounds advisory; parallel array indexed by luaL_checkoption result"},
{"rule":"STR34-C","file":"lbaselib.c","line":243,"verdict":"FP","confidence":"high","reason":"params is char array indexed by luaL_checkoption result; no sign-extension risk"},
{"rule":"DCL13-C","file":"lbaselib.c","line":280,"verdict":"FP","confidence":"high","reason":"L is lua_State* internal API; const-param advisory not applicable"},
{"rule":"DCL30-C","file":"lbaselib.c","line":348,"verdict":"FP","confidence":"high","reason":"mode points to Lua stack string via luaL_optstring, not a local variable"},
{"rule":"STR34-C","file":"lbaselib.c","line":356,"verdict":"FP","confidence":"high","reason":"fname is const char*, sqc misidentifies pointer as char value; no sign-extension"},
{"rule":"STR34-C","file":"lbaselib.c","line":356,"verdict":"FP","confidence":"high","reason":"mode is const char*, sqc misidentifies pointer as char value; no sign-extension"},
{"rule":"API05-C","file":"lbaselib.c","line":371,"verdict":"FP","confidence":"high","reason":"conformant-array-parameter advisory; Lua codebase does not use C99 VLA syntax"},
{"rule":"DCL13-C","file":"lbaselib.c","line":371,"verdict":"FP","confidence":"high","reason":"ud is void* callback userdata; const-param advisory not applicable to API callback"},
{"rule":"EXP33-C","file":"lbaselib.c","line":398,"verdict":"FP","confidence":"high","reason":"l filled by lua_tolstring output param; only used when s is non-NULL"},
{"rule":"ARR02-C","file":"lbaselib.c","line":509,"verdict":"FP","confidence":"high","reason":"implicit array bounds on luaL_Reg table; null-terminated table is standard idiom"},
{"rule":"API00-C","file":"lbaselib.c","line":540,"verdict":"FP","confidence":"high","reason":"luaopen_base is module opener; L is guaranteed non-NULL by Lua runtime"},
{"rule":"DCL15-C","file":"lbaselib.c","line":540,"verdict":"FP","confidence":"high","reason":"luaopen_base marked LUAMOD_API requires external linkage; static inappropriate"},
{"rule":"STR30-C","file":"lbaselib.c","line":549,"verdict":"FP","confidence":"high","reason":"lua_setfield receives string literal as key only, never modifies it"},
{"rule":"PRE00-C","file":"llex.c","line":32,"verdict":"FP","confidence":"high","reason":"next macro: ls is always a plain variable at call sites, no multiple-eval side effect"},
{"rule":"PRE01-C","file":"llex.c","line":32,"verdict":"FP","confidence":"high","reason":"next macro: ls is a struct pointer variable, unparenthesized use in member access is safe"},
{"rule":"PRE12-C","file":"llex.c","line":32,"verdict":"FP","confidence":"high","reason":"next macro: ls never passed with side effects at any call site in this file"},
{"rule":"PRE00-C","file":"llex.c","line":41,"verdict":"FP","confidence":"high","reason":"currIsNewline: ls always a plain variable, no multiple-eval risk"},
{"rule":"PRE01-C","file":"llex.c","line":41,"verdict":"FP","confidence":"high","reason":"currIsNewline: member access on unparenthesized ls is safe"},
{"rule":"PRE12-C","file":"llex.c","line":41,"verdict":"FP","confidence":"high","reason":"currIsNewline: ls never side-effecting at call sites"},
{"rule":"ARR02-C","file":"llex.c","line":45,"verdict":"FP","confidence":"high","reason":"implicit bounds on static keyword-string table; advisory only"},
{"rule":"PRE00-C","file":"llex.c","line":56,"verdict":"FP","confidence":"high","reason":"save_and_next: ls is a plain LexState* variable at all call sites"},
{"rule":"PRE01-C","file":"llex.c","line":56,"verdict":"FP","confidence":"high","reason":"save_and_next: unparenthesized ls safe for member access in expansion"},
{"rule":"PRE12-C","file":"llex.c","line":56,"verdict":"FP","confidence":"high","reason":"save_and_next: ls never side-effecting at call sites"},
{"rule":"MSC04-C","file":"llex.c","line":62,"verdict":"FP","confidence":"high","reason":"save/lexerror/txtToken cycle is phantom; lexerror calls luaD_throw (longjmp), never returns"},
{"rule":"INT14-C","file":"llex.c","line":68,"verdict":"FP","confidence":"high","reason":"newsize >> 1 is arithmetic right-shift for 1.5x growth; advisory readability only"},
{"rule":"API00-C","file":"llex.c","line":75,"verdict":"FP","confidence":"high","reason":"luaX_init is internal; L is always a valid lua_State* from runtime"},
{"rule":"DCL00-C","file":"llex.c","line":77,"verdict":"FP","confidence":"high","reason":"e is a TString* used in luaC_fix immediately; const-qualify advisory"},
{"rule":"MEM31-C","file":"llex.c","line":80,"verdict":"FP","confidence":"high","reason":"luaS_new returns GC-managed Lua string; not libc heap, no free needed"},
{"rule":"EXP34-C","file":"llex.c","line":82,"verdict":"FP","confidence":"high","reason":"luaS_new longjmps on OOM via luaM_*; ts is never NULL on return"},
{"rule":"API00-C","file":"llex.c","line":87,"verdict":"FP","confidence":"high","reason":"luaX_token2str internal; ls always valid"},
{"rule":"MSC37-C","file":"llex.c","line":87,"verdict":"FP","confidence":"high","reason":"all branches return a value or call luaO_pushfstring which always returns"},
{"rule":"DCL13-C","file":"llex.c","line":87,"verdict":"FP","confidence":"high","reason":"ls is LexState* internal; const-param advisory"},
{"rule":"ARR00-C","file":"llex.c","line":99,"verdict":"FP","confidence":"high","reason":"s points to static luaX_tokens[] string literal, not a local array"},
{"rule":"MSC04-C","file":"llex.c","line":104,"verdict":"FP","confidence":"high","reason":"indirect recursion cycle is phantom; lexerror always longjmps via luaD_throw"},
{"rule":"MSC04-C","file":"llex.c","line":116,"verdict":"FP","confidence":"high","reason":"lexerror is l_noret; always throws via luaD_throw, no actual recursion"},
{"rule":"MSC37-C","file":"llex.c","line":116,"verdict":"FP","confidence":"high","reason":"lexerror is l_noret; correctly has no return stmt after luaD_throw"},
{"rule":"API00-C","file":"llex.c","line":124,"verdict":"FP","confidence":"high","reason":"luaX_syntaxerror internal; ls always valid"},
{"rule":"API00-C","file":"llex.c","line":124,"verdict":"FP","confidence":"high","reason":"luaX_syntaxerror internal; msg always valid from Lua error infrastructure"},
{"rule":"MSC37-C","file":"llex.c","line":124,"verdict":"FP","confidence":"high","reason":"luaX_syntaxerror is l_noret; calls lexerror which always longjmps"},
{"rule":"DCL13-C","file":"llex.c","line":135,"verdict":"FP","confidence":"high","reason":"ls is LexState* internal API; const-param advisory"},
{"rule":"API00-C","file":"llex.c","line":156,"verdict":"FP","confidence":"high","reason":"luaX_newstring internal; ls always valid"},
{"rule":"API00-C","file":"llex.c","line":156,"verdict":"FP","confidence":"high","reason":"luaX_newstring internal; str is buffer pointer from lexer, always valid"},
{"rule":"API05-C","file":"llex.c","line":156,"verdict":"FP","confidence":"high","reason":"conformant-array-parameter advisory; Lua does not use C99 VLA syntax"},
{"rule":"API00-C","file":"llex.c","line":176,"verdict":"FP","confidence":"high","reason":"luaX_setinput internal; L always valid"},
{"rule":"API00-C","file":"llex.c","line":176,"verdict":"FP","confidence":"high","reason":"luaX_setinput internal; ls always valid"},
{"rule":"API00-C","file":"llex.c","line":176,"verdict":"FP","confidence":"high","reason":"luaX_setinput internal; z always valid"},
{"rule":"API00-C","file":"llex.c","line":176,"verdict":"FP","confidence":"high","reason":"luaX_setinput internal; source is a TString* from Lua infrastructure"},
{"rule":"DCL13-C","file":"llex.c","line":176,"verdict":"FP","confidence":"high","reason":"z is ZIO* internal; const-param advisory"},
{"rule":"DCL13-C","file":"llex.c","line":176,"verdict":"FP","confidence":"high","reason":"source is TString* stored into ls->source; cannot be const"},
{"rule":"DCL00-C","file":"llex.c","line":353,"verdict":"FP","confidence":"high","reason":"r in readhexaesc is modified on next line via r = (r<<4)+gethexa; sqc wrong"},
{"rule":"INT14-C","file":"llex.c","line":354,"verdict":"FP","confidence":"high","reason":"r accumulates hex nibbles; mixed bitwise/arithmetic advisory only"},
{"rule":"INT13-C","file":"llex.c","line":354,"verdict":"FP","confidence":"high","reason":"r is 0 or positive hex digit; shift on bounded non-negative signed int is safe"},
{"rule":"INT14-C","file":"llex.c","line":374,"verdict":"FP","confidence":"high","reason":"r in readutf8esc bounded 0..0x7FFFFFFF; advisory only"},
{"rule":"INT13-C","file":"llex.c","line":374,"verdict":"FP","confidence":"high","reason":"r is non-negative and bounded by esccheck guard; shift is safe"},
{"rule":"ARR00-C","file":"llex.c","line":387,"verdict":"FP","confidence":"high","reason":"buff filled by luaO_utf8esc before read; buff[UTF8BUFFSZ-n] reads valid initialized bytes"},
{"rule":"EXP33-C","file":"llex.c","line":387,"verdict":"FP","confidence":"high","reason":"buff initialized by luaO_utf8esc which fills buff[UTF8BUFFSZ-n..UTF8BUFFSZ-1]"},
{"rule":"DCL00-C","file":"llex.c","line":393,"verdict":"FP","confidence":"high","reason":"r in readdecesc initialized to 0, modified in loop body"},
{"rule":"MSC37-C","file":"llex.c","line":467,"verdict":"FP","confidence":"high","reason":"llex infinite for-loop with all branches returning or continuing; no fall-off"},
{"rule":"EXP30-C","file":"llex.c","line":568,"verdict":"FP","confidence":"high","reason":"luaZ_buffer and luaZ_bufflen are pure struct-field macros; no side effects or sequencing issue"},
{"rule":"DCL00-C","file":"llex.c","line":578,"verdict":"FP","confidence":"high","reason":"c is single-char token value; const-qualify advisory only"},
{"rule":"API00-C","file":"llex.c","line":588,"verdict":"FP","confidence":"high","reason":"luaX_next internal; ls always valid"},
{"rule":"API00-C","file":"llex.c","line":599,"verdict":"FP","confidence":"high","reason":"luaX_lookahead internal; ls always valid"},
{"rule":"API00-C","file":"lobject.c","line":37,"verdict":"FP","confidence":"high","reason":"luaO_ceillog2 internal; x is bounded unsigned int from callers"},
{"rule":"INT14-C","file":"lobject.c","line":50,"verdict":"FP","confidence":"high","reason":"int2fb encoding mixes bitwise/arithmetic by design; advisory readability only"},
{"rule":"ARR00-C","file":"lobject.c","line":51,"verdict":"FP","confidence":"high","reason":"log_2[x] where x<256 enforced by while loop; bounds are safe"},
{"rule":"INT14-C","file":"lobject.c","line":63,"verdict":"FP","confidence":"high","reason":"luaO_codeparam encoding; mixed bitwise/arithmetic advisory"},
{"rule":"INT14-C","file":"lobject.c","line":63,"verdict":"FP","confidence":"high","reason":"cast macro usage; advisory readability only"},
{"rule":"INT14-C","file":"lobject.c","line":66,"verdict":"FP","confidence":"high","reason":"luaO_codeparam bit-twiddling; advisory only"},
{"rule":"INT14-C","file":"lobject.c","line":74,"verdict":"FP","confidence":"high","reason":"log computation; advisory only"},
{"rule":"MSC37-C","file":"lobject.c","line":89,"verdict":"FP","confidence":"high","reason":"luaO_applyparam has explicit return on all branches including nested else"},
{"rule":"DCL00-C","file":"lobject.c","line":91,"verdict":"FP","confidence":"high","reason":"m is modified (m += 0x10) in normalized branch; sqc wrong about never modified"},
{"rule":"INT14-C","file":"lobject.c","line":94,"verdict":"FP","confidence":"high","reason":"m in applyparam; mixed bitwise/arithmetic advisory"},
{"rule":"INT14-C","file":"lobject.c","line":96,"verdict":"FP","confidence":"high","reason":"e in applyparam; advisory only"},
{"rule":"EXP00-C","file":"lobject.c","line":98,"verdict":"FP","confidence":"high","reason":"operator precedence is correct; >> has lower precedence than / by C standard"},
{"rule":"INT14-C","file":"lobject.c","line":98,"verdict":"FP","confidence":"high","reason":"MAX_LMEM/0x1F >> e overflow check; advisory"},
{"rule":"INT13-C","file":"lobject.c","line":98,"verdict":"FP","confidence":"high","reason":"e = (p>>4) adjusted; range -7..7, non-negative when used here; safe shift"},
{"rule":"INT14-C","file":"lobject.c","line":99,"verdict":"FP","confidence":"high","reason":"x*m << e; advisory only"},
{"rule":"INT13-C","file":"lobject.c","line":99,"verdict":"FP","confidence":"high","reason":"e is non-negative in this branch (e>=0 guard); shift safe"},
{"rule":"FIO50-C","file":"lobject.c","line":106,"verdict":"FP","confidence":"high","reason":"no file I/O here; sqc misidentifies arithmetic expression as stream operation"},
{"rule":"FIO50-C","file":"lobject.c","line":106,"verdict":"FP","confidence":"high","reason":"no file I/O here; sqc misidentifies arithmetic expression as stream operation"},
{"rule":"INT13-C","file":"lobject.c","line":106,"verdict":"FP","confidence":"high","reason":"e is negative here (negated); >>e is right-shift on non-negative l_mem value"},
{"rule":"INT13-C","file":"lobject.c","line":107,"verdict":"FP","confidence":"high","reason":"x>>e where e>0 and x is l_mem (signed); in practice x>=0 as memory size"},
{"rule":"INT13-C","file":"lobject.c","line":108,"verdict":"FP","confidence":"high","reason":"x>>e; same as above, l_mem is a size-like signed value, non-negative in use"},
{"rule":"EXP30-C","file":"lobject.c","line":175,"verdict":"FP","confidence":"high","reason":"&& sequences operands; tonumberns assigns to separate n1/n2 with no aliasing"},
{"rule":"API00-C","file":"lobject.c","line":188,"verdict":"FP","confidence":"high","reason":"luaO_arith internal; op is a valid LUA_OP* constant"},
{"rule":"API00-C","file":"lobject.c","line":197,"verdict":"FP","confidence":"high","reason":"luaO_hexavalue internal; c is always a valid hex digit (assert guards)"},
{"rule":"INT07-C","file":"lobject.c","line":199,"verdict":"FP","confidence":"high","reason":"c is int (from ls->current); arithmetic c-'0' and c-'a' on bounded digit values"},
{"rule":"INT08-C","file":"lobject.c","line":199,"verdict":"FP","confidence":"high","reason":"c-'0' on hex digit 0-9; result bounded 0-9, no narrow overflow"},
{"rule":"INT08-C","file":"lobject.c","line":200,"verdict":"FP","confidence":"high","reason":"(ltolower(c)-'a')+10 on hex a-f; result bounded 10-15, no overflow"},
{"rule":"DCL00-C","file":"lobject.c","line":230,"verdict":"FP","confidence":"high","reason":"r is lua_Number modified in loop body; sqc wrong about never modified"},
{"rule":"DCL00-C","file":"lobject.c","line":233,"verdict":"FP","confidence":"high","reason":"e is int modified in loop and exponent section; sqc wrong"},
{"rule":"STR34-C","file":"lobject.c","line":236,"verdict":"FP","confidence":"high","reason":"*endptr == '\\0' comparison; NUL is 0, safe regardless of char signedness"},
{"rule":"STR34-C","file":"lobject.c","line":258,"verdict":"FP","confidence":"high","reason":"*endptr comparison to '\\0'; no sign-extension risk in equality test"},
{"rule":"STR34-C","file":"lobject.c","line":271,"verdict":"FP","confidence":"high","reason":"*endptr comparison to '\\0'; no sign-extension risk in equality test"},
{"rule":"EXP34-C","file":"lobject.c","line":296,"verdict":"FP","confidence":"high","reason":"endptr set to cast_charp(s) at top of lua_strx2number; always valid non-NULL"},
{"rule":"STR34-C","file":"lobject.c","line":317,"verdict":"FP","confidence":"high","reason":"pmode is const char*; ltolower(cast_uchar(*pmode)) uses proper unsigned cast"},
{"rule":"STR34-C","file":"lobject.c","line":317,"verdict":"FP","confidence":"high","reason":"*pmode used via cast_uchar; no sign-extension risk"},
{"rule":"STR34-C","file":"lobject.c","line":317,"verdict":"FP","confidence":"high","reason":"pmode is char*; no sign-extension in pointer comparison context"},
{"rule":"ENV01-C","file":"lobject.c","line":322,"verdict":"FP","confidence":"high","reason":"buff[L_MAXLENNUM+1] is for locale conversion, not getenv; no environment variable involved"},
{"rule":"MEM05-C","file":"lobject.c","line":322,"verdict":"FP","confidence":"high","reason":"L_MAXLENNUM is a compile-time constant 200; this is a fixed-size stack array, not a VLA"},
{"rule":"EXP05-C","file":"lobject.c","line":326,"verdict":"FP","confidence":"high","reason":"strcpy(buff, s) is correct const char* source; no cast-away of const"},
{"rule":"ARR36-C","file":"lobject.c","line":330,"verdict":"FP","confidence":"high","reason":"endptr points into buff (from l_str2dloc(buff,...)); subtraction valid within same array"},
{"rule":"DCL30-C","file":"lobject.c","line":332,"verdict":"FP","confidence":"high","reason":"endptr is adjusted to s+(endptr-buff) before return; points into caller's string s, not local buff"},
{"rule":"PRE02-C","file":"lobject.c","line":336,"verdict":"FP","confidence":"high","reason":"MAXBY10 macro is used as a value in comparison; no precedence risk"},
{"rule":"PRE02-C","file":"lobject.c","line":337,"verdict":"FP","confidence":"high","reason":"MAXLASTD macro is used as a value; no precedence risk"},
{"rule":"STR34-C","file":"lobject.c","line":355,"verdict":"FP","confidence":"high","reason":"*s is char used as isspace argument; comparison is safe for ASCII"},
{"rule":"STR34-C","file":"lobject.c","line":355,"verdict":"FP","confidence":"high","reason":"s pointer iteration; no sign-extension in pointer arithmetic"},
{"rule":"EXP33-C","file":"lobject.c","line":375,"verdict":"FP","confidence":"high","reason":"i filled by l_str2int output param; only used when l_str2int returns non-NULL"},
{"rule":"API00-C","file":"lobject.c","line":386,"verdict":"FP","confidence":"high","reason":"luaO_utf8esc internal; buff always valid stack buffer from caller"},
{"rule":"DCL15-C","file":"lobject.c","line":386,"verdict":"FP","confidence":"high","reason":"luaO_utf8esc declared in lobject.h for cross-TU use; cannot be static"},
{"rule":"DCL19-C","file":"lobject.c","line":386,"verdict":"FP","confidence":"high","reason":"luaO_utf8esc is declared in lobject.h; used by llex.c; scope is intentional"},
{"rule":"INT14-C","file":"lobject.c","line":395,"verdict":"FP","confidence":"high","reason":"x>>=6 in UTF-8 encoding loop on l_uint32; purely bitwise, advisory only"},
{"rule":"STR34-C","file":"lobject.c","line":429,"verdict":"FP","confidence":"high","reason":"buff is char array used with l_sprintf (snprintf); no sign-extension risk"},
{"rule":"API00-C","file":"lobject.c","line":449,"verdict":"FP","confidence":"high","reason":"luaO_tostringbuff internal; obj always a valid number TValue from runtime"},
{"rule":"API00-C","file":"lobject.c","line":464,"verdict":"FP","confidence":"high","reason":"luaO_tostring internal; L and obj always valid from VM"},
{"rule":"API00-C","file":"lobject.c","line":464,"verdict":"FP","confidence":"high","reason":"luaO_tostring internal; obj always valid"},
{"rule":"PRE02-C","file":"lobject.c","line":484,"verdict":"FP","confidence":"high","reason":"BUFVFS macro used only to initialize array size; no operator precedence issue"},
{"rule":"DCL13-C","file":"lobject.c","line":500,"verdict":"FP","confidence":"high","reason":"L is lua_State* assigned into buff->L; cannot be const"},
{"rule":"ARR01-C","file":"lobject.c","line":503,"verdict":"FP","confidence":"high","reason":"sizeof(buff->space) where space is a char array member; yields array size, not pointer size"},
{"rule":"DCL13-C","file":"lobject.c","line":513,"verdict":"FP","confidence":"high","reason":"ud is void* callback userdata cast to BuffFS*; cannot be const void*"},
{"rule":"STR31-C","file":"lobject.c","line":521,"verdict":"FP","confidence":"high","reason":"strcpy writes 4 bytes to b+blen-3; blen>3 invariant holds from addstr2buff logic"},
{"rule":"STR31-C","file":"lobject.c","line":523,"verdict":"FP","confidence":"high","reason":"strcpy writes 4 bytes to b+blen; buffer has buffsize-blen>=3 bytes but null may extend 1 past; however luaS_newlstr uses explicit blen length, not null termination"},
{"rule":"DCL30-C","file":"lobject.c","line":545,"verdict":"FP","confidence":"high","reason":"clearbuff returns getstr(tsvalue(...)) pointing to heap Lua string, not local variable"},
{"rule":"API05-C","file":"lobject.c","line":549,"verdict":"FP","confidence":"high","reason":"conformant-array-parameter advisory; Lua does not use C99 VLA syntax"},
{"rule":"API00-C","file":"lobject.c","line":596,"verdict":"FP","confidence":"high","reason":"luaO_pushvfstring internal; L always valid"},
{"rule":"API00-C","file":"lobject.c","line":596,"verdict":"FP","confidence":"high","reason":"luaO_pushvfstring internal; fmt always valid string from Lua error infrastructure"},
{"rule":"MSC39-C","file":"lobject.c","line":596,"verdict":"FP","confidence":"high","reason":"va_list passed by value is standard C; luaO_pushvfstring is the sole consumer"},
{"rule":"CON43-C","file":"lobject.c","line":602,"verdict":"FP","confidence":"high","reason":"no concurrency; single-threaded event loop; double-fetch concern does not apply"},
{"rule":"EXP47-C","file":"lobject.c","line":604,"verdict":"FP","confidence":"high","reason":"va_arg(argp, char*) reads a pointer, not char; no promotion issue"},
{"rule":"DCL00-C","file":"lobject.c","line":610,"verdict":"FP","confidence":"high","reason":"c stores single char read from va_arg; const-qualify advisory only"},
{"rule":"API00-C","file":"lobject.c","line":662,"verdict":"FP","confidence":"high","reason":"luaO_pushfstring internal; L always valid"},
{"rule":"API00-C","file":"lobject.c","line":662,"verdict":"FP","confidence":"high","reason":"luaO_pushfstring internal; fmt always valid"},
{"rule":"DCL30-C","file":"lobject.c","line":670,"verdict":"FP","confidence":"high","reason":"msg is return of luaO_pushvfstring which points to heap Lua string, not local var"},
{"rule":"PRE00-C","file":"lobject.c","line":680,"verdict":"FP","confidence":"high","reason":"addstr macro: a and b are plain pointer variables at all call sites"},
{"rule":"PRE01-C","file":"lobject.c","line":680,"verdict":"FP","confidence":"high","reason":"addstr macro: a and b are simple pointers; no precedence risk in member access"},
{"rule":"PRE12-C","file":"lobject.c","line":680,"verdict":"FP","confidence":"high","reason":"addstr macro: args are never side-effecting expressions at call sites"},
{"rule":"API00-C","file":"lobject.c","line":682,"verdict":"FP","confidence":"high","reason":"luaO_chunkid internal; out always valid buffer"},
{"rule":"API00-C","file":"lobject.c","line":682,"verdict":"FP","confidence":"high","reason":"luaO_chunkid internal; source always valid from Lua string"},
{"rule":"API05-C","file":"lobject.c","line":682,"verdict":"FP","confidence":"high","reason":"conformant-array-parameter advisory; Lua does not use C99 VLA syntax"},
{"rule":"API05-C","file":"lobject.c","line":682,"verdict":"FP","confidence":"high","reason":"conformant-array-parameter advisory; Lua does not use C99 VLA syntax"},
{"rule":"ARR38-C","file":"lobject.c","line":686,"verdict":"FP","confidence":"high","reason":"memcpy guarded by srclen<=bufflen check; size is valid"},
{"rule":"STR34-C","file":"lobject.c","line":689,"verdict":"FP","confidence":"high","reason":"*out='\\0' assigns NUL byte to char*; no sign-extension risk"},
{"rule":"ARR38-C","file":"lobject.c","line":694,"verdict":"FP","confidence":"high","reason":"memcpy guarded by srclen<=bufflen check in @-branch; size is valid"},
{"rule":"ARR38-C","file":"lobject.c","line":698,"verdict":"FP","confidence":"high","reason":"memcpy copies bufflen bytes after RETS prefix; remaining space calculated correctly"},
{"rule":"ARR38-C","file":"lobject.c","line":715,"verdict":"FP","confidence":"high","reason":"memcpy(out, POS, (LL(POS)+1)*sizeof(char)) copies 2 bytes; out has space (post-source content)"},
{"rule":"INT32-C","file":"lobject.c","line":715,"verdict":"FP","confidence":"high","reason":"LL(POS)=1 so (1+1)*1=2; no overflow possible"}
],
"fns": [],
"files_reviewed": ["lbaselib.c", "llex.c", "lobject.c"],
"files_clean": ["lbaselib.c", "llex.c", "lobject.c"],
"summary": {
"ground_truth": 0,
"tp": 0,
"fp": 160,
"fn": 0
}
}