40 improve uninitialized variable analysis with byte range lattice and interprocedural function summaries

CMakeLists.txt

@@ -66,6 +66,7 @@ set(STACK_ANALYZER_SOURCES
     src/analysis/StackBufferAnalysis.cpp
     src/analysis/StackComputation.cpp
     src/analysis/StackPointerEscape.cpp
+    src/analysis/UninitializedVarAnalysis.cpp
     src/report/ReportSerialization.cpp
     src/mangle.cpp
     src/passes/ModulePasses.cpp

README.md

@@ -62,6 +62,7 @@ LLVM_DIR=/opt/llvm/lib/cmake/llvm Clang_DIR=/opt/llvm/lib/cmake/clang ./build.sh
 --only-dir=<path> or --only-dir <path> filters by directory
 --only-function=<name> or --only-function <name> filters by function
 --only-func=<name> alias for --only-function
+--STL includes STL/system library functions (default excludes them)
 --dump-filter prints filter decisions (stderr)
 ```
 

include/StackUsageAnalyzer.hpp

@@ -46,6 +46,7 @@ namespace ctrace::stack
         std::vector<std::string> onlyFiles;
         std::vector<std::string> onlyDirs;
         std::vector<std::string> onlyFunctions;
+        bool includeSTL = false;
         bool dumpFilter = false;
         std::string dumpIRPath;
         bool dumpIRIsDir = false;
@@ -119,12 +120,13 @@ namespace ctrace::stack
         InvalidBaseReconstruction = 10,
         ConstParameterNotModified = 11,
         SizeMinusOneWrite = 12,
-        DuplicateIfCondition = 13
+        DuplicateIfCondition = 13,
+        UninitializedLocalRead = 14
     };
 
     template <> struct EnumTraits<DescriptiveErrorCode>
     {
-        static constexpr std::array<std::string_view, 14> names = {"None",
+        static constexpr std::array<std::string_view, 15> names = {"None",
                                                                    "StackBufferOverflow",
                                                                    "NegativeStackIndex",
                                                                    "VLAUsage",
@@ -137,7 +139,8 @@ namespace ctrace::stack
                                                                    "InvalidBaseReconstruction",
                                                                    "ConstParameterNotModified",
                                                                    "SizeMinusOneWrite",
-                                                                   "DuplicateIfCondition"};
+                                                                   "DuplicateIfCondition",
+                                                                   "UninitializedLocalRead"};
     };
 
     /*
@@ -160,6 +163,8 @@ namespace ctrace::stack
         DiagnosticSeverity severity = DiagnosticSeverity::Warning;
         DescriptiveErrorCode errCode = DescriptiveErrorCode::None;
         std::string ruleId;
+        double confidence = -1.0; // [0,1], negative means unset
+        std::string cweId;
         std::vector<std::string> variableAliasingVec;
         std::string message;
     };

include/analysis/UninitializedVarAnalysis.hpp

@@ -0,0 +1,37 @@
+#pragma once
+
+#include <functional>
+#include <string>
+#include <vector>
+
+namespace llvm
+{
+    class Function;
+    class Instruction;
+    class Module;
+} // namespace llvm
+
+namespace ctrace::stack::analysis
+{
+    enum class UninitializedLocalIssueKind
+    {
+        ReadBeforeDefiniteInit,
+        ReadBeforeDefiniteInitViaCall,
+        NeverInitialized
+    };
+
+    struct UninitializedLocalReadIssue
+    {
+        std::string funcName;
+        std::string varName;
+        const llvm::Instruction* inst = nullptr;
+        unsigned line = 0;
+        unsigned column = 0;
+        std::string calleeName;
+        UninitializedLocalIssueKind kind = UninitializedLocalIssueKind::ReadBeforeDefiniteInit;
+    };
+
+    std::vector<UninitializedLocalReadIssue>
+    analyzeUninitializedLocalReads(llvm::Module& mod,
+                                   const std::function<bool(const llvm::Function&)>& shouldAnalyze);
+} // namespace ctrace::stack::analysis

main.cpp

@@ -47,6 +47,7 @@ static void printHelp()
         << "  --only-file=<path>     Only report functions from this source file\n"
         << "  --only-dir=<path>      Only report functions under this directory\n"
         << "  --only-func=<name>     Only report functions with this name (comma-separated)\n"
+        << "  --STL                  Include STL/system library functions in analysis\n"
         << "  --stack-limit=<value>  Override stack size limit (bytes, or KiB/MiB/GiB)\n"
         << "  --dump-filter          Print filter decisions to stderr\n"
         << "  --dump-ir=<path>       Write LLVM IR to file (or directory for multiple inputs)\n"
@@ -419,6 +420,11 @@ int main(int argc, char** argv)
             cfg.quiet = true;
             continue;
         }
+        if (argStr == "--STL" || argStr == "--stl")
+        {
+            cfg.includeSTL = true;
+            continue;
+        }
         if (argStr == "--only-file")
         {
             if (i + 1 >= argc)

run_test.py

@@ -717,6 +717,18 @@ def check_cli_parsing_and_filters() -> bool:
         else:
             print(f"  ✅ macro case OK: {' '.join(opt)}")
 
+    # STL toggle
+    for opt in [["--STL"], ["--stl"]]:
+        cmd = [str(ANALYZER), str(sample)] + opt + ["--only-function=transition"]
+        result = subprocess.run(cmd, capture_output=True, text=True)
+        output = (result.stdout or "") + (result.stderr or "")
+        if result.returncode != 0 or "Function:" not in output:
+            print(f"  ❌ STL flag case failed: {' '.join(opt)}")
+            print(output)
+            ok = False
+        else:
+            print(f"  ✅ STL flag case OK: {' '.join(opt)}")
+
     print()
     return ok
 

src/StackUsageAnalyzer.cpp

@@ -32,6 +32,7 @@
 #include "analysis/StackBufferAnalysis.hpp"
 #include "analysis/StackComputation.hpp"
 #include "analysis/StackPointerEscape.hpp"
+#include "analysis/UninitializedVarAnalysis.hpp"
 #include "passes/ModulePasses.hpp"
 
 namespace ctrace::stack
@@ -922,6 +923,75 @@ namespace ctrace::stack
             }
         }
 
+        static void appendUninitializedLocalReadDiagnostics(
+            AnalysisResult& result,
+            const std::vector<analysis::UninitializedLocalReadIssue>& issues)
+        {
+            for (const auto& issue : issues)
+            {
+                unsigned line = issue.line;
+                unsigned column = issue.column;
+                bool haveLoc = (line != 0);
+                if (issue.inst)
+                {
+                    llvm::DebugLoc DL = issue.inst->getDebugLoc();
+                    if (DL)
+                    {
+                        line = DL.getLine();
+                        column = DL.getCol();
+                        haveLoc = true;
+                    }
+                }
+
+                std::ostringstream body;
+                if (issue.kind == analysis::UninitializedLocalIssueKind::ReadBeforeDefiniteInit)
+                {
+                    body << "  [!!] potential read of uninitialized local variable '"
+                         << issue.varName << "'\n";
+                    body << "       this load may execute before any definite initialization on "
+                            "all control-flow paths\n";
+                }
+                else if (issue.kind ==
+                         analysis::UninitializedLocalIssueKind::ReadBeforeDefiniteInitViaCall)
+                {
+                    body << "  [!!] potential read of uninitialized local variable '"
+                         << issue.varName << "'\n";
+                    body
+                        << "       this call may read the value before any definite initialization";
+                    if (!issue.calleeName.empty())
+                    {
+                        body << " in '" << issue.calleeName << "'";
+                    }
+                    body << "\n";
+                }
+                else
+                {
+                    body << "  [!] local variable '" << issue.varName << "' is never initialized\n";
+                    body << "      declared without initializer and no definite write was found "
+                            "in this function\n";
+                }
+
+                Diagnostic diag;
+                diag.funcName = issue.funcName;
+                diag.line = haveLoc ? line : 0;
+                diag.column = haveLoc ? column : 0;
+                diag.severity = DiagnosticSeverity::Warning;
+                diag.errCode = DescriptiveErrorCode::UninitializedLocalRead;
+                diag.ruleId =
+                    (issue.kind == analysis::UninitializedLocalIssueKind::ReadBeforeDefiniteInit ||
+                     issue.kind ==
+                         analysis::UninitializedLocalIssueKind::ReadBeforeDefiniteInitViaCall)
+                        ? "UninitializedLocalRead"
+                        : "UninitializedLocalVariable";
+                diag.confidence =
+                    (issue.kind == analysis::UninitializedLocalIssueKind::NeverInitialized) ? 0.75
+                                                                                            : 0.90;
+                diag.cweId = "CWE-457";
+                diag.message = body.str();
+                result.diagnostics.push_back(std::move(diag));
+            }
+        }
+
         static void appendInvalidBaseReconstructionDiagnostics(
             AnalysisResult& result,
             const std::vector<analysis::InvalidBaseReconstructionIssue>& issues)
@@ -1268,6 +1338,13 @@ namespace ctrace::stack
         appendDuplicateIfConditionDiagnostics(result, duplicateIfIssues);
         logDuration("Multiple stores", t0);
 
+        // 12c) Detect potential reads from uninitialized local stack variables
+        t0 = Clock::now();
+        std::vector<analysis::UninitializedLocalReadIssue> uninitializedReadIssues =
+            analysis::analyzeUninitializedLocalReads(mod, shouldAnalyzeFunction);
+        appendUninitializedLocalReadDiagnostics(result, uninitializedReadIssues);
+        logDuration("Uninitialized local reads", t0);
+
         // 13) Detect invalid base pointer reconstructions (offsetof/container_of)
         t0 = Clock::now();
         std::vector<analysis::InvalidBaseReconstructionIssue> baseReconIssues =