# Semgrep C/C++ Rules vs fold Detectors — Gap Matrix

> Generated 2026-05-29. Maps Semgrep's `p/c` and `p/cpp` rulesets (~80 rules) to fold detectors.

## Coverage Summary

| Category | Semgrep Rules | fold Has | fold Missing |
|----------|--------------|----------|-------------|
| Banned/deprecated functions | ~15 | 0 | 15 |
| Memory safety | ~10 | 7 | 3 |
| Injection | ~8 | 1 | 7 |
| Crypto misuse | ~8 | 0 | 8 |
| Information disclosure | ~6 | 0 | 6 |
| Resource management | ~5 | 3 | 2 |
| Input validation | ~5 | 0 | 5 |
| Concurrency | ~4 | 0 | 4 |
| Style/quality | ~20 | 0 | 20 |
| **Total** | **~80** | **11** | **~70** |

## Key Gaps fold Could Close (Phase 1 — Syntactic)

Semgrep's strength is pattern-matching. These rules require NO Z3 — just AST pattern matching like fold's existing `deprecated_api.cpp`:

| Semgrep Rule | fold Detector | Pattern |
|-------------|---------------|---------|
| `c.lang.security.insecure-use-gets` | `deprecated-gets` | `gets(...)` call |
| `c.lang.security.insecure-use-sprintf` | `deprecated-sprintf` | `sprintf(buf, fmt, ...)` with non-literal fmt |
| `c.lang.security.insecure-use-strcpy` | `deprecated-strcpy` | `strcpy(dst, src)` call |
| `c.lang.security.insecure-use-strcat` | `deprecated-strcat` | `strcat(dst, src)` call |
| `cpp.lang.security.insufficient-key-size` | `weak-crypto` | RSA < 2048, ECC < 256 bit |
| `c.lang.security.insecure-use-printf-fn` | `format-string` | Non-literal format arg to printf family |
| `c.lang.security.md5-used-as-password` | `weak-crypto-md5` | MD5() in password/hash context |
| `c.lang.security.sha1-used-as-password` | `weak-crypto-sha1` | SHA1() in password context |

## Semgrep Rules Impossible for fold

Patterns requiring whole-program or cross-file context that fold's single-TU design can't express:

| Rule | Why Not |
|------|--------|
| `insecure-use-memset` | Context-dependent (memset to zero before free is secure, other uses vary) |
| `detect-http-to-https-redirect` | Requires HTTP protocol semantics |
| `detect-weak-tls-ciphers` | Requires runtime config analysis |

## Recommended Priority

| Priority | Rules | Approach | Effort |
|----------|-------|----------|--------|
| 1 | Banned functions (5 rules) | Syntactic, extend deprecated_api.cpp | S |
| 2 | Crypto misuse (3 rules) | Syntactic, new weak-crypto detector | S |
| 3 | Format string (1 rule) | Syntactic, new format-string detector | S |
| 4 | Input validation (5 rules) | Partially syntactic, some Z3 | M |
| 5 | Info disclosure (6 rules) | Mostly contextual | L |

## What fold Already Does Better Than Semgrep

| Capability | fold | Semgrep |
|-----------|------|---------|
| Z3-proved findings | Yes (UNSAT proofs) | No (pattern only) |
| Control-flow analysis | Yes (CFG + path predicates) | No (single-statement matching) |
| Type-aware checking | Yes (bit-width, signedness) | No (text only) |
| Interprocedural analysis | Partial (summaries) | No |
| Semantic equivalence | Yes (Type-4 clones) | No |