585ae4e4ab
- clang-analysis-api-research.md: AST nodes, CFG, type system, constant folding - multi-language-ir-patterns.md: CodeQL shared engine, Infer SIL, Kani MIR→Goto-C - rust-clang-scanning-parity.md: 9-component comparison table, 8 priority fixes
55 lines
2.5 KiB
Markdown
55 lines
2.5 KiB
Markdown
# Rust ↔ Clang Scanning Pipeline Parity
|
|
|
|
> Generated 2026-05-28. Gap analysis between fold's two source scanning pipelines.
|
|
|
|
## Pipeline Comparison
|
|
|
|
| Component | Clang Pipeline | Rust Pipeline | Parity? |
|
|
|-----------|---------------|---------------|---------|
|
|
| Frontend | Clang LibTooling (in-process) | fold-rust + rustc_driver (subprocess) | Partial |
|
|
| AST/IR | `clang::Expr` tree → `ir::Expr` | HIR → `RustExprNode` | Partial |
|
|
| CFG | `security_walker.cpp` (homegrown) | None (expression tree only) | **No** |
|
|
| Path predicates | Full forking (if/else, ternary, &&/\|\|) | None (path=true always) | **No** |
|
|
| Z3 encoding | `encoder.cpp` (BV-64, typed) | `rust_ir_encoder.cpp` (BV-64 only) | Partial |
|
|
| Observer hooks | Full SafetyObserver interface | Partial (onPointerDeref, onBinaryArith, onDivision) | Partial |
|
|
| Type threading | Bit-width + signedness | int_width only (no signedness threading) | **No** |
|
|
| Interprocedural | SymbolicSummary + SummaryStore | None | **No** |
|
|
| Taint tracking | Source-to-sink flow | TaintOrigin (local only, no propagation) | Partial |
|
|
| Memory model | HeapModel (malloc/free tracking) | None | **No** |
|
|
|
|
## Priority Fixes
|
|
|
|
### Phase 1 — Quick wins (S effort, high impact)
|
|
|
|
| # | Gap | Fix | FP reduction |
|
|
|---|-----|-----|-------------|
|
|
| 1 | No path predicates | Fork path in encodeRustNode for &&/\|\| and ternaries | 30-40% null-deref |
|
|
| 2 | No known-safe prefixes | Add KnownSafePaths set to classify_origin | ~200 path-traversal |
|
|
|
|
### Phase 2 — Structural (M-L effort)
|
|
|
|
| # | Gap | Fix |
|
|
|---|-----|-----|
|
|
| 3 | No CFG | Wire MIR basic blocks into encoder (task 120) |
|
|
| 4 | No signedness | Thread int_signed through observer hooks (done: `93439bf`) |
|
|
| 5 | No Member encoding | Add Member case to encodeRustNode (done: `93439bf`) |
|
|
| 6 | No summaries | Interprocedural SymbolicSummary for Rust (task 123) |
|
|
|
|
### Phase 3 — Unification (M effort)
|
|
|
|
| # | Gap | Fix |
|
|
|---|-----|-----|
|
|
| 7 | Separate IR types | Add language discriminator to RustExprNode (task 124) |
|
|
| 8 | Separate encoders | Unify encodeRustIr + encodeClangExpr into single encodeIr |
|
|
|
|
## Current State
|
|
|
|
After this session's fixes, the Rust pipeline has:
|
|
- ✅ Taint origin tracking (LiteralValue vs UnknownProvenance)
|
|
- ✅ ts_rs function filtering (~500 FPs eliminated)
|
|
- ✅ augment_args filtering (~150 FPs eliminated)
|
|
- ✅ Rust signedness threading through observer hooks
|
|
- ✅ Member encoding for struct field access
|
|
- ✅ hasInit + isExceptionVariable filters for uninit-read
|
|
|
|
Remaining priorities: path predicate tracking (task 121) and MIR control flow (task 120).
|