585ae4e4ab
- clang-analysis-api-research.md: AST nodes, CFG, type system, constant folding - multi-language-ir-patterns.md: CodeQL shared engine, Infer SIL, Kani MIR→Goto-C - rust-clang-scanning-parity.md: 9-component comparison table, 8 priority fixes
2.5 KiB
2.5 KiB
Rust ↔ Clang Scanning Pipeline Parity
Generated 2026-05-28. Gap analysis between fold's two source scanning pipelines.
Pipeline Comparison
| Component | Clang Pipeline | Rust Pipeline | Parity? |
|---|---|---|---|
| Frontend | Clang LibTooling (in-process) | fold-rust + rustc_driver (subprocess) | Partial |
| AST/IR | clang::Expr tree → ir::Expr |
HIR → RustExprNode |
Partial |
| CFG | security_walker.cpp (homegrown) |
None (expression tree only) | No |
| Path predicates | Full forking (if/else, ternary, &&/||) | None (path=true always) | No |
| Z3 encoding | encoder.cpp (BV-64, typed) |
rust_ir_encoder.cpp (BV-64 only) |
Partial |
| Observer hooks | Full SafetyObserver interface | Partial (onPointerDeref, onBinaryArith, onDivision) | Partial |
| Type threading | Bit-width + signedness | int_width only (no signedness threading) | No |
| Interprocedural | SymbolicSummary + SummaryStore | None | No |
| Taint tracking | Source-to-sink flow | TaintOrigin (local only, no propagation) | Partial |
| Memory model | HeapModel (malloc/free tracking) | None | No |
Priority Fixes
Phase 1 — Quick wins (S effort, high impact)
| # | Gap | Fix | FP reduction |
|---|---|---|---|
| 1 | No path predicates | Fork path in encodeRustNode for &&/|| and ternaries | 30-40% null-deref |
| 2 | No known-safe prefixes | Add KnownSafePaths set to classify_origin | ~200 path-traversal |
Phase 2 — Structural (M-L effort)
| # | Gap | Fix |
|---|---|---|
| 3 | No CFG | Wire MIR basic blocks into encoder (task 120) |
| 4 | No signedness | Thread int_signed through observer hooks (done: 93439bf) |
| 5 | No Member encoding | Add Member case to encodeRustNode (done: 93439bf) |
| 6 | No summaries | Interprocedural SymbolicSummary for Rust (task 123) |
Phase 3 — Unification (M effort)
| # | Gap | Fix |
|---|---|---|
| 7 | Separate IR types | Add language discriminator to RustExprNode (task 124) |
| 8 | Separate encoders | Unify encodeRustIr + encodeClangExpr into single encodeIr |
Current State
After this session's fixes, the Rust pipeline has:
- ✅ Taint origin tracking (LiteralValue vs UnknownProvenance)
- ✅ ts_rs function filtering (~500 FPs eliminated)
- ✅ augment_args filtering (~150 FPs eliminated)
- ✅ Rust signedness threading through observer hooks
- ✅ Member encoding for struct field access
- ✅ hasInit + isExceptionVariable filters for uninit-read
Remaining priorities: path predicate tracking (task 121) and MIR control flow (task 120).