From c15c2bbe2ae85880c7716d77242b334cc46eaa22 Mon Sep 17 00:00:00 2001 From: ericsson-kuma Date: Mon, 6 Jul 2026 07:56:19 +0800 Subject: [PATCH] fix remaining clang-tidy findings in the C sources Fix the two findings left in issue #353: h_malloc.c:432 clang-analyzer-security.ArrayBound: false positive. slots is limited to MAX_SLAB_SLOT_COUNT (256) via size_class_slots, so (slots - 1) / U64_WIDTH <= 3 and i always stays within the 4 bitmap words; random_index is bounded by slots as well. The analyzer can't see either bound across translation units (slots is loaded from a u16 field and get_random_u16_uniform is defined in random.c), so suppress the report with a targeted NOLINT instead of disabling the check. util.h:51 bugprone-narrowing-conversions: make the conversion explicit with a cast. int64_t rather than long long since casting to the higher rank long long trips bugprone-misplaced-widening-cast. The same bits reach __builtin_ffsll as before and the built library is unchanged. --- h_malloc.c | 5 ++++- util.h | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/h_malloc.c b/h_malloc.c index fc95bd47..88ea7646 100644 --- a/h_malloc.c +++ b/h_malloc.c @@ -429,7 +429,10 @@ static size_t get_free_slot(struct random_state *rng, size_t slots, const struct } i = i == (slots - 1) / U64_WIDTH ? 0 : i + 1; - masked = metadata->bitmap[i]; + // false positive: i is bounded by the bitmap length since slots is limited to + // MAX_SLAB_SLOT_COUNT (256) and random_index is bounded by slots, but the + // analyzer can't see either bound across translation units + masked = metadata->bitmap[i]; // NOLINT(clang-analyzer-security.ArrayBound) } } else { for (size_t i = 0; i <= (slots - 1) / U64_WIDTH; i++) { diff --git a/util.h b/util.h index 72c28d8b..7d5f6485 100644 --- a/util.h +++ b/util.h @@ -48,7 +48,7 @@ typedef unsigned __int128 u128; #define U64_WIDTH 64 static inline int ffz64(u64 x) { - return __builtin_ffsll(~x); + return __builtin_ffsll((int64_t) ~x); } // parameter must not be 0