Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
dlang/dmd
master @ 93da0e2
42
Fixes
0
CVEs
HIGH
Peak severity
34.4%
Coverage
Highlights
Memory Safety: 16 prior fixes. Scrutinize any change in this area.
compiler/src/dmd/safe.d: most-fixed (5 issues). Treat as high-risk during review.
13 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Memory Safety: The compiler's type safety validation logic has repeatedly failed to catch unsafe actions in `@safe` code, such as invalid array casts, unsafe union overlaps, and casting base types to derived C++ classes without RTTI. This allows bypasses of the compiler's primary memory safety invariants.
Integer Overflow: Array allocation wrappers in the runtime are susceptible to integer overflows when computing allocation sizes and padding values, leading to undersized heap allocations and subsequent buffer overflows or heap memory corruption.
Memory Corruption: Vulnerabilities in the garbage collector implementation (such as invalidation errors in the block cache and premature frees of GC objects before finalization) have historically triggered severe memory corruption and use-after-free bugs.