Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
llvm-mirror/clang
master @ aa231e4
28
Fixes
2
CVEs
HIGH
Peak severity
33.3%
Coverage
Highlights
Memory Safety: 12 prior fixes. Scrutinize any change in this area.
lib/AST/ASTContext.cpp: most-fixed (3 issues). Treat as high-risk during review.
3 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Integer Overflow: Integer overflows during C++ array size allocation computations can lead to undersized heap allocations and subsequent heap buffer overflows. Mitigating this requires validating the cookie and array multiplication size calculations using safe arithmetic builtins.
Memory Safety: The ASTContext contains multiple stack-based buffer overflows stemming from unsafe `sprintf` usage during type name generation. Standardizing on dynamically-allocated buffers or strict boundary assertions is required to avoid corrupting the stack.
Use After Free: Reference invalidation during map lookups and container modifications in ASTContext can result in use-after-free vulnerabilities. These must be prevented by making local copies of values before performing operations that can reallocate or modify the map.