Skip to content

Fix #15172 FP constParameterPointer with mmap() addr argument - #8992

Merged
danmar merged 1 commit into
cppcheck-opensource:mainfrom
mptre:cfg-mmap-addr
Nov 6, 2026
Merged

danmar merged 1 commit into
cppcheck-opensource:mainfrom
mptre:cfg-mmap-addr

Conversation

@mptre

@mptre mptre commented Nov 4, 2026

Copy link
Copy Markdown
Contributor

The first argument to mmap() was marked as direction="in", causing constParameterPointer to suggest declaring it as pointer to const. However, with MAP_FIXED any existing mapping at addr is replaced, so the pointed-to memory is effectively modified. Drop the direction from the first argument of mmap() in bsd.cfg and posix.cfg, and mmap64() in posix.cfg.

@dmcppcheck dmcppcheck left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AI review

The fix is incomplete. cfg/gnu.cfg also defines mmap (around line 1989), and its arg 1 still has direction="in". When gnu.cfg is loaded, the false positive is still reported: with --library=gnu, and also with --library=posix --library=gnu and --library=gnu --library=posix. On Linux, gnu.cfg is normally loaded, so most users of this check will still get the warning. The fix needs the same one-line change in gnu.cfg and a matching test in test/cfg/gnu.c. mmap64 is fixed in every load order, since only posix.cfg defines it.

The change also removes a false uninitvar on char buf[100]; mmap(buf, ...), which is a good side effect. Uninitialized pointer arguments are still reported. I found no other problems.

Testing

I built cppcheck from both pr/ and base/.

test/cfg/runtests.sh passes for posix.c, bsd.c and gnu.c on the PR build. pkg-config is missing here, so the script skipped its compiler syntax checks.

Test file scratch/t1.c:

#include <sys/mman.h>
void f1(void *addr) {
    (void)mmap(addr, 0x1000, PROT_READ, MAP_PRIVATE | MAP_FIXED, 0, 0);
}
void f2(char *addr) {
    (void)mmap64(addr, 0x1000, PROT_READ, MAP_PRIVATE | MAP_FIXED, 0, 0);
}
void f4(void) {
    char buf[100];
    (void)mmap(buf, 0x1000, PROT_READ, MAP_PRIVATE | MAP_FIXED, 0, 0);
}
void f5(void) {
    char *p;
    (void)mmap(p, 0x1000, PROT_READ, MAP_PRIVATE | MAP_FIXED, 0, 0);
}

Results:

  • --library=posix and --library=bsd: the PR fixes constParameterPointer for f1 and f2. The constVariable/uninitvar warnings on buf go away, and uninitvar on p is still reported.
  • gnu.cfg loaded: the false positive remains. Command and output:
$ pr/cppcheck -q --enable=style --library=gnu t1.c
t1.c:2:15: style: Parameter 'addr' can be declared as pointer to const [constParameterPointer]
t1.c:12:10: style: Variable 'buf' can be declared as const array [constVariable]
t1.c:13:16: error: Uninitialized variable: buf [uninitvar]
  • --library=posix --library=gnu (either order): the PR still reports constParameterPointer for f1 (mmap), but no longer for f2 (mmap64). The output for f1 is the same as in base.

Automated review of 4a06233 by Claude. The pull request was built and tested locally.

Comment thread cfg/posix.cfg Resolved
The first argument to mmap() was marked as direction="in", causing
constParameterPointer to suggest declaring it as pointer to const.
However, with MAP_FIXED any existing mapping at addr is replaced, so
the pointed-to memory is effectively modified. Drop the direction from
the first argument of mmap() in bsd.cfg and posix.cfg, and mmap64() in
posix.cfg.
@mptre

mptre commented Nov 5, 2026 via email

Copy link
Copy Markdown
Contributor Author

@dmcppcheck dmcppcheck left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AI review

I found no new problems. The earlier review said cfg/gnu.cfg also needed the fix, and the PR now has it. The constParameterPointer false positive on the addr argument of mmap()/mmap64() is gone with posix, bsd and gnu, and with posix,gnu and gnu,posix loaded together. uninitvar on an uninitialized pointer passed as addr is still reported.

Testing

  • Build: I built cppcheck in pr/ with make -j8 cppcheck. It built cleanly.

  • cfg tests: bash test/cfg/runtests.sh test/cfg/posix.c, test/cfg/bsd.c and test/cfg/gnu.c all printed SUCCESS and exited with 0. The script skipped its compiler syntax checks because pkg-config is not installed here.

  • Scratch test: scratch/t.c has these functions:

    • void f1(void *addr) calls mmap(addr, ..., MAP_FIXED, ...).
    • void f2(char *addr) calls mmap64(addr, ...).
    • f3 passes an uninitialized char *p to mmap.
    • f4 stores the mmap result in a local.

    I ran pr/cppcheck -q --enable=style --library=X t.c with X = posix, bsd, gnu, posix,gnu and gnu,posix.

  • Results:

    • No constParameterPointer is reported for f1 or f2 with any of these.
    • uninitvar on p in f3 is still reported every time.
    • The posix leak checks (leakReturnValNotUsed, memleak) still work.

Automated review of 634e4ed by Claude. The pull request was built and tested locally.

@danmar
danmar merged commit 4cd263c into cppcheck-opensource:main Nov 6, 2026
71 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants