Skip to content

Commit 4c70e13

Browse files
Fix TSA #2816218: suppress Flawfinder false positive on Cython read-loop iterator (#2030)
Flawfinder's buffer/read rule (CWE-120, CWE-20) fires whenever an identifier named "read" appears inside a loop, assuming it refers to the POSIX read() syscall. The Cython 3.x ModuleStateLookup boilerplate in __Pyx_State_ConvertFromInterpIdAsIndex uses "read" as the name of a pointer iterator that walks data->table, bounded by end = read + data->count. There is no syscall and no unbounded buffer access -- this is a false positive. Add an inline /* Flawfinder: ignore */ annotation to the flagged line in the Cython-generated pydevd_frame_evaluator.c and extend the existing post-processing block in setup_pydevd_cython.py so the annotation is re-applied automatically whenever Cython regenerates the .c files. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent 19c2b8c commit 4c70e13

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

src/debugpy/_vendored/pydevd/_pydevd_frame_eval/pydevd_frame_evaluator.c

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)