Configure Clang static analyzer CI

.github/workflows/clang-analyzer.yml

@@ -0,0 +1,51 @@
+
+name: Clang Static Analyzer
+on: [push, pull_request]
+
+jobs:
+  Analyze:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          submodules: true
+
+      - name: Prepare
+        run: |
+          sudo apt-get -qq update
+          sudo apt-get -qq install ninja-build clang-tools
+
+      - name: Configure
+        run: |
+          mkdir build
+          cd build
+          scan-build cmake -G Ninja -DPCRE2_SUPPORT_JIT=ON -DCMAKE_BUILD_TYPE=Debug ..
+
+      - name: Build
+        run: |
+          # Inefficiently run clang scan twice; once to generate HTML, and secondly
+          # to generate SARIF files. Ideally we would have some way to scan once and
+          # generate one of those outputs from the other, but I don't know a good way
+          # to do that.
+          cd build
+          scan-build -o clang-report/ ninja
+
+          ninja clean
+          scan-build -o clang-sarif -sarif ninja
+          # Work around issue in GitHub's SARIF ingestion - merge all SARIF files into one
+          npx -y @microsoft/sarif-multitool merge clang-sarif/*/*.sarif --output-file=clang.sarif
+
+      # Upload the browsable HTML report as an artifact.
+      - name: Upload report
+        uses: actions/upload-artifact@v4
+        with:
+          name: "Clang Static Analyzer report"
+          path: './build/clang-report'
+
+      # Upload the results to GitHub's code scanning dashboard.
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: build/clang.sarif
+          category: clang-analyzer

.github/workflows/scorecards.yml

@@ -51,6 +51,7 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@5f532563584d71fdef14ee64d17bafb34f751ce5 # v1.0.26
+        uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: results.sarif
+          category: ossf-scorecard

src/pcre2_compile.c

@@ -2964,6 +2964,8 @@ ptrdiff_t parsed_pattern_extra_check = 0;
 PCRE2_SPTR ptr_check;
 #endif
 
+PCRE2_ASSERT(parsed_pattern != NULL);
+
 /* Insert leading items for word and line matching (features provided for the
 benefit of pcre2grep). */
 
@@ -7131,6 +7133,7 @@ for (;; pptr++)
     /* Save start of previous item, in case we have to move it up in order to
     insert something before it, and remember what it was. */
 
+    PCRE2_ASSERT(previous != NULL);
     tempcode = previous;
     op_previous = *previous;
 
@@ -10154,6 +10157,7 @@ PCRE2_ZERO_TERMINATED. Check for an overlong pattern. */
 
 if ((zero_terminated = (patlen == PCRE2_ZERO_TERMINATED)))
   patlen = PRIV(strlen)(pattern);
+(void)zero_terminated; /* Silence compiler; only used if Valgrind enabled */
 
 if (patlen > ccontext->max_pattern_length)
   {

src/pcre2_compile_class.c

@@ -1103,7 +1103,7 @@ while (TRUE)
   int posix_class;
   int taboffset, tabopt;
   uint8_t pbits[32];
-  uint32_t escape, c, d;
+  uint32_t escape, c;
 
   /* Handle POSIX classes such as [:alpha:] etc. */
   switch (META_CODE(meta))
@@ -1408,7 +1408,7 @@ while (TRUE)
   characters are equal, and for hyphens that cannot indicate a range. At
   this point, therefore, no checking is needed. */
 
-  c = d = meta;
+  c = meta;
 
   /* Remember if \r or \n were explicitly used */
 
@@ -1418,6 +1418,8 @@ while (TRUE)
 
   if (*pptr == META_RANGE_LITERAL || *pptr == META_RANGE_ESCAPED)
     {
+    uint32_t d;
+
 #ifdef EBCDIC
     BOOL range_is_literal = (*pptr == META_RANGE_LITERAL);
 #endif

src/pcre2_match.c

@@ -5792,6 +5792,8 @@ fprintf(stderr, "++ %2ld op=%3d %s\n", Fecode - mb->start_code, *Fecode,
 
       /* Disable compiler warning. */
       offset = 0;
+      (void)offset;
+
       for (;;)
         {
         if (*ecode == OP_CREF)

src/pcre2_printint.c

@@ -329,8 +329,6 @@ else
 Arguments:
   f            file to write to
   code         pointer in the compiled code
-
-Returns:       end of the character list
 */
 
 static PCRE2_SPTR
@@ -527,14 +525,17 @@ if (printmap)
 if (*code == OP_XCLASS)
   {
   PCRE2_UCHAR ch;
+
   while ((ch = *ccode++) != XCL_END)
     {
     const char *notch = "";
+
     if (ch >= XCL_LIST)
       {
       ccode = print_char_list(f, ccode - 1, char_lists_end);
       break;
       }
+
     switch(ch)
       {
       case XCL_NOTPROP:
@@ -567,6 +568,7 @@ if (*code == OP_XCLASS)
           }
         }
       break;
+
       default:
       ccode += 1 + print_char(f, ccode, utf);
       if (ch == XCL_RANGE)
@@ -577,6 +579,8 @@ if (*code == OP_XCLASS)
       break;
       }
     }
+
+  PCRE2_ASSERT(ccode == code + GET(code, 1));
   }
 
 /* Indicate a non-UTF class which was created by negation */

src/pcre2_substitute.c

@@ -766,6 +766,7 @@ do
         }
 
       next = 0; /* not used or updated after this point */
+      (void)next;
 
       /* In extended mode we recognize ${name:+set text:unset text} and
       ${name:-default text}. */

src/pcre2grep.c

@@ -1539,12 +1539,13 @@ switch(endlinetype)
   for (;;)
     {
     while (p < endptr && *p != '\r') p++;
-    if (++p >= endptr)
+    if (p == endptr)
       {
       *lenptr = 0;
       return endptr;
       }
-    if (*p == '\n')
+    p++;
+    if (p < endptr && *p == '\n')
       {
       *lenptr = 2;
       return p + 1;

src/pcre2test.c

@@ -8056,6 +8056,7 @@ for (gmatched = 0;; gmatched++)
   if ((dat_datctl.control & (CTL_FINDLIMITS|CTL_FINDLIMITS_NOHEAP)) != 0)
     {
     capcount = 0;  /* This stops compiler warnings */
+    (void)capcount;
 
     if ((dat_datctl.control & CTL_FINDLIMITS_NOHEAP) == 0 &&
         (FLD(compiled_code, executable_jit) == NULL ||