Embed Notice

@lanodan Well yeah, these are the reasons why you have checkers with false positives and mostly only basic local reasoning.

From what I see, flawfinder is pattern matching well-known footguns by function name, rather than understanding these kinds of bugs semantically.
It can of course still be super useful given how common these footguns are, but it's not analyzing C deeply.

Clang analyzer does a lot of sophisticated analysis, but it is limited by the flexibility/vagueness of C's semantics.