Hello @Xazax-hun I am interested in this topic, I have been working on my proposal and checking all provided materials, I also checked the tutorials mentioned here Static Analysis in Clang - Resources - Google Docs
I have a better understanding for CSA now, I have wrote my proposal and shared it with Daniel Domjan.
The gap today: The checker hardcodes 12 basic_string invalidating methods and 3 inner pointer access functions (c_str, data, std::data). This means vector::data(), string::operator[], optional::value(), and all other STL containers are completely invisible to it.
The bridge: LifetimeAnnotations.h already provides generic queries isContainerInvalidationMethod(), shouldTrackImplicitObjectArg(), isGslOwnerType(), shouldTrackFirstArgument(), that cover all [[gsl::Owner]] types. These functions check [clang::lifetimebound] on method parameters to determine whether a return value depends on the object’s lifetime.
Proposed approach: Extend InnerPointerChecker’s checkPostCall to consult these annotation queries alongside the existing hardcoded lists (kept as fallback). During checkPostCall, when a method on a [[gsl::Owner]] type has LifetimeBoundAttr on its implicit this parameter, the checker creates a symbolic dependency between the return value and the container in RawPtrMap —so subsequent invalidation triggers use-after-free detection. A new checkPreCall would handle [clang::lifetime_capture_by]
Impact beyond STL: Since annotations work on user-defined types too (e.g., a ConnectionPool annotated with [gsl::Owner] and [clang::lifetimebound] on its borrow() method),this extends the checker’s reach to any type that opts in via annotations.
we will get warning here after the proposed implementation.
let me know if there anything I can dot. Thank you
