Example of GCC SARIF output showing LTO report of a cross-TU type-mismatch in a use of a variadic API

a.wpa.sarif

{"$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json", "runs": [{"results": [{"level": "warning", "ruleId": "-Wanalyzer-va-arg-type-mismatch", "locations": [{"logicalLocations": [{"decoratedName": "called_by_test_type_mismatch_1", "kind": "function", "name": "called_by_test_type_mismatch_1", "fullyQualifiedName": "called_by_test_type_mismatch_1"}], "physicalLocation": {"contextRegion": {"startLine": 19, "snippet": {"text": "  str = va_arg (ap, const char *); /* { dg-warning \"'va_arg' expected '\\[^\\n\\r\\]*' but received 'int' for variadic argument 1 of 'ap'\" } */\n"}}, "artifactLocation": {"uri": "../../src/gcc/testsuite/gcc.dg/analyzer/stdarg-lto-1-a.c", "uriBaseId": "PWD"}, "region": {"startLine": 19, "endColumn": 8, "startColumn": 7}}}], "message": {"text": "‘va_arg’ expected ‘const char *’ but received ‘int’ for variadic argument 1 of ‘ap’"}, "taxa": [{"id": "686", "toolComponent": {"name": "cwe"}}], "codeFlows": [{"threadFlows": [{"locations": [{"nestingLevel": 1, "location": {"logicalLocations": [{"decoratedName": "test_type_mismatch_1", "kind": "function", "name": "test_type_mismatch_1", "fullyQualifiedName": "test_type_mismatch_1"}], "message": {"text": "entry to ‘test_type_mismatch_1’"}, "physicalLocation": {"contextRegion": {"startLine": 3, "snippet": {"text": "void test_type_mismatch_1 (void)\n"}}, "artifactLocation": {"uri": "../../src/gcc/testsuite/gcc.dg/analyzer/stdarg-lto-1-b.c", "uriBaseId": "PWD"}, "region": {"startLine": 3, "endColumn": 7, "startColumn": 6}}}, "kinds": ["enter", "function"]}, {"nestingLevel": 1, "location": {"logicalLocations": [{"decoratedName": "test_type_mismatch_1", "kind": "function", "name": "test_type_mismatch_1", "fullyQualifiedName": "test_type_mismatch_1"}], "message": {"text": "calling ‘called_by_test_type_mismatch_1’ from ‘test_type_mismatch_1’ with 1 variadic argument"}, "physicalLocation": {"contextRegion": {"startLine": 5, "snippet": {"text": "  called_by_test_type_mismatch_1 (42, 1066);\n"}}, "artifactLocation": {"uri": "../../src/gcc/testsuite/gcc.dg/analyzer/stdarg-lto-1-b.c", "uriBaseId": "PWD"}, "region": {"startLine": 5, "endColumn": 4, "startColumn": 3}}}, "kinds": ["call", "function"]}, {"nestingLevel": 2, "location": {"logicalLocations": [{"decoratedName": "called_by_test_type_mismatch_1", "kind": "function", "name": "called_by_test_type_mismatch_1", "fullyQualifiedName": "called_by_test_type_mismatch_1"}], "message": {"text": "entry to ‘called_by_test_type_mismatch_1’"}, "physicalLocation": {"contextRegion": {"startLine": 12, "snippet": {"text": "called_by_test_type_mismatch_1 (int placeholder, ...)\n"}}, "artifactLocation": {"uri": "../../src/gcc/testsuite/gcc.dg/analyzer/stdarg-lto-1-a.c", "uriBaseId": "PWD"}, "region": {"startLine": 12, "endColumn": 2, "startColumn": 1}}}, "kinds": ["enter", "function"]}, {"nestingLevel": 2, "location": {"logicalLocations": [{"decoratedName": "called_by_test_type_mismatch_1", "kind": "function", "name": "called_by_test_type_mismatch_1", "fullyQualifiedName": "called_by_test_type_mismatch_1"}], "message": {"text": "‘va_arg’ expected ‘const char *’ but received ‘int’ for variadic argument 1 of ‘ap’"}, "physicalLocation": {"contextRegion": {"startLine": 19, "snippet": {"text": "  str = va_arg (ap, const char *); /* { dg-warning \"'va_arg' expected '\\[^\\n\\r\\]*' but received 'int' for variadic argument 1 of 'ap'\" } */\n"}}, "artifactLocation": {"uri": "../../src/gcc/testsuite/gcc.dg/analyzer/stdarg-lto-1-a.c", "uriBaseId": "PWD"}, "region": {"startLine": 19, "endColumn": 8, "startColumn": 7}}}, "kinds": ["danger"]}]}]}]}], "artifacts": [{"location": {"uri": "../../src/gcc/testsuite/gcc.dg/analyzer/stdarg-lto-1-a.c", "uriBaseId": "PWD"}, "contents": {"text": "/* { dg-do link } */\n/* { dg-require-effective-target lto } */\n/* { dg-additional-options \"-flto\" } */\n/* { dg-additional-sources stdarg-lto-1-b.c } */\n\n#include <stdarg.h>\n#include \"stdarg-lto-1.h\"\n\n/* Type mismatch: expect const char *, but passed an int.  */\n\nvoid\ncalled_by_test_type_mismatch_1 (int placeholder, ...)\n{\n  const char *str;\n  \n  va_list ap;\n  va_start (ap, placeholder);\n\n  str = va_arg (ap, const char *); /* { dg-warning \"'va_arg' expected '\\[^\\n\\r\\]*' but received 'int' for variadic argument 1 of 'ap'\" } */\n\n  va_end (ap);\n}\n\nint main() { return 0; }\n"}}, {"location": {"uri": "../../src/gcc/testsuite/gcc.dg/analyzer/stdarg-lto-1-b.c", "uriBaseId": "PWD"}, "contents": {"text": "#include \"stdarg-lto-1.h\"\n\nvoid test_type_mismatch_1 (void)\n{\n  called_by_test_type_mismatch_1 (42, 1066);\n}\n"}}], "tool": {"driver": {"fullName": "GNU GIMPLE (GCC) version 13.0.0 20220707 (experimental) (x86_64-pc-linux-gnu)", "name": "GNU GIMPLE", "rules": [{"id": "-Wanalyzer-va-arg-type-mismatch", "helpUri": "https://gcc.gnu.org/onlinedocs/gcc/Static-Analyzer-Options.html#index-Wanalyzer-va-arg-type-mismatch"}], "informationUri": "https://gcc.gnu.org/gcc-13/", "version": "13.0.0 20220707 (experimental)"}}, "originalUriBaseIds": {"PWD": {"uri": "file:///home/david/coding/gcc-newgit-clean/build/gcc/"}}, "taxonomies": [{"organization": "MITRE", "name": "CWE", "version": "4.7", "shortDescription": {"text": "The MITRE Common Weakness Enumeration"}, "taxa": [{"id": "686", "helpUri": "https://cwe.mitre.org/data/definitions/686.html"}]}]}], "version": "2.1.0"}