Skip to content

Add a check for VideoSnapshot&& to ImageViewRGB32 conversion #1142

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
pifopi wants to merge 5 commits into
base: main
Choose a base branch
from
+30 −5
Draft

Add a check for VideoSnapshot&& to ImageViewRGB32 conversion #1142

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
3183b65
Add a check for VideoSnapshot&& to ImageViewRGB32 conversion
pifopi Mar 11, 2026
9b72ad6
Improve script
pifopi Mar 23, 2026
c3891e4
One file at a time
pifopi Mar 23, 2026
22f4c19
for each
pifopi Mar 23, 2026
6a74556
back to previous query
pifopi Mar 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 30 additions & 5 deletions .github/workflows/cpp-ci-serial-programs-base.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,10 +140,35 @@ jobs:
)
EOF

files=$(jq -r '.[].file' SerialPrograms/bin/compile_commands.json)
echo "$files" | xargs --max-args=150 clang-query -p SerialPrograms/bin/ -f query.txt >> output.txt
cat output.txt
if grep --silent "Match #" output.txt; then
echo "::error Forbidden std::filesystem::path construction detected!"
files=$(jq --raw-output '.[].file' SerialPrograms/bin/compile_commands.json)
for file in $files; do
echo "Processing: $file"
clang-query -p SerialPrograms/bin/ -f query.txt "$file" >> clang-query-stdout.txt
done

FOUND_FORBIDDEN=0
if grep --quiet "Binding for 'path_error'" clang-query-stdout.txt; then
echo "std::filesystem::path created from std::string. More information https://discord.com/channels/695809740428673034/1462210406616531259/1462567541825339635"
FOUND_FORBIDDEN=1
fi
if grep --quiet "Binding for 'view_error'" clang-query-stdout.txt; then
echo "ImageViewRGB32 created from VideoSnapshot&& that is stored. It is a dangling pointer as nothing hold the data anymore"
FOUND_FORBIDDEN=1
fi

if [ "$FOUND_FORBIDDEN" -eq 1 ]; then
echo "Clang query encountered a banned pattern."
echo "Check clang-query-stdout.txt below."
exit 1
fi

echo "Scan completed successfully with no violations."

- name: Upload Clang query output
uses: actions/upload-artifact@v7
if: inputs.run-clang-query && always()
with:
name: Clang query output (compiler=${{inputs.compiler}})
path: |
Arduino-Source/SerialPrograms/bin/compile_commands.json
Arduino-Source/clang-query-stdout.txt
Loading