y2038: eliminate false positives with automatic build system detection by Hiesx · Pull Request #7631 · danmar/cppcheck

Hiesx · 2025-06-26T14:47:51Z

The Y2038 addon currently generates false positive warnings when scanning
codebases that are properly configured for Y2038 safety through build
system flags, making it impractical for comprehensive codebase analysis.

This prevents teams from running Y2038 checks across entire projects in
CI/CD pipelines due to noise from correctly configured code.

Add automatic build system detection to discover Y2038-related compiler
flags (_TIME_BITS=64, _FILE_OFFSET_BITS=64, _USE_TIME_BITS64) from:

Makefile variants (Makefile, makefile, GNUmakefile, *.mk)
CMake files (CMakeLists.txt, *.cmake)
Meson build files (meson.build)
Autotools scripts (configure, configure.ac, configure.in)
Compiler flags passed via cppcheck -D options

When proper Y2038 configuration is detected (both _TIME_BITS=64 AND
_FILE_OFFSET_BITS=64), suppress Y2038 warnings and display an
informational message indicating the configuration source.

Implement hierarchical directory search up to 5 levels from source files
to locate relevant build files, with flag precedence: build system >
compiler flags > source code #define directives.

Add performance optimizations:

Intelligent file caching with TTL-based invalidation
UTF-8 BOM handling for cross-platform compatibility
Robust import fallback system

Extend test suite with comprehensive coverage:

Compiler flag parsing edge cases (18 test scenarios)
Build system detection for all supported formats
Caching behavior and performance validation
Cross-platform file encoding handling

This enables organizations to run comprehensive Y2038 analysis on entire
codebases without false positives from properly configured projects,
while maintaining detection of actual Y2038 safety issues.

firewave · 2025-06-26T15:29:33Z

Thanks for you contribution.

Please add buildsystem.py to addons/README.md and win_installer/cppcheck.wxs (all other packaging related stuff should use wildcards).

Also please add yourself to AUTHORS so you get credited.

Hiesx · 2025-06-27T07:42:31Z

Added the buildsystem.py to addons/README.md and win_installer/cppcheck.wxs. In addition to this i also fixed the pylint errors!

danmar

I haven't really looked at the python code yet. Spontanously I feel this is very interesting and will make the y2038 more useful!

It's unfortunate that the doc/y2038.txt is a text document. It would probably make sense to switch to markdown. And I'm not sure why we don't have the info in the manual instead.
https://github.com/danmar/cppcheck/blob/main/man/manual.md#y2038py
I don't understand why the manual points at https://github.com/3adev/y2038
do you think that makes sense?

Hiesx · 2025-07-01T07:39:28Z

I also moved from the y2038.txt documentation file to a markdown one. Also the y2038.md file is now linked in the main manual and the reference to the 3adev/y2038 is now removed, since the current y2038 check is too different to reference it, imo.

sonarqubecloud · 2025-08-10T14:19:30Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

danmar · 2025-08-22T17:25:41Z

I think it's great that you fix the y2038 addon!

The Y2038 addon currently generates false positive warnings when scanning codebases that are properly configured for Y2038 safety through build system flags, making it impractical for comprehensive codebase analysis. This prevents teams from running Y2038 checks across entire projects in CI/CD pipelines due to noise from correctly configured code. Add automatic build system detection to discover Y2038-related compiler flags (_TIME_BITS=64, _FILE_OFFSET_BITS=64, _USE_TIME_BITS64) from: - Makefile variants (Makefile, makefile, GNUmakefile, *.mk) - CMake files (CMakeLists.txt, *.cmake) - Meson build files (meson.build) - Autotools scripts (configure, configure.ac, configure.in) - Compiler flags passed via cppcheck -D options When proper Y2038 configuration is detected (both _TIME_BITS=64 AND _FILE_OFFSET_BITS=64), suppress Y2038 warnings and display an informational message indicating the configuration source. Implement hierarchical directory search up to 5 levels from source files to locate relevant build files, with flag precedence: build system > compiler flags > source code #define directives. Add performance optimizations: - Intelligent file caching with TTL-based invalidation - UTF-8 BOM handling for cross-platform compatibility - Robust import fallback system Extend test suite with comprehensive coverage: - Compiler flag parsing edge cases (18 test scenarios) - Build system detection for all supported formats - Caching behavior and performance validation - Cross-platform file encoding handling This enables organizations to run comprehensive Y2038 analysis on entire codebases without false positives from properly configured projects, while maintaining detection of actual Y2038 safety issues.

sonarqubecloud · 2025-11-03T06:45:39Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

danmar · 2025-11-05T13:21:23Z

@Hiesx thanks! finally I merged this.

firewave · 2025-11-06T12:51:16Z

    // TODO: handle differently
    std::string cppcheckDefines() const {
-        return defines + (msc ? ";_MSC_VER=1900" : "") + (useMfc ? ";__AFXWIN_H__=1" : "");
+        std::ostringstream oss;


The TODO should have indicated that this function should not have been extended. Having this function is actually a current blocker of doing some improvement in the internal usage of this class.

I also do not understand why so many explicit things had to be added here. As they are defines that should just be used as such and not have dedicated fields. This seems the wrong approach.

That would also mean this will only work when using projects?

Hiesx force-pushed the feature/y2038_buildsystem_detection branch from ba0a6d5 to 9edcaf2 Compare June 27, 2025 07:41

danmar reviewed Jun 28, 2025

View reviewed changes

Comment thread addons/doc/y2038.txt Outdated

Comment thread addons/buildsystem.py Outdated

Hiesx force-pushed the feature/y2038_buildsystem_detection branch from 9edcaf2 to e84499e Compare July 1, 2025 07:35

danmar reviewed Jul 2, 2025

View reviewed changes

Comment thread addons/doc/y2038.md Outdated

Comment thread addons/doc/y2038.md Outdated

Hiesx force-pushed the feature/y2038_buildsystem_detection branch from e84499e to cf40a64 Compare July 9, 2025 17:22

danmar reviewed Jul 10, 2025

View reviewed changes

Comment thread addons/README.md Outdated

Comment thread addons/doc/y2038.md Outdated

Comment thread addons/doc/y2038.md Outdated

Hiesx force-pushed the feature/y2038_buildsystem_detection branch 3 times, most recently from 9ff635b to c3219bf Compare August 4, 2025 17:20

Hiesx force-pushed the feature/y2038_buildsystem_detection branch from c3219bf to a07154c Compare August 10, 2025 14:09

danmar reviewed Aug 22, 2025

View reviewed changes

Comment thread addons/doc/y2038.md Outdated

danmar reviewed Aug 22, 2025

View reviewed changes

Comment thread addons/README.md Outdated

Comment thread addons/doc/y2038.md Outdated

Comment thread addons/y2038_buildsystem.py Outdated

Comment thread man/manual.md Outdated

Hiesx force-pushed the feature/y2038_buildsystem_detection branch 3 times, most recently from bb5cb6b to dd4440e Compare October 31, 2025 08:23

danmar reviewed Nov 1, 2025

View reviewed changes

Comment thread lib/importproject.cpp Outdated

Comment thread addons/doc/y2038.md Outdated

danmar reviewed Nov 1, 2025

View reviewed changes

Comment thread man/manual.md Outdated

Hiesx force-pushed the feature/y2038_buildsystem_detection branch from dd4440e to 27f6b4f Compare November 3, 2025 06:26

Hiesx force-pushed the feature/y2038_buildsystem_detection branch from 27f6b4f to bdd4b7e Compare November 3, 2025 06:35

danmar merged commit 5fd0e6c into danmar:main Nov 5, 2025
55 checks passed

firewave reviewed Nov 6, 2025

View reviewed changes

Conversation

Hiesx commented Jun 26, 2025

Uh oh!

firewave commented Jun 26, 2025

Uh oh!

Hiesx commented Jun 27, 2025

Uh oh!

danmar left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Hiesx commented Jul 1, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud bot commented Aug 10, 2025

Quality Gate passed

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

danmar commented Aug 22, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud bot commented Nov 3, 2025

Quality Gate passed

Uh oh!

Uh oh!

danmar commented Nov 5, 2025

Uh oh!

firewave Nov 6, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants