Scott McPeak

semgrep --verbose says there is a "list of default ignores: https://semgrep.dev/docs/cli-usage/#ignoring-files"

4

If `semgrep` is run with `--verbose`, it prints a message about `.semgrepignore`: ``` $ semgrep -e print -l python --verbose hello.py No .semgrepignore found. Using default .semgrepignore rules. See the...

semgrep/cli/tests/e2e/test_baseline.py requires a recent (>=2.30) /usr/bin/git

1

Some of the tests in `semgrep/cli`, such as `tests/e2e/test_baseline.py`, require that `/usr/bin/git` exist and be at least version 2.30. If `/usr/bin/git` is too old: ``` semgrep/cli$ pytest tests/e2e/test_baseline.py::test_one_commit_with_baseline [...] tests/e2e/test_baseline.py...

semgrep --baseline-commit requires git 2.30 or later

2

If the `--baseline-commit` option is passed to `semgrep`, it invokes the `git` on the `PATH`. If the `git` version is 2.29 or earlier, it will fail: ``` $ semgrep -e...

semgrep/README.md: Broken "Contributing" link

1

The README.md file, which is served from github at https://github.com/returntocorp/semgrep, has in the "More" section a link called "Contributing" that goes to: * https://semgrep.dev/docs/contributing/how-to-contribute/ The link yields "Page not found"....

callbacks that run after caml_startup crash on stack overflow instead of raising Stack_overflow

2

In normal usage (on Linux/x86_64), if OCaml code exhausts the stack, `Stack_overflow` is raised. However, if a C program embeds the OCaml runtime, then any OCaml callbacks invoked after `caml_startup`...

heapsort and heapsort_r: Undefined behavior due to out of bounds pointer arithmetic

1

The `heapsort` and `heapsort_r` functions both contain this code: ``` /* * Items are numbered from 1 to nmemb, so offset from size bytes * below the starting address. */...

semgrep-hack/lib/scanner.cc: str: use after free due to "return str.c_str();"

1

In `semgrep-core/src/tree-sitter-lang/semgrep-hack/lib/scanner.cc`, there is this code: ``` string str; str += chr; return str.c_str(); ``` This creates a local `string` and returns a pointer to its internal buffer, but that...

"Error: Pure bytecode executables cannot contain foreign stubs." is misleading

1

If one attempts to create an `executable` with `(modes (byte exe))` and `foreign_stubs`, `dune` complains: "Error: Pure bytecode executables cannot contain foreign stubs." This message seems to be saying that...

If I create an executable and test together with `test`, but the executable uses `(modes (byte exe))` and contains a library with `foreign_stubs`, then the test fails due to failing...

example.py:19: DeprecationWarning: Script.exports will become asynchronous in the future, use the explicit Script.exports_sync instead

1

Following the instructions at https://frida.re/docs/installation/ , when I run `example.py`, it prints a mysterious deprecation warning: ``` $ python3 example.py /home/scott/wrk/learn/frida/example/example.py:19: DeprecationWarning: Script.exports will become asynchronous in the future, use...