y2038: eliminate false positives with automatic build system detection #7631

Hiesx · 2025-06-26T14:47:51Z

The Y2038 addon currently generates false positive warnings when scanning
codebases that are properly configured for Y2038 safety through build
system flags, making it impractical for comprehensive codebase analysis.

This prevents teams from running Y2038 checks across entire projects in
CI/CD pipelines due to noise from correctly configured code.

Add automatic build system detection to discover Y2038-related compiler
flags (_TIME_BITS=64, _FILE_OFFSET_BITS=64, _USE_TIME_BITS64) from:

Makefile variants (Makefile, makefile, GNUmakefile, *.mk)
CMake files (CMakeLists.txt, *.cmake)
Meson build files (meson.build)
Autotools scripts (configure, configure.ac, configure.in)
Compiler flags passed via cppcheck -D options

When proper Y2038 configuration is detected (both _TIME_BITS=64 AND
_FILE_OFFSET_BITS=64), suppress Y2038 warnings and display an
informational message indicating the configuration source.

Implement hierarchical directory search up to 5 levels from source files
to locate relevant build files, with flag precedence: build system >
compiler flags > source code #define directives.

Add performance optimizations:

Intelligent file caching with TTL-based invalidation
UTF-8 BOM handling for cross-platform compatibility
Robust import fallback system

Extend test suite with comprehensive coverage:

Compiler flag parsing edge cases (18 test scenarios)
Build system detection for all supported formats
Caching behavior and performance validation
Cross-platform file encoding handling

This enables organizations to run comprehensive Y2038 analysis on entire
codebases without false positives from properly configured projects,
while maintaining detection of actual Y2038 safety issues.

firewave · 2025-06-26T15:29:33Z

Thanks for you contribution.

Please add buildsystem.py to addons/README.md and win_installer/cppcheck.wxs (all other packaging related stuff should use wildcards).

Also please add yourself to AUTHORS so you get credited.

Hiesx · 2025-06-27T07:42:31Z

Added the buildsystem.py to addons/README.md and win_installer/cppcheck.wxs. In addition to this i also fixed the pylint errors!

danmar

I haven't really looked at the python code yet. Spontanously I feel this is very interesting and will make the y2038 more useful!

It's unfortunate that the doc/y2038.txt is a text document. It would probably make sense to switch to markdown. And I'm not sure why we don't have the info in the manual instead.
https://github.com/danmar/cppcheck/blob/main/man/manual.md#y2038py
I don't understand why the manual points at https://github.com/3adev/y2038
do you think that makes sense?

addons/doc/y2038.txt

addons/buildsystem.py

Hiesx · 2025-07-01T07:39:28Z

I also moved from the y2038.txt documentation file to a markdown one. Also the y2038.md file is now linked in the main manual and the reference to the 3adev/y2038 is now removed, since the current y2038 check is too different to reference it, imo.

addons/doc/y2038.md

danmar · 2025-07-10T14:56:55Z

addons/README.md

@@ -16,6 +16,8 @@ Addons are scripts that analyses Cppcheck dump files to check compatibility with
  Enforces naming conventions across the code. Enhanced version with support for type prefixes in variable and function names.
 + [findcasts.py](https://github.com/danmar/cppcheck/blob/main/addons/findcasts.py)
  Locates casts in the code.
+ [y2038_buildsystem.py](https://github.com/danmar/cppcheck/blob/main/addons/y2038_buildsystem.py)


sorry.. but this is not a "addon" is it. So I would probably not mention this file here.

danmar · 2025-07-10T15:00:34Z

addons/doc/y2038.md

+For standalone build system analysis, you can still use the helper script directly:
+
+```bash
+python3 addons/y2038_buildsystem.py /path/to/your/project


what exactly does this command do? Does it execute cppcheck or are you supposed to execute cppcheck after this..

danmar · 2025-07-10T15:02:41Z

addons/doc/y2038.md

+The Y2038 addon seamlessly integrates with your existing cppcheck workflow. Simply use the addon flag with cppcheck:
+
+```bash
+cppcheck --addon=addons/y2038.py source_file.c


cppcheck reads the compile_commands.json and it feels redundant that addons would do that also. Can't cppcheck pass the interesting info in the dump file. which info from the compile_commands.json would you like?

Example command:

cppcheck --project=build/compile_commands.json --addon=y2038

The Y2038 addon currently generates false positive warnings when scanning codebases that are properly configured for Y2038 safety through build system flags, making it impractical for comprehensive codebase analysis. This prevents teams from running Y2038 checks across entire projects in CI/CD pipelines due to noise from correctly configured code. Add automatic build system detection to discover Y2038-related compiler flags (_TIME_BITS=64, _FILE_OFFSET_BITS=64, _USE_TIME_BITS64) from: - Makefile variants (Makefile, makefile, GNUmakefile, *.mk) - CMake files (CMakeLists.txt, *.cmake) - Meson build files (meson.build) - Autotools scripts (configure, configure.ac, configure.in) - Compiler flags passed via cppcheck -D options When proper Y2038 configuration is detected (both _TIME_BITS=64 AND _FILE_OFFSET_BITS=64), suppress Y2038 warnings and display an informational message indicating the configuration source. Implement hierarchical directory search up to 5 levels from source files to locate relevant build files, with flag precedence: build system > compiler flags > source code #define directives. Add performance optimizations: - Intelligent file caching with TTL-based invalidation - UTF-8 BOM handling for cross-platform compatibility - Robust import fallback system Extend test suite with comprehensive coverage: - Compiler flag parsing edge cases (18 test scenarios) - Build system detection for all supported formats - Caching behavior and performance validation - Cross-platform file encoding handling This enables organizations to run comprehensive Y2038 analysis on entire codebases without false positives from properly configured projects, while maintaining detection of actual Y2038 safety issues.

sonarqubecloud · 2025-08-10T14:19:30Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

danmar · 2025-08-22T16:50:50Z

addons/doc/y2038.md

+In Linux, the current date and time is kept as the number of seconds elapsed
+since the Unix epoch, that is, since January 1st, 1970 at 00:00:00 GMT.
+
+Most of the time, this representation is stored as a 32-bit signed quantity.


hmm.. you did not write this.

But I am skeptic that it is still correct to say "Most of the time". On my computer, time_t is a 64-bit integer as far as I see. Do you know some common platform that uses 32-bit signed integer?

danmar · 2025-08-22T16:54:50Z

addons/README.md

@@ -7,7 +7,7 @@ Addons are scripts that analyses Cppcheck dump files to check compatibility with
 + [misra.py](https://github.com/danmar/cppcheck/blob/main/addons/misra.py) 
  Used to verify compliance with MISRA C 2012 - a proprietary set of guidelines to avoid such questionable code, developed for embedded systems. Since this standard is proprietary, cppcheck does not display error text by specifying only the number of violated rules (for example, [c2012-21.3]). If you want to display full texts for violated rules, you will need to create a text file containing MISRA rules, which you will have to pass when calling the script with `--rule-texts` key. Some examples of rule texts files available in [tests directory](https://github.com/danmar/cppcheck/blob/main/addons/test/misra/).
 + [y2038.py](https://github.com/danmar/cppcheck/blob/main/addons/y2038.py) 
-  Checks Linux system for [year 2038 problem](https://en.wikipedia.org/wiki/Year_2038_problem) safety. This required [modified environment](https://github.com/3adev/y2038). See complete description [here](https://github.com/danmar/cppcheck/blob/main/addons/doc/y2038.txt).
+  Checks code for [year 2038 problem](https://en.wikipedia.org/wiki/Year_2038_problem) safety. Integrates with cppcheck's project parsing to automatically extract Y2038-related compiler flags from `compile_commands.json` and other build system configurations. See complete description [here](https://github.com/danmar/cppcheck/blob/main/addons/doc/y2038.md).


imho.. I don't know if "Integrates with cppcheck's project parsing to automatically extract Y2038-related compiler flags from compile_commands.json and other build system configurations." makes sense. this is a natural consequence of all cppcheck addons..

danmar · 2025-08-22T17:03:23Z

addons/doc/y2038.md

+
+## Testing
+
+The Y2038 addon includes comprehensive test suites to ensure reliability and correctness:


hmm imho user documentation should not say how it's tested.

danmar · 2025-08-22T17:04:53Z

addons/y2038_buildsystem.py

@@ -0,0 +1,228 @@
+#!/usr/bin/env python3


do we still need this file?

danmar · 2025-08-22T17:07:30Z

man/manual.md

@@ -1037,7 +1037,7 @@ Example configuration of naming conventions:

 ### y2038.py

-[y2038.py](https://github.com/danmar/cppcheck/blob/main/addons/y2038.py) checks Linux systems for [year 2038 problem](https://en.wikipedia.org/wiki/Year_2038_problem) safety. This required [modified environment](https://github.com/3adev/y2038). See complete description [here](https://github.com/danmar/cppcheck/blob/main/addons/doc/y2038.txt).
+[y2038.py](../addons/doc/y2038.md) checks Linux systems for [year 2038 problem](https://en.wikipedia.org/wiki/Year_2038_problem) safety.


I don't know if it should point at "Linux". According to your tweaks it sounds like MSVC builds can be vulnerable.

danmar · 2025-08-22T17:25:41Z

I think it's great that you fix the y2038 addon!

Hiesx force-pushed the feature/y2038_buildsystem_detection branch from ba0a6d5 to 9edcaf2 Compare June 27, 2025 07:41

danmar reviewed Jun 28, 2025

View reviewed changes

addons/doc/y2038.txt Outdated Show resolved Hide resolved

addons/buildsystem.py Outdated Show resolved Hide resolved

Hiesx force-pushed the feature/y2038_buildsystem_detection branch from 9edcaf2 to e84499e Compare July 1, 2025 07:35

danmar reviewed Jul 2, 2025

View reviewed changes

addons/doc/y2038.md Outdated Show resolved Hide resolved

addons/doc/y2038.md Outdated Show resolved Hide resolved

Hiesx force-pushed the feature/y2038_buildsystem_detection branch from e84499e to cf40a64 Compare July 9, 2025 17:22

danmar reviewed Jul 10, 2025

View reviewed changes

Hiesx force-pushed the feature/y2038_buildsystem_detection branch 3 times, most recently from 9ff635b to c3219bf Compare August 4, 2025 17:20

Hiesx force-pushed the feature/y2038_buildsystem_detection branch from c3219bf to a07154c Compare August 10, 2025 14:09

danmar reviewed Aug 22, 2025

View reviewed changes


		## Testing

		The Y2038 addon includes comprehensive test suites to ensure reliability and correctness:

y2038: eliminate false positives with automatic build system detection #7631

Are you sure you want to change the base?

y2038: eliminate false positives with automatic build system detection #7631

Uh oh!

Conversation

Hiesx commented Jun 26, 2025

Uh oh!

firewave commented Jun 26, 2025

Uh oh!

Hiesx commented Jun 27, 2025

Uh oh!

danmar left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Hiesx commented Jul 1, 2025

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

danmar Jul 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Aug 10, 2025

Quality Gate passed

Uh oh!

danmar Aug 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

danmar commented Aug 22, 2025

Uh oh!

Uh oh!

danmar Jul 10, 2025 •

edited

Loading

danmar Aug 22, 2025 •

edited

Loading