CFamily taint analysis — LLVM ERROR: Invalid size request on a scalable vector (exit 134)

SonarQube Cloud
,
1

On SonarCloud (project saratoga-data-systems_flume, C/C++ analyzed in compilation-database mode via bear), the CFamily taint analysis sensor crashes on every run. It links the LLVM IR (68 modules), builds the call graph, spawns the taint rules (S2076/S2083/S5145/S5334), then aborts:

ERROR [stderr] LLVM ERROR: Invalid size request on a scalable vector.
Taint analysis for C and C++ finished with exit code: 134

It then reports 4 rules … raised 0 issue(s) and generates sonar-cfamily-taint-analysis-reproducer.tar.xz.

  • Toolchain: C++20, gcc-toolset-15 (GCC 15.x; analyzer reports clang 20.1.8), x86_64 Linux. (Looks related to the known C++20/GCC-15 CFamily crashes.)
  • Impact: the overall analysis and quality gate still pass, but we get no C/C++ taint coverage at all — the 0 issues is the crash, not a clean result.
  • Reproducer: auto-generated, but it contains our source-derived LLVM IR, so we’d prefer to share it privately — what’s the best channel to send it to you?

Is this a known issue, fixed in a newer analyzer build, or is there a workaround?

3

Any comments from Sonar Source about this?

4

Hey @BillHoover, I’ve flagged this for the team to have a look at

6

Hi @BillHoover,

Thanks for reaching out and your patience.

If you want to reduce the noise, you can explicitly disable taint analysis by setting the sonar.cfamily.taintAnalysis property to false. We hope to fix this issue by the next release.

Sharing that reproducer will definitely help us ensure the analysis is more robust and accurate. I’ll send you a private message to exchange the file.

Thank you

7

Thanks, I shared the reproducer with you. A new run now (after some code changes) seemed to be taking extremely long - my Jenkins job killed it after 1 hr when previous runs were done in several minutes. So for now I’ll als add this property to bypass it.

8

I have received the reproducer. Thank you for sharing it.

9

Thanks again for sharing the reproducer. We managed to improve the analyzer. We’ll communicate once the update has been released on SonarQube Cloud.

12

Hi @BillHoover,

We have released an improvement for the C/C++ taint analysis that should address the issue you reported.

Let us know if you face any other difficulties, and thanks again for the feedback!