AI review of 2026-10-15_18-02-29-cd753bfd6b6e-results.txt
PR:          #8944 https://github.com/cppcheck-opensource/cppcheck/pull/8944
Tested:      cd753bfd6b6ee6ad366a06d16f09545f59baf516
Merge base:  b2d83612a1d235901d70a77d25c21759014e4919
Reviewed:    2026-10-15 20:51:47 UTC
Model:       claude-opus-5-5 (effort high)
Results:     2 reviewed of 2 in the report
Verdicts:    2 improvement
Tokens:      3767 input, 3441 cache read, 3441 cache write, 896 output

The verdicts are written by AI and can be wrong.

---- 1 / 2 ----
Verdict:     IMPROVEMENT (high confidence)
Package:     https://ftp.debian.org/debian/pool/main/p/perdition/perdition_2.2.orig.tar.xz
Result:      your perdition-2.2/perdition/db/daemon/client.c:108:19: warning: Buffer is accessed out of bounds: "/tmp/perdition-map-XXXXXX" [bufferAccessOutOfBounds]
Explanation: The new warning is a true positive. `DIR_TEMPLATE` is the string literal "/tmp/perdition-map-XXXXXX", which is 26 bytes including the NUL. The `memcpy` copies `PERDITION_UN_STR_LEN-1` bytes from it. That constant sizes Unix socket path buffers (around 108, like `sun_path`), so it is far larger than 26. The call therefore reads past the end of the literal. The PR's new string-literal buffer size lets Cppcheck catch this real bug.

---- 2 / 2 ----
Verdict:     IMPROVEMENT (high confidence)
Package:     https://ftp.debian.org/debian/pool/main/p/perdition/perdition_2.2.orig.tar.xz
Result:      your perdition-2.2/perdition/db/daemon/perditiondb_daemon.c:240:19: warning: Buffer is accessed out of bounds: "/tmp/perdition-map-XXXXXX" [bufferAccessOutOfBounds]
Explanation: DIR_TEMPLATE is the string literal "/tmp/perdition-map-XXXXXX", which is 26 bytes including the terminator. The code calls memcpy with length PERDITION_UN_STR_LEN-1. Cppcheck only reports this if it resolved that length to a known value larger than 26 (the macro is likely a sun_path-sized constant around 108). Copying that many bytes reads past the end of the literal, which is undefined behaviour. strncpy or a sized copy would have been correct. The PR now computes buffer sizes for string literals, so this new warning is a true positive.