Fix TSA #2816217: suppress Flawfinder false positive on Cython JoinPyUnicode memcpy by StellaHuang95 · Pull Request #2029 · microsoft/debugpy

StellaHuang95 · 2026-05-28T21:25:02Z

Issue

Internal Flawfinder compliance scan flagged a memcpy in the Cython-generated _pydevd_sys_monitoring_cython.c.

Work item: TSA #2816217
Rule: FlawFinder/buffer/memcpy — "Does not check for buffer overflows when copying to destination (CWE-120)"
File: src/debugpy/_vendored/pydevd/_pydevd_sys_monitoring/_pydevd_sys_monitoring_cython.c
Line: 38188
AB#2816217

What Flawfinder reported

memcpy((char *)result_udata + (char_pos << kind_shift),
       udata,
       (size_t)(ulength << kind_shift));

inside the Cython 3.x string-join helper __Pyx_PyUnicode_Join (Cython's implementation of "".join([...])).

Why this is a false positive

Flawfinder flags every memcpy() because the size argument here is a variable (ulength << kind_shift) rather than a constant. But the surrounding code makes the copy provably safe:

Destination is pre-allocated to the exact total length. A few lines above:
```
result_uval = PyUnicode_New(result_ulength, max_char);
result_udata = PyUnicode_DATA(result_uval);
```
result_ulength is the sum of all input lengths, computed by the caller.
Overflow is explicitly checked before each memcpy. Two lines above the flagged line:
```
if (unlikely((PY_SSIZE_T_MAX >> kind_shift) - ulength < char_pos))
    goto overflow;
```
This guards against char_pos + ulength exceeding the addressable range. If it would, the code skips the copy and reports an OverflowError.
char_pos accumulates the same ulength values that sized the buffer, so by induction char_pos + ulength ≤ result_ulength at every iteration.

This mirrors CPython's own str.join() implementation in Objects/unicodeobject.c.

Fix

Add /* Flawfinder: ignore */ to the flagged line. This is the documented Flawfinder suppression token (see flawfinder --help).
Add a corresponding c_file_contents.replace(...) to the existing post-processing block in setup_pydevd_cython.py so the suppression is automatically re-applied if Cython is re-run to regenerate the .c file.

The annotation is a C block comment — equivalent to whitespace at the lexer level, with zero effect on compiled output or runtime behavior.

Verification

Ran Flawfinder 2.0.20 locally against the modified file:

Run	Hits at line 38188
Default	0 ✅
`flawfinder --neverignore` (suppressions disabled)	1 (the originally reported warning reappears)

The originally flagged warning is silenced, and the positive control with --neverignore confirms the suppression is what's silencing it.

Risk

Zero behavioral change. The .c file edit is a comment; the setup_pydevd_cython.py edit is a str.replace() that is a no-op if the matched text is absent (so it's safe even if Cython upstream changes its output).

…Unicode memcpy Flawfinder's buffer/memcpy rule (CWE-120) fires on any memcpy() call by default. The flagged call sits inside the Cython 3.x string-join helper __Pyx_PyUnicode_Join: memcpy((char *)result_udata + (char_pos << kind_shift), udata, (size_t) (ulength << kind_shift)); It is provably safe: * result_uval was just allocated via PyUnicode_New(result_ulength, max_char) and result_udata = PyUnicode_DATA(result_uval) points into that buffer. * The immediately preceding check (PY_SSIZE_T_MAX >> kind_shift) - ulength < char_pos guards against char_pos+ulength overflow before the memcpy executes. * result_ulength is computed by the caller as the sum of input lengths, so char_pos + ulength <= result_ulength after each iteration. The byte count `ulength << kind_shift` is bounded by the allocated buffer. Add an inline /* Flawfinder: ignore */ annotation on the flagged line in the Cython-generated _pydevd_sys_monitoring_cython.c and extend the existing post-processing block in setup_pydevd_cython.py so the annotation is re-applied automatically whenever Cython regenerates the .c files. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

rchiodo

Approved via Review Center.

…mcpy-unicode-join

…) call The merge from main inadvertently dropped the closing ')' of the new JoinPyUnicode '.replace(...)' call, so the subsequent 'read<end' '.replace(...)' block was being parsed as continued arguments. Add the missing ')' (and a blank line) to separate the two calls cleanly.

…) call Same merge-from-main artifact as microsoft#2029: the closing ')' of the new DIGIT_PAIRS_8 '.replace(...)' call was dropped when the 'read<end' '.replace(...)' block was spliced in, leaving the second call's args being parsed as continued positional args to the first.

rchiodo

Approved via Review Center.

…PAIRS_8 memcpy (#2028) * Fix TSA #2816216: suppress Flawfinder false positive on Cython DIGIT_PAIRS_8 memcpy Flawfinder's buffer/memcpy rule (CWE-120) fires on any memcpy() call by default. The flagged call sits inside the Cython 3.x integer formatter __Pyx____Pyx_PyUnicode_From_int (case 'o'): memcpy(dpos, DIGIT_PAIRS_8 + digit_pos * 2, 2); It is provably safe: * dpos points into the stack buffer `digits[sizeof(int)*3+2]` (14 bytes for a 32-bit int); `dpos -= 2` immediately precedes the copy and the enclosing do/while loop iterates at most ceil(log_64(max_int)) times, so dpos always stays >= digits. * DIGIT_PAIRS_8 is a 128-byte compile-time constant table containing the 64 two-character octal digit pairs "00".."77". `digit_pos = abs(remaining % 64)`, so `digit_pos * 2` ranges over [0, 126] and reads 2 bytes from offset [0, 127] -- within the table. * The size argument is the compile-time constant 2. Add an inline /* Flawfinder: ignore */ annotation on the flagged line in the Cython-generated pydevd_cython.c and extend the existing post-processing block in setup_pydevd_cython.py so the annotation is re-applied automatically whenever Cython regenerates the .c files. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix SyntaxError: add missing closing paren on DIGIT_PAIRS_8 .replace() call Same merge-from-main artifact as #2029: the closing ')' of the new DIGIT_PAIRS_8 '.replace(...)' call was dropped when the 'read<end' '.replace(...)' block was spliced in, leaving the second call's args being parsed as continued positional args to the first. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…6217-flawfinder-cython-memcpy-unicode-join # Conflicts: # src/debugpy/_vendored/pydevd/setup_pydevd_cython.py

This MR contains the following updates: | Package | Type | Update | Change | OpenSSF | |---|---|---|---|---| | [debugpy](https://aka.ms/debugpy) ([source](https://github.com/microsoft/debugpy)) | dev | patch | `1.8.20` → `1.8.21` | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/microsoft/debugpy/badge)](https://securityscorecards.dev/viewer/?uri=github.com/microsoft/debugpy) | | [numpy](https://github.com/numpy/numpy) ([changelog](https://numpy.org/doc/stable/release)) | dependencies | patch | `2.4.4` → `2.4.6` | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/numpy/numpy/badge)](https://securityscorecards.dev/viewer/?uri=github.com/numpy/numpy) | | [pydantic-settings](https://github.com/pydantic/pydantic-settings) ([changelog](https://github.com/pydantic/pydantic-settings/releases)) | dependencies | patch | `2.14.0` → `2.14.2` | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/pydantic/pydantic-settings/badge)](https://securityscorecards.dev/viewer/?uri=github.com/pydantic/pydantic-settings) | | [python-multipart](https://github.com/Kludex/python-multipart) ([changelog](https://github.com/Kludex/python-multipart/blob/master/CHANGELOG.md)) | dependencies | patch | `^0.0.22` → `^0.0.32` | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/Kludex/python-multipart/badge)](https://securityscorecards.dev/viewer/?uri=github.com/Kludex/python-multipart) | | [types-requests](https://github.com/python/typeshed) ([changelog](https://github.com/typeshed-internal/stub_uploader/blob/main/data/changelogs/requests.md)) | dependencies | patch | `2.32.0.20240523` → `2.32.4.20260324` | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/python/typeshed/badge)](https://securityscorecards.dev/viewer/?uri=github.com/python/typeshed) | --- ### Release Notes <details> <summary>microsoft/debugpy (debugpy)</summary> ### [`v1.8.21`](https://github.com/microsoft/debugpy/releases/tag/v1.8.21): debugpy v1.8.21 [Compare Source](microsoft/debugpy@v1.8.20...v1.8.21) Fixes for: - Return evaluate result in DAP response body instead of writing to stdout: [#2027](microsoft/debugpy#2027) - Prevent invalid `scopes` request from crashing debug session: [#2026](microsoft/debugpy#2026) - Skip uninitialized `__slots__` in variable resolver: [#2024](microsoft/debugpy#2024) - Handle `-c` arguments that are `bytes` instead of `str`: [#2021](microsoft/debugpy#2021) - Fix evaluation of variables from chained exception frames: [#2018](microsoft/debugpy#2018) - `ContinueRequest` with a specific `threadId` no longer resumes all threads (in-process adapter): [#2012](microsoft/debugpy#2012) - Avoid strong reference to exceptions during unwind: [#2008](microsoft/debugpy#2008) - Show error message on evaluate failures in the hover context: [#2006](microsoft/debugpy#2006) - Display `dlerror` output when `dlopen` fails: [#2000](microsoft/debugpy#2000) - Replace removed `pkgutil.get_loader` with `importlib.util.find_spec` in `get_fullname`: [#1998](microsoft/debugpy#1998) Enhancements: - Add option to ignore all system exit codes: [#2017](microsoft/debugpy#2017) - Pull changes from pydevd up to March 2026: [#2010](microsoft/debugpy#2010) Infrastructure work: - Suppress Flawfinder false positives on Cython memcpy / read-loop iterators (TSA [#2816216](https://github.com/microsoft/debugpy/issues/2816216), [#2816217](https://github.com/microsoft/debugpy/issues/2816217), [#2816218](https://github.com/microsoft/debugpy/issues/2816218), [#2816219](https://github.com/microsoft/debugpy/issues/2816219), [#2816220](https://github.com/microsoft/debugpy/issues/2816220)): [#2028](microsoft/debugpy#2028), [#2029](microsoft/debugpy#2029), [#2030](microsoft/debugpy#2030), [#2031](microsoft/debugpy#2031), [#2032](microsoft/debugpy#2032) Thanks to [@maxbachmann](https://github.com/maxbachmann), [@mfussenegger](https://github.com/mfussenegger), and [@sambrightman](https://github.com/sambrightman) for the commits. </details> <details> <summary>numpy/numpy (numpy)</summary> ### [`v2.4.6`](https://github.com/numpy/numpy/releases/tag/v2.4.6): (May 18, 2026) [Compare Source](numpy/numpy@v2.4.5...v2.4.6) ### NumPy 2.4.6 Release Notes NumPy 2.4.6 is a quick release that fixes a regression discovered in the 2.4.5 release. This release supports Python versions 3.11-3.14 #### Contributors A total of 4 people contributed to this release. People with a "+" by their names contributed a patch for the first time. - !EarlMilktea - Charles Harris - Sebastian Berg - Warren Weckesser #### Pull requests merged A total of 4 pull requests were merged for this release. - [#31444](numpy/numpy#31444): MAINT: Prepare 2.4.x for further development - [#31453](numpy/numpy#31453): BUG: Fix regression in `arr.conj()` - [#31459](numpy/numpy#31459): BUG: `np.linalg.svd(..., hermitian=True)` returns non-unitary... - [#31460](numpy/numpy#31460): BUG: Don't call INCREF/DECREF on descr in NpyStringAcquireAllocator... ### [`v2.4.5`](https://github.com/numpy/numpy/releases/tag/v2.4.5): (May 15, 2026) [Compare Source](numpy/numpy@v2.4.4...v2.4.5) ### NumPy 2.4.5 Release Notes NumPy 2.4.5 is a patch release that fixes bugs discovered after the 2.4.4 release, has some typing improvements, and maintains infrastructure. This release supports Python versions 3.11-3.14 #### Contributors A total of 17 people contributed to this release. People with a "+" by their names contributed a patch for the first time. - Aleksei Nikiforov - Anarion Zuo + - Ankit Ahlawat - Breno Favaretto + - Charles Harris - Igor Krivenko + - Ijtihed Kilani + - Joren Hammudoglu - Maarten Baert + - Matti Picus - Nathan Goldbaum - Praneeth Kodumagulla + - Ralf Gommers - RoomWithOutRoof + - Sebastian Berg - Warren Weckesser - div + #### Pull requests merged A total of 28 pull requests were merged for this release. - [#31093](numpy/numpy#31093): MAINT: Prepare 2.4.x for further development - [#31182](numpy/numpy#31182): TYP: fix `np.shape` assignability issue for python lists ([#31171](numpy/numpy#31171)) - [#31197](numpy/numpy#31197): ENH: Return rank 0 for empty matrices in matrix\_rank ([#30422](numpy/numpy#30422)) - [#31198](numpy/numpy#31198): CI/BUG: add native jobs for s390x, fix bug in `pack_inner`... - [#31199](numpy/numpy#31199): BUG: f2py map complex\_long\_double to NPY\_CLONGDOUBLE - [#31205](numpy/numpy#31205): MAINT: f2py: Stop setting re.\_MAXCACHE to 50. - [#31206](numpy/numpy#31206): BUG: fix heap buffer overflow in timedelta to string casts - [#31207](numpy/numpy#31207): MAINT: Rename ppc64le and s390x workflow ([#31121](numpy/numpy#31121)) - [#31208](numpy/numpy#31208): BUG: Fix matvec/vecmat in-place aliasing (out=input produces... - [#31209](numpy/numpy#31209): TYP: `tile`: accept numpy scalars and arrays as second argument... - [#31211](numpy/numpy#31211): DEP: Undo deprecation for np.dtype() signature used by old pickles... - [#31212](numpy/numpy#31212): REV: Manual revert of float16 svml use ([#31178](numpy/numpy#31178)) - [#31222](numpy/numpy#31222): TYP: `ix_` fix for boolean and non-1d input ([#31218](numpy/numpy#31218)) - [#31329](numpy/numpy#31329): BUG: incorrect temp elision for new-style (NEP 43) user-defined... - [#31330](numpy/numpy#31330): TYP: fix sliding\_window\_view axis parameter typing - [#31335](numpy/numpy#31335): BUG: Prevent deadlock due to downstream importing NumPy in dlopen... - [#31336](numpy/numpy#31336): BUG: Fix segfault in nditer.multi\_index when \_\_getitem\_\_ raises... - [#31338](numpy/numpy#31338): TYP: Fix ruff lint error - [#31357](numpy/numpy#31357): BUG: fix memory leak in np.zeros when fill-zero loop raises ([#31320](numpy/numpy#31320)) - [#31358](numpy/numpy#31358): BUG: np.einsum() fails with a 0-dimensional out argument and... - [#31379](numpy/numpy#31379): BUG: Fix signed overflow issue in npy\_gcd for INT\_MIN on s390x... - [#31383](numpy/numpy#31383): CI: remove Cirrus CI FreeBSD job ([#31380](numpy/numpy#31380)) - [#31390](numpy/numpy#31390): BUILD: newer MKL uses so.3 - [#31391](numpy/numpy#31391): BLD/MAINT: improve support for Intel LLVM compilers - [#31401](numpy/numpy#31401): BUG: Avoid UB in [safe]()\[add,sub,mul] helpers ([#31396](numpy/numpy#31396)) - [#31402](numpy/numpy#31402): BUG: exclude \_\_pycache\_\_ directories from wheels ([#31397](numpy/numpy#31397)) - [#31404](numpy/numpy#31404): TYP: `_NestedSequence` type parameter default to work around... - [#31426](numpy/numpy#31426): TYP: Fix `DTypeLike` runtime type-checker support ([#31425](numpy/numpy#31425)) </details> <details> <summary>pydantic/pydantic-settings (pydantic-settings)</summary> ### [`v2.14.2`](https://github.com/pydantic/pydantic-settings/releases/tag/v2.14.2) [Compare Source](pydantic/pydantic-settings@v2.14.1...v2.14.2) #### What's Changed This is a security patch release. - Prevent `NestedSecretsSettingsSource` from following symlinks outside `secrets_dir` by [@hramezani](https://github.com/hramezani) in [#889](pydantic/pydantic-settings#889) - Prepare release 2.14.2 by [@hramezani](https://github.com/hramezani) in [#890](pydantic/pydantic-settings#890) ##### Security Fixes [GHSA-4xgf-cpjx-pc3j](GHSA-4xgf-cpjx-pc3j): `NestedSecretsSettingsSource` with `secrets_nested_subdir=True` could follow a symbolic link inside `secrets_dir` pointing outside it, reading out-of-tree files into settings values and bypassing the `secrets_dir_max_size` cap. Affected versions: `>= 2.12.0, < 2.14.2`. **Full Changelog**: <pydantic/pydantic-settings@v2.14.1...v2.14.2> ### [`v2.14.1`](https://github.com/pydantic/pydantic-settings/releases/tag/v2.14.1) [Compare Source](pydantic/pydantic-settings@v2.14.0...v2.14.1) #### What's Changed - Bump the python-packages group with 4 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#850](pydantic/pydantic-settings#850) - Bump the python-packages group with 5 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#854](pydantic/pydantic-settings#854) - Bump the github-actions group with 3 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#853](pydantic/pydantic-settings#853) - Bump the python-packages group with 2 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#856](pydantic/pydantic-settings#856) - Fix field named `cls` conflicting with classmethod parameter by [@hramezani](https://github.com/hramezani) in [#858](pydantic/pydantic-settings#858) - Prepare release 2.14.1 by [@hramezani](https://github.com/hramezani) in [#859](pydantic/pydantic-settings#859) **Full Changelog**: <pydantic/pydantic-settings@v2.14.0...v2.14.1> </details> <details> <summary>Kludex/python-multipart (python-multipart)</summary> ### [`v0.0.32`](https://github.com/Kludex/python-multipart/blob/HEAD/CHANGELOG.md#0032-2026-06-04) [Compare Source](Kludex/python-multipart@0.0.31...0.0.32) - Speed up partial-boundary scanning for CR/LF-dense part data [#300](Kludex/python-multipart#300). ### [`v0.0.31`](https://github.com/Kludex/python-multipart/blob/HEAD/CHANGELOG.md#0031-2026-06-04) [Compare Source](Kludex/python-multipart@0.0.30...0.0.31) - Speed up multipart header parsing and callback dispatch [#295](Kludex/python-multipart#295). - Bound header field name size before validating [#296](Kludex/python-multipart#296). - Validate `Content-Length` is non-negative in `parse_form` [#297](Kludex/python-multipart#297). ### [`v0.0.30`](https://github.com/Kludex/python-multipart/blob/HEAD/CHANGELOG.md#0030-2026-05-31) [Compare Source](Kludex/python-multipart@0.0.29...0.0.30) - Parse `application/x-www-form-urlencoded` bodies per the WHATWG URL standard, treating only `&` as a field separator [#290](Kludex/python-multipart#290). - Ignore RFC 2231/5987 extended parameters (`name*`, `filename*`) in `parse_options_header`, keeping the plain parameter authoritative per [RFC 7578 §4.2](https://datatracker.ietf.org/doc/html/rfc7578#section-4.2) [#291](Kludex/python-multipart#291). ### [`v0.0.29`](https://github.com/Kludex/python-multipart/blob/HEAD/CHANGELOG.md#0029-2026-05-17) [Compare Source](Kludex/python-multipart@0.0.28...0.0.29) - Handle malformed RFC 2231 continuations in `parse_options_header` [#270](Kludex/python-multipart#270). ### [`v0.0.28`](https://github.com/Kludex/python-multipart/blob/HEAD/CHANGELOG.md#0028-2026-05-10) [Compare Source](Kludex/python-multipart@0.0.27...0.0.28) - Speed up partial-boundary tail scan via `bytes.find` [#281](Kludex/python-multipart#281). - Cap multipart boundary length at 256 bytes [#282](Kludex/python-multipart#282). ### [`v0.0.27`](https://github.com/Kludex/python-multipart/blob/HEAD/CHANGELOG.md#0027-2026-04-27) [Compare Source](Kludex/python-multipart@0.0.26...0.0.27) - Add multipart header limits [#267](Kludex/python-multipart#267). - Pass parse offsets via constructors [#268](Kludex/python-multipart#268). ### [`v0.0.26`](https://github.com/Kludex/python-multipart/blob/HEAD/CHANGELOG.md#0026-2026-04-10) [Compare Source](Kludex/python-multipart@0.0.25...0.0.26) - Skip preamble before the first multipart boundary more efficiently [#262](Kludex/python-multipart#262). - Silently discard epilogue data after the closing multipart boundary [#259](Kludex/python-multipart#259). ### [`v0.0.25`](https://github.com/Kludex/python-multipart/blob/HEAD/CHANGELOG.md#0025-2026-04-10) [Compare Source](Kludex/python-multipart@0.0.24...0.0.25) - Add MIME content type info to `File` [#143](Kludex/python-multipart#143). - Handle CTE values case-insensitively [#258](Kludex/python-multipart#258). - Remove custom `FormParser` classes [#257](Kludex/python-multipart#257). - Add `UPLOAD_DELETE_TMP` to `FormParser` config [#254](Kludex/python-multipart#254). - Emit `field_end` for trailing bare field names on finalize [#230](Kludex/python-multipart#230). - Handle multipart headers case-insensitively [#252](Kludex/python-multipart#252). - Apply Apache-2.0 properly [#247](Kludex/python-multipart#247). ### [`v0.0.24`](https://github.com/Kludex/python-multipart/blob/HEAD/CHANGELOG.md#0024-2026-04-05) [Compare Source](Kludex/python-multipart@0.0.23...0.0.24) - Validate `chunk_size` in `parse_form()` [#244](Kludex/python-multipart#244). ### [`v0.0.23`](https://github.com/Kludex/python-multipart/blob/HEAD/CHANGELOG.md#0023-2026-04-05) [Compare Source](Kludex/python-multipart@0.0.22...0.0.23) - Remove unused `trust_x_headers` parameter and `X-File-Name` fallback [#196](Kludex/python-multipart#196). - Return processed length from `QuerystringParser._internal_write` [#229](Kludex/python-multipart#229). - Cleanup metadata dunders from `__init__.py` [#227](Kludex/python-multipart#227). </details> --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  See merge request swiss-armed-forces/cyber-command/cea/loom!460 Co-authored-by: Loom MR Pipeline Trigger <group_103951964_bot_9504bb8dead6d4e406ad817a607f24be@noreply.gitlab.com> Co-authored-by: shrewd-laidback palace <shrewd-laidback-palace-736-c41-2c1-e464fc974@swiss-armed-forces-open-source.ch>

StellaHuang95 requested a review from a team as a code owner May 28, 2026 21:25

rchiodo approved these changes May 28, 2026

View reviewed changes

Merge branch 'main' into stellahuang/tsa-2816217-flawfinder-cython-me…

4d5456b

…mcpy-unicode-join

rchiodo reviewed May 28, 2026

View reviewed changes

Comment thread src/debugpy/_vendored/pydevd/setup_pydevd_cython.py

StellaHuang95 mentioned this pull request May 28, 2026

Fix TSA #2816216: suppress Flawfinder false positive on Cython DIGIT_PAIRS_8 memcpy #2028

Merged

rchiodo approved these changes May 29, 2026

View reviewed changes

Merge remote-tracking branch 'upstream/main' into stellahuang/tsa-281…

ae9e5e8

…6217-flawfinder-cython-memcpy-unicode-join # Conflicts: # src/debugpy/_vendored/pydevd/setup_pydevd_cython.py

bschnurr approved these changes May 29, 2026

View reviewed changes

rchiodo approved these changes May 29, 2026

View reviewed changes

StellaHuang95 merged commit 858b05c into microsoft:main May 29, 2026
25 of 27 checks passed

StellaHuang95 deleted the stellahuang/tsa-2816217-flawfinder-cython-memcpy-unicode-join branch May 29, 2026 20:52

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fix TSA #2816217: suppress Flawfinder false positive on Cython JoinPyUnicode memcpy#2029

Fix TSA #2816217: suppress Flawfinder false positive on Cython JoinPyUnicode memcpy#2029
StellaHuang95 merged 4 commits into
microsoft:mainfrom
StellaHuang95:stellahuang/tsa-2816217-flawfinder-cython-memcpy-unicode-join

StellaHuang95 commented May 28, 2026

Uh oh!

rchiodo left a comment

Uh oh!

Uh oh!

rchiodo left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

StellaHuang95 commented May 28, 2026

Issue

What Flawfinder reported

Why this is a false positive

Fix

Verification

Risk

Uh oh!

rchiodo left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

rchiodo left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants