Output Formats

Output Formats

The analyzer supports three output formats, controlled with --format=<format>.

---

Human-Readable (default)

./build/stack_usage_analyzer main.c

Shows per-function stack metrics followed by inline diagnostics:

Mode: ABI

Function: main
  local stack: 32 bytes
  max stack (including callees): 32 bytes
  at line 4, column 14
  [ !!Warn ] potential stack buffer overflow on variable 'buf' (size 10)
  ... constant index 15 is out of bounds (0..9)
  ... (this is a write access)

Diagnostics summary: info=0, warning=1, error=0

For multi-file analysis, each file is separated with a header:

File: src/main.cpp
Mode: IR
...

File: src/utils.cpp
Mode: IR
...

Total diagnostics summary: info=2, warning=5, error=1 (across 2 files)

Modifiers

• --quiet suppresses per-function diagnostics entirely, showing only stack sizes
• --warnings-only hides info-level diagnostics; in human output, only functions with remaining warnings/errors are listed

---

JSON

./build/stack_usage_analyzer main.c --format=json

Structured JSON for CI pipelines and machine consumption. Contains:

• functions: array of per-function results (name, stack sizes, flags)
• diagnostics: array of diagnostic objects with full location and rule metadata
• meta: tool/input/mode metadata

Key diagnostic fields in JSON:

{
  "diagnostics": [
    {
      "id": "diag-1",
      "ruleId": "StackBufferOverflow",
      "severity": "WARNING",
      "confidence": null,
      "cwe": null,
      "location": {
        "file": "main.c",
        "function": "main",
        "startLine": 4,
        "startColumn": 14,
        "endLine": 4,
        "endColumn": 14
      },
      "details": {
        "message": "potential stack buffer overflow on variable 'buf'...",
        "variableAliasing": []
      }
    }
  ]
}

Severity values are emitted as strings: INFO, WARNING, ERROR.

---

SARIF 2.1.0

./build/stack_usage_analyzer main.c --format=sarif --base-dir=/workspace

SARIF (Static Analysis Results Interchange Format) version 2.1.0, compatible with GitHub Code Scanning. --sarif-out=<path> writes it to a file in addition to stdout.

The rules array

Rules are emitted once per rule, not once per result, sorted by id. Each entry carries:

• id and a shortDescription;
• properties.tags: "security" plus one external/cwe/cwe-NNN tag per CWE the rule's diagnostics carried in this run. One rule can detect several weaknesses — a stack write and a stack read are different CWEs — so the tags are collected across the run rather than taken from whichever diagnostic came first;
• properties.security-severity: one score for the whole rule, the highest of its CWEs.

A rule whose diagnostics carry no CWE gets no properties block at all, and therefore no security tag and no security-severity: it is not ranked among security findings. That is deliberate for the AnalysisIncomplete rules and for findings that are patterns rather than weaknesses — see Diagnostic Rule Catalog.

Results

Each result carries ruleId, level (note, warning, error), the message, and a properties block with confidence and cwe when they exist.

Locations use the diagnostic's own file path when it has one, falling back to the input file — so in a multi-file or cross-TU run a finding points at the file it is really in, not at the translation unit that happened to pull it in. --base-dir=<path> strips a prefix from those URIs. SARIF requires 1-based positions, so a line the analyzer keeps as 0 for unknown is clamped to 1 for schema compliance.

Tool metadata

name and version come from the build, so an uploaded report identifies the analyzer version that produced it.

Upload to GitHub Code Scanning:

- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: artifacts/stack-usage.sarif
    category: coretrace-stack-analyzer

---

Multi-File Output

When analyzing multiple files, all formats merge results into a single output:

• Human: files are printed sequentially with headers
• JSON: all functions and diagnostics are merged into one JSON object
• SARIF: all results are merged into a single SARIF run, with one rules entry per distinct rule across every file

---

CI Adapter Script

For CI pipelines, the scripts/ci/run_code_analysis.py wrapper can produce both JSON and SARIF in one invocation:

python3 scripts/ci/run_code_analysis.py \
  --analyzer ./build/stack_usage_analyzer \
  --compdb ./build/compile_commands.json \
  --fail-on error \
  --json-out artifacts/stack-usage.json \
  --sarif-out artifacts/stack-usage.sarif

This runs the analyzer twice (once for JSON, once for SARIF) and applies a CI gate policy. See CI/CD Integration for more.