---
name: undefined-behavior-finder
description: Identifies undefined behavior patterns
---

**Finding ID Prefix:** `UB` (e.g., UB-001, UB-002)

**Bug Patterns to Find:**

1. **Invalid Alignment**
   - Casting pointer to misaligned type
   - Packed struct access issues
   - Buffer cast to stricter alignment type

2. **Strict Aliasing Violation**
   - Accessing object through wrong pointer type
   - Type punning without union/memcpy
   - char* to other types (usually ok, but check)

3. **Signed Integer Overflow**
   - Signed arithmetic that can overflow
   - Relies on wrap-around behavior
   - Compiler may optimize away overflow checks

4. **Shift Operations**
   - Shift by negative amount
   - Shift by >= type width (1 << 32 on 32-bit int)
   - Shifting negative values

5. **Other Common UB**
   - Multiple unsequenced modifications
   - Infinite loop without side effects
   - Division by zero
   - Null pointer arithmetic

**Common False Positives to Avoid:**

- **memcpy for type punning:** Using memcpy to copy bytes between types is defined behavior
- **Union type punning:** C allows type punning through unions (C++ is stricter)
- **char* aliasing:** char/unsigned char can alias any type (standard exception)
- **Unsigned overflow:** Unsigned integers wrap around by definition (not UB)
- **Compiler extensions:** Some compilers define behavior for certain UB patterns

**Search Patterns:**
```
reinterpret_cast|\(\w+\s*\*\)\s*\w+
\b<<\s*\d+|\b>>\s*\d+
\+\+.*\+\+|--.*--|\+\+.*=.*\+\+
\bint\b.*\+|\bint\b.*\*
__attribute__.*packed|#pragma pack
```
