Impact
Upstream fixes in open-source projects resulting from my research.
This page lists defects I found with static analysis that were actually fixed upstream: pull requests that were merged, and reported bugs that maintainers fixed themselves. They come from two lines of work.
- In our ISSTA 2025 study, we applied CodeQL to 258 open-source embedded software projects and responsibly disclosed the defects it found. Maintainers confirmed 376 of the 709 defects.
- With Aithos, the LLM-agent framework from our RAID 2026 paper that triages SAST alerts, I filtered CodeQL results on widely used system software and reported the true positives to projects such as zstd, util-linux, pciutils, libidn, xauth and mawk.
125
patches merged
19
bug reports fixed by maintainers
73
open-source projects
374
defects fixed
298
security-relevant defects fixed
Upstream fixes
One row per merged pull request or fixed bug report, grouped by project and ordered by number of fixes per project. The bug type is the CWE category of the defects, with descendants of CWE-119 grouped as buffer overflow; code-quality defects without a CWE are described in words. Bug types marked “security” are those we classified as security-relevant in the ISSTA study; all Aithos findings are memory-safety bugs. “Other” rows are bugs I found and reported outside either study.
| Project | Bug type | Defects | My contribution | Link | Source |
|---|---|---|---|---|---|
| apache/nuttx | Null pointer dereference CWE-476 security | 3 | Patch, merged | #9621 | CodeQL |
| apache/nuttx | Constant comparison result | 1 | Patch, merged | #12046 | CodeQL |
| apache/nuttx | Constant comparison result | 2 | Patch, merged | #12047 | CodeQL |
| apache/nuttx | Uninitialized variable CWE-457 security | 7 | Patch, merged | #12045 | CodeQL |
| apache/nuttx | Uninitialized variable CWE-457 security | 1 | Patch, merged | #12031 | CodeQL |
| apache/nuttx | Implicit function declaration | 3 | Patch, merged | #9607 | CodeQL |
| apache/nuttx | TOCTOU race condition CWE-367 security | 2 | Patch, merged | #9644 | CodeQL |
| apache/nuttx | Duplicate include guard | 4 | Patch, merged | #9604 | CodeQL |
| apache/nuttx | Use after free CWE-416 security | 2 | Patch, merged | #9608 | CodeQL |
| apache/nuttx | Resource leak CWE-772 security | 6 | Patch, merged | #9613 | CodeQL |
| apache/nuttx | Nested loops with same variable | 1 | Patch, merged | #9609 | CodeQL |
| apache/nuttx | Integer overflow CWE-190 security | 1 | Patch, merged | #9615 | CodeQL |
| apache/nuttx | Uninitialized variable CWE-457 security | 4 | Patch, merged | #13193 | CodeQL |
| ARMmbed/mbed-os | Null pointer dereference CWE-476 security | 15 | Patch, merged | #15406 | CodeQL |
| ARMmbed/mbed-os | Stack address escape | 1 | Patch, merged | #15405 | CodeQL |
| ARMmbed/mbed-os | Buffer overflow CWE-119 security | 1 | Patch, merged | #15404 | CodeQL |
| ARMmbed/mbed-os | Virtual call in constructor | 6 | Patch, merged | #15401 | CodeQL |
| ARMmbed/mbed-os | Redefined default parameter | 3 | Patch, merged | #15403 | CodeQL |
| ARMmbed/mbed-os | Mismatched new/delete CWE-762 security | 1 | Patch, merged | #15402 | CodeQL |
| ARMmbed/mbed-os | Uninitialized variable CWE-457 security | 1 | Patch, merged | #15496 | CodeQL |
| contiki-ng/contiki-ng | Null pointer dereference CWE-476 security | 4 | Patch, merged | #2477 | CodeQL |
| contiki-ng/contiki-ng | Null pointer dereference CWE-476 security | 7 | Patch, merged | #2478 | CodeQL |
| contiki-ng/contiki-ng | Constant comparison result | 9 | Patch, merged | #2423 | CodeQL |
| contiki-ng/contiki-ng | Stack address escape | 1 | Patch, merged | #2424 | CodeQL |
| contiki-ng/contiki-ng | Duplicate include guard | 2 | Patch, merged | #2422 | CodeQL |
| contiki-ng/contiki-ng | Buffer overflow CWE-119 security | 2 | Patch, merged | #2425 | CodeQL |
| gozfree/gear-lib | Null pointer dereference CWE-476 security | 10 | Patch, merged | #90 | CodeQL |
| gozfree/gear-lib | Unchecked return value CWE-252 security | 1 | Patch, merged | #94 | CodeQL |
| gozfree/gear-lib | Buffer overflow CWE-119 security | 2 | Patch, merged | #91 | CodeQL |
| gozfree/gear-lib | Buffer overflow CWE-119 security | 2 | Patch, merged | #95 | CodeQL |
| gozfree/gear-lib | Buffer overflow CWE-119 security | 1 | Patch, merged | #96 | CodeQL |
| gozfree/gear-lib | Buffer overflow CWE-119 security | 2 | Patch, merged | #93 | CodeQL |
| zlgopen/awtk | Null pointer dereference CWE-476 security | 8 | Bug report, fixed by maintainers | #825 | CodeQL |
| zlgopen/awtk | Null pointer dereference CWE-476 security | 2 | Bug report, fixed by maintainers | #871 | CodeQL |
| zlgopen/awtk | Uncontrolled allocation size CWE-789 security | 1 | Bug report, fixed by maintainers | #835 | CodeQL |
| zlgopen/awtk | Wrong format argument type CWE-686 security | 1 | Bug report, fixed by maintainers | #870 | CodeQL |
| zlgopen/awtk | Buffer overflow CWE-119 security | 1 | Bug report, fixed by maintainers | #827 | CodeQL |
| zlgopen/awtk | Self-referential initializer | 1 | Bug report, fixed by maintainers | #828 | CodeQL |
| embox/embox | Null pointer dereference CWE-476 security | 4 | Patch, merged | #2765 | CodeQL |
| embox/embox | Unchecked return value CWE-252 security | 6 | Patch, merged | #2768 | CodeQL |
| embox/embox | Uncontrolled allocation size CWE-789 security | 2 | Patch, merged | #2766 | CodeQL |
| embox/embox | Constant comparison result | 2 | Patch, merged | #2769 | CodeQL |
| embox/embox | Constant return type | 4 | Patch, merged | #2770 | CodeQL |
| LibVNC/libvncserver | Null pointer dereference CWE-476 security | 3 | Patch, merged | #578 | CodeQL |
| LibVNC/libvncserver | Unchecked return value CWE-252 security | 6 | Patch, merged | #582 | CodeQL |
| LibVNC/libvncserver | Uncontrolled allocation size CWE-789 security | 6 | Patch, merged | #579 | CodeQL |
| LibVNC/libvncserver | Constant comparison result | 1 | Patch, merged | #581 | CodeQL |
| LibVNC/libvncserver | Buffer overflow CWE-119 security | 1 | Patch, merged | #580 | CodeQL |
| libsdl-org/SDL | Null pointer dereference CWE-476 security | 1 | Patch, merged | #7641 | CodeQL |
| libsdl-org/SDL | Null pointer dereference CWE-476 security | 2 | Patch, merged | #7644 | CodeQL |
| libsdl-org/SDL | Null pointer dereference CWE-476 security | 1 | Patch, merged | #7645 | CodeQL |
| libsdl-org/SDL | TOCTOU race condition CWE-367 security | 3 | Patch, merged | #9228 | CodeQL |
| RIOT-OS/RIOT | Null pointer dereference CWE-476 security | 12 | Patch, merged | #19756 | CodeQL |
| RIOT-OS/RIOT | Null pointer dereference CWE-476 security | 2 | Patch, merged | #19757 | CodeQL |
| RIOT-OS/RIOT | Dead code CWE-561 | 1 | Patch, merged | #19749 | CodeQL |
| RIOT-OS/RIOT | Integer overflow CWE-190 security | 1 | Patch, merged | #19739 | CodeQL |
| ardera/flutter-pi | Unchecked return value CWE-252 security | 2 | Patch, merged | #330 | CodeQL |
| ardera/flutter-pi | Buffer overflow CWE-119 security | 2 | Patch, merged | #329 | CodeQL |
| ardera/flutter-pi | Buffer overflow CWE-119 security | 2 | Patch, merged | #331 | CodeQL |
| aws/aws-iot-device-sdk-embedded-C | Buffer overflow CWE-119 security | 1 | Patch, merged | #1859 | CodeQL |
| aws/aws-iot-device-sdk-embedded-C | Constant comparison result | 2 | Patch, merged | #1860 | CodeQL |
| aws/aws-iot-device-sdk-embedded-C | Constant comparison result | 1 | Patch, merged | #1861 | CodeQL |
| liudf0716/xkcptun | Null pointer dereference CWE-476 security | 1 | Patch, merged | #51 | CodeQL |
| liudf0716/xkcptun | Wrong format argument type CWE-686 security | 6 | Patch, merged | #49 | CodeQL |
| liudf0716/xkcptun | Wrong format argument count CWE-685 security | 1 | Patch, merged | #50 | CodeQL |
| openlgtv/epk2extract | Null pointer dereference CWE-476 security | 3 | Patch, merged | #75 | CodeQL |
| openlgtv/epk2extract | Buffer overflow CWE-119 security | 1 | Patch, merged | #77 | CodeQL |
| openlgtv/epk2extract | Duplicate include guard | 2 | Patch, merged | #76 | CodeQL |
| RT-Thread/rt-thread | Constant comparison result | 1 | Patch, merged | #7666 | CodeQL |
| RT-Thread/rt-thread | Buffer overflow CWE-119 security | 2 | Patch, merged | #7667 | CodeQL |
| RT-Thread/rt-thread | Null pointer dereference CWE-476 security | 1 | Patch, merged | #7668 | CodeQL |
| apache/mynewt-nimble | Missing return statement | 1 | Patch, merged | #1555 | CodeQL |
| apache/mynewt-nimble | Implicit function declaration | 3 | Patch, merged | #1556 | CodeQL |
| lwip-tcpip/lwip | Null pointer dereference CWE-476 security | 1 | Patch, merged | patch #10336 | CodeQL |
| lwip-tcpip/lwip | Integer overflow CWE-190 security | 1 | Patch, merged | patch #10335 | CodeQL |
| moonlight-stream/moonlight-embedded | Buffer overflow CWE-119 security | 4 | Patch, merged | #890 | CodeQL |
| moonlight-stream/moonlight-embedded | Uninitialized variable CWE-457 security | 1 | Bug report, fixed by maintainers | #889 | CodeQL |
| pikasTech/PikaPython | Constant comparison result | 1 | Patch, merged | #339 | CodeQL |
| pikasTech/PikaPython | Format string vulnerability CWE-134 security | 2 | Patch, merged | #338 | CodeQL |
| pikasTech/PikaPython | Wrong format argument type CWE-686 security | 2 | Patch, merged | #337 | CodeQL |
| raysan5/raylib | Buffer overflow CWE-119 security | 1 | Patch, merged | #3795 | CodeQL |
| raysan5/raylib | Buffer overflow CWE-119 security | 1 | Patch, merged | #3021 | CodeQL |
| rusefi/rusefi | Buffer overflow CWE-119 security | 1 | Patch, merged | #5287 | CodeQL |
| rusefi/rusefi | Virtual call in constructor | 3 | Patch, merged | #5286 | CodeQL |
| stlink-org/stlink | Null pointer dereference CWE-476 security | 1 | Patch, merged | #1307 | CodeQL |
| stlink-org/stlink | Unchecked return value CWE-252 security Buffer overflow CWE-119 | 5 | Patch, merged | #1306 | CodeQL |
| TrampolineRTOS/trampoline | Buffer overflow CWE-119 security | 1 | Bug report, fixed by maintainers | #127 | CodeQL |
| TrampolineRTOS/trampoline | Wrong format argument type CWE-686 security | 2 | Bug report, fixed by maintainers | #125 | CodeQL |
| wolfSSL/wolfssl | Uncontrolled allocation size CWE-789 security | 4 | Patch, merged | #7371 | CodeQL |
| wolfSSL/wolfssl | sizeof() on a pointer CWE-467 security | 1 | Patch, merged | #7370 | CodeQL |
| wolkykim/qlibc | Unchecked return value CWE-252 security | 1 | Patch, merged | #100 | CodeQL |
| wolkykim/qlibc | Use after free CWE-416 security | 1 | Patch, merged | #101 | CodeQL |
| xboot/xboot | Null pointer dereference CWE-476 security | 4 | Patch, merged | #52 | CodeQL |
| xboot/xboot | Buffer overflow CWE-119 security | 1 | Patch, merged | #53 | CodeQL |
| apache/mynewt-core | Null pointer dereference CWE-476 security | 3 | Patch, merged | #3022 | CodeQL |
| atomvm/AtomVM | Null pointer dereference CWE-476 security | 2 | Patch, merged | #576 | CodeQL |
| Azure/azure-c-shared-utility | strcpy result used as condition | 4 | Patch, merged | #625 | CodeQL |
| Azure/azure-iot-sdk-c | Duplicate include guard | 2 | Patch, merged | #2467 | CodeQL |
| cesanta/mongoose | Null pointer dereference CWE-476 security | 1 | Patch, merged | #2171 | CodeQL |
| civetweb/civetweb | Buffer overflow CWE-119 security | 2 | Patch, merged | #1171 | CodeQL |
| DISTORTEC/distortos | Dead code CWE-561 | 2 | Patch, merged | #68 | CodeQL |
| illiliti/libudev-zero | TOCTOU race condition CWE-367 security | 2 | Patch, merged | #57 | CodeQL |
| InfiniTimeOrg/InfiniTime | Buffer overflow CWE-119 security | 7 | Patch, merged | #1742 | CodeQL |
| jnz/q3vm | Wrong format argument type CWE-686 security | 1 | Patch, merged | #35 | CodeQL |
| littlekernel/lk | Buffer overflow CWE-119 security | 1 | Patch, merged | #401 | CodeQL |
| lvgl/lvgl | Null pointer dereference CWE-476 security | 2 | Patch, merged | #4155 | CodeQL |
| majianjia/nnom | Null pointer dereference CWE-476 security | 7 | Patch, merged | #216 | CodeQL |
| micropython/micropython | Buffer overflow CWE-119 security | 2 | Patch, merged | #11306 | CodeQL |
| monkey/monkey | Buffer overflow CWE-119 security | 1 | Patch, merged | #402 | CodeQL |
| never-lang/never | Constant comparison result | 2 | Bug report, fixed by maintainers | #52 | CodeQL |
| paladin-t/my_basic | Unclear comparison precedence | 6 | Patch, merged | #97 | CodeQL |
| rauc/rauc | Uninitialized variable CWE-457 security | 1 | Patch, merged | #1171 | CodeQL |
| ryankurte/micro-gui | Implicit function declaration | 1 | Patch, merged | #6 | CodeQL |
| stateos/StateOS | Unchecked return value CWE-252 security | 15 | Bug report, fixed by maintainers | #1 | CodeQL |
| symisc/sod | Buffer overflow CWE-119 security | 1 | Patch, merged | #36 | CodeQL |
| syoyo/tinyobjloader-c | Use after free CWE-416 security | 2 | Patch, merged | #62 | CodeQL |
| tio/tio | Unchecked return value CWE-252 security | 10 | Patch, merged | #232 | CodeQL |
| z88dk/z88dk | Buffer overflow CWE-119 security | 1 | Patch, merged | #2272 | CodeQL |
| zephyrproject-rtos/zephyr | Buffer overflow CWE-119 security | 1 | Patch, merged | #59286 | CodeQL |
| zevv/zForth | Unchecked return value CWE-252 security | 1 | Patch, merged | #31 | CodeQL |
| hathach/tinyusb | Incorrect operator CWE-480 | 1 | Bug report, fixed by maintainers | #2502 | CodeQL |
| cosmos72/twin | Uncontrolled allocation size CWE-789 security | 1 | Bug report, fixed by maintainers | #84 | CodeQL |
| cosmos72/twin | TOCTOU race condition CWE-367 security | 1 | Patch, merged | commit b08040a | CodeQL |
| glfw/glfw | Null pointer dereference CWE-476 security | 2 | Bug report, fixed by maintainers | #2327 | CodeQL |
| eclipse-threadx/netxduo | Constant comparison result | 1 | Bug report, fixed by maintainers | #164 | CodeQL |
| apache/nuttx-apps | Cleartext transmission CWE-319 security | 1 | Patch, merged | #1817 | CodeQL |
| Mbed-TLS/mbedtls | Buffer overflow CWE-119 security | 3 | Patch, merged | #8897 | CodeQL |
| wasm3/wasm3 | Uninitialized variable CWE-457 security | 1 | Patch, merged | #467 | CodeQL |
| libts/tslib | Buffer overflow CWE-119 security | 1 | Patch, merged | #205 | CodeQL |
| Azure/azure-uamqp-c | Null pointer dereference CWE-476 security | 1 | Patch, merged | #455 | CodeQL |
| openssh/openssh-portable | Uninitialized variable CWE-457 security | 1 | Patch, merged | commit 6157e1c4 | Aithos |
| libidn/libidn | Buffer overflow CWE-119 security | 2 | Bug report, fixed by maintainers | commit ba07192 | Aithos |
| xorg/app/xauth | Buffer overflow CWE-119 security | 1 | Bug report, fixed by maintainers | #24 | Aithos |
| facebook/zstd | Buffer overflow CWE-119 security | 2 | Patch, merged | #4238 | Aithos |
| pciutils/pciutils | Buffer overflow CWE-119 security | 2 | Patch, merged | #207 | Aithos |
| util-linux/util-linux | Unchecked return value CWE-252 security | 2 | Patch, merged | #3615 | Aithos |
| ThomasDickey/original-mawk | Uncontrolled allocation size CWE-789 security | 2 | Bug report, fixed by maintainers | #91 | Aithos |
| tmux/tmux | Use after free CWE-416 security | 1 | Bug report, fixed by maintainers | commit a1873fe | Other |
| alsa-project/alsa-lib | Buffer overflow CWE-119 security | 2 | Patch, merged | commit 0e0a92b | Other |
| alsa-project/alsa-utils | Buffer overflow CWE-119 security Uncontrolled format string CWE-134 | 6 | Patch, merged | commit 4ce6a0a | Other |
| alsa-project/alsa-utils | Buffer overflow CWE-119 security | 1 | Patch, merged | commit 004d085 | Other |
| anope/anope | Wrong format argument type CWE-686 security | 6 | Patch, merged | #334 | Other |
| aide/aide | Unchecked return value CWE-252 | 1 | Patch, merged | #161 | Other |
| nrfconnect/sdk-sidewalk | Buffer overflow CWE-119 security | 1 | Patch, merged | #452 | Other |