From 634e4ed345d9bc47b23a8d78f6cf33363d950562 Mon Sep 17 00:00:00 2001
From: Anton Lindqvist <anton@basename.se>
Date: Wed, 4 Nov 2026 08:26:52 +0100
Subject: [PATCH] Fix #15172 FP constParameterPointer with mmap() addr argument

The first argument to mmap() was marked as direction="in", causing
constParameterPointer to suggest declaring it as pointer to const.
However, with MAP_FIXED any existing mapping at addr is replaced, so
the pointed-to memory is effectively modified. Drop the direction from
the first argument of mmap() in bsd.cfg and posix.cfg, and mmap64() in
posix.cfg.
---
 cfg/bsd.cfg      | 2 +-
 cfg/gnu.cfg      | 2 +-
 cfg/posix.cfg    | 4 ++--
 test/cfg/bsd.c   | 7 +++++++
 test/cfg/gnu.c   | 7 +++++++
 test/cfg/posix.c | 7 +++++++
 6 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/cfg/bsd.cfg b/cfg/bsd.cfg
index 158d7a8a885..5888327cc3c 100644
--- a/cfg/bsd.cfg
+++ b/cfg/bsd.cfg
@@ -443,7 +443,7 @@
     <returnValue type="void *"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1" direction="in">
+    <arg nr="1">
       <not-uninit/>
     </arg>
     <arg nr="2" direction="in">
diff --git a/cfg/gnu.cfg b/cfg/gnu.cfg
index af2fff93e59..ee0f4c8790c 100644
--- a/cfg/gnu.cfg
+++ b/cfg/gnu.cfg
@@ -1991,7 +1991,7 @@
     <returnValue type="void *"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1" direction="in">
+    <arg nr="1">
       <not-uninit/>
     </arg>
     <arg nr="2" direction="in">
diff --git a/cfg/posix.cfg b/cfg/posix.cfg
index 22f4c6c73b7..19c5f50c4fa 100644
--- a/cfg/posix.cfg
+++ b/cfg/posix.cfg
@@ -2472,7 +2472,7 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <returnValue type="void *"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1" direction="in">
+    <arg nr="1">
       <not-uninit/>
     </arg>
     <arg nr="2" direction="in">
@@ -2504,7 +2504,7 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <returnValue type="void *"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1" direction="in">
+    <arg nr="1">
       <not-uninit/>
     </arg>
     <arg nr="2" direction="in">
diff --git a/test/cfg/bsd.c b/test/cfg/bsd.c
index 3cb39c14810..e5a749ebb8f 100644
--- a/test/cfg/bsd.c
+++ b/test/cfg/bsd.c
@@ -11,6 +11,7 @@
 #include <string.h>
 #include <stdlib.h>
 #include <stdint.h>
+#include <sys/mman.h>
 #include <sys/time.h>
 #include <sys/uio.h>
 
@@ -180,3 +181,9 @@ void reallocarray_notused(void)
     // cppcheck-suppress [leakReturnValNotUsed, ignoredReturnValue]
     reallocarray(NULL, 10, 10);
 }
+
+void mmap_fixed(void *addr) // No constParameterPointer: mmap() may replace the mapping at addr
+{
+    // cppcheck-suppress valueFlowBailoutIncompleteVar
+    (void)mmap(addr, 0x1000, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON | MAP_FIXED, -1, 0);
+}
diff --git a/test/cfg/gnu.c b/test/cfg/gnu.c
index 830618c241d..7a2abd8aef5 100644
--- a/test/cfg/gnu.c
+++ b/test/cfg/gnu.c
@@ -905,3 +905,10 @@ int nullPointer_epoll_ctl(int epfd, int op, int fd, struct epoll_event *event)
     return epoll_ctl(epfd, EPOLL_CTL_DEL, fd, NULL);
 }
 #endif
+
+void mmap_fixed(void *addr) // No constParameterPointer: mmap() may replace the mapping at addr
+{
+    // cppcheck-suppress valueFlowBailoutIncompleteVar
+    // cppcheck-suppress leakReturnValNotUsed
+    (void)mmap(addr, 0x1000, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, -1, 0);
+}
diff --git a/test/cfg/posix.c b/test/cfg/posix.c
index b8d1d50483d..874ae168e34 100644
--- a/test/cfg/posix.c
+++ b/test/cfg/posix.c
@@ -1628,3 +1628,10 @@ void pthread_define_test()
     PTHREAD_SCOPE_PROCESS;
     PTHREAD_SCOPE_SYSTEM;
 }
+
+void mmap_fixed(void *addr) // No constParameterPointer: mmap() may replace the mapping at addr
+{
+    // cppcheck-suppress valueFlowBailoutIncompleteVar
+    // cppcheck-suppress leakReturnValNotUsed
+    (void)mmap(addr, 0x1000, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_FIXED, 0, 0);
+}