• 软总线安全卫士 请审查这个文件：D:\code\example.c

  (Soft Bus Security Guard, please review this file: D:\code\example.c)

• 请使用软总线安全卫士检查这个目录

  (Please use Soft Bus Security Guard to check this directory)

• 软总线安全卫士 检视lnn_lane_dfx.c文件

  (Soft Bus Security Guard, review the lnn_lane_dfx.c file)

• Logging Specification Check: 1 core rule
• Secure Coding Check: 40+ rules, covering 11 major categories
• General Code Quality Check: Code complexity, readability, concurrency security, etc.
• Cross-File Call Analysis: Call chain tracking, resource transfer, data flow analysis
• Control Flow Analysis: Path-sensitive analysis, unreachable code detection

• OpenHarmony dsoftbus component code
• C/C++ system-level communication code
• Code involving IPC, network communication, and multi-threading
• Code requiring strict logging specifications and secure coding

• Rule Details and Examples - Complete documentation for 40+ rules
  • Problem description, risk level, problematic examples, fix solutions, and inspection points for each rule
  • Includes complete code examples and best practices
  • Includes formatted print type matching table and list of commonly used secure functions

💡 Quick Navigation: Click the link after each rule to view detailed explanations and code examples

• Prohibit returning SOFTBUS_ERR → Detailed Explanation

• Prohibit pointer bitwise operations → Detailed Explanation
• Check sizeof usage → Detailed Explanation
• Null pointer dereference check → Detailed Explanation
• IPC result null check → Detailed Explanation

• Pointer variable initialization → Detailed Explanation
• Resource descriptor initialization → Detailed Explanation
• bool variable initialization → Detailed Explanation

• Array out-of-bounds risk → Detailed Explanation
• External input subscript validation → Detailed Explanation

• Lock/Unlock paired use → Detailed Explanation
• Lock variable consistency → Detailed Explanation
• Release lock in all return paths → Detailed Explanation

• SocketCreate/Close paired use → Detailed Explanation
• Correct fd closure → Detailed Explanation

• Size validity check before memory allocation → Detailed Explanation
• SoftBusMalloc/SoftBusCalloc paired use with SoftBusFree → Detailed Explanation
• new paired use with delete → Detailed Explanation
• Null check after memory allocation → Detailed Explanation
• Nullify global variables after release → Detailed Explanation
• Nullify after release in loop bodies → Detailed Explanation
• Specific resource management (regcomp/regfree, cJSON_Parse/Delete, etc.) → Detailed Explanation

• Prohibit printing of keys, paths, addresses, etc. → Detailed Explanation
• Clear stack keys after use → Detailed Explanation
• Anonymized printing of sensitive identifiers → Detailed Explanation

• Risk of overflow, underflow, division by zero → Detailed Explanation
• Prohibit bitwise operations on signed integers → Detailed Explanation

• Unsigned number infinite loop → Detailed Explanation
• Validation of loops controlled by external data → Detailed Explanation

• Return value check for secure functions → Detailed Explanation
• Buffer size consistency → Detailed Explanation

• Permission validation for new SDK IPC interfaces → Detailed Explanation

• Path normalization → See Details
• TLV parsing length validity → See Details
• Source buffer actual size check → See Details
• Complete validation scheme → See Details

• Validation of addition/subtraction/memory allocation based on external input → See Details
• Default length validation → See Details
• TLV format length validation → See Details

• Resource release in exception branches → See Details
• Resource leaks in macro definitions → See Details
• Function return value consistency → See Details
• Formatted print type matching → See Details
• Struct byte alignment → See Details

1. Check for modifications under the path:

   git status --porcelain <path>

2. If there are modifications, provide options:
   • Full review of all code in the path
   • Incremental review of modified code (total N files)
3. If no modifications, directly perform full review

1. Check for modifications in the current repository:

   git status --porcelain

2. Provide options:
   • Review all repository code
   • Specify review path
   • Review locally modified code (total N files)
3. Execute based on user selection

• Rule Details Document - Detailed explanations and code examples for each rule
• Use Grep tool to search for violation patterns
• Combine contextual analysis to avoid false positives

• Call graph construction
• Cross-file resource tracking (separated malloc/free)
• Cross-file data flow analysis
• Cross-file error handling
• Cross-file access to global variables

• Control flow graph construction
• Unreachable code detection
• Path-sensitive analysis
• Uninitialized variable analysis
• Resource release path analysis

• Complete function or code block fix examples
• Comments on modification reasons
• Multiple fix solutions (if available)

d:/code-review-YYYYMMDD-HHMMSS/

• code_review_report.md

  - Complete review report

• code_fixes.patch

  - All fix code (in Git patch format)

• statistics.json

  - Statistical data

💡 Detailed Inspection Methods: For detailed inspection methods, code examples, and fix solutions for each error pattern, please refer to the Checklist

*ptr

ptr->

arr[index]

uint32_t i--

ptr & mask

• Check the context to confirm if protective measures are already in place
• Avoid false positives (e.g., global variables may be initialized elsewhere)

• In addition to the 40+ explicitly defined rules, perform general code quality checks
• Code complexity, readability, concurrency security, performance issues, etc.

• Code paths handling external input
• Resource usage in macro definitions
• Problematic code in conditional compilation
• High-risk security issues (null pointers, memory leaks, sensitive information leakage)

• This skill only reads and analyzes code
• Fix recommendations are only for inclusion in reports
• Never directly modify any source files
• Read-only operations: Only use read-only tools such as Read, Grep, Glob, etc.

• Rule Details and Examples - Detailed explanations and code examples for 40+ rules
  • Problem description, risk level, problematic examples, fix solutions, and inspection points for each rule
  • Includes complete code examples and best practices
  • Includes formatted print type matching table and list of commonly used secure functions

• Common Error Quick Reference - Quickly locate error patterns
• Usage Tips - How to effectively use this skill

1. Quickly Locate Issues: Use the "Quick Reference" table to find relevant rules based on code features
2. Deeply Learn Rules: Read

   references/security_rules_explained.md

   to understand detailed explanations and code examples for each rule
3. Categorized Review: Check item by item according to "Rule Categories" to avoid omissions
4. Prioritize Critical Issues: Refer to the "Common Error Quick Reference" to fix high-risk issues first
5. Use Workflow: Conduct reviews systematically following the "Code Review Workflow"

• Automatic Report Generation: Reports are automatically generated in the

  d:/code-review-timestamp/

  directory after review completion
• Report Directory Format: Use timestamp in

  YYYYMMDD-HHMMSS

  format
• File Encoding: Report files use UTF-8 encoding to ensure proper display of Chinese characters
• Fix Code for Reference Only: All fix code appears only in code blocks within report files and is not written to the source code directory