## Unsafe Operations (High)

### Trigger Signals

- Use of uninitialized local variables or memory (used without assignment after declaration)
- Raw pointer dereference in Rust `unsafe` blocks (`*raw_ptr`, `ptr::read`)
- Allocation size calculated from external input (`malloc(user_len)`, `new char[size]`) without integer overflow validation
- Type punning/reinterpret casts (`reinterpret_cast`, `union` type confusion)
- `memset`/`memcpy` operations on non-POD types

### Judgment Process

1. **Identify uninitialized reads**: `Read` checks local variable declarations, tracks to first use location, confirming whether there is assignment or initialization:
   - Partial struct initialization (only some fields initialized)
   - Array declared then read without filling
   - Allocated via `malloc` then read without `memset`
2. **Check Rust unsafe blocks**: `Read` confirms whether operations in `unsafe` blocks have safety guarantees:
   - Whether raw pointers point to valid memory (not null, not dangling, properly aligned)
   - Whether safe API alternatives exist for unsafe code
   - Whether `unsafe` blocks have invariant comments explaining safety
3. **Check integer overflow causing allocation anomalies**: `Read` confirms the calculation process for allocation size:
   - Whether `size * count` can cause integer overflow (e.g., `size = 0x10000, count = 0x10000`)
   - Whether external input is range-validated before being used for allocation size
4. **Check type punning**: `Read` confirms whether `reinterpret_cast`/union violates strict aliasing rules

### Evidence Construction

After confirming a defect, the output must include:
- Uninitialized variable/unsafe operation location (with file:line number)
- Value propagation path of uninitialized read (which operations does the read value flow to)
- Safety assumptions of unsafe operations (what invariants are relied upon)
- Security impact (information leakage, undefined behavior, crash)

### Exclusions

- Variables initialized at declaration (`int x = 0`, `std::vector` constructor)
- Rust safe code (unsafe is explicitly marked, safe code guaranteed by compiler)
- Memory already initialized with `calloc`/`memset`
- Compiler already has `-Wuninitialized` enabled with no warnings
