Anas Khan 6859e9c035 fix: clamp max-concurrency in custom analysis to avoid deadlock and panic (#1700) ...

RunCustomAnalysis built its worker semaphore directly from the unvalidated
a.MaxConcurrency field, unlike RunAnalysis which clamps the value first. With
the user-supplied --max-concurrency flag this caused two failures:

- --max-concurrency 0 makes an unbuffered channel, so the pre-send blocks
  waiting for a receiver that is only launched on the next line, deadlocking
  the whole analyze command whenever a custom analyzer is configured.
- --max-concurrency -1 makes make(chan struct{}, -1) panic with
  "makechan: size out of range".

Apply the same lower/upper bound clamp RunAnalysis already uses (default 10 for
non-positive values, cap at 100). Add regression tests covering both cases.

Signed-off-by: Anas Khan <83116240+anxkhn@users.noreply.github.com>
Co-authored-by: Alex Jones <1235925+AlexsJones@users.noreply.github.com>

2026-07-14 15:58:07 +01:00

..

analysis_test.go

fix: clamp max-concurrency in custom analysis to avoid deadlock and panic (#1700)

2026-07-14 15:58:07 +01:00

analysis.go

fix: clamp max-concurrency in custom analysis to avoid deadlock and panic (#1700)

2026-07-14 15:58:07 +01:00

output_test.go

test: added missing tests for pkg/analysis package (#908)

2024-05-05 17:24:26 +01:00

output.go

feat: add stats option to analyze command for performance insights (#1237)

2024-10-30 13:58:18 +00:00