hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-22 11:46:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

C++: More principled macro exclusion

Browse Source 
We no longer exclude macros based on their name, which means we can now
find results inside arguments to the `likely` macro in Linux (except
that Linux is compiled with `-fno-strict-overflow`).
This commit is contained in:
Jonas Jensen
2019-11-13 13:55:29 +01:00
parent db33053422
commit 1b849dbf0e
1 changed files with 3 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
cpp/ql/src/Likely Bugs/Memory Management/PointerOverflow.ql
View File

@@ -12,6 +12,7 @@
import cpp import cpp
private import semmle.code.cpp.valuenumbering.GlobalValueNumbering private import semmle.code.cpp.valuenumbering.GlobalValueNumbering
private import semmle.code.cpp.commons.Exclusions
from RelationalOperation ro, PointerAddExpr add, Expr expr1, Expr expr2 from RelationalOperation ro, PointerAddExpr add, Expr expr1, Expr expr2
where where
@@ -19,13 +20,8 @@ where
add.getAnOperand() = expr1 and add.getAnOperand() = expr1 and
ro.getAnOperand() = expr2 and ro.getAnOperand() = expr2 and
globalValueNumber(expr1) = globalValueNumber(expr2) and globalValueNumber(expr1) = globalValueNumber(expr2) and
// Exclude macros except for assert macros. // Exclude macros but not their arguments
// TODO: port that location-based macro check we have in another query. Then not isFromMacroDefinition(ro) and
// we don't need to special-case on names.
not exists(MacroInvocation mi |
mi.getAnAffectedElement() = add and
not mi.getMacroName().toLowerCase().matches("%assert%")
) and
// There must be a compilation of this file without a flag that makes pointer // There must be a compilation of this file without a flag that makes pointer
// overflow well defined. // overflow well defined.
exists(Compilation c | c.getAFileCompiled() = ro.getFile() | exists(Compilation c | c.getAFileCompiled() = ro.getFile() |