hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 18:56:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

C++: Exclude calls to operator new / delete from NewFreeMismatch.ql.

Browse Source
This commit is contained in:
Geoffrey White
2020-04-06 11:30:14 +01:00
parent 97cdcbee63
commit 3e9f9645ae
3 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
cpp/ql/src/Critical/NewDelete.qll
View File

@@ -5,6 +5,8 @@
import cpp import cpp
import semmle.code.cpp.controlflow.SSA import semmle.code.cpp.controlflow.SSA
import semmle.code.cpp.dataflow.DataFlow import semmle.code.cpp.dataflow.DataFlow
import semmle.code.cpp.models.implementations.Allocation
import semmle.code.cpp.models.implementations.Deallocation
/** /**
* Holds if `alloc` is a use of `malloc` or `new`. `kind` is * Holds if `alloc` is a use of `malloc` or `new`. `kind` is
@@ -15,6 +17,7 @@ predicate allocExpr(Expr alloc, string kind) {
not alloc.isFromUninstantiatedTemplate(_) and not alloc.isFromUninstantiatedTemplate(_) and
( (
alloc instanceof FunctionCall and alloc instanceof FunctionCall and
not alloc.(FunctionCall).getTarget() instanceof OperatorNewAllocationFunction and
kind = "malloc" kind = "malloc"
or or
alloc instanceof NewExpr and alloc instanceof NewExpr and
@@ -111,6 +114,7 @@ predicate allocReaches(Expr e, Expr alloc, string kind) {
*/ */
predicate freeExpr(Expr free, Expr freed, string kind) { predicate freeExpr(Expr free, Expr freed, string kind) {
freeCall(free, freed) and freeCall(free, freed) and
not free.(FunctionCall).getTarget() instanceof OperatorDeleteDeallocationFunction and
kind = "free" kind = "free"
or or
free.(DeleteExpr).getExpr() = freed and free.(DeleteExpr).getExpr() = freed and

2
cpp/ql/test/query-tests/Critical/NewFree/NewFreeMismatch.expected
View File

@@ -1,8 +1,6 @@
| test2.cpp:19:3:19:6 | call to free | There is a new/free mismatch between this free and the corresponding $@. | test2.cpp:18:12:18:18 | new | new | | test2.cpp:19:3:19:6 | call to free | There is a new/free mismatch between this free and the corresponding $@. | test2.cpp:18:12:18:18 | new | new |
| test2.cpp:26:3:26:6 | call to free | There is a new/free mismatch between this free and the corresponding $@. | test2.cpp:25:7:25:13 | new | new | | test2.cpp:26:3:26:6 | call to free | There is a new/free mismatch between this free and the corresponding $@. | test2.cpp:25:7:25:13 | new | new |
| test2.cpp:50:2:50:18 | call to operator delete | There is a new/free mismatch between this free and the corresponding $@. | test2.cpp:45:18:45:24 | new | new |
| test2.cpp:51:2:51:5 | call to free | There is a new/free mismatch between this free and the corresponding $@. | test2.cpp:45:18:45:24 | new | new | | test2.cpp:51:2:51:5 | call to free | There is a new/free mismatch between this free and the corresponding $@. | test2.cpp:45:18:45:24 | new | new |
| test2.cpp:53:2:53:17 | delete | There is a malloc/delete mismatch between this delete and the corresponding $@. | test2.cpp:46:20:46:33 | call to operator new | malloc |
| test2.cpp:57:2:57:18 | delete | There is a malloc/delete mismatch between this delete and the corresponding $@. | test2.cpp:47:21:47:26 | call to malloc | malloc | | test2.cpp:57:2:57:18 | delete | There is a malloc/delete mismatch between this delete and the corresponding $@. | test2.cpp:47:21:47:26 | call to malloc | malloc |
| test.cpp:36:2:36:17 | delete | There is a malloc/delete mismatch between this delete and the corresponding $@. | test.cpp:27:18:27:23 | call to malloc | malloc | | test.cpp:36:2:36:17 | delete | There is a malloc/delete mismatch between this delete and the corresponding $@. | test.cpp:27:18:27:23 | call to malloc | malloc |
| test.cpp:41:2:41:5 | call to free | There is a new/free mismatch between this free and the corresponding $@. | test.cpp:26:7:26:17 | new | new | | test.cpp:41:2:41:5 | call to free | There is a new/free mismatch between this free and the corresponding $@. | test.cpp:26:7:26:17 | new | new |

4
cpp/ql/test/query-tests/Critical/NewFree/test2.cpp
View File

@@ -47,10 +47,10 @@ void test_operator_new()
void *ptr_malloc = malloc(sizeof(int)); void *ptr_malloc = malloc(sizeof(int));
delete ptr_new; // GOOD delete ptr_new; // GOOD
::operator delete(ptr_new); // GOOD [FALSE POSITIVE] ::operator delete(ptr_new); // GOOD
free(ptr_new); // BAD free(ptr_new); // BAD
delete ptr_opnew; // GOOD [FALSE POSITIVE] delete ptr_opnew; // GOOD
::operator delete(ptr_opnew); // GOOD ::operator delete(ptr_opnew); // GOOD
free(ptr_opnew); // BAD [NOT DETECTED] free(ptr_opnew); // BAD [NOT DETECTED]