hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 10:15:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: Fix some Ql4Ql violations.

Browse Source
This commit is contained in:
Michael Nebel
2025-09-03 08:14:20 +02:00
parent 31852985e5
commit 83d53baf82
33 changed files with 111 additions and 85 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
cpp/ql/src/experimental/Likely Bugs/RedundantNullCheckParam.ql
View File

@@ -47,7 +47,7 @@ where
// for a function parameter
unchecked.getTarget() = param and
// this function parameter is not overwritten
count(param.getAnAssignment()) = 0 and
not exists(param.getAnAssignment()) and
check.getTarget() = param and
// which is once checked
candidateResultChecked(check, eqop) and

13
cpp/ql/src/experimental/Security/CWE/CWE-1126/DeclarationOfVariableWithUnnecessarilyWideScope.ql
View File

@@ -19,16 +19,17 @@ import cpp
* Errors when using a variable declaration inside a loop.
*/
class DangerousWhileLoop extends WhileStmt {
Expr exp;
Declaration dl;
DangerousWhileLoop() {
this = dl.getParentScope().(BlockStmt).getParent*() and
exp = this.getCondition().getAChild*() and
not exp instanceof PointerFieldAccess and
not exp instanceof ValueFieldAccess and
exp.(VariableAccess).getTarget().getName() = dl.getName() and
not exp.getParent*() instanceof FunctionCall
exists(Expr exp |
exp = this.getCondition().getAChild*() and
not exp instanceof PointerFieldAccess and
not exp instanceof ValueFieldAccess and
exp.(VariableAccess).getTarget().getName() = dl.getName() and
not exp.getParent*() instanceof FunctionCall
)
}
Declaration getDeclaration() { result = dl }

2
cpp/ql/src/experimental/Security/CWE/CWE-125/DangerousWorksWithMultibyteOrWideCharacters.ql
View File

@@ -46,7 +46,7 @@ predicate exprMayBeString(Expr exp) {
)
}
/** Holds if expression is constant or operator call `sizeof`. */
/** Holds if expression `exp` is constant or operator call `sizeof`. */
predicate argConstOrSizeof(Expr exp) {
exp.getValue().toInt() > 1 or
exp.(SizeofTypeOperator).getTypeOperand().getSize() > 1

4
cpp/ql/src/experimental/Security/CWE/CWE-243/IncorrectChangingWorkingDirectory.ql
View File

@@ -15,7 +15,7 @@
import cpp
import semmle.code.cpp.commons.Exclusions
/** Holds if a `fc` function call is available before or after a `chdir` function call. */
/** Holds if a `fcp` function call is available before or after a `chdir` function call. */
predicate inExistsChdir(FunctionCall fcp) {
exists(FunctionCall fctmp |
(
@@ -29,7 +29,7 @@ predicate inExistsChdir(FunctionCall fcp) {
)
}
/** Holds if a `fc` function call is available before or after a function call containing a `chdir` call. */
/** Holds if a `fcp` function call is available before or after a function call containing a `chdir` call. */
predicate outExistsChdir(FunctionCall fcp) {
exists(FunctionCall fctmp |
exists(FunctionCall fctmp2 |

2
cpp/ql/src/experimental/Security/CWE/CWE-416/UseAfterExpiredLifetime.ql
View File

@@ -266,7 +266,7 @@ class LifetimePointerType extends LifetimeIndirectionType {
class FullExpr extends Expr {
FullExpr() {
// A full-expression is not a subexpression
not exists(Expr p | this.getParent() = p)
not this.getParent() instanceof Expr
or
// A sub-expression that is an unevaluated operand
this.isUnevaluated()