hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-21 06:55:31 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #15123 from MathiasVP/fix-fps-in-double-free

Browse Source 
C++: Fix FPs in `cpp/double-free` and `cpp/use-after-free`
This commit is contained in:
Mathias Vorreiter Pedersen
2023-12-18 10:44:18 +01:00
committed by GitHub
parent e88c6888bc 82b9f1b31c
commit 8ed9fbb295
3 changed files with 3 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
cpp/ql/src/Critical/FlowAfterFree.qll
View File

@@ -87,6 +87,8 @@ module FlowFromFree<isSinkSig/2 isASink, isExcludedSig/2 isExcluded> {
|
e = any(StoreInstruction store).getDestinationAddress().getUnconvertedResultExpression()
)
or
n.asExpr() instanceof ArrayExpr
}
}

4
cpp/ql/test/query-tests/Critical/MemoryFreed/DoubleFree.expected
View File

@@ -9,7 +9,6 @@ edges
| test_free.cpp:83:12:83:12 | pointer to operator delete output argument | test_free.cpp:85:12:85:12 | a |
| test_free.cpp:101:10:101:10 | pointer to free output argument | test_free.cpp:103:10:103:10 | a |
| test_free.cpp:128:10:128:11 | pointer to free output argument | test_free.cpp:129:10:129:11 | * ... |
| test_free.cpp:131:10:131:13 | pointer to free output argument | test_free.cpp:132:10:132:13 | access to array |
| test_free.cpp:152:27:152:27 | pointer to free output argument | test_free.cpp:154:10:154:10 | a |
| test_free.cpp:207:10:207:10 | pointer to free output argument | test_free.cpp:209:10:209:10 | a |
nodes
@@ -33,8 +32,6 @@ nodes
| test_free.cpp:103:10:103:10 | a | semmle.label | a |
| test_free.cpp:128:10:128:11 | pointer to free output argument | semmle.label | pointer to free output argument |
| test_free.cpp:129:10:129:11 | * ... | semmle.label | * ... |
| test_free.cpp:131:10:131:13 | pointer to free output argument | semmle.label | pointer to free output argument |
| test_free.cpp:132:10:132:13 | access to array | semmle.label | access to array |
| test_free.cpp:152:27:152:27 | pointer to free output argument | semmle.label | pointer to free output argument |
| test_free.cpp:154:10:154:10 | a | semmle.label | a |
| test_free.cpp:207:10:207:10 | pointer to free output argument | semmle.label | pointer to free output argument |
@@ -51,6 +48,5 @@ subpaths
| test_free.cpp:85:12:85:12 | a | test_free.cpp:83:12:83:12 | pointer to operator delete output argument | test_free.cpp:85:12:85:12 | a | Memory pointed to by 'a' may already have been freed by $@. | test_free.cpp:83:5:83:13 | delete | delete |
| test_free.cpp:103:10:103:10 | a | test_free.cpp:101:10:101:10 | pointer to free output argument | test_free.cpp:103:10:103:10 | a | Memory pointed to by 'a' may already have been freed by $@. | test_free.cpp:101:5:101:8 | call to free | call to free |
| test_free.cpp:129:10:129:11 | * ... | test_free.cpp:128:10:128:11 | pointer to free output argument | test_free.cpp:129:10:129:11 | * ... | Memory pointed to by '* ...' may already have been freed by $@. | test_free.cpp:128:5:128:8 | call to free | call to free |
| test_free.cpp:132:10:132:13 | access to array | test_free.cpp:131:10:131:13 | pointer to free output argument | test_free.cpp:132:10:132:13 | access to array | Memory pointed to by 'access to array' may already have been freed by $@. | test_free.cpp:131:5:131:8 | call to free | call to free |
| test_free.cpp:154:10:154:10 | a | test_free.cpp:152:27:152:27 | pointer to free output argument | test_free.cpp:154:10:154:10 | a | Memory pointed to by 'a' may already have been freed by $@. | test_free.cpp:152:22:152:25 | call to free | call to free |
| test_free.cpp:209:10:209:10 | a | test_free.cpp:207:10:207:10 | pointer to free output argument | test_free.cpp:209:10:209:10 | a | Memory pointed to by 'a' may already have been freed by $@. | test_free.cpp:207:5:207:8 | call to free | call to free |

2
cpp/ql/test/query-tests/Critical/MemoryFreed/test_free.cpp
View File

@@ -129,7 +129,7 @@ void test_ptr_deref(void ** a) {
free(*a); // BAD
*a = malloc(10);
free(a[0]); // GOOD
free(a[1]); // GOOD [FALSE POSITIVE]
free(a[1]); // GOOD
}
struct list {