hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 18:56:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

C++: Use the unary version of 'comparesEq' to handle both disjuncts.

Browse Source
This commit is contained in:
Mathias Vorreiter Pedersen
2024-06-25 09:30:53 +01:00
parent d2a00fa773
commit bb8b0d0bf5
1 changed files with 12 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
cpp/ql/src/Security/CWE/CWE-570/IncorrectAllocationErrorHandling.ql
View File

@@ -215,13 +215,18 @@ predicate noThrowInTryBlock(NewOrNewArrayExpr newExpr, BadAllocCatchBlock catchB
*/
predicate nullCheckInThrowingNew(NewOrNewArrayExpr newExpr, GuardCondition guard) {
newExpr.getAllocator() instanceof ThrowingAllocator and
(
// Handles null comparisons.
guard.ensuresEq(globalValueNumber(newExpr).getAnExpr(), any(NullValue null), _, _, _)
or
// Handles `if(ptr)` and `if(!ptr)` cases.
guard = globalValueNumber(newExpr).getAnExpr()
)
// There can be many guard conditions that compares `newExpr` againgst 0.
// For example, for `if(!p)` both `p` and `!p` is a guard condition. To not
// produce duplicates results we pick the "first" guard condition according
// to some arbitrary ordering (i.e., location information). This means `!p` is the
// element that we use to construct the alert.
guard =
min(GuardCondition gc, int startline, int startcolumn, int endline, int endcolumn |
gc.comparesEq(globalValueNumber(newExpr).getAnExpr(), 0, _, _) and
gc.getLocation().hasLocationInfo(_, startline, startcolumn, endline, endcolumn)
|
gc order by startline, startcolumn, endline, endcolumn
)
}
from NewOrNewArrayExpr newExpr, Element element, string msg, string elementString