mirror of
https://github.com/github/codeql.git
synced 2025-12-20 10:46:30 +01:00
C++: QLDoc for FileClosed, LoopBounds and MemoryFreed
This commit is contained in:
@@ -1,5 +1,6 @@
|
||||
import semmle.code.cpp.pointsto.PointsTo
|
||||
|
||||
/** Holds if there exists a call to a function that might close the file specified by `e`. */
|
||||
predicate closed(Expr e) {
|
||||
fcloseCall(_, e) or
|
||||
exists(ExprCall c |
|
||||
@@ -8,10 +9,19 @@ predicate closed(Expr e) {
|
||||
)
|
||||
}
|
||||
|
||||
/** An expression for which there exists a function call that might close it. */
|
||||
class ClosedExpr extends PointsToExpr {
|
||||
ClosedExpr() { closed(this) }
|
||||
|
||||
override predicate interesting() { closed(this) }
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if `fc` is a call to function that opens a file which might be closed. For example:
|
||||
* ```
|
||||
* FILE* f = fopen("file.txt", "r");
|
||||
* ...
|
||||
* fclose(f);
|
||||
* ```
|
||||
*/
|
||||
predicate fopenCallMayBeClosed(FunctionCall fc) { fopenCall(fc) and anythingPointsTo(fc) }
|
||||
|
||||
@@ -2,12 +2,23 @@
|
||||
|
||||
import cpp
|
||||
|
||||
/** An assignment to a variable with the value `0`. For example:
|
||||
* ```
|
||||
* int x;
|
||||
* x = 0;
|
||||
* ```
|
||||
* but not:
|
||||
* ```
|
||||
* int x = 0;
|
||||
* ```
|
||||
*/
|
||||
class ZeroAssignment extends AssignExpr {
|
||||
ZeroAssignment() {
|
||||
this.getAnOperand() instanceof VariableAccess and
|
||||
this.getAnOperand() instanceof Zero
|
||||
}
|
||||
|
||||
/** Gets a variable that is assigned the value `0`. */
|
||||
Variable assignedVariable() { result.getAnAccess() = this.getAnOperand() }
|
||||
}
|
||||
|
||||
|
||||
@@ -9,10 +9,19 @@ private predicate freed(Expr e) {
|
||||
)
|
||||
}
|
||||
|
||||
/** An expression that might be deallocated. */
|
||||
class FreedExpr extends PointsToExpr {
|
||||
FreedExpr() { freed(this) }
|
||||
|
||||
override predicate interesting() { freed(this) }
|
||||
}
|
||||
|
||||
/**
|
||||
* An allocation expression that might be deallocated. For example:
|
||||
* ```
|
||||
* int* p = new int;
|
||||
* ...
|
||||
* delete p;
|
||||
* ```
|
||||
*/
|
||||
predicate allocMayBeFreed(AllocationExpr alloc) { anythingPointsTo(alloc) }
|
||||
|
||||
Reference in New Issue
Block a user