Merge pull request #6004 from MathiasVP/path-sensitive-stack-variable-reachability-analysis

C++: Add path-sensitivity to `StackVariableReachability`

cpp/change-notes/2021-06-15-path-sensitive-stack-reachability.md

@@ -0,0 +1,4 @@
+lgtm,codescanning
+* The `StackVariableReachability` library now ignores some paths that contain an infeasible combination
+  of conditionals. These improvements primarily affect the queries `cpp/uninitialized-local` and
+  `cpp/use-after-free`.

cpp/ql/src/semmle/code/cpp/controlflow/DefinitionsAndUses.qll

@@ -208,7 +208,7 @@ private predicate bbSuccessorEntryReachesDefOrUse(
   boolean skipsFirstLoopAlwaysTrueUponEntry
 ) {
   exists(BasicBlock succ, boolean succSkipsFirstLoopAlwaysTrueUponEntry |
-    bbSuccessorEntryReachesLoopInvariant(bb, succ, skipsFirstLoopAlwaysTrueUponEntry,
+    bbSuccessorEntryReachesLoopInvariant0(bb, succ, skipsFirstLoopAlwaysTrueUponEntry,
       succSkipsFirstLoopAlwaysTrueUponEntry)
   |
     bbEntryReachesDefOrUseLocally(succ, v, defOrUse) and

cpp/ql/src/semmle/code/cpp/controlflow/StackVariableReachability.qll

@@ -3,7 +3,250 @@
  * reachability involving stack variables.
  */
 
-import cpp
+private import semmle.code.cpp.controlflow.Guards
+private import semmle.code.cpp.valuenumbering.GlobalValueNumbering
+
+/** A `GuardCondition` which appear in a control-flow path to a sink. */
+abstract private class LogicalGuardCondition extends GuardCondition {
+  LogicalGuardCondition() {
+    // Either the `GuardCondition` is part of the path from a source to a sink
+    revBbSuccessorEntryReaches0(_, this.getBasicBlock(), _, _, _)
+    or
+    // or it controls the basic block that contains the source node.
+    this.controls(any(BasicBlock bb | fwdBbEntryReachesLocally(bb, _, _, _)), _)
+  }
+
+  /**
+   * Holds if the truth of this logical expression having value `wholeIsTrue`
+   * implies that the truth of the child expression `part` has truth value `partIsTrue`.
+   */
+  abstract predicate impliesCondition(
+    LogicalGuardCondition e, boolean testIsTrue, boolean condIsTrue
+  );
+}
+
+private class BinaryLogicalGuardCondition extends LogicalGuardCondition, BinaryLogicalOperation {
+  override predicate impliesCondition(
+    LogicalGuardCondition e, boolean testIsTrue, boolean condIsTrue
+  ) {
+    this.impliesValue(e, testIsTrue, condIsTrue)
+  }
+}
+
+private class VariableGuardCondition extends LogicalGuardCondition, VariableAccess {
+  override predicate impliesCondition(
+    LogicalGuardCondition e, boolean testIsTrue, boolean condIsTrue
+  ) {
+    this = e and
+    (
+      testIsTrue = true and condIsTrue = true
+      or
+      testIsTrue = false and condIsTrue = false
+    )
+  }
+}
+
+private class NotGuardCondition extends LogicalGuardCondition, NotExpr {
+  override predicate impliesCondition(
+    LogicalGuardCondition e, boolean testIsTrue, boolean condIsTrue
+  ) {
+    e = this.getOperand() and
+    (
+      testIsTrue = true and
+      condIsTrue = false
+      or
+      testIsTrue = false and
+      condIsTrue = true
+    )
+  }
+}
+
+private newtype TCondition =
+  MkCondition(LogicalGuardCondition guard, boolean testIsTrue) { testIsTrue = [false, true] }
+
+private class Condition extends MkCondition {
+  boolean testIsTrue;
+  LogicalGuardCondition guard;
+
+  Condition() { this = MkCondition(guard, testIsTrue) }
+
+  /**
+   * Holds if this condition having the value `this.getTruthValue()` implies that `cond` has truth
+   * value `cond.getTruthValue()`.
+   */
+  string toString() { result = guard.toString() + " == " + testIsTrue.toString() }
+
+  /** Gets the value of this `Condition`. */
+  boolean getTruthValue() { result = testIsTrue }
+
+  LogicalGuardCondition getCondition() { result = guard }
+
+  pragma[nomagic]
+  predicate impliesCondition(Condition cond) {
+    exists(LogicalGuardCondition other |
+      other = cond.getCondition() and
+      this.getCondition()
+          .impliesCondition(globalValueNumber(other).getAnExpr(),
+            pragma[only_bind_into](pragma[only_bind_out](testIsTrue)),
+            pragma[only_bind_into](pragma[only_bind_out](cond.getTruthValue())))
+    )
+  }
+
+  /** Gets the negated expression represented by this `Condition`, if any. */
+  private Condition negate() {
+    result.getCondition() = guard and
+    result.getTruthValue() = testIsTrue.booleanNot()
+  }
+
+  /**
+   * Holds if this condition having the value `this.getTruthValue()` implies that `cond` cannot have
+   * the truth value `cond.getTruthValue()`.
+   */
+  final predicate refutesCondition(Condition cond) { this.impliesCondition(cond.negate()) }
+
+  /** Gets the `Location` of the expression that generated this `Condition`. */
+  Location getLocation() { result = guard.getLocation() }
+}
+
+/**
+ * Gets a `Condition` that controls `b`. That is, to enter `b` the condition must hold.
+ */
+private Condition getADirectCondition(BasicBlock b) {
+  result.getCondition().controls(b, result.getTruthValue())
+}
+
+/**
+ * Like the shared dataflow library, the reachability analysis is split into two stages:
+ * In the first stage, we compute an overapproximation of the possible control-flow paths where we don't
+ * reason about path conditions. This stage is split into phases: A forward phase (computed by the
+ * predicates prefixes with `fwd`), and a reverse phase (computed by the predicates prefixed with `rev`).
+ *
+ * The forward phease computes the set of control-flow nodes reachable from a given `source` and `v` such
+ * that `config.isSource(source, v)` holds.
+ *
+ * See the QLDoc on `revBbSuccessorEntryReaches0` for a description of what the reverse phase computes.
+ */
+private predicate fwdBbSuccessorEntryReaches0(
+  ControlFlowNode source, BasicBlock bb, SemanticStackVariable v,
+  boolean skipsFirstLoopAlwaysTrueUponEntry, StackVariableReachability config
+) {
+  fwdBbEntryReachesLocally(bb, v, source, config) and
+  skipsFirstLoopAlwaysTrueUponEntry = false
+  or
+  exists(BasicBlock pred, boolean predSkipsFirstLoopAlwaysTrueUponEntry |
+    bbSuccessorEntryReachesLoopInvariant0(pred, bb, predSkipsFirstLoopAlwaysTrueUponEntry,
+      skipsFirstLoopAlwaysTrueUponEntry)
+  |
+    // Note we cannot filter out barriers at this point.
+    // See the comment in `revBbSuccessorEntryReaches0` for an explanation why,
+    fwdBbSuccessorEntryReaches0(source, pred, v, predSkipsFirstLoopAlwaysTrueUponEntry, config)
+  )
+}
+
+/**
+ * The second phase of the first stages computes, for each `source` and `v` pair such
+ * that `config.isSource(source, v)`, which sinks are reachable from that `(source, v)` pair.
+ */
+private predicate revBbSuccessorEntryReaches0(
+  ControlFlowNode source, BasicBlock bb, SemanticStackVariable v,
+  boolean skipsFirstLoopAlwaysTrueUponEntry, StackVariableReachability config
+) {
+  exists(BasicBlock succ, boolean succSkipsFirstLoopAlwaysTrueUponEntry |
+    fwdBbSuccessorEntryReaches0(source, bb, v, skipsFirstLoopAlwaysTrueUponEntry, config) and
+    bbSuccessorEntryReachesLoopInvariant0(bb, succ, skipsFirstLoopAlwaysTrueUponEntry,
+      succSkipsFirstLoopAlwaysTrueUponEntry)
+  |
+    revBbEntryReachesLocally(succ, v, _, config) and
+    succSkipsFirstLoopAlwaysTrueUponEntry = false
+    or
+    // Note: We cannot rule out a successor block that contain a barrier here (like we do later in
+    // `bbSuccessorEntryReaches`) as we might later discover that the only way to get through a piece of
+    // code is through that barrier, and we want to discover this in
+    // `bbSuccessorEntryReachesLoopInvariant`. As an example, consider this piece of code:
+    // ```
+    // if(b) { (1) source(); }
+    // (2) if(b) { (3) barrier(); }
+    // (4) sink();
+    // ```
+    // here, we want the successor relation to contain:
+    // 1 -> {2}, 2 -> {3, 4}
+    // since the second stage will deduce that the edge (2) -> (3) is unconditional (as b is always true
+    // if we start at `source()`), and so there is actually no path from (1) to (4) without going through
+    // a barrier.
+    revBbSuccessorEntryReaches0(source, succ, v, succSkipsFirstLoopAlwaysTrueUponEntry, config)
+  )
+}
+
+private predicate successorExitsLoop(BasicBlock pred, BasicBlock succ, Loop loop) {
+  pred.getASuccessor() = succ and
+  bbDominates(loop.getStmt(), pred) and
+  not bbDominates(loop.getStmt(), succ)
+}
+
+private predicate successorExitsFirstDisjunct(BasicBlock pred, BasicBlock succ) {
+  exists(LogicalOrExpr orExpr | orExpr instanceof GuardCondition |
+    pred.getAFalseSuccessor() = succ and
+    pred.contains(orExpr.getLeftOperand())
+  )
+}
+
+/**
+ * When we exit a loop, we filter out the conditions that arise from the loop's guard.
+ * To see why this is necessary, consider this example:
+ * ```
+ * (1) source();
+ * while (b) { (2) ... }
+ * (3) sink();
+ * ```
+ * If we keep all the conditions when we transition from (2) to (3) we learn that `b` is true at
+ * (3), but since we exited the loop we also learn that `b` is false at 3.
+ * Thus, when we transition from (2) to (3) we discard all those conditions that are true at (2),
+ * but NOT true at (3).
+ */
+private predicate isLoopCondition(LogicalGuardCondition cond, BasicBlock pred, BasicBlock bb) {
+  exists(Loop loop, boolean testIsTrue | successorExitsLoop(pred, bb, loop) |
+    // the resulting `Condition` holds inside the loop
+    cond.controls(pred, testIsTrue) and
+    // but not prior to the loop.
+    not cond.controls(loop.getBasicBlock(), testIsTrue)
+  )
+}
+
+/**
+ * When we leave the first disjunct we throw away the condition that says the the first disjunct is
+ * false. To see why this is necessary, consider this example:
+ * ```
+ * if((1) b1 || (2) b2) { (3) ... }
+ * ```
+ * it holds that `b1 == false` controls (2), and since (2) steps to (3) we learn that `b1 == false `
+ * holds at (3). So we filter out the conditions that we learn from leaving taking the false
+ * branch in a disjunction.
+ */
+private predicate isDisjunctionCondition(LogicalGuardCondition cond, BasicBlock pred, BasicBlock bb) {
+  exists(boolean testIsTrue | successorExitsFirstDisjunct(pred, bb) |
+    // the resulting `Condition` holds after evaluating the left-hand side
+    cond.controls(bb, testIsTrue) and
+    // but not before evaluating the left-hand side.
+    not cond.controls(pred, testIsTrue)
+  )
+}
+
+private predicate isLoopVariantCondition(LogicalGuardCondition cond, BasicBlock pred, BasicBlock bb) {
+  exists(Loop loop |
+    bb.getEnd() = loop.getCondition() and
+    pred.getASuccessor() = bb and
+    bbDominates(bb, pred) and
+    loopVariant(cond.getAChild*(), loop)
+  )
+}
+
+private predicate loopVariant(VariableAccess e, Loop loop) {
+  exists(SsaDefinition d | d.getAUse(e.getTarget()) = e |
+    d.getAnUltimateDefiningValue(e.getTarget()) = loop.getCondition().getAChild*() or
+    d.getAnUltimateDefiningValue(e.getTarget()).getEnclosingStmt().getParent*() = loop.getStmt() or
+    d.getAnUltimateDefiningValue(e.getTarget()) = loop.(ForStmt).getUpdate().getAChild*()
+  )
+}
 
 /**
  * A reachability analysis for control-flow nodes involving stack variables.
@@ -60,7 +303,8 @@ abstract class StackVariableReachability extends string {
    * ```
    *
    * In addition to using a better performing implementation, this analysis
-   * accounts for loops where the condition is provably true upon entry.
+   * accounts for loops where the condition is provably true upon entry, and discards paths that require
+   * an infeasible combination of guard conditions (for example, `if(b) { ... }` and `if(!b) { ... }`).
    */
   predicate reaches(ControlFlowNode source, SemanticStackVariable v, ControlFlowNode sink) {
     /*
@@ -80,46 +324,184 @@ abstract class StackVariableReachability extends string {
         j > i and
         sink = bb.getNode(j) and
         isSink(sink, v) and
-        not exists(int k | isBarrier(bb.getNode(k), v) | k in [i + 1 .. j - 1])
+        not isBarrier(bb.getNode(pragma[only_bind_into]([i + 1 .. j - 1])), v)
       )
       or
       not exists(int k | isBarrier(bb.getNode(k), v) | k > i) and
-      bbSuccessorEntryReaches(bb, v, sink, _)
+      bbSuccessorEntryReaches(source, bb, v, sink, _)
+    )
+  }
+
+  private Condition getASinkCondition(SemanticStackVariable v) {
+    exists(BasicBlock bb |
+      revBbEntryReachesLocally(bb, v, _, this) and
+      result.getCondition().controls(bb, result.getTruthValue())
+    )
+  }
+
+  private Condition getABarrierCondition(SemanticStackVariable v) {
+    exists(BasicBlock bb |
+      isBarrier(bb.getANode(), v) and
+      result.getCondition().controls(bb, result.getTruthValue())
+    )
+  }
+
+  /**
+   * Gets a condition with a known truth value in `bb` when the control-flow starts at the source
+   * node `source` and we're tracking reachability using variable `v` (that is,
+   * `this.isSource(source, v)` holds).
+   *
+   * This predicate is `pragma[noopt]` as it seems difficult to get the correct join order for the
+   * recursive case otherwise:
+   * revBbSuccessorEntryReaches0(bb) -> getASuccessor -> prev_delta ->
+   * revBbSuccessorEntryReaches0(pred) -> {isLoopCondition, isDisjunctionCondition, isLoopVariantCondition}
+   */
+  pragma[noopt]
+  private Condition getACondition(ControlFlowNode source, SemanticStackVariable v, BasicBlock bb) {
+    revBbSuccessorEntryReaches0(source, bb, v, _, this) and
+    (
+      result = getADirectCondition(bb) and
+      (
+        exists(Condition c |
+          c = getASinkCondition(v) and
+          result.refutesCondition(c)
+        )
+        or
+        exists(Condition c |
+          c = getABarrierCondition(v) and
+          result.impliesCondition(c)
+        )
+      )
+      or
+      exists(BasicBlock pred |
+        pred.getASuccessor() = bb and
+        result = getACondition(source, v, pred) and
+        revBbSuccessorEntryReaches0(source, pred, v, _, this) and
+        exists(LogicalGuardCondition c | c = result.getCondition() |
+          not isLoopCondition(c, pred, bb) and
+          not isDisjunctionCondition(c, pred, bb) and
+          not isLoopVariantCondition(c, pred, bb)
+        )
+      )
+    )
+  }
+
+  pragma[nomagic]
+  private predicate bbSuccessorEntryReachesLoopInvariantSucc(
+    ControlFlowNode source, BasicBlock pred, SemanticStackVariable v, BasicBlock succ,
+    boolean predSkipsFirstLoopAlwaysTrueUponEntry
+  ) {
+    revBbSuccessorEntryReaches0(source, pragma[only_bind_into](pred), v,
+      predSkipsFirstLoopAlwaysTrueUponEntry, this) and
+    pred.getASuccessor() = succ
+  }
+
+  pragma[nomagic]
+  private predicate bbSuccessorEntryReachesLoopInvariantCand(
+    ControlFlowNode source, BasicBlock pred, SemanticStackVariable v, BasicBlock succ,
+    boolean predSkipsFirstLoopAlwaysTrueUponEntry, boolean succSkipsFirstLoopAlwaysTrueUponEntry
+  ) {
+    bbSuccessorEntryReachesLoopInvariantSucc(source, pragma[only_bind_into](pred), v, succ,
+      predSkipsFirstLoopAlwaysTrueUponEntry) and
+    bbSuccessorEntryReachesLoopInvariant0(pred, succ, predSkipsFirstLoopAlwaysTrueUponEntry,
+      succSkipsFirstLoopAlwaysTrueUponEntry)
+  }
+
+  /**
+   * Holds if `pred`, `succ`, `predSkipsFirstLoopAlwaysTrueUponEntry` and
+   * `succSkipsFirstLoopAlwaysTrueUponEntry` satisfy the loop invariants specified in the QLDoc
+   * for `bbSuccessorEntryReachesLoopInvariant0`.
+   *
+   * In addition, this predicate:
+   * 1. Rules out successor blocks that are unreachable due to contradictory path conditions.
+   * 2. Refines the successor relation when the edge `pred -> succ` is a conditional edge whose truth
+   *    value is known.
+   */
+  pragma[nomagic]
+  private predicate bbSuccessorEntryReachesLoopInvariant(
+    ControlFlowNode source, BasicBlock pred, SemanticStackVariable v, BasicBlock succ,
+    boolean predSkipsFirstLoopAlwaysTrueUponEntry, boolean succSkipsFirstLoopAlwaysTrueUponEntry
+  ) {
+    bbSuccessorEntryReachesLoopInvariantCand(source, pred, v, succ,
+      predSkipsFirstLoopAlwaysTrueUponEntry, succSkipsFirstLoopAlwaysTrueUponEntry) and
+    not exists(Condition cond, Condition direct |
+      cond = getACondition(source, v, pred) and
+      direct = pragma[only_bind_out](getADirectCondition(succ)) and
+      cond.refutesCondition(direct)
+    ) and
+    (
+      // If we picked the successor edge corresponding to a condition being true, there must not be
+      // another path condition that refutes that the condition is true.
+      not exists(Condition cond | cond = getACondition(source, v, pred) |
+        succ = pred.getATrueSuccessor() and
+        cond.refutesCondition(pragma[only_bind_out](MkCondition(pred.getEnd(), true)))
+      ) and
+      // If we picked the successor edge corresponding to a condition being false, there must not be
+      // another path condition that refutes that the condition is false.
+      not exists(Condition cond | cond = getACondition(source, v, pred) |
+        succ = pred.getAFalseSuccessor() and
+        cond.refutesCondition(pragma[only_bind_out](MkCondition(pred.getEnd(), false)))
+      )
     )
   }
 
   private predicate bbSuccessorEntryReaches(
-    BasicBlock bb, SemanticStackVariable v, ControlFlowNode node,
+    ControlFlowNode source, BasicBlock bb, SemanticStackVariable v, ControlFlowNode node,
     boolean skipsFirstLoopAlwaysTrueUponEntry
   ) {
     exists(BasicBlock succ, boolean succSkipsFirstLoopAlwaysTrueUponEntry |
-      bbSuccessorEntryReachesLoopInvariant(bb, succ, skipsFirstLoopAlwaysTrueUponEntry,
+      bbSuccessorEntryReachesLoopInvariant(source, bb, v, succ, skipsFirstLoopAlwaysTrueUponEntry,
         succSkipsFirstLoopAlwaysTrueUponEntry)
     |
-      bbEntryReachesLocally(succ, v, node) and
+      revBbEntryReachesLocally(succ, v, node, this) and
       succSkipsFirstLoopAlwaysTrueUponEntry = false
       or
-      not isBarrier(succ.getNode(_), v) and
-      bbSuccessorEntryReaches(succ, v, node, succSkipsFirstLoopAlwaysTrueUponEntry)
+      bbSuccessorEntryReachesLoopInvariant(source, bb, v, succ, skipsFirstLoopAlwaysTrueUponEntry,
+        succSkipsFirstLoopAlwaysTrueUponEntry) and
+      not isBarrier(pragma[only_bind_out](succ.getANode()), v) and
+      pragma[only_bind_into](this)
+          .bbSuccessorEntryReaches(source, succ, v, node, succSkipsFirstLoopAlwaysTrueUponEntry)
     )
   }
+}
 
-  private predicate bbEntryReachesLocally(
-    BasicBlock bb, SemanticStackVariable v, ControlFlowNode node
-  ) {
-    exists(int n |
-      node = bb.getNode(n) and
-      isSink(node, v)
-    |
-      not exists(this.firstBarrierIndexIn(bb, v))
+private predicate fwdBbEntryReachesLocally(
+  BasicBlock bb, SemanticStackVariable v, ControlFlowNode node, StackVariableReachability config
+) {
+  exists(int n |
+    node = bb.getNode(n) and
+    config.isSource(node, v) and
+    (
+      not exists(lastBarrierIndexIn(bb, v, config))
       or
-      n <= this.firstBarrierIndexIn(bb, v)
+      lastBarrierIndexIn(bb, v, config) <= n
     )
-  }
+  )
+}
 
-  private int firstBarrierIndexIn(BasicBlock bb, SemanticStackVariable v) {
-    result = min(int m | isBarrier(bb.getNode(m), v))
-  }
+private predicate revBbEntryReachesLocally(
+  BasicBlock bb, SemanticStackVariable v, ControlFlowNode node, StackVariableReachability config
+) {
+  exists(int n |
+    node = bb.getNode(n) and
+    config.isSink(node, v)
+  |
+    not exists(firstBarrierIndexIn(bb, v, config))
+    or
+    n <= firstBarrierIndexIn(bb, v, config)
+  )
+}
+
+private int firstBarrierIndexIn(
+  BasicBlock bb, SemanticStackVariable v, StackVariableReachability config
+) {
+  result = min(int m | config.isBarrier(bb.getNode(m), v))
+}
+
+private int lastBarrierIndexIn(
+  BasicBlock bb, SemanticStackVariable v, StackVariableReachability config
+) {
+  result = max(int m | config.isBarrier(bb.getNode(m), v))
 }
 
 /**
@@ -182,7 +564,7 @@ private predicate bbLoopConditionAlwaysTrueUponEntrySuccessor(
  * is provably true upon entry, then `succ` is not allowed to skip
  * that loop (`succSkipsFirstLoopAlwaysTrueUponEntry = false`).
  */
-predicate bbSuccessorEntryReachesLoopInvariant(
+predicate bbSuccessorEntryReachesLoopInvariant0(
   BasicBlock pred, BasicBlock succ, boolean predSkipsFirstLoopAlwaysTrueUponEntry,
   boolean succSkipsFirstLoopAlwaysTrueUponEntry
 ) {
@@ -296,10 +678,52 @@ abstract class StackVariableReachabilityWithReassignment extends StackVariableRe
     )
   }
 
+  private predicate bbSuccessorEntryReaches(
+    BasicBlock bb, SemanticStackVariable v, ControlFlowNode node,
+    boolean skipsFirstLoopAlwaysTrueUponEntry
+  ) {
+    exists(BasicBlock succ, boolean succSkipsFirstLoopAlwaysTrueUponEntry |
+      bbSuccessorEntryReachesLoopInvariant0(bb, succ, skipsFirstLoopAlwaysTrueUponEntry,
+        succSkipsFirstLoopAlwaysTrueUponEntry)
+    |
+      revBbEntryReachesLocally(succ, v, node, this) and
+      succSkipsFirstLoopAlwaysTrueUponEntry = false
+      or
+      not isBarrier(succ.getNode(_), v) and
+      bbSuccessorEntryReaches(succ, v, node, succSkipsFirstLoopAlwaysTrueUponEntry)
+    )
+  }
+
+  private predicate reaches0(ControlFlowNode source, SemanticStackVariable v, ControlFlowNode sink) {
+    /*
+     * Implementation detail: the predicates in this class are a generalization of
+     * those in DefinitionsAndUses.qll, and should be kept in sync.
+     *
+     * Unfortunately, caching of abstract predicates does not work well, so the
+     * predicates in DefinitionsAndUses.qll cannot use this library.
+     */
+
+    exists(BasicBlock bb, int i |
+      isSource(source, v) and
+      bb.getNode(i) = source and
+      not bb.isUnreachable()
+    |
+      exists(int j |
+        j > i and
+        sink = bb.getNode(j) and
+        isSink(sink, v) and
+        not isBarrier(bb.getNode(pragma[only_bind_into]([i + 1 .. j - 1])), v)
+      )
+      or
+      not exists(int k | isBarrier(bb.getNode(k), v) | k > i) and
+      bbSuccessorEntryReaches(bb, v, sink, _)
+    )
+  }
+
   private predicate reassignment(
     ControlFlowNode source, SemanticStackVariable v, ControlFlowNode def, SemanticStackVariable v0
   ) {
-    StackVariableReachability.super.reaches(source, v, def) and
+    reaches0(source, v, def) and
     exprDefinition(v0, def, v.getAnAccess())
   }
 
@@ -365,11 +789,11 @@ abstract class StackVariableReachabilityExt extends string {
     boolean skipsFirstLoopAlwaysTrueUponEntry
   ) {
     exists(BasicBlock succ, boolean succSkipsFirstLoopAlwaysTrueUponEntry |
-      bbSuccessorEntryReachesLoopInvariant(bb, succ, skipsFirstLoopAlwaysTrueUponEntry,
+      bbSuccessorEntryReachesLoopInvariant0(bb, succ, skipsFirstLoopAlwaysTrueUponEntry,
         succSkipsFirstLoopAlwaysTrueUponEntry) and
       not isBarrier(source, bb.getEnd(), succ.getStart(), v)
     |
-      bbEntryReachesLocally(source, succ, v, node) and
+      this.bbEntryReachesLocally(source, succ, v, node) and
       succSkipsFirstLoopAlwaysTrueUponEntry = false
       or
       not exists(int k | isBarrier(source, succ.getNode(k), succ.getNode(k + 1), v)) and

cpp/ql/test/library-tests/fields/fields/Fields.expected

@@ -1,13 +1,21 @@
 | fields.cpp:3:8:3:12 | Entry | fields.cpp:4:9:4:12 | name | public | CharPointerType | char |
+| fields.cpp:3:8:3:12 | Entry | fields.cpp:4:9:4:12 | name | public | PointerDumpType | char |
 | fields.cpp:3:8:3:12 | Entry | fields.cpp:5:8:5:8 | t | public | Enum |  |
+| fields.cpp:3:8:3:12 | Entry | fields.cpp:5:8:5:8 | t | public | UserDumpType |  |
 | fields.cpp:3:8:3:12 | Entry | fields.cpp:6:9:6:9 | s | public | CharPointerType | char |
+| fields.cpp:3:8:3:12 | Entry | fields.cpp:6:9:6:9 | s | public | PointerDumpType | char |
 | fields.cpp:3:8:3:12 | Entry | fields.cpp:7:7:7:7 | i | public | IntType |  |
+| fields.cpp:3:8:3:12 | Entry | fields.cpp:7:7:7:7 | i | public | IntegralDumpType |  |
 | fields.cpp:3:8:3:12 | Entry | fields.cpp:7:7:7:7 | i | public | MicrosoftInt32Type |  |
 | fields.cpp:3:8:3:12 | Entry | fields.cpp:9:7:9:14 | internal | private | IntType |  |
+| fields.cpp:3:8:3:12 | Entry | fields.cpp:9:7:9:14 | internal | private | IntegralDumpType |  |
 | fields.cpp:3:8:3:12 | Entry | fields.cpp:9:7:9:14 | internal | private | MicrosoftInt32Type |  |
-| fields.cpp:12:7:12:10 | Name | fields.cpp:13:15:13:15 | s | private | PointerType | const char |
-| fields.cpp:16:7:16:11 | Table | fields.cpp:17:9:17:9 | p | private | PointerType | Name |
+| fields.cpp:12:7:12:10 | Name | fields.cpp:13:15:13:15 | s | private | PointerDumpType | const char |
+| fields.cpp:16:7:16:11 | Table | fields.cpp:17:9:17:9 | p | private | PointerDumpType | Name |
 | fields.cpp:16:7:16:11 | Table | fields.cpp:18:7:18:8 | sz | private | IntType |  |
+| fields.cpp:16:7:16:11 | Table | fields.cpp:18:7:18:8 | sz | private | IntegralDumpType |  |
 | fields.cpp:16:7:16:11 | Table | fields.cpp:18:7:18:8 | sz | private | MicrosoftInt32Type |  |
 | fields.cpp:26:7:26:10 | Date | fields.cpp:28:16:28:26 | cache_valid | private | BoolType |  |
+| fields.cpp:26:7:26:10 | Date | fields.cpp:28:16:28:26 | cache_valid | private | IntegralDumpType |  |
 | fields.cpp:26:7:26:10 | Date | fields.cpp:30:17:30:21 | cache | public | CharPointerType | char |
+| fields.cpp:26:7:26:10 | Date | fields.cpp:30:17:30:21 | cache | public | PointerDumpType | char |

cpp/ql/test/library-tests/functions/routinetype/types.expected

@@ -1 +1 @@
-| routinetype.cpp:2:7:2:19 | myRoutineType | file://:0:0:0:0 | ..()(..) | RoutineType |
+| routinetype.cpp:2:7:2:19 | myRoutineType | file://:0:0:0:0 | ..()(..) | PrintableElement, RoutineDumpType |

cpp/ql/test/library-tests/typedefs/Typedefs2.expected

@@ -1,2 +1,2 @@
-| typedefs.cpp:6:6:6:7 | f1 | typedefs.cpp:8:15:8:18 | TYPE | CTypedefType, LocalTypedefType |
-| typedefs.cpp:6:6:6:7 | f1 | typedefs.cpp:9:9:9:9 | D | DirectAccessHolder, LocalClass, MetricClass, StructLikeClass |
+| typedefs.cpp:6:6:6:7 | f1 | typedefs.cpp:8:15:8:18 | TYPE | CTypedefType, LocalTypedefType, PrintableElement, UserDumpType |
+| typedefs.cpp:6:6:6:7 | f1 | typedefs.cpp:9:9:9:9 | D | DirectAccessHolder, LocalClass, MetricClass, PrintableElement, StructLikeClass, UserDumpType |

cpp/ql/test/library-tests/types/__wchar_t/wchar_t.expected

@@ -1,3 +1,3 @@
-| file://:0:0:0:0 | __wchar_t * | PointerType | Wchar_t, WideCharType |
-| file://:0:0:0:0 | const __wchar_t | SpecifiedType | Wchar_t, WideCharType |
-| file://:0:0:0:0 | wchar_t | Wchar_t, WideCharType |  |
+| file://:0:0:0:0 | __wchar_t * | PointerDumpType, PrintableElement | IntegralDumpType, PrintableElement, Wchar_t, WideCharType |
+| file://:0:0:0:0 | const __wchar_t | PrintableElement, SpecifiedDumpType | IntegralDumpType, PrintableElement, Wchar_t, WideCharType |
+| file://:0:0:0:0 | wchar_t | IntegralDumpType, PrintableElement, Wchar_t, WideCharType |  |

cpp/ql/test/library-tests/types/cstd_types/cstd_types_fastestminimumwidth.expected

@@ -1,8 +1,8 @@
-| cstd_types.cpp:47:13:47:15 | if8 | CTypedefType, FastestMinimumWidthIntegralType, Int_fast8_t |
-| cstd_types.cpp:48:14:48:17 | if16 | CTypedefType, FastestMinimumWidthIntegralType, Int_fast16_t |
-| cstd_types.cpp:49:14:49:17 | if32 | CTypedefType, FastestMinimumWidthIntegralType, Int_fast32_t |
-| cstd_types.cpp:50:14:50:17 | if64 | CTypedefType, FastestMinimumWidthIntegralType, Int_fast64_t |
-| cstd_types.cpp:51:14:51:16 | uf8 | CTypedefType, FastestMinimumWidthIntegralType, UInt_fast8_t |
-| cstd_types.cpp:52:15:52:18 | uf16 | CTypedefType, FastestMinimumWidthIntegralType, UInt_fast16_t |
-| cstd_types.cpp:53:15:53:18 | uf32 | CTypedefType, FastestMinimumWidthIntegralType, UInt_fast32_t |
-| cstd_types.cpp:54:15:54:18 | uf64 | CTypedefType, FastestMinimumWidthIntegralType, UInt_fast64_t |
+| cstd_types.cpp:47:13:47:15 | if8 | CTypedefType, FastestMinimumWidthIntegralType, Int_fast8_t, PrintableElement, UserDumpType |
+| cstd_types.cpp:48:14:48:17 | if16 | CTypedefType, FastestMinimumWidthIntegralType, Int_fast16_t, PrintableElement, UserDumpType |
+| cstd_types.cpp:49:14:49:17 | if32 | CTypedefType, FastestMinimumWidthIntegralType, Int_fast32_t, PrintableElement, UserDumpType |
+| cstd_types.cpp:50:14:50:17 | if64 | CTypedefType, FastestMinimumWidthIntegralType, Int_fast64_t, PrintableElement, UserDumpType |
+| cstd_types.cpp:51:14:51:16 | uf8 | CTypedefType, FastestMinimumWidthIntegralType, PrintableElement, UInt_fast8_t, UserDumpType |
+| cstd_types.cpp:52:15:52:18 | uf16 | CTypedefType, FastestMinimumWidthIntegralType, PrintableElement, UInt_fast16_t, UserDumpType |
+| cstd_types.cpp:53:15:53:18 | uf32 | CTypedefType, FastestMinimumWidthIntegralType, PrintableElement, UInt_fast32_t, UserDumpType |
+| cstd_types.cpp:54:15:54:18 | uf64 | CTypedefType, FastestMinimumWidthIntegralType, PrintableElement, UInt_fast64_t, UserDumpType |

cpp/ql/test/library-tests/types/cstd_types/cstd_types_fixedwidth.expected

@@ -1,8 +1,8 @@
-| cstd_types.cpp:31:8:31:9 | i8 | CTypedefType, FixedWidthIntegralType, Int8_t |
-| cstd_types.cpp:32:9:32:11 | i16 | CTypedefType, FixedWidthIntegralType, Int16_t |
-| cstd_types.cpp:33:9:33:11 | i32 | CTypedefType, FixedWidthIntegralType, Int32_t |
-| cstd_types.cpp:34:9:34:11 | i64 | CTypedefType, FixedWidthIntegralType, Int64_t |
-| cstd_types.cpp:35:9:35:11 | ui8 | CTypedefType, FixedWidthIntegralType, UInt8_t |
-| cstd_types.cpp:36:10:36:13 | ui16 | CTypedefType, FixedWidthIntegralType, UInt16_t |
-| cstd_types.cpp:37:10:37:13 | ui32 | CTypedefType, FixedWidthIntegralType, UInt32_t |
-| cstd_types.cpp:38:10:38:13 | ui64 | CTypedefType, FixedWidthIntegralType, UInt64_t |
+| cstd_types.cpp:31:8:31:9 | i8 | CTypedefType, FixedWidthIntegralType, Int8_t, PrintableElement, UserDumpType |
+| cstd_types.cpp:32:9:32:11 | i16 | CTypedefType, FixedWidthIntegralType, Int16_t, PrintableElement, UserDumpType |
+| cstd_types.cpp:33:9:33:11 | i32 | CTypedefType, FixedWidthIntegralType, Int32_t, PrintableElement, UserDumpType |
+| cstd_types.cpp:34:9:34:11 | i64 | CTypedefType, FixedWidthIntegralType, Int64_t, PrintableElement, UserDumpType |
+| cstd_types.cpp:35:9:35:11 | ui8 | CTypedefType, FixedWidthIntegralType, PrintableElement, UInt8_t, UserDumpType |
+| cstd_types.cpp:36:10:36:13 | ui16 | CTypedefType, FixedWidthIntegralType, PrintableElement, UInt16_t, UserDumpType |
+| cstd_types.cpp:37:10:37:13 | ui32 | CTypedefType, FixedWidthIntegralType, PrintableElement, UInt32_t, UserDumpType |
+| cstd_types.cpp:38:10:38:13 | ui64 | CTypedefType, FixedWidthIntegralType, PrintableElement, UInt64_t, UserDumpType |

cpp/ql/test/library-tests/types/cstd_types/cstd_types_fixedwidthenum.expected

@@ -1,2 +1,2 @@
-| cstd_types.cpp:74:4:74:6 | _e0 | Enum, FixedWidthEnumType |
-| cstd_types.cpp:75:4:75:6 | _e1 | FixedWidthEnumType, ScopedEnum |
+| cstd_types.cpp:74:4:74:6 | _e0 | Enum, FixedWidthEnumType, PrintableElement, UserDumpType |
+| cstd_types.cpp:75:4:75:6 | _e1 | FixedWidthEnumType, PrintableElement, ScopedEnum, UserDumpType |

cpp/ql/test/library-tests/types/cstd_types/cstd_types_maximumwidth.expected

@@ -1,2 +1,2 @@
-| cstd_types.cpp:55:10:55:11 | im | CTypedefType, Intmax_t, MaximumWidthIntegralType |
-| cstd_types.cpp:56:11:56:13 | uim | CTypedefType, MaximumWidthIntegralType, Uintmax_t |
+| cstd_types.cpp:55:10:55:11 | im | CTypedefType, Intmax_t, MaximumWidthIntegralType, PrintableElement, UserDumpType |
+| cstd_types.cpp:56:11:56:13 | uim | CTypedefType, MaximumWidthIntegralType, PrintableElement, Uintmax_t, UserDumpType |

cpp/ql/test/library-tests/types/cstd_types/cstd_types_minimumwidth.expected

@@ -1,8 +1,8 @@
-| cstd_types.cpp:39:15:39:16 | l8 | CTypedefType, Int_least8_t, MinimumWidthIntegralType |
-| cstd_types.cpp:40:15:40:17 | l16 | CTypedefType, Int_least16_t, MinimumWidthIntegralType |
-| cstd_types.cpp:41:15:41:17 | l32 | CTypedefType, Int_least32_t, MinimumWidthIntegralType |
-| cstd_types.cpp:42:15:42:17 | l64 | CTypedefType, Int_least64_t, MinimumWidthIntegralType |
-| cstd_types.cpp:43:15:43:17 | ul8 | CTypedefType, MinimumWidthIntegralType, UInt_least8_t |
-| cstd_types.cpp:44:16:44:19 | ul16 | CTypedefType, MinimumWidthIntegralType, UInt_least16_t |
-| cstd_types.cpp:45:16:45:19 | ul32 | CTypedefType, MinimumWidthIntegralType, UInt_least32_t |
-| cstd_types.cpp:46:16:46:19 | ul64 | CTypedefType, MinimumWidthIntegralType, UInt_least64_t |
+| cstd_types.cpp:39:15:39:16 | l8 | CTypedefType, Int_least8_t, MinimumWidthIntegralType, PrintableElement, UserDumpType |
+| cstd_types.cpp:40:15:40:17 | l16 | CTypedefType, Int_least16_t, MinimumWidthIntegralType, PrintableElement, UserDumpType |
+| cstd_types.cpp:41:15:41:17 | l32 | CTypedefType, Int_least32_t, MinimumWidthIntegralType, PrintableElement, UserDumpType |
+| cstd_types.cpp:42:15:42:17 | l64 | CTypedefType, Int_least64_t, MinimumWidthIntegralType, PrintableElement, UserDumpType |
+| cstd_types.cpp:43:15:43:17 | ul8 | CTypedefType, MinimumWidthIntegralType, PrintableElement, UInt_least8_t, UserDumpType |
+| cstd_types.cpp:44:16:44:19 | ul16 | CTypedefType, MinimumWidthIntegralType, PrintableElement, UInt_least16_t, UserDumpType |
+| cstd_types.cpp:45:16:45:19 | ul32 | CTypedefType, MinimumWidthIntegralType, PrintableElement, UInt_least32_t, UserDumpType |
+| cstd_types.cpp:46:16:46:19 | ul64 | CTypedefType, MinimumWidthIntegralType, PrintableElement, UInt_least64_t, UserDumpType |

cpp/ql/test/library-tests/types/integral_types_ms/vars.expected

@@ -1,4 +1,4 @@
-| integral_types.cpp:2:8:2:9 | i8 | file://:0:0:0:0 | char | MicrosoftInt8Type, PlainCharType |
-| integral_types.cpp:3:9:3:11 | i16 | file://:0:0:0:0 | short | MicrosoftInt16Type, ShortType |
-| integral_types.cpp:4:9:4:11 | i32 | file://:0:0:0:0 | int | IntType, MicrosoftInt32Type |
-| integral_types.cpp:5:9:5:11 | i64 | file://:0:0:0:0 | long long | LongLongType, MicrosoftInt64Type |
+| integral_types.cpp:2:8:2:9 | i8 | file://:0:0:0:0 | char | IntegralDumpType, MicrosoftInt8Type, PlainCharType, PrintableElement |
+| integral_types.cpp:3:9:3:11 | i16 | file://:0:0:0:0 | short | IntegralDumpType, MicrosoftInt16Type, PrintableElement, ShortType |
+| integral_types.cpp:4:9:4:11 | i32 | file://:0:0:0:0 | int | IntType, IntegralDumpType, MicrosoftInt32Type, PrintableElement |
+| integral_types.cpp:5:9:5:11 | i64 | file://:0:0:0:0 | long long | IntegralDumpType, LongLongType, MicrosoftInt64Type, PrintableElement |

cpp/ql/test/library-tests/types/wchar_t_typedef/wchar_t.expected

@@ -1,3 +1,3 @@
-| file://:0:0:0:0 | wchar_t | Wchar_t, WideCharType |  |
-| file://:0:0:0:0 | wchar_t * | PointerType | CTypedefType, Wchar_t |
-| ms.c:2:24:2:30 | wchar_t | CTypedefType, Wchar_t |  |
+| file://:0:0:0:0 | wchar_t | IntegralDumpType, PrintableElement, Wchar_t, WideCharType |  |
+| file://:0:0:0:0 | wchar_t * | PointerDumpType, PrintableElement | CTypedefType, PrintableElement, UserDumpType, Wchar_t |
+| ms.c:2:24:2:30 | wchar_t | CTypedefType, PrintableElement, UserDumpType, Wchar_t |  |

cpp/ql/test/library-tests/variables/variables/types.expected

@@ -1,94 +1,94 @@
-| ..()(..) | RoutineType |  |  |  |  |
-| ..(*)(..) | FunctionPointerType |  | ..()(..) |  |  |
-| _Complex __float128 | BinaryFloatingPointType, ComplexNumberType |  |  |  |  |
-| _Complex double | BinaryFloatingPointType, ComplexNumberType |  |  |  |  |
-| _Complex float | BinaryFloatingPointType, ComplexNumberType |  |  |  |  |
-| _Complex long double | BinaryFloatingPointType, ComplexNumberType |  |  |  |  |
-| _Decimal32 | Decimal32Type |  |  |  |  |
-| _Decimal64 | Decimal64Type |  |  |  |  |
-| _Decimal128 | Decimal128Type |  |  |  |  |
-| _Float32 | BinaryFloatingPointType, RealNumberType |  |  |  |  |
-| _Float32x | BinaryFloatingPointType, RealNumberType |  |  |  |  |
-| _Float64 | BinaryFloatingPointType, RealNumberType |  |  |  |  |
-| _Float64x | BinaryFloatingPointType, RealNumberType |  |  |  |  |
-| _Float128 | BinaryFloatingPointType, RealNumberType |  |  |  |  |
-| _Float128x | BinaryFloatingPointType, RealNumberType |  |  |  |  |
-| _Imaginary double | BinaryFloatingPointType, ImaginaryNumberType |  |  |  |  |
-| _Imaginary float | BinaryFloatingPointType, ImaginaryNumberType |  |  |  |  |
-| _Imaginary long double | BinaryFloatingPointType, ImaginaryNumberType |  |  |  |  |
-| __float128 | Float128Type |  |  |  |  |
-| __int128 | Int128Type |  |  |  |  |
-| __va_list_tag | DirectAccessHolder, MetricClass, Struct, StructLikeClass |  |  |  |  |
-| __va_list_tag & | LValueReferenceType |  | __va_list_tag |  |  |
-| __va_list_tag && | RValueReferenceType |  | __va_list_tag |  |  |
-| address | DirectAccessHolder, MetricClass, Struct, StructLikeClass |  |  |  |  |
-| address & | LValueReferenceType |  | address |  |  |
-| address && | RValueReferenceType |  | address |  |  |
-| auto | AutoType |  |  |  |  |
-| bool | BoolType |  |  |  |  |
-| char | MicrosoftInt8Type, PlainCharType |  |  |  |  |
-| char8_t | Char8Type |  |  |  |  |
-| char16_t | Char16Type |  |  |  |  |
-| char32_t | Char32Type |  |  |  |  |
-| char * | CharPointerType |  | char |  |  |
-| char *[3] | ArrayType | char * | char * |  |  |
-| char *[32] | ArrayType | char * | char * |  |  |
-| char *[] | ArrayType | char * | char * |  |  |
-| char[2] | ArrayType | char | char |  |  |
-| char[3] | ArrayType | char | char |  |  |
-| char[5] | ArrayType | char | char |  |  |
-| char[6] | ArrayType | char | char |  |  |
-| char[8] | ArrayType | char | char |  |  |
-| char[9] | ArrayType | char | char |  |  |
-| char[10] | ArrayType | char | char |  |  |
-| char[53] | ArrayType | char | char |  |  |
-| char[] | ArrayType | char | char |  |  |
-| const __va_list_tag | SpecifiedType |  | __va_list_tag |  |  |
-| const __va_list_tag & | LValueReferenceType |  | const __va_list_tag |  |  |
-| const address | SpecifiedType |  | address |  |  |
-| const address & | LValueReferenceType |  | const address |  |  |
-| const char | SpecifiedType |  | char |  |  |
-| const char * | PointerType |  | const char |  |  |
-| const char *[3] | ArrayType | const char * | const char * |  |  |
-| const char *[] | ArrayType | const char * | const char * |  |  |
-| const char[5] | ArrayType | const char | const char |  |  |
-| const char[6] | ArrayType | const char | const char |  |  |
-| const char[8] | ArrayType | const char | const char |  |  |
-| const char[9] | ArrayType | const char | const char |  |  |
-| const char[10] | ArrayType | const char | const char |  |  |
-| const char[53] | ArrayType | const char | const char |  |  |
-| const double | SpecifiedType |  | double |  |  |
-| const int | SpecifiedType |  | int |  |  |
-| decltype(nullptr) | NullPointerType |  |  |  |  |
-| double | DoubleType |  |  |  |  |
-| error | ErroneousType |  |  |  |  |
-| float | FloatType |  |  |  |  |
-| float[3] | ArrayType | float | float |  |  |
-| int | IntType, MicrosoftInt32Type |  |  |  |  |
-| int * | IntPointerType |  | int |  |  |
-| int[4] | ArrayType | int | int |  |  |
-| int[8] | ArrayType | int | int |  |  |
-| int[10] | ArrayType | int | int |  |  |
-| int[10][20] | ArrayType | int[20] | int[20] |  |  |
-| int[20] | ArrayType | int | int |  |  |
-| int[] | ArrayType | int | int |  |  |
-| long | LongType |  |  |  |  |
-| long double | LongDoubleType |  |  |  |  |
-| long long | LongLongType, MicrosoftInt64Type |  |  |  |  |
-| short | MicrosoftInt16Type, ShortType |  |  |  |  |
-| signed __int128 | Int128Type |  |  |  |  |
-| signed char | SignedCharType |  |  |  |  |
-| signed int | IntType |  |  |  |  |
-| signed long | LongType |  |  |  |  |
-| signed long long | LongLongType |  |  |  |  |
-| signed short | ShortType |  |  |  |  |
-| unknown | UnknownType |  |  |  |  |
-| unsigned __int128 | Int128Type |  |  |  | unsigned integral |
-| unsigned char | UnsignedCharType |  |  |  | unsigned integral |
-| unsigned int | IntType |  |  | unsigned int | unsigned integral |
-| unsigned long | LongType |  |  |  | unsigned integral |
-| unsigned long long | LongLongType |  |  |  | unsigned integral |
-| unsigned short | ShortType |  |  |  | unsigned integral |
-| void | VoidType |  |  |  |  |
-| void * | VoidPointerType |  | void |  |  |
-| wchar_t | Wchar_t, WideCharType |  |  |  |  |
+| ..()(..) | PrintableElement, RoutineDumpType |  |  |  |  |
+| ..(*)(..) | FunctionPointerDumpType, PrintableElement |  | ..()(..) |  |  |
+| _Complex __float128 | BinaryFloatingPointType, BuiltInDumpType, ComplexNumberType, PrintableElement |  |  |  |  |
+| _Complex double | BinaryFloatingPointType, BuiltInDumpType, ComplexNumberType, PrintableElement |  |  |  |  |
+| _Complex float | BinaryFloatingPointType, BuiltInDumpType, ComplexNumberType, PrintableElement |  |  |  |  |
+| _Complex long double | BinaryFloatingPointType, BuiltInDumpType, ComplexNumberType, PrintableElement |  |  |  |  |
+| _Decimal32 | BuiltInDumpType, Decimal32Type, PrintableElement |  |  |  |  |
+| _Decimal64 | BuiltInDumpType, Decimal64Type, PrintableElement |  |  |  |  |
+| _Decimal128 | BuiltInDumpType, Decimal128Type, PrintableElement |  |  |  |  |
+| _Float32 | BinaryFloatingPointType, BuiltInDumpType, PrintableElement, RealNumberType |  |  |  |  |
+| _Float32x | BinaryFloatingPointType, BuiltInDumpType, PrintableElement, RealNumberType |  |  |  |  |
+| _Float64 | BinaryFloatingPointType, BuiltInDumpType, PrintableElement, RealNumberType |  |  |  |  |
+| _Float64x | BinaryFloatingPointType, BuiltInDumpType, PrintableElement, RealNumberType |  |  |  |  |
+| _Float128 | BinaryFloatingPointType, BuiltInDumpType, PrintableElement, RealNumberType |  |  |  |  |
+| _Float128x | BinaryFloatingPointType, BuiltInDumpType, PrintableElement, RealNumberType |  |  |  |  |
+| _Imaginary double | BinaryFloatingPointType, BuiltInDumpType, ImaginaryNumberType, PrintableElement |  |  |  |  |
+| _Imaginary float | BinaryFloatingPointType, BuiltInDumpType, ImaginaryNumberType, PrintableElement |  |  |  |  |
+| _Imaginary long double | BinaryFloatingPointType, BuiltInDumpType, ImaginaryNumberType, PrintableElement |  |  |  |  |
+| __float128 | BuiltInDumpType, Float128Type, PrintableElement |  |  |  |  |
+| __int128 | Int128Type, IntegralDumpType, PrintableElement |  |  |  |  |
+| __va_list_tag | DirectAccessHolder, MetricClass, PrintableElement, Struct, StructLikeClass, UserDumpType |  |  |  |  |
+| __va_list_tag & | LValueReferenceDumpType, PrintableElement |  | __va_list_tag |  |  |
+| __va_list_tag && | PrintableElement, RValueReferenceDumpType |  | __va_list_tag |  |  |
+| address | DirectAccessHolder, MetricClass, PrintableElement, Struct, StructLikeClass, UserDumpType |  |  |  |  |
+| address & | LValueReferenceDumpType, PrintableElement |  | address |  |  |
+| address && | PrintableElement, RValueReferenceDumpType |  | address |  |  |
+| auto | AutoType, PrintableElement, UserDumpType |  |  |  |  |
+| bool | BoolType, IntegralDumpType, PrintableElement |  |  |  |  |
+| char | IntegralDumpType, MicrosoftInt8Type, PlainCharType, PrintableElement |  |  |  |  |
+| char8_t | Char8Type, IntegralDumpType, PrintableElement |  |  |  |  |
+| char16_t | Char16Type, IntegralDumpType, PrintableElement |  |  |  |  |
+| char32_t | Char32Type, IntegralDumpType, PrintableElement |  |  |  |  |
+| char * | CharPointerType, PointerDumpType, PrintableElement |  | char |  |  |
+| char *[3] | ArrayDumpType, PrintableElement | char * | char * |  |  |
+| char *[32] | ArrayDumpType, PrintableElement | char * | char * |  |  |
+| char *[] | ArrayDumpType, PrintableElement | char * | char * |  |  |
+| char[2] | ArrayDumpType, PrintableElement | char | char |  |  |
+| char[3] | ArrayDumpType, PrintableElement | char | char |  |  |
+| char[5] | ArrayDumpType, PrintableElement | char | char |  |  |
+| char[6] | ArrayDumpType, PrintableElement | char | char |  |  |
+| char[8] | ArrayDumpType, PrintableElement | char | char |  |  |
+| char[9] | ArrayDumpType, PrintableElement | char | char |  |  |
+| char[10] | ArrayDumpType, PrintableElement | char | char |  |  |
+| char[53] | ArrayDumpType, PrintableElement | char | char |  |  |
+| char[] | ArrayDumpType, PrintableElement | char | char |  |  |
+| const __va_list_tag | PrintableElement, SpecifiedDumpType |  | __va_list_tag |  |  |
+| const __va_list_tag & | LValueReferenceDumpType, PrintableElement |  | const __va_list_tag |  |  |
+| const address | PrintableElement, SpecifiedDumpType |  | address |  |  |
+| const address & | LValueReferenceDumpType, PrintableElement |  | const address |  |  |
+| const char | PrintableElement, SpecifiedDumpType |  | char |  |  |
+| const char * | PointerDumpType, PrintableElement |  | const char |  |  |
+| const char *[3] | ArrayDumpType, PrintableElement | const char * | const char * |  |  |
+| const char *[] | ArrayDumpType, PrintableElement | const char * | const char * |  |  |
+| const char[5] | ArrayDumpType, PrintableElement | const char | const char |  |  |
+| const char[6] | ArrayDumpType, PrintableElement | const char | const char |  |  |
+| const char[8] | ArrayDumpType, PrintableElement | const char | const char |  |  |
+| const char[9] | ArrayDumpType, PrintableElement | const char | const char |  |  |
+| const char[10] | ArrayDumpType, PrintableElement | const char | const char |  |  |
+| const char[53] | ArrayDumpType, PrintableElement | const char | const char |  |  |
+| const double | PrintableElement, SpecifiedDumpType |  | double |  |  |
+| const int | PrintableElement, SpecifiedDumpType |  | int |  |  |
+| decltype(nullptr) | BuiltInDumpType, NullPointerType, PrintableElement |  |  |  |  |
+| double | BuiltInDumpType, DoubleType, PrintableElement |  |  |  |  |
+| error | BuiltInDumpType, ErroneousType, PrintableElement |  |  |  |  |
+| float | BuiltInDumpType, FloatType, PrintableElement |  |  |  |  |
+| float[3] | ArrayDumpType, PrintableElement | float | float |  |  |
+| int | IntType, IntegralDumpType, MicrosoftInt32Type, PrintableElement |  |  |  |  |
+| int * | IntPointerType, PointerDumpType, PrintableElement |  | int |  |  |
+| int[4] | ArrayDumpType, PrintableElement | int | int |  |  |
+| int[8] | ArrayDumpType, PrintableElement | int | int |  |  |
+| int[10] | ArrayDumpType, PrintableElement | int | int |  |  |
+| int[10][20] | ArrayDumpType, PrintableElement | int[20] | int[20] |  |  |
+| int[20] | ArrayDumpType, PrintableElement | int | int |  |  |
+| int[] | ArrayDumpType, PrintableElement | int | int |  |  |
+| long | IntegralDumpType, LongType, PrintableElement |  |  |  |  |
+| long double | BuiltInDumpType, LongDoubleType, PrintableElement |  |  |  |  |
+| long long | IntegralDumpType, LongLongType, MicrosoftInt64Type, PrintableElement |  |  |  |  |
+| short | IntegralDumpType, MicrosoftInt16Type, PrintableElement, ShortType |  |  |  |  |
+| signed __int128 | Int128Type, IntegralDumpType, PrintableElement |  |  |  |  |
+| signed char | IntegralDumpType, PrintableElement, SignedCharType |  |  |  |  |
+| signed int | IntType, IntegralDumpType, PrintableElement |  |  |  |  |
+| signed long | IntegralDumpType, LongType, PrintableElement |  |  |  |  |
+| signed long long | IntegralDumpType, LongLongType, PrintableElement |  |  |  |  |
+| signed short | IntegralDumpType, PrintableElement, ShortType |  |  |  |  |
+| unknown | BuiltInDumpType, PrintableElement, UnknownType |  |  |  |  |
+| unsigned __int128 | Int128Type, IntegralDumpType, PrintableElement |  |  |  | unsigned integral |
+| unsigned char | IntegralDumpType, PrintableElement, UnsignedCharType |  |  |  | unsigned integral |
+| unsigned int | IntType, IntegralDumpType, PrintableElement |  |  | unsigned int | unsigned integral |
+| unsigned long | IntegralDumpType, LongType, PrintableElement |  |  |  | unsigned integral |
+| unsigned long long | IntegralDumpType, LongLongType, PrintableElement |  |  |  | unsigned integral |
+| unsigned short | IntegralDumpType, PrintableElement, ShortType |  |  |  | unsigned integral |
+| void | BuiltInDumpType, PrintableElement, VoidType |  |  |  |  |
+| void * | PointerDumpType, PrintableElement, VoidPointerType |  | void |  |  |
+| wchar_t | IntegralDumpType, PrintableElement, Wchar_t, WideCharType |  |  |  |  |

cpp/ql/test/library-tests/variables/variables/variable.expected

@@ -1,70 +1,111 @@
+| file://:0:0:0:0 | (unnamed parameter 0) | file://:0:0:0:0 | __va_list_tag && | DumpVariable |  |  |
 | file://:0:0:0:0 | (unnamed parameter 0) | file://:0:0:0:0 | __va_list_tag && | SemanticStackVariable |  |  |
+| file://:0:0:0:0 | (unnamed parameter 0) | file://:0:0:0:0 | address && | DumpVariable |  |  |
 | file://:0:0:0:0 | (unnamed parameter 0) | file://:0:0:0:0 | address && | SemanticStackVariable |  |  |
+| file://:0:0:0:0 | (unnamed parameter 0) | file://:0:0:0:0 | const __va_list_tag & | DumpVariable |  |  |
 | file://:0:0:0:0 | (unnamed parameter 0) | file://:0:0:0:0 | const __va_list_tag & | SemanticStackVariable |  |  |
+| file://:0:0:0:0 | (unnamed parameter 0) | file://:0:0:0:0 | const address & | DumpVariable |  |  |
 | file://:0:0:0:0 | (unnamed parameter 0) | file://:0:0:0:0 | const address & | SemanticStackVariable |  |  |
+| file://:0:0:0:0 | fp_offset | file://:0:0:0:0 | unsigned int | DumpVariable |  |  |
 | file://:0:0:0:0 | fp_offset | file://:0:0:0:0 | unsigned int | Field |  |  |
+| file://:0:0:0:0 | gp_offset | file://:0:0:0:0 | unsigned int | DumpVariable |  |  |
 | file://:0:0:0:0 | gp_offset | file://:0:0:0:0 | unsigned int | Field |  |  |
+| file://:0:0:0:0 | overflow_arg_area | file://:0:0:0:0 | void * | DumpVariable |  |  |
 | file://:0:0:0:0 | overflow_arg_area | file://:0:0:0:0 | void * | Field |  |  |
+| file://:0:0:0:0 | reg_save_area | file://:0:0:0:0 | void * | DumpVariable |  |  |
 | file://:0:0:0:0 | reg_save_area | file://:0:0:0:0 | void * | Field |  |  |
+| variables.cpp:1:12:1:12 | i | file://:0:0:0:0 | int | DumpVariable |  |  |
 | variables.cpp:1:12:1:12 | i | file://:0:0:0:0 | int | GlobalVariable |  |  |
 | variables.cpp:1:12:1:12 | i | file://:0:0:0:0 | int | StaticStorageDurationVariable |  |  |
+| variables.cpp:2:12:2:12 | i | file://:0:0:0:0 | int | DumpVariable |  |  |
 | variables.cpp:2:12:2:12 | i | file://:0:0:0:0 | int | GlobalVariable |  |  |
 | variables.cpp:2:12:2:12 | i | file://:0:0:0:0 | int | StaticStorageDurationVariable |  |  |
+| variables.cpp:3:12:3:12 | i | file://:0:0:0:0 | int | DumpVariable |  |  |
 | variables.cpp:3:12:3:12 | i | file://:0:0:0:0 | int | GlobalVariable |  |  |
 | variables.cpp:3:12:3:12 | i | file://:0:0:0:0 | int | StaticStorageDurationVariable |  |  |
+| variables.cpp:5:11:5:11 | c | file://:0:0:0:0 | const int | DumpVariable | const | static |
 | variables.cpp:5:11:5:11 | c | file://:0:0:0:0 | const int | GlobalVariable | const | static |
 | variables.cpp:5:11:5:11 | c | file://:0:0:0:0 | const int | StaticStorageDurationVariable | const | static |
+| variables.cpp:6:14:6:15 | pi | file://:0:0:0:0 | const double | DumpVariable | const | static |
 | variables.cpp:6:14:6:15 | pi | file://:0:0:0:0 | const double | GlobalVariable | const | static |
 | variables.cpp:6:14:6:15 | pi | file://:0:0:0:0 | const double | StaticStorageDurationVariable | const | static |
+| variables.cpp:8:10:8:10 | a | file://:0:0:0:0 | unsigned int | DumpVariable |  |  |
 | variables.cpp:8:10:8:10 | a | file://:0:0:0:0 | unsigned int | GlobalVariable |  |  |
 | variables.cpp:8:10:8:10 | a | file://:0:0:0:0 | unsigned int | StaticStorageDurationVariable |  |  |
+| variables.cpp:10:14:10:14 | b | file://:0:0:0:0 | unsigned int | DumpVariable |  |  |
 | variables.cpp:10:14:10:14 | b | file://:0:0:0:0 | unsigned int | GlobalVariable |  |  |
 | variables.cpp:10:14:10:14 | b | file://:0:0:0:0 | unsigned int | StaticStorageDurationVariable |  |  |
+| variables.cpp:12:13:12:17 | kings | file://:0:0:0:0 | const char *[] | DumpVariable |  |  |
 | variables.cpp:12:13:12:17 | kings | file://:0:0:0:0 | const char *[] | GlobalVariable |  |  |
 | variables.cpp:12:13:12:17 | kings | file://:0:0:0:0 | const char *[] | StaticStorageDurationVariable |  |  |
+| variables.cpp:14:6:14:6 | p | file://:0:0:0:0 | int * | DumpVariable |  |  |
 | variables.cpp:14:6:14:6 | p | file://:0:0:0:0 | int * | GlobalVariable |  |  |
 | variables.cpp:14:6:14:6 | p | file://:0:0:0:0 | int * | StaticStorageDurationVariable |  |  |
+| variables.cpp:14:9:14:9 | q | file://:0:0:0:0 | int | DumpVariable |  |  |
 | variables.cpp:14:9:14:9 | q | file://:0:0:0:0 | int | GlobalVariable |  |  |
 | variables.cpp:14:9:14:9 | q | file://:0:0:0:0 | int | StaticStorageDurationVariable |  |  |
+| variables.cpp:15:12:15:13 | v1 | file://:0:0:0:0 | int[10] | DumpVariable |  | static |
 | variables.cpp:15:12:15:13 | v1 | file://:0:0:0:0 | int[10] | GlobalVariable |  | static |
 | variables.cpp:15:12:15:13 | v1 | file://:0:0:0:0 | int[10] | StaticStorageDurationVariable |  | static |
+| variables.cpp:15:21:15:22 | pv | file://:0:0:0:0 | int * | DumpVariable |  | static |
 | variables.cpp:15:21:15:22 | pv | file://:0:0:0:0 | int * | GlobalVariable |  | static |
 | variables.cpp:15:21:15:22 | pv | file://:0:0:0:0 | int * | StaticStorageDurationVariable |  | static |
+| variables.cpp:17:7:17:8 | fp | file://:0:0:0:0 | ..(*)(..) | DumpVariable |  |  |
 | variables.cpp:17:7:17:8 | fp | file://:0:0:0:0 | ..(*)(..) | FunctionPointerVariable |  |  |
 | variables.cpp:17:7:17:8 | fp | file://:0:0:0:0 | ..(*)(..) | GlobalVariable |  |  |
 | variables.cpp:17:7:17:8 | fp | file://:0:0:0:0 | ..(*)(..) | StaticStorageDurationVariable |  |  |
+| variables.cpp:19:7:19:8 | v2 | file://:0:0:0:0 | float[3] | DumpVariable |  |  |
 | variables.cpp:19:7:19:8 | v2 | file://:0:0:0:0 | float[3] | GlobalVariable |  |  |
 | variables.cpp:19:7:19:8 | v2 | file://:0:0:0:0 | float[3] | StaticStorageDurationVariable |  |  |
+| variables.cpp:20:7:20:8 | v3 | file://:0:0:0:0 | char *[32] | DumpVariable |  |  |
 | variables.cpp:20:7:20:8 | v3 | file://:0:0:0:0 | char *[32] | GlobalVariable |  |  |
 | variables.cpp:20:7:20:8 | v3 | file://:0:0:0:0 | char *[32] | StaticStorageDurationVariable |  |  |
+| variables.cpp:22:5:22:6 | d2 | file://:0:0:0:0 | int[10][20] | DumpVariable |  |  |
 | variables.cpp:22:5:22:6 | d2 | file://:0:0:0:0 | int[10][20] | GlobalVariable |  |  |
 | variables.cpp:22:5:22:6 | d2 | file://:0:0:0:0 | int[10][20] | StaticStorageDurationVariable |  |  |
+| variables.cpp:24:6:24:7 | v4 | file://:0:0:0:0 | char[3] | DumpVariable |  |  |
 | variables.cpp:24:6:24:7 | v4 | file://:0:0:0:0 | char[3] | GlobalVariable |  |  |
 | variables.cpp:24:6:24:7 | v4 | file://:0:0:0:0 | char[3] | StaticStorageDurationVariable |  |  |
+| variables.cpp:26:5:26:6 | v5 | file://:0:0:0:0 | int[8] | DumpVariable |  |  |
 | variables.cpp:26:5:26:6 | v5 | file://:0:0:0:0 | int[8] | GlobalVariable |  |  |
 | variables.cpp:26:5:26:6 | v5 | file://:0:0:0:0 | int[8] | StaticStorageDurationVariable |  |  |
+| variables.cpp:28:7:28:8 | p2 | file://:0:0:0:0 | char * | DumpVariable |  |  |
 | variables.cpp:28:7:28:8 | p2 | file://:0:0:0:0 | char * | GlobalVariable |  |  |
 | variables.cpp:28:7:28:8 | p2 | file://:0:0:0:0 | char * | StaticStorageDurationVariable |  |  |
+| variables.cpp:29:6:29:7 | p3 | file://:0:0:0:0 | char[] | DumpVariable |  |  |
 | variables.cpp:29:6:29:7 | p3 | file://:0:0:0:0 | char[] | GlobalVariable |  |  |
 | variables.cpp:29:6:29:7 | p3 | file://:0:0:0:0 | char[] | StaticStorageDurationVariable |  |  |
+| variables.cpp:31:6:31:10 | alpha | file://:0:0:0:0 | char[] | DumpVariable |  |  |
 | variables.cpp:31:6:31:10 | alpha | file://:0:0:0:0 | char[] | GlobalVariable |  |  |
 | variables.cpp:31:6:31:10 | alpha | file://:0:0:0:0 | char[] | StaticStorageDurationVariable |  |  |
+| variables.cpp:34:5:34:6 | av | file://:0:0:0:0 | int[] | DumpVariable |  |  |
 | variables.cpp:34:5:34:6 | av | file://:0:0:0:0 | int[] | GlobalVariable |  |  |
 | variables.cpp:34:5:34:6 | av | file://:0:0:0:0 | int[] | StaticStorageDurationVariable |  |  |
+| variables.cpp:35:6:35:8 | ap1 | file://:0:0:0:0 | int * | DumpVariable |  |  |
 | variables.cpp:35:6:35:8 | ap1 | file://:0:0:0:0 | int * | GlobalVariable |  |  |
 | variables.cpp:35:6:35:8 | ap1 | file://:0:0:0:0 | int * | StaticStorageDurationVariable |  |  |
+| variables.cpp:36:6:36:8 | ap2 | file://:0:0:0:0 | int * | DumpVariable |  |  |
 | variables.cpp:36:6:36:8 | ap2 | file://:0:0:0:0 | int * | GlobalVariable |  |  |
 | variables.cpp:36:6:36:8 | ap2 | file://:0:0:0:0 | int * | StaticStorageDurationVariable |  |  |
+| variables.cpp:37:6:37:8 | ap3 | file://:0:0:0:0 | int * | DumpVariable |  |  |
 | variables.cpp:37:6:37:8 | ap3 | file://:0:0:0:0 | int * | GlobalVariable |  |  |
 | variables.cpp:37:6:37:8 | ap3 | file://:0:0:0:0 | int * | StaticStorageDurationVariable |  |  |
+| variables.cpp:41:7:41:11 | local | file://:0:0:0:0 | char[] | DumpVariable |  |  |
 | variables.cpp:41:7:41:11 | local | file://:0:0:0:0 | char[] | LocalVariable |  |  |
 | variables.cpp:41:7:41:11 | local | file://:0:0:0:0 | char[] | SemanticStackVariable |  |  |
+| variables.cpp:43:14:43:18 | local | file://:0:0:0:0 | int | DumpVariable |  | static |
 | variables.cpp:43:14:43:18 | local | file://:0:0:0:0 | int | StaticLocalVariable |  | static |
+| variables.cpp:48:9:48:12 | name | file://:0:0:0:0 | char * | DumpVariable |  |  |
 | variables.cpp:48:9:48:12 | name | file://:0:0:0:0 | char * | Field |  |  |
+| variables.cpp:49:12:49:17 | number | file://:0:0:0:0 | long | DumpVariable |  |  |
 | variables.cpp:49:12:49:17 | number | file://:0:0:0:0 | long | Field |  |  |
+| variables.cpp:50:9:50:14 | street | file://:0:0:0:0 | char * | DumpVariable |  |  |
 | variables.cpp:50:9:50:14 | street | file://:0:0:0:0 | char * | Field |  |  |
+| variables.cpp:51:9:51:12 | town | file://:0:0:0:0 | char * | DumpVariable |  |  |
 | variables.cpp:51:9:51:12 | town | file://:0:0:0:0 | char * | Field |  |  |
+| variables.cpp:52:16:52:22 | country | file://:0:0:0:0 | char * | DumpVariable |  | static |
 | variables.cpp:52:16:52:22 | country | file://:0:0:0:0 | char * | MemberVariable |  | static |
 | variables.cpp:52:16:52:22 | country | file://:0:0:0:0 | char * | StaticStorageDurationVariable |  | static |
+| variables.cpp:56:14:56:29 | externInFunction | file://:0:0:0:0 | int | DumpVariable |  |  |
 | variables.cpp:56:14:56:29 | externInFunction | file://:0:0:0:0 | int | GlobalVariable |  |  |
 | variables.cpp:56:14:56:29 | externInFunction | file://:0:0:0:0 | int | StaticStorageDurationVariable |  |  |

cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree.expected

@@ -7,3 +7,4 @@
 | test.cpp:170:6:170:9 | data | Memory pointed to by 'data' may have been previously freed $@ | test.cpp:165:2:165:5 | call to free | here |
 | test.cpp:193:6:193:9 | data | Memory pointed to by 'data' may have been previously freed $@ | test.cpp:191:3:191:6 | call to free | here |
 | test.cpp:201:6:201:6 | x | Memory pointed to by 'x' may have been previously freed $@ | test.cpp:200:2:200:9 | delete | here |
+| test.cpp:242:14:242:17 | data | Memory pointed to by 'data' may have been previously freed $@ | test.cpp:243:11:243:14 | call to free | here |

cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/test.cpp

@@ -213,3 +213,42 @@ void regression_test_for_static_var_handling()
 	data = (char *)malloc(100*sizeof(char));
 	use(data); // GOOD
 }
+
+void test16(int n, bool b) {
+  char* data = NULL;
+	for(int i = 0; i < n; ++i) {
+    if(b) data = (char*)malloc(10 * sizeof(char));
+    if(!b || data == NULL) return;
+    use(data); // GOOD
+    free(data); // GOOD
+  }
+}
+
+void test17(int n, bool b) {
+  char* data = (char*)malloc(10);
+  if(b) {
+    free(data);
+  }
+
+  if(!b) {
+    use(data); // GOOD
+  }
+}
+
+void test18(int* array) {
+	char* data = (char*)malloc(10 * sizeof(char));
+	for (int i = 0; i < 4; ++i) {
+  	int b = array[i];
+  	if(b) use(data); // BAD
+  	if(!b) free(data);
+	}
+}
+
+void test19(int* array) {
+	char* data = (char*)malloc(10 * sizeof(char));
+	int b = array[0];
+	for (int i = 0; i < 4; ++i) {
+  	if(b) use(data); // GOOD
+  	if(!b) free(data);
+	}
+}

cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/tests/UninitializedLocal.expected

@@ -8,7 +8,6 @@
 | test.cpp:132:9:132:9 | j | The variable $@ may not be initialized here. | test.cpp:126:6:126:6 | j | j |
 | test.cpp:219:3:219:3 | x | The variable $@ may not be initialized here. | test.cpp:218:7:218:7 | x | x |
 | test.cpp:243:13:243:13 | i | The variable $@ may not be initialized here. | test.cpp:241:6:241:6 | i | i |
-| test.cpp:329:9:329:11 | val | The variable $@ may not be initialized here. | test.cpp:321:6:321:8 | val | val |
 | test.cpp:336:10:336:10 | a | The variable $@ may not be initialized here. | test.cpp:333:7:333:7 | a | a |
 | test.cpp:369:10:369:10 | a | The variable $@ may not be initialized here. | test.cpp:358:7:358:7 | a | a |
 | test.cpp:378:9:378:11 | val | The variable $@ may not be initialized here. | test.cpp:359:6:359:8 | val | val |

cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/tests/test.cpp

@@ -326,7 +326,7 @@ int test28() {
 		a = false;
 		c = false;
 	}
-	return val; // GOOD [FALSE POSITIVE]
+	return val; // GOOD
 }
 
 int test29() {