mirror of
https://github.com/github/codeql.git
synced 2026-04-28 10:15:14 +02:00
C++: Use the IR for 'cpp/return-stack-allocated-memory'.
This commit is contained in:
Mathias Vorreiter Pedersen
@@ -4,4 +4,4 @@ Record* fixRecord(Record* r) {
|
||||
|
||||
myRecord.fix();
|
||||
return &myRecord; //returns reference to myRecord, which is a stack-allocated object
|
||||
}
|
||||
}
|
||||
@@ -3,7 +3,7 @@
|
||||
* @description A function returns a pointer to a stack-allocated region of
|
||||
* memory. This memory is deallocated at the end of the function,
|
||||
* which may lead the caller to dereference a dangling pointer.
|
||||
* @kind problem
|
||||
* @kind path-problem
|
||||
* @id cpp/return-stack-allocated-memory
|
||||
* @problem.severity warning
|
||||
* @precision high
|
||||
@@ -12,59 +12,151 @@
|
||||
*/
|
||||
|
||||
import cpp
|
||||
import semmle.code.cpp.dataflow.EscapesTree
|
||||
import semmle.code.cpp.models.interfaces.PointerWrapper
|
||||
import semmle.code.cpp.dataflow.DataFlow
|
||||
import semmle.code.cpp.ir.IR
|
||||
import semmle.code.cpp.ir.dataflow.DataFlow::DataFlow
|
||||
|
||||
/**
|
||||
* Holds if `n1` may flow to `n2`, ignoring flow through fields because these
|
||||
* are currently modeled as an overapproximation that assumes all objects may
|
||||
* alias.
|
||||
* Holds if `source` is a node that represents the use of a stack variable
|
||||
*/
|
||||
predicate conservativeDataFlowStep(DataFlow::Node n1, DataFlow::Node n2) {
|
||||
DataFlow::localFlowStep(n1, n2) and
|
||||
not n2.asExpr() instanceof FieldAccess and
|
||||
not hasNontrivialConversion(n2.asExpr())
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if `e` has a conversion that changes it from lvalue to pointer or
|
||||
* back. As the data-flow library does not support conversions, we cannot track
|
||||
* data flow through such expressions.
|
||||
*/
|
||||
predicate hasNontrivialConversion(Expr e) {
|
||||
e instanceof Conversion and
|
||||
not (
|
||||
e instanceof Cast
|
||||
or
|
||||
e instanceof ParenthesisExpr
|
||||
predicate isSource(Node source) {
|
||||
exists(VariableAddressInstruction var |
|
||||
var = source.asInstruction() and
|
||||
var.getASTVariable() instanceof StackVariable and
|
||||
// Pointer-to-member types aren't properly handled in the dbscheme.
|
||||
not var.getResultType() instanceof PointerToMemberType and
|
||||
// Rule out FPs caused by extraction errors.
|
||||
not any(ErrorExpr e).getEnclosingFunction() = var.getEnclosingFunction()
|
||||
)
|
||||
or
|
||||
// A smart pointer can be stack-allocated while the data it points to is heap-allocated.
|
||||
// So we exclude such "conversions" from this predicate.
|
||||
e = any(PointerWrapper wrapper).getAnUnwrapperFunction().getACallToThisFunction()
|
||||
or
|
||||
hasNontrivialConversion(e.getConversion())
|
||||
}
|
||||
|
||||
from StackVariable var, VariableAccess va, ReturnStmt r
|
||||
where
|
||||
not var.getUnspecifiedType() instanceof ReferenceType and
|
||||
not r.isFromUninstantiatedTemplate(_) and
|
||||
va = var.getAnAccess() and
|
||||
/**
|
||||
* Holds if `sink` is a node that represents the `StoreInstruction` that is subsequently used in
|
||||
* a `ReturnValueInstruction`. We use the `StoreInstruction` instead of the instruction that defines the
|
||||
* `ReturnValueInstruction`'s source value oprand because the former has better location information.
|
||||
*/
|
||||
predicate isSink(Node sink) {
|
||||
exists(StoreInstruction store |
|
||||
store.getDestinationAddress().(VariableAddressInstruction).getIRVariable() instanceof
|
||||
IRReturnVariable and
|
||||
sink.asOperand() = store.getSourceValueOperand()
|
||||
)
|
||||
}
|
||||
|
||||
/** Holds if `node1` _must_ flow to `node2`. */
|
||||
predicate step(Node node1, Node node2) {
|
||||
instructionToOperandStep(node1.asInstruction(), node2.asOperand())
|
||||
or
|
||||
operandToInstructionStep(node1.asOperand(), node2.asInstruction())
|
||||
}
|
||||
|
||||
predicate instructionToOperandStep(Instruction instr, Operand operand) { operand.getDef() = instr }
|
||||
|
||||
/**
|
||||
* Holds if `operand` flows to the result of `instr`.
|
||||
*
|
||||
* This predicate ignores flow through `PhiInstruction`s to create a 'must flow' relation. It also
|
||||
* intentionally conflates addresses of fields and their object, and pointer offsets with their
|
||||
* base pointer as this allows us to detect cases where an object's address flows to a return statement
|
||||
* via a field. For example:
|
||||
*
|
||||
* ```cpp
|
||||
* struct S { int x, y };
|
||||
* int* test() {
|
||||
* S s;
|
||||
* return &s.x; // BAD: &s.x is an address of a variable on the stack.
|
||||
* }
|
||||
* ```
|
||||
*/
|
||||
predicate operandToInstructionStep(Operand operand, Instruction instr) {
|
||||
instr.(CopyInstruction).getSourceValueOperand() = operand
|
||||
or
|
||||
instr.(ConvertInstruction).getUnaryOperand() = operand
|
||||
or
|
||||
instr.(CheckedConvertOrNullInstruction).getUnaryOperand() = operand
|
||||
or
|
||||
instr.(InheritanceConversionInstruction).getUnaryOperand() = operand
|
||||
or
|
||||
instr.(FieldAddressInstruction).getObjectAddressOperand() = operand
|
||||
or
|
||||
instr.(PointerOffsetInstruction).getLeftOperand() = operand
|
||||
}
|
||||
|
||||
/** Holds if a source node flows to `n`. */
|
||||
predicate branchlessLocalFlow0(Node n) {
|
||||
isSource(n)
|
||||
or
|
||||
exists(Node mid |
|
||||
branchlessLocalFlow0(mid) and
|
||||
step(mid, n)
|
||||
)
|
||||
}
|
||||
|
||||
/** Holds if `n` is reachable through some source node, and `n` also eventually reaches a sink. */
|
||||
predicate branchlessLocalFlow1(Node n) {
|
||||
branchlessLocalFlow0(n) and
|
||||
(
|
||||
// To check if the address escapes directly from `e` in `return e`, we need
|
||||
// to check the fully-converted `e` in case there are implicit
|
||||
// array-to-pointer conversions or reference conversions.
|
||||
variableAddressEscapesTree(va, r.getExpr().getFullyConverted())
|
||||
isSink(n)
|
||||
or
|
||||
// The data flow library doesn't support conversions, so here we check that
|
||||
// the address escapes into some expression `pointerToLocal`, which flows
|
||||
// in one or more steps to a returned expression.
|
||||
exists(Expr pointerToLocal |
|
||||
variableAddressEscapesTree(va, pointerToLocal.getFullyConverted()) and
|
||||
not hasNontrivialConversion(pointerToLocal) and
|
||||
conservativeDataFlowStep+(DataFlow::exprNode(pointerToLocal), DataFlow::exprNode(r.getExpr()))
|
||||
exists(Node mid |
|
||||
branchlessLocalFlow1(mid) and
|
||||
step(n, mid)
|
||||
)
|
||||
)
|
||||
select r, "May return stack-allocated memory from $@.", va, va.toString()
|
||||
}
|
||||
|
||||
newtype TLocalPathNode =
|
||||
TLocalPathNodeMid(Node n) {
|
||||
branchlessLocalFlow1(n) and
|
||||
(
|
||||
isSource(n) or
|
||||
exists(LocalPathNodeMid mid | step(mid.getNode(), n))
|
||||
)
|
||||
}
|
||||
|
||||
abstract class LocalPathNode extends TLocalPathNode {
|
||||
Node n;
|
||||
|
||||
/** Gets the underlying node. */
|
||||
Node getNode() { result = n }
|
||||
|
||||
/** Gets a textual representation of this node. */
|
||||
string toString() { result = n.toString() }
|
||||
|
||||
/** Gets the location of this element. */
|
||||
Location getLocation() { result = n.getLocation() }
|
||||
|
||||
/** Gets a successor `LocalPathNode`, if any. */
|
||||
LocalPathNode getASuccessor() { step(this.getNode(), result.getNode()) }
|
||||
}
|
||||
|
||||
class LocalPathNodeMid extends LocalPathNode, TLocalPathNodeMid {
|
||||
LocalPathNodeMid() { this = TLocalPathNodeMid(n) }
|
||||
}
|
||||
|
||||
class LocalPathNodeSink extends LocalPathNodeMid {
|
||||
LocalPathNodeSink() { isSink(this.getNode()) }
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if `source` is a source node, `sink` is a sink node, and there's flow
|
||||
* from `source` to `sink` using `step` relation.
|
||||
*/
|
||||
predicate hasFlow(LocalPathNode source, LocalPathNodeSink sink) {
|
||||
isSource(source.getNode()) and
|
||||
source.getASuccessor+() = sink
|
||||
}
|
||||
|
||||
predicate reach(LocalPathNode n) { n instanceof LocalPathNodeSink or reach(n.getASuccessor()) }
|
||||
|
||||
query predicate edges(LocalPathNode a, LocalPathNode b) { a.getASuccessor() = b and reach(b) }
|
||||
|
||||
query predicate nodes(LocalPathNode n, string key, string val) {
|
||||
reach(n) and key = "semmle.label" and val = n.toString()
|
||||
}
|
||||
|
||||
from LocalPathNode source, LocalPathNodeSink sink, VariableAddressInstruction var
|
||||
where
|
||||
hasFlow(source, sink) and
|
||||
source.getNode().asInstruction() = var
|
||||
select sink.getNode(), source, sink, "May return stack-allocated memory from $@.", var.getAST(),
|
||||
var.getAST().toString()
|
||||
|
||||
@@ -1,8 +1,231 @@
|
||||
| test.cpp:17:2:17:12 | return ... | May return stack-allocated memory from $@. | test.cpp:17:10:17:11 | mc | mc |
|
||||
| test.cpp:25:2:25:12 | return ... | May return stack-allocated memory from $@. | test.cpp:23:18:23:19 | mc | mc |
|
||||
| test.cpp:47:2:47:11 | return ... | May return stack-allocated memory from $@. | test.cpp:47:9:47:10 | mc | mc |
|
||||
| test.cpp:54:2:54:16 | return ... | May return stack-allocated memory from $@. | test.cpp:54:11:54:12 | mc | mc |
|
||||
| test.cpp:92:2:92:12 | return ... | May return stack-allocated memory from $@. | test.cpp:89:10:89:11 | mc | mc |
|
||||
| test.cpp:112:2:112:12 | return ... | May return stack-allocated memory from $@. | test.cpp:112:9:112:11 | arr | arr |
|
||||
| test.cpp:119:2:119:19 | return ... | May return stack-allocated memory from $@. | test.cpp:119:11:119:13 | arr | arr |
|
||||
| test.cpp:171:3:171:24 | return ... | May return stack-allocated memory from $@. | test.cpp:170:35:170:41 | myLocal | myLocal |
|
||||
edges
|
||||
| test.cpp:17:9:17:11 | & ... | test.cpp:17:9:17:11 | StoreValue |
|
||||
| test.cpp:17:10:17:11 | Unary | test.cpp:17:9:17:11 | & ... |
|
||||
| test.cpp:17:10:17:11 | mc | test.cpp:17:10:17:11 | Unary |
|
||||
| test.cpp:23:17:23:19 | & ... | test.cpp:23:17:23:19 | StoreValue |
|
||||
| test.cpp:23:17:23:19 | Store | test.cpp:25:9:25:11 | Load |
|
||||
| test.cpp:23:17:23:19 | StoreValue | test.cpp:23:17:23:19 | Store |
|
||||
| test.cpp:23:18:23:19 | Unary | test.cpp:23:17:23:19 | & ... |
|
||||
| test.cpp:23:18:23:19 | mc | test.cpp:23:18:23:19 | Unary |
|
||||
| test.cpp:25:9:25:11 | Load | test.cpp:25:9:25:11 | ptr |
|
||||
| test.cpp:25:9:25:11 | ptr | test.cpp:25:9:25:11 | StoreValue |
|
||||
| test.cpp:39:17:39:18 | (reference to) | test.cpp:39:17:39:18 | StoreValue |
|
||||
| test.cpp:39:17:39:18 | Store | test.cpp:41:10:41:12 | Load |
|
||||
| test.cpp:39:17:39:18 | StoreValue | test.cpp:39:17:39:18 | Store |
|
||||
| test.cpp:39:17:39:18 | Unary | test.cpp:39:17:39:18 | (reference to) |
|
||||
| test.cpp:39:17:39:18 | mc | test.cpp:39:17:39:18 | Unary |
|
||||
| test.cpp:41:9:41:12 | & ... | test.cpp:41:9:41:12 | StoreValue |
|
||||
| test.cpp:41:10:41:12 | (reference dereference) | test.cpp:41:10:41:12 | Unary |
|
||||
| test.cpp:41:10:41:12 | Load | test.cpp:41:10:41:12 | ref |
|
||||
| test.cpp:41:10:41:12 | Unary | test.cpp:41:9:41:12 | & ... |
|
||||
| test.cpp:41:10:41:12 | Unary | test.cpp:41:10:41:12 | (reference dereference) |
|
||||
| test.cpp:41:10:41:12 | ref | test.cpp:41:10:41:12 | Unary |
|
||||
| test.cpp:47:9:47:10 | (reference to) | test.cpp:47:9:47:10 | StoreValue |
|
||||
| test.cpp:47:9:47:10 | Unary | test.cpp:47:9:47:10 | (reference to) |
|
||||
| test.cpp:47:9:47:10 | mc | test.cpp:47:9:47:10 | Unary |
|
||||
| test.cpp:54:9:54:15 | & ... | test.cpp:54:9:54:15 | StoreValue |
|
||||
| test.cpp:54:11:54:12 | Unary | test.cpp:54:14:54:14 | a |
|
||||
| test.cpp:54:11:54:12 | mc | test.cpp:54:11:54:12 | Unary |
|
||||
| test.cpp:54:14:54:14 | Unary | test.cpp:54:9:54:15 | & ... |
|
||||
| test.cpp:54:14:54:14 | a | test.cpp:54:14:54:14 | Unary |
|
||||
| test.cpp:89:3:89:11 | Store | test.cpp:92:9:92:11 | Load |
|
||||
| test.cpp:89:9:89:11 | & ... | test.cpp:89:9:89:11 | StoreValue |
|
||||
| test.cpp:89:9:89:11 | StoreValue | test.cpp:89:3:89:11 | Store |
|
||||
| test.cpp:89:10:89:11 | Unary | test.cpp:89:9:89:11 | & ... |
|
||||
| test.cpp:89:10:89:11 | mc | test.cpp:89:10:89:11 | Unary |
|
||||
| test.cpp:92:9:92:11 | Load | test.cpp:92:9:92:11 | ptr |
|
||||
| test.cpp:92:9:92:11 | ptr | test.cpp:92:9:92:11 | StoreValue |
|
||||
| test.cpp:112:9:112:11 | Unary | test.cpp:112:9:112:11 | array to pointer conversion |
|
||||
| test.cpp:112:9:112:11 | arr | test.cpp:112:9:112:11 | Unary |
|
||||
| test.cpp:112:9:112:11 | array to pointer conversion | test.cpp:112:9:112:11 | StoreValue |
|
||||
| test.cpp:119:9:119:18 | & ... | test.cpp:119:9:119:18 | StoreValue |
|
||||
| test.cpp:119:11:119:13 | Left | test.cpp:119:11:119:17 | access to array |
|
||||
| test.cpp:119:11:119:13 | Unary | test.cpp:119:11:119:13 | array to pointer conversion |
|
||||
| test.cpp:119:11:119:13 | arr | test.cpp:119:11:119:13 | Unary |
|
||||
| test.cpp:119:11:119:13 | array to pointer conversion | test.cpp:119:11:119:13 | Left |
|
||||
| test.cpp:119:11:119:17 | Unary | test.cpp:119:9:119:18 | & ... |
|
||||
| test.cpp:119:11:119:17 | access to array | test.cpp:119:11:119:17 | Unary |
|
||||
| test.cpp:134:2:134:14 | Store | test.cpp:135:2:135:4 | Load |
|
||||
| test.cpp:134:8:134:10 | Left | test.cpp:134:8:134:14 | ... + ... |
|
||||
| test.cpp:134:8:134:10 | Unary | test.cpp:134:8:134:10 | array to pointer conversion |
|
||||
| test.cpp:134:8:134:10 | arr | test.cpp:134:8:134:10 | Unary |
|
||||
| test.cpp:134:8:134:10 | array to pointer conversion | test.cpp:134:8:134:10 | Left |
|
||||
| test.cpp:134:8:134:14 | ... + ... | test.cpp:134:8:134:14 | StoreValue |
|
||||
| test.cpp:134:8:134:14 | StoreValue | test.cpp:134:2:134:14 | Store |
|
||||
| test.cpp:135:2:135:4 | Left | test.cpp:135:2:135:6 | PointerAdd |
|
||||
| test.cpp:135:2:135:4 | Load | test.cpp:135:2:135:4 | ptr |
|
||||
| test.cpp:135:2:135:4 | ptr | test.cpp:135:2:135:4 | Left |
|
||||
| test.cpp:135:2:135:6 | PointerAdd | test.cpp:135:2:135:6 | StoreValue |
|
||||
| test.cpp:135:2:135:6 | Store | test.cpp:137:9:137:11 | Load |
|
||||
| test.cpp:135:2:135:6 | StoreValue | test.cpp:135:2:135:6 | Store |
|
||||
| test.cpp:137:9:137:11 | Load | test.cpp:137:9:137:11 | ptr |
|
||||
| test.cpp:137:9:137:11 | ptr | test.cpp:137:9:137:11 | StoreValue |
|
||||
| test.cpp:170:26:170:41 | (void *)... | test.cpp:170:26:170:41 | StoreValue |
|
||||
| test.cpp:170:26:170:41 | Store | test.cpp:171:10:171:23 | Load |
|
||||
| test.cpp:170:26:170:41 | StoreValue | test.cpp:170:26:170:41 | Store |
|
||||
| test.cpp:170:34:170:41 | & ... | test.cpp:170:34:170:41 | Unary |
|
||||
| test.cpp:170:34:170:41 | Unary | test.cpp:170:26:170:41 | (void *)... |
|
||||
| test.cpp:170:35:170:41 | Unary | test.cpp:170:34:170:41 | & ... |
|
||||
| test.cpp:170:35:170:41 | myLocal | test.cpp:170:35:170:41 | Unary |
|
||||
| test.cpp:171:10:171:23 | Load | test.cpp:171:10:171:23 | pointerToLocal |
|
||||
| test.cpp:171:10:171:23 | pointerToLocal | test.cpp:171:10:171:23 | StoreValue |
|
||||
| test.cpp:176:25:176:34 | Store | test.cpp:177:10:177:23 | Load |
|
||||
| test.cpp:176:25:176:34 | StoreValue | test.cpp:176:25:176:34 | Store |
|
||||
| test.cpp:176:25:176:34 | Unary | test.cpp:176:25:176:34 | array to pointer conversion |
|
||||
| test.cpp:176:25:176:34 | array to pointer conversion | test.cpp:176:25:176:34 | StoreValue |
|
||||
| test.cpp:176:25:176:34 | localArray | test.cpp:176:25:176:34 | Unary |
|
||||
| test.cpp:177:10:177:23 | (void *)... | test.cpp:177:10:177:23 | StoreValue |
|
||||
| test.cpp:177:10:177:23 | Load | test.cpp:177:10:177:23 | pointerToLocal |
|
||||
| test.cpp:177:10:177:23 | Unary | test.cpp:177:10:177:23 | (void *)... |
|
||||
| test.cpp:177:10:177:23 | pointerToLocal | test.cpp:177:10:177:23 | Unary |
|
||||
| test.cpp:182:21:182:27 | (reference to) | test.cpp:182:21:182:27 | StoreValue |
|
||||
| test.cpp:182:21:182:27 | Store | test.cpp:183:10:183:19 | Load |
|
||||
| test.cpp:182:21:182:27 | StoreValue | test.cpp:182:21:182:27 | Store |
|
||||
| test.cpp:182:21:182:27 | Unary | test.cpp:182:21:182:27 | (reference to) |
|
||||
| test.cpp:182:21:182:27 | myLocal | test.cpp:182:21:182:27 | Unary |
|
||||
| test.cpp:183:10:183:19 | (reference dereference) | test.cpp:183:10:183:19 | Unary |
|
||||
| test.cpp:183:10:183:19 | (reference to) | test.cpp:183:10:183:19 | StoreValue |
|
||||
| test.cpp:183:10:183:19 | Load | test.cpp:183:10:183:19 | refToLocal |
|
||||
| test.cpp:183:10:183:19 | Unary | test.cpp:183:10:183:19 | (reference dereference) |
|
||||
| test.cpp:183:10:183:19 | Unary | test.cpp:183:10:183:19 | (reference to) |
|
||||
| test.cpp:183:10:183:19 | refToLocal | test.cpp:183:10:183:19 | Unary |
|
||||
| test.cpp:189:16:189:16 | (reference to) | test.cpp:189:16:189:16 | StoreValue |
|
||||
| test.cpp:189:16:189:16 | Store | test.cpp:190:10:190:13 | Load |
|
||||
| test.cpp:189:16:189:16 | StoreValue | test.cpp:189:16:189:16 | Store |
|
||||
| test.cpp:189:16:189:16 | Unary | test.cpp:189:16:189:16 | (reference to) |
|
||||
| test.cpp:189:16:189:16 | p | test.cpp:189:16:189:16 | Unary |
|
||||
| test.cpp:190:10:190:13 | (reference dereference) | test.cpp:190:10:190:13 | Unary |
|
||||
| test.cpp:190:10:190:13 | (reference to) | test.cpp:190:10:190:13 | StoreValue |
|
||||
| test.cpp:190:10:190:13 | Load | test.cpp:190:10:190:13 | pRef |
|
||||
| test.cpp:190:10:190:13 | Unary | test.cpp:190:10:190:13 | (reference dereference) |
|
||||
| test.cpp:190:10:190:13 | Unary | test.cpp:190:10:190:13 | (reference to) |
|
||||
| test.cpp:190:10:190:13 | pRef | test.cpp:190:10:190:13 | Unary |
|
||||
nodes
|
||||
| test.cpp:17:9:17:11 | & ... | semmle.label | & ... |
|
||||
| test.cpp:17:9:17:11 | StoreValue | semmle.label | StoreValue |
|
||||
| test.cpp:17:10:17:11 | Unary | semmle.label | Unary |
|
||||
| test.cpp:17:10:17:11 | mc | semmle.label | mc |
|
||||
| test.cpp:23:17:23:19 | & ... | semmle.label | & ... |
|
||||
| test.cpp:23:17:23:19 | Store | semmle.label | Store |
|
||||
| test.cpp:23:17:23:19 | StoreValue | semmle.label | StoreValue |
|
||||
| test.cpp:23:18:23:19 | Unary | semmle.label | Unary |
|
||||
| test.cpp:23:18:23:19 | mc | semmle.label | mc |
|
||||
| test.cpp:25:9:25:11 | Load | semmle.label | Load |
|
||||
| test.cpp:25:9:25:11 | StoreValue | semmle.label | StoreValue |
|
||||
| test.cpp:25:9:25:11 | ptr | semmle.label | ptr |
|
||||
| test.cpp:39:17:39:18 | (reference to) | semmle.label | (reference to) |
|
||||
| test.cpp:39:17:39:18 | Store | semmle.label | Store |
|
||||
| test.cpp:39:17:39:18 | StoreValue | semmle.label | StoreValue |
|
||||
| test.cpp:39:17:39:18 | Unary | semmle.label | Unary |
|
||||
| test.cpp:39:17:39:18 | mc | semmle.label | mc |
|
||||
| test.cpp:41:9:41:12 | & ... | semmle.label | & ... |
|
||||
| test.cpp:41:9:41:12 | StoreValue | semmle.label | StoreValue |
|
||||
| test.cpp:41:10:41:12 | (reference dereference) | semmle.label | (reference dereference) |
|
||||
| test.cpp:41:10:41:12 | Load | semmle.label | Load |
|
||||
| test.cpp:41:10:41:12 | Unary | semmle.label | Unary |
|
||||
| test.cpp:41:10:41:12 | Unary | semmle.label | Unary |
|
||||
| test.cpp:41:10:41:12 | ref | semmle.label | ref |
|
||||
| test.cpp:47:9:47:10 | (reference to) | semmle.label | (reference to) |
|
||||
| test.cpp:47:9:47:10 | StoreValue | semmle.label | StoreValue |
|
||||
| test.cpp:47:9:47:10 | Unary | semmle.label | Unary |
|
||||
| test.cpp:47:9:47:10 | mc | semmle.label | mc |
|
||||
| test.cpp:54:9:54:15 | & ... | semmle.label | & ... |
|
||||
| test.cpp:54:9:54:15 | StoreValue | semmle.label | StoreValue |
|
||||
| test.cpp:54:11:54:12 | Unary | semmle.label | Unary |
|
||||
| test.cpp:54:11:54:12 | mc | semmle.label | mc |
|
||||
| test.cpp:54:14:54:14 | Unary | semmle.label | Unary |
|
||||
| test.cpp:54:14:54:14 | a | semmle.label | a |
|
||||
| test.cpp:89:3:89:11 | Store | semmle.label | Store |
|
||||
| test.cpp:89:9:89:11 | & ... | semmle.label | & ... |
|
||||
| test.cpp:89:9:89:11 | StoreValue | semmle.label | StoreValue |
|
||||
| test.cpp:89:10:89:11 | Unary | semmle.label | Unary |
|
||||
| test.cpp:89:10:89:11 | mc | semmle.label | mc |
|
||||
| test.cpp:92:9:92:11 | Load | semmle.label | Load |
|
||||
| test.cpp:92:9:92:11 | StoreValue | semmle.label | StoreValue |
|
||||
| test.cpp:92:9:92:11 | ptr | semmle.label | ptr |
|
||||
| test.cpp:112:9:112:11 | StoreValue | semmle.label | StoreValue |
|
||||
| test.cpp:112:9:112:11 | Unary | semmle.label | Unary |
|
||||
| test.cpp:112:9:112:11 | arr | semmle.label | arr |
|
||||
| test.cpp:112:9:112:11 | array to pointer conversion | semmle.label | array to pointer conversion |
|
||||
| test.cpp:119:9:119:18 | & ... | semmle.label | & ... |
|
||||
| test.cpp:119:9:119:18 | StoreValue | semmle.label | StoreValue |
|
||||
| test.cpp:119:11:119:13 | Left | semmle.label | Left |
|
||||
| test.cpp:119:11:119:13 | Unary | semmle.label | Unary |
|
||||
| test.cpp:119:11:119:13 | arr | semmle.label | arr |
|
||||
| test.cpp:119:11:119:13 | array to pointer conversion | semmle.label | array to pointer conversion |
|
||||
| test.cpp:119:11:119:17 | Unary | semmle.label | Unary |
|
||||
| test.cpp:119:11:119:17 | access to array | semmle.label | access to array |
|
||||
| test.cpp:134:2:134:14 | Store | semmle.label | Store |
|
||||
| test.cpp:134:8:134:10 | Left | semmle.label | Left |
|
||||
| test.cpp:134:8:134:10 | Unary | semmle.label | Unary |
|
||||
| test.cpp:134:8:134:10 | arr | semmle.label | arr |
|
||||
| test.cpp:134:8:134:10 | array to pointer conversion | semmle.label | array to pointer conversion |
|
||||
| test.cpp:134:8:134:14 | ... + ... | semmle.label | ... + ... |
|
||||
| test.cpp:134:8:134:14 | StoreValue | semmle.label | StoreValue |
|
||||
| test.cpp:135:2:135:4 | Left | semmle.label | Left |
|
||||
| test.cpp:135:2:135:4 | Load | semmle.label | Load |
|
||||
| test.cpp:135:2:135:4 | ptr | semmle.label | ptr |
|
||||
| test.cpp:135:2:135:6 | PointerAdd | semmle.label | PointerAdd |
|
||||
| test.cpp:135:2:135:6 | Store | semmle.label | Store |
|
||||
| test.cpp:135:2:135:6 | StoreValue | semmle.label | StoreValue |
|
||||
| test.cpp:137:9:137:11 | Load | semmle.label | Load |
|
||||
| test.cpp:137:9:137:11 | StoreValue | semmle.label | StoreValue |
|
||||
| test.cpp:137:9:137:11 | ptr | semmle.label | ptr |
|
||||
| test.cpp:170:26:170:41 | (void *)... | semmle.label | (void *)... |
|
||||
| test.cpp:170:26:170:41 | Store | semmle.label | Store |
|
||||
| test.cpp:170:26:170:41 | StoreValue | semmle.label | StoreValue |
|
||||
| test.cpp:170:34:170:41 | & ... | semmle.label | & ... |
|
||||
| test.cpp:170:34:170:41 | Unary | semmle.label | Unary |
|
||||
| test.cpp:170:35:170:41 | Unary | semmle.label | Unary |
|
||||
| test.cpp:170:35:170:41 | myLocal | semmle.label | myLocal |
|
||||
| test.cpp:171:10:171:23 | Load | semmle.label | Load |
|
||||
| test.cpp:171:10:171:23 | StoreValue | semmle.label | StoreValue |
|
||||
| test.cpp:171:10:171:23 | pointerToLocal | semmle.label | pointerToLocal |
|
||||
| test.cpp:176:25:176:34 | Store | semmle.label | Store |
|
||||
| test.cpp:176:25:176:34 | StoreValue | semmle.label | StoreValue |
|
||||
| test.cpp:176:25:176:34 | Unary | semmle.label | Unary |
|
||||
| test.cpp:176:25:176:34 | array to pointer conversion | semmle.label | array to pointer conversion |
|
||||
| test.cpp:176:25:176:34 | localArray | semmle.label | localArray |
|
||||
| test.cpp:177:10:177:23 | (void *)... | semmle.label | (void *)... |
|
||||
| test.cpp:177:10:177:23 | Load | semmle.label | Load |
|
||||
| test.cpp:177:10:177:23 | StoreValue | semmle.label | StoreValue |
|
||||
| test.cpp:177:10:177:23 | Unary | semmle.label | Unary |
|
||||
| test.cpp:177:10:177:23 | pointerToLocal | semmle.label | pointerToLocal |
|
||||
| test.cpp:182:21:182:27 | (reference to) | semmle.label | (reference to) |
|
||||
| test.cpp:182:21:182:27 | Store | semmle.label | Store |
|
||||
| test.cpp:182:21:182:27 | StoreValue | semmle.label | StoreValue |
|
||||
| test.cpp:182:21:182:27 | Unary | semmle.label | Unary |
|
||||
| test.cpp:182:21:182:27 | myLocal | semmle.label | myLocal |
|
||||
| test.cpp:183:10:183:19 | (reference dereference) | semmle.label | (reference dereference) |
|
||||
| test.cpp:183:10:183:19 | (reference to) | semmle.label | (reference to) |
|
||||
| test.cpp:183:10:183:19 | Load | semmle.label | Load |
|
||||
| test.cpp:183:10:183:19 | StoreValue | semmle.label | StoreValue |
|
||||
| test.cpp:183:10:183:19 | Unary | semmle.label | Unary |
|
||||
| test.cpp:183:10:183:19 | Unary | semmle.label | Unary |
|
||||
| test.cpp:183:10:183:19 | refToLocal | semmle.label | refToLocal |
|
||||
| test.cpp:189:16:189:16 | (reference to) | semmle.label | (reference to) |
|
||||
| test.cpp:189:16:189:16 | Store | semmle.label | Store |
|
||||
| test.cpp:189:16:189:16 | StoreValue | semmle.label | StoreValue |
|
||||
| test.cpp:189:16:189:16 | Unary | semmle.label | Unary |
|
||||
| test.cpp:189:16:189:16 | p | semmle.label | p |
|
||||
| test.cpp:190:10:190:13 | (reference dereference) | semmle.label | (reference dereference) |
|
||||
| test.cpp:190:10:190:13 | (reference to) | semmle.label | (reference to) |
|
||||
| test.cpp:190:10:190:13 | Load | semmle.label | Load |
|
||||
| test.cpp:190:10:190:13 | StoreValue | semmle.label | StoreValue |
|
||||
| test.cpp:190:10:190:13 | Unary | semmle.label | Unary |
|
||||
| test.cpp:190:10:190:13 | Unary | semmle.label | Unary |
|
||||
| test.cpp:190:10:190:13 | pRef | semmle.label | pRef |
|
||||
#select
|
||||
| test.cpp:17:9:17:11 | StoreValue | test.cpp:17:10:17:11 | mc | test.cpp:17:9:17:11 | StoreValue | May return stack-allocated memory from $@. | test.cpp:17:10:17:11 | mc | mc |
|
||||
| test.cpp:25:9:25:11 | StoreValue | test.cpp:23:18:23:19 | mc | test.cpp:25:9:25:11 | StoreValue | May return stack-allocated memory from $@. | test.cpp:23:18:23:19 | mc | mc |
|
||||
| test.cpp:41:9:41:12 | StoreValue | test.cpp:39:17:39:18 | mc | test.cpp:41:9:41:12 | StoreValue | May return stack-allocated memory from $@. | test.cpp:39:17:39:18 | mc | mc |
|
||||
| test.cpp:47:9:47:10 | StoreValue | test.cpp:47:9:47:10 | mc | test.cpp:47:9:47:10 | StoreValue | May return stack-allocated memory from $@. | test.cpp:47:9:47:10 | mc | mc |
|
||||
| test.cpp:54:9:54:15 | StoreValue | test.cpp:54:11:54:12 | mc | test.cpp:54:9:54:15 | StoreValue | May return stack-allocated memory from $@. | test.cpp:54:11:54:12 | mc | mc |
|
||||
| test.cpp:92:9:92:11 | StoreValue | test.cpp:89:10:89:11 | mc | test.cpp:92:9:92:11 | StoreValue | May return stack-allocated memory from $@. | test.cpp:89:10:89:11 | mc | mc |
|
||||
| test.cpp:112:9:112:11 | StoreValue | test.cpp:112:9:112:11 | arr | test.cpp:112:9:112:11 | StoreValue | May return stack-allocated memory from $@. | test.cpp:112:9:112:11 | arr | arr |
|
||||
| test.cpp:119:9:119:18 | StoreValue | test.cpp:119:11:119:13 | arr | test.cpp:119:9:119:18 | StoreValue | May return stack-allocated memory from $@. | test.cpp:119:11:119:13 | arr | arr |
|
||||
| test.cpp:137:9:137:11 | StoreValue | test.cpp:134:8:134:10 | arr | test.cpp:137:9:137:11 | StoreValue | May return stack-allocated memory from $@. | test.cpp:134:8:134:10 | arr | arr |
|
||||
| test.cpp:171:10:171:23 | StoreValue | test.cpp:170:35:170:41 | myLocal | test.cpp:171:10:171:23 | StoreValue | May return stack-allocated memory from $@. | test.cpp:170:35:170:41 | myLocal | myLocal |
|
||||
| test.cpp:177:10:177:23 | StoreValue | test.cpp:176:25:176:34 | localArray | test.cpp:177:10:177:23 | StoreValue | May return stack-allocated memory from $@. | test.cpp:176:25:176:34 | localArray | localArray |
|
||||
| test.cpp:183:10:183:19 | StoreValue | test.cpp:182:21:182:27 | myLocal | test.cpp:183:10:183:19 | StoreValue | May return stack-allocated memory from $@. | test.cpp:182:21:182:27 | myLocal | myLocal |
|
||||
| test.cpp:190:10:190:13 | StoreValue | test.cpp:189:16:189:16 | p | test.cpp:190:10:190:13 | StoreValue | May return stack-allocated memory from $@. | test.cpp:189:16:189:16 | p | p |
|
||||
|
||||
@@ -38,7 +38,7 @@ MyClass *test4()
|
||||
MyClass mc;
|
||||
MyClass &ref = mc;
|
||||
|
||||
return &ref; // BAD [NOT DETECTED]
|
||||
return &ref; // BAD
|
||||
}
|
||||
|
||||
MyClass &test5()
|
||||
@@ -134,7 +134,7 @@ char *testArray4()
|
||||
ptr = arr + 1;
|
||||
ptr++;
|
||||
|
||||
return ptr; // BAD [NOT DETECTED]
|
||||
return ptr; // BAD
|
||||
}
|
||||
|
||||
char *testArray5()
|
||||
@@ -174,20 +174,20 @@ void *conversionBeforeDataFlow() {
|
||||
void *arrayConversionBeforeDataFlow() {
|
||||
int localArray[4];
|
||||
int *pointerToLocal = localArray; // has conversion
|
||||
return pointerToLocal; // BAD [NOT DETECTED]
|
||||
return pointerToLocal; // BAD
|
||||
}
|
||||
|
||||
int &dataFlowThroughReference() {
|
||||
int myLocal;
|
||||
int &refToLocal = myLocal; // has conversion
|
||||
return refToLocal; // BAD [NOT DETECTED]
|
||||
return refToLocal; // BAD
|
||||
}
|
||||
|
||||
int *&conversionInFlow() {
|
||||
int myLocal;
|
||||
int *p = &myLocal;
|
||||
int *&pRef = p; // has conversion in the middle of data flow
|
||||
return pRef; // BAD [NOT DETECTED]
|
||||
return pRef; // BAD
|
||||
}
|
||||
|
||||
namespace std {
|
||||
@@ -215,4 +215,4 @@ auto make_read_port()
|
||||
auto port = std::shared_ptr<int>(new int);
|
||||
auto ptr = port.get();
|
||||
return ptr; // GOOD
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user