codeql/cpp/ql/src/Microsoft/CallWithNullSAL.ql at codeql-cli/v2.19.0 · github/codeql · GitHub

22 lines (20 loc) · 663 Bytes

/**

* @name SAL requires non-null argument

* @description When null is passed to a function that is SAL-annotated to

* forbid this, undefined behavior may result.

* @kind problem

* @id cpp/call-with-null-sal

* @problem.severity warning

* @tags reliability

import cpp

import SAL

from Parameter p, Call c, Expr arg

where

any(SalNotNull a).getDeclaration() = p and

c.getTarget() = p.getFunction() and

arg = c.getArgument(p.getIndex()) and

nullValue(arg)

select arg,

"Argument (" + arg.toString() + ") for parameter $@ in call to " + c.getTarget().getName() +

" may be null, but a SAL annotation forbids this.", p, p.getName()

Expand file tree