FazBrowse GitHub Viewer
|
Trending
|
URL:
|
Home
Tools:
[Download Repo ZIP]
[View Raw Code]
[Original HTTPS Page]
codeql/cpp/ql/src/Critical/NewDelete.qll at codeql-cli/v2.19.2 · github/codeql · GitHub
Uh oh!
There was an error while loading.
Please reload this page
.
github
/
codeql
Public
Notifications
You must be signed in to change notification settings
Fork
2.1k
Star
10k
Code
Issues
998
Pull requests
467
Discussions
Actions
Projects
Security and quality
0
Insights
Additional navigation options
Code
Issues
Pull requests
Discussions
Actions
Projects
Security and quality
Insights
Expand file tree
Breadcrumbs
codeql
/
cpp
/
ql
/
src
/
Critical
/
NewDelete.qll
Copy path
More file actions
More file actions
Latest commit
History
History
History
167 lines (159 loc) · 4.82 KB
Breadcrumbs
codeql
/
cpp
/
ql
/
src
/
Critical
/
NewDelete.qll
Copy path
File metadata and controls
167 lines (159 loc) · 4.82 KB
Raw
Copy raw file
Download raw file
Open symbols panel
Edit and raw actions
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
/**
* Provides predicates for associating new/malloc calls with delete/free.
*/
import
cpp
import
semmle.code.cpp.controlflow.SSA
import
semmle.code.cpp.ir.dataflow.DataFlow
/**
* Holds if `alloc` is a use of `malloc` or `new`. `kind` is
* a string describing the type of the allocation.
*/
predicate
allocExpr
(
Expr
alloc
,
string
kind
)
{
(
exists
(
Function
target
|
alloc
.
(
AllocationExpr
)
.
(
FunctionCall
)
.
getTarget
(
)
=
target
and
(
target
.
getName
(
)
=
"operator new"
and
kind
=
"new"
and
// exclude placement new and custom overloads as they
// may not conform to assumptions
not
target
.
getNumberOfParameters
(
)
>
1
or
target
.
getName
(
)
=
"operator new[]"
and
kind
=
"new[]"
and
// exclude placement new and custom overloads as they
// may not conform to assumptions
not
target
.
getNumberOfParameters
(
)
>
1
or
not
target
instanceof
OperatorNewAllocationFunction
and
kind
=
"malloc"
)
)
or
alloc
instanceof
NewExpr
and
kind
=
"new"
and
// exclude placement new and custom overloads as they
// may not conform to assumptions
not
alloc
.
(
NewExpr
)
.
getAllocatorCall
(
)
.
getTarget
(
)
.
getNumberOfParameters
(
)
>
1
or
alloc
instanceof
NewArrayExpr
and
kind
=
"new[]"
and
// exclude placement new and custom overloads as they
// may not conform to assumptions
not
alloc
.
(
NewArrayExpr
)
.
getAllocatorCall
(
)
.
getTarget
(
)
.
getNumberOfParameters
(
)
>
1
)
and
not
alloc
.
isFromUninstantiatedTemplate
(
_
)
}
/**
* Holds if `alloc` is a use of `malloc` or `new`, or a function
* wrapping one of those. `kind` is a string describing the type
* of the allocation.
*/
predicate
allocExprOrIndirect
(
Expr
alloc
,
string
kind
)
{
// direct alloc
allocExpr
(
alloc
,
kind
)
or
exists
(
ReturnStmt
rtn
|
// indirect alloc via function call
alloc
.
(
FunctionCall
)
.
getTarget
(
)
=
rtn
.
getEnclosingFunction
(
)
and
(
allocExprOrIndirect
(
rtn
.
getExpr
(
)
,
kind
)
or
exists
(
Expr
e
|
allocExprOrIndirect
(
e
,
kind
)
and
DataFlow
::
localExprFlow
(
e
,
rtn
.
getExpr
(
)
)
)
)
)
}
/**
* Holds if `v` is a non-local variable which is assigned with allocations of
* type `kind`.
*/
pragma
[
nomagic
]
private
predicate
allocReachesVariable
(
Variable
v
,
Expr
alloc
,
string
kind
)
{
exists
(
Expr
mid
|
not
v
instanceof
StackVariable
and
v
.
getAnAssignedValue
(
)
=
mid
and
allocReaches0
(
mid
,
alloc
,
kind
)
)
}
/**
* Holds if `e` is an expression which may evaluate to the
* result of a previous memory allocation `alloc`. `kind` is a
* string describing the type of that allocation.
*/
private
predicate
allocReaches0
(
Expr
e
,
Expr
alloc
,
string
kind
)
{
// alloc
allocExprOrIndirect
(
alloc
,
kind
)
and
e
=
alloc
or
exists
(
SsaDefinition
def
,
StackVariable
v
|
// alloc via SSA
allocReaches0
(
def
.
getAnUltimateDefiningValue
(
v
)
,
alloc
,
kind
)
and
e
=
def
.
getAUse
(
v
)
)
or
exists
(
Variable
v
|
// alloc via a global
allocReachesVariable
(
v
,
alloc
,
kind
)
and
strictcount
(
VariableAccess
va
|
va
.
getTarget
(
)
=
v
)
<=
50
and
// avoid very expensive cases
e
.
(
VariableAccess
)
.
getTarget
(
)
=
v
)
}
/**
* Holds if `e` is an expression which may evaluate to the
* result of previous memory allocations `alloc` only of type
* `kind`.
*/
predicate
allocReaches
(
Expr
e
,
Expr
alloc
,
string
kind
)
{
allocReaches0
(
e
,
alloc
,
kind
)
and
not
exists
(
string
k2
|
allocReaches0
(
e
,
_
,
k2
)
and
kind
!=
k2
)
}
/**
* Holds if `free` is a use of free or delete. `freed` is the
* expression that is freed / deleted and `kind` is a string
* describing the type of that free or delete.
*/
predicate
freeExpr
(
Expr
free
,
Expr
freed
,
string
kind
)
{
exists
(
Function
target
|
freed
=
free
.
(
DeallocationExpr
)
.
getFreedExpr
(
)
and
free
.
(
FunctionCall
)
.
getTarget
(
)
=
target
and
(
target
.
getName
(
)
=
"operator delete"
and
kind
=
"delete"
or
target
.
getName
(
)
=
"operator delete[]"
and
kind
=
"delete[]"
or
not
target
instanceof
OperatorDeleteDeallocationFunction
and
kind
=
"free"
)
)
or
free
.
(
DeleteExpr
)
.
getExpr
(
)
=
freed
and
kind
=
"delete"
or
free
.
(
DeleteArrayExpr
)
.
getExpr
(
)
=
freed
and
kind
=
"delete[]"
}
/**
* Holds if `free` is a use of free or delete, or a function
* wrapping one of those. `freed` is the expression that is
* freed / deleted and `kind` is a string describing the type
* of that free or delete.
*/
predicate
freeExprOrIndirect
(
Expr
free
,
Expr
freed
,
string
kind
)
{
// direct free
freeExpr
(
free
,
freed
,
kind
)
or
// indirect free via function call
exists
(
Expr
internalFreed
,
int
arg
|
freeExprOrIndirect
(
_
,
internalFreed
,
kind
)
and
free
.
(
FunctionCall
)
.
getTarget
(
)
.
getParameter
(
arg
)
=
internalFreed
.
(
VariableAccess
)
.
getTarget
(
)
and
free
.
(
FunctionCall
)
.
getArgument
(
arg
)
=
freed
)
}
Back
|
FazBrowse Home
|
New Git URL