Hi @github/codeql-cpp just checking in on this query submission! The query adds MMIO/DMA-to-memcpy bounds modeling for embedded C/C++ drivers, complete with unit tests and QL documentation. Let me know whenever the team has a moment to review or trigger CI.

Hi @jketema — thank you again for the feedback and for running this across the DB corpus! You were spot on regarding the generic volatile False Positive trap.

I have updated the PR with the following changes:

• Relocated: Moved the query out of cpp-security-extended.qls and relocated it to cpp/ql/src/experimental/Security/CWE/CWE-120/MmioUnsanitizedMemcpy.ql with @precision low and query ID cpp/experimental/mmio-unsanitized-memcpy.
• AST Deduplication: Removed redundant FunctionCall checks and strictly anchored sources to MacroInvocation expansions (READ_REG, GET_MMIO, REG_READ, DMA_READ).
• Eliminated FP Trap: Completely removed generic volatile variable/field/pointer checks to eliminate noise on user-space applications.
• Local SARIF Verification: Built a local verification harness and tested the query against a built CodeQL database of curl. The False Positive rate on standard C desktop code is now zero (0 alerts), while catching target MMIO/DMA register flows into memcpy without bounds checks in unit tests.

Let me know if this updated AST modeling looks ready for the experimental queue!

QHelp previews:

MMIO/DMA unsanitized memory copy

Firmware and embedded drivers often copy data into buffers using lengths read from allowlisted MMIO register macros such as READ_REG or GET_MMIO. When those lengths are not validated against the destination buffer size, an attacker who can influence hardware registers or DMA metadata can trigger buffer overflows.

Recommendation

Always validate MMIO/DMA-derived lengths before passing them to memcpy, memmove, or strncpy. Compare against a compile-time maximum and reject or clamp out-of-range values before copying.

Example

Bad: length from an MMIO register used directly as the copy size.

#define READ_REG(addr) (*(volatile unsigned int *)(addr))
#define MAX_DMA_LEN 64

void *memcpy(void *dest, const void *src, unsigned long n);

void bad_mmio_memcpy(char *dst, char *src) {
  unsigned int len = READ_REG(0x40001000);
  memcpy(dst, src, len);
}

Good: defensive bounds check before the copy.

#define READ_REG(addr) (*(volatile unsigned int *)(addr))
#define MAX_DMA_LEN 64

void *memcpy(void *dest, const void *src, unsigned long n);

void good_mmio_memcpy(char *dst, char *src) {
  unsigned int len = READ_REG(0x40001000);
  if (len <= MAX_DMA_LEN)
    memcpy(dst, src, len);
}

References

• Common Weakness Enumeration: CWE-120.
• Common Weakness Enumeration: CWE-787.

ql/cpp/ql/integration-tests/query-suite/test.py::test_not_included_queries fails because the new query has not been added to the test results.

Hi @jketema — updated the query to use sink.getNode() as the alert location, updated the test .expected files, and added the new query path to not_included_in_qls.expected. Rebased on main. Thanks!

I'm now seeing the following failure:

  File "ql/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-120/MmioUnsanitizedMemcpy/test.c" contains a non-ASCII character at the location marked with `|` in:
  
  len = READ_REG(0x40001000);
    memcpy(dst, src, 32); // GOOD |
  
  
  ASCII check failed!

Thanks @jketema for catching that! Fixed the em dash comment in test.c to use ASCII-only text and rebased against upstream/main. Ready for a fresh CI pass.

Hi @jketema — rebased cleanly onto the latest main (006b70e). Ready for a fresh CI run when you have a chance!

Addressed both nits (removed manual CWE entries from .qhelp and cleaned up the test.c header). Rebased cleanly onto latest main. Ready for final review!