`EXP39-C`: False positives related to compatible types, harmless casts

Abierto
#1,200 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
48/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
cpp
Área
devtools

Línea de trabajo

Start with the EXP39-C implementation and compare its compatibleTypes predicate with common/types/Compatible.qll, paying particular attention to typedefs and pointer compatibility. Review how casted expressions are modeled as sources and sinks, then use the provided typedef and unused-cast examples to verify that harmless casts are no longer reported.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Difficulty-Medium false positive/false negative false-positive Impact-Medium Standard-CERT-C
Affected rules
  • EXP39-C
Description

First off, our implementation uses a compatibleTypes predicate that is incomplete and doesn't handle typedefs, and should be replaced with our common/types/Compatible.qll library. This results in thousands of false positives in certain codebases, usually due to casting to a project-specific typedef of a byte like GLBYTE*.

Secondly, while we use dataflow to trace realloc's that flow to a deref without a memset, we don't use dataflow to handle the more typical case of A* cast to B* followed by a deref. Instead, we have a type representing casted expressions that's both a sink and a source. (We check compatibility of the pointers in the cast in the select statement). This isn't strictly UB unless the pointer is dereferenced, and I do see examples of this in real code. As a related example, casts to void** are often flagged while void* is excluded. This isn't a rare exceptional use of void, it's really just a harmless cast.

Example
typedef char BYTE;
void example_function() {
  int x;
  (long *) &x; // harmless since it's unused
  BYTE *x_bytes = (BYTE *)&x; // Allowed since BYTE is a char.
}
Lenguaje dominante
CodeQL
Estrellas
227
Forks
82
Merge medio
6 d 7 h
PR fusionados (30 d)
9

Guía de contribución

Abrir la guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de github/codeql-coding-standards

Todos los issues de github/codeql-coding-standards

Issues similares

Más issues de DevTools

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.