CPP: Nested Conditionals and BarrierGuards

I'm trying to detect sanitizing/barrier guards in more complex control flow. In another BarrierGarud issue I opened (https://github.com/github/codeql/issues/10011), we established how to address complex dataflow into the barrier guard, but the remaining issue I have is that the underlying mechanics of these guards (whether using barrier guards directly or the mechanic in https://github.com/github/codeql/issues/10011) relies on the 'controls' predicate.

Here is a null dereference example that use of barrier guards or the mechanism discussed in https://github.com/github/codeql/issues/10011 works fine with (the query correctly identifies the bad case, but not the good case):

```
char* d = (char*)my_malloc(10);
// BARRIER GUARD: CHECKS IF THE VALUE IS NULL
if(d == NULL)
goto end;
// GOOD: NULL-CHECKED DEREF (CORRECTLY NOT IDENTIFIED BY THE QUERY)
use(d);

end:
// BAD: POSSIBLE NULL DEREF (CORRECTSLY IDENTIFIED BY THE QUERY)
use(d);

```

This style of code (using gotos, exits, or returns) is common, and unfortunately, it's not always as that simple in terms of the control flow. Often the null check (barrier guard) is buried within other conditionals. Here is an example, and due to the nesting of the barrier guard, both the good and bad case are detected as potential null dereference.

```
char* d;
if (boolgen()) {
d = malloc(10);
if (d == NULL)
{
goto end;
}
}

// GOOD: NULL-CHECKED DEREF (INCORRECTLY IDENTIFIED BY THE QUERY)
use(d);

end:
// BAD: POSSIBLE NULL DEREF (CORRECTLY IDENTIFIED BY THE QUERY)
use(d);
```

Note that in this case it is possible the value is used without initialization, which is its own bug, but that's not what CodeQL is reporting for me query. It is identifying the malloc initialization as the source.

The issue, as far as I can tell, is that the underlying 'controls' logic correctly says the guard does not control the use (since it is nested and not a dominating guard).

Examples like this yield hundreds of false positives in real-world tests, and it's unclear to me what CodeQL paradigm can be used to filter out these cases. Any suggestions?

Start with the controls predicate and the barrier-guard behavior described in this issue, then compare the simple and nested conditional examples with the related issue 10011. A completed change would need to define and validate how nested guards distinguish the GOOD and BAD dereferences, but the issue does not identify files, tests, or a concrete implementation target.

由索引模型根據 Issue 內容生成。