github / github/codeql

How can I pick out "Dubious Null Check" by both the caller and the called function (not what DubiousNullCheck.ql means to)?

未關閉
#13,327 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
question
主要語言
CodeQL
星號
10.1k
分支
2.1k
平均合併
2 天 15 小時
30 天內合併 PR
141

描述

For example, null check for both the argument `pi` and the parameter `p`:

```cpp
#include

int func(int *p) {
if (p = NULL) return 0;
return *p;
}
int main() {
int i = 9, *pi = &i;
//if (pi != NULL)
printf("%d\n", func(pi));
}
```

I've tried to write some ql, as below, but failed to complete it.
What troubles me the most now is: how to connect the parameter with the argument?

```codeql
import cpp

VariableAccess modify(LocalVariable variable) {
result = variable.getAnAccess() and
result.isModified()
}

from LocalVariable variable, FunctionCall call
where
variable.getType() instanceof PointerType
and exists(call.getTarget().getAParameter())
and call.getEnclosingFunction() = variable.getFunction()
and variable.getAnAccess().getLocation().getStartLine() = call.getLocation().getStartLine()
and not modify(variable).getLocation().getStartLine() = call.getLocation().getStartLine()
and not (call.getTarget().isMember() and call.getTarget().getDeclaringType() = variable.getType().stripType())
select variable, call
```

貢獻指南

開啟貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。