A typedef defined with extern "C" prevents CodeQL from finding the TypdefType of a C++ member function's FunctionDeclarationEntry
- 主要语言
- CodeQL
- 星标
- 10.1k
- 派生
- 2.1k
- 平均合并
- 2 天 15 小时
- 30 天内合并 PR
- 141
描述
**Description of the issue**
If a C++ class member function is declared with a typedef that was defined with "extern "C" ", CodeQL will not return any result for the TypedefType of the FunctionDeclarationEntry for that function when using [getTypedefType()](https://codeql.github.com/codeql-standard-libraries/cpp/semmle/code/cpp/Function.qll/predicate.Function$FunctionDeclarationEntry$getTypedefType.0.html)
**Example**
Query:
```
import cpp
from FunctionDeclarationEntry fde, Class c
where fde.getFunction() = c.getAMemberFunction()
select fde,
"class $@, FDE $@, TypdefType $@ ",c, c.toString(), fde, fde.toString(), fde.getTypedefType(), fde.getTypedefType().toString()
```
Code:
test.h
```
#pragma once
//
// extern
extern "C"
{
typedef VOID
TYPEDEF_TEST1(
_In_ int i);
typedef TYPEDEF_TEST1 *ITEM1;
}
// global namespace
typedef VOID TYPEDEF_TEST2(
_In_ int i);
typedef TYPEDEF_TEST2 *ITEM2;
// some other namespace
namespace SomeOtherNamespace
{
typedef VOID TYPEDEF_TEST3(
_In_ int i);
typedef TYPEDEF_TEST3 *ITEM3;
}
class SomeClass
{
public:
NTSTATUS Init();
//=====================================================================
// Default CUnknown
static TYPEDEF_TEST1 typedefFunction; // This typedef is NOT found
static TYPEDEF_TEST2 typedefFunction2; // This typedef is found
};
namespace SomeOtherNamespace
{
class SomeClassSomeOtherNamespace
{
public:
NTSTATUS Init();
//=====================================================================
// Default CUnknown
static TYPEDEF_TEST1 typedefFunction3; // This typedef is NOT found
static TYPEDEF_TEST2 typedefFunction4; // This typedef is found
static TYPEDEF_TEST3 typedefFunction5; // This typedef is found
};
}
#pragma code_seg()
VOID SomeClass::typedefFunction(
_In_ int i)
{
i = NULL;
}
#pragma code_seg()
VOID SomeClass::typedefFunction2(
_In_ int i)
{
i = NULL;
}
namespace SomeOtherNamespace
{
#pragma code_seg()
VOID SomeClassSomeOtherNamespace::typedefFunction3(
_In_ int i)
{
i = NULL;
}
#pragma code_seg()
VOID SomeClassSomeOtherNamespace::typedefFunction4(
_In_ int i)
{
i = NULL;
}
#pragma code_seg()
VOID SomeClassSomeOtherNamespace::typedefFunction5(
_In_ int i)
{
i = NULL;
}
} // namespace SomeOtherNamespace
```
CodeQL can find just the TypedefTypes. The following query has results for each of the three typedefs:
```
import cpp
from TypedefType t
where
t.getName().matches("TYPEDEF_TEST1") or
t.getName().matches("TYPEDEF_TEST2") or
t.getName().matches("TYPEDEF_TEST3")
select t,
t.toString()
```
And can find just the FunctionDeclarationEntry. The following query has results for each of the functions:
```
import cpp
from FunctionDeclarationEntry fde
where
fde.getName().matches("typedefFunction") or
fde.getName().matches("typedefFunction2") or
fde.getName().matches("typedefFunction3") or
fde.getName().matches("typedefFunction4") or
fde.getName().matches("typedefFunction5")
select fde,
fde.toString()
```
However, it fails to find the TypedefType of the FunctionDeclarationEntry of typedefFunction and typedefFunction3 which are declared with TYPEDEF_TEST1. The results for the following query only produces TYPEDEF_TEST2 and TYPEDEF_TEST3
```
import cpp
from FunctionDeclarationEntry fde
where
fde.getName().matches("typedefFunction") or
fde.getName().matches("typedefFunction2") or
fde.getName().matches("typedefFunction3") or
fde.getName().matches("typedefFunction4") or
fde.getName().matches("typedefFunction5")
select fde,
fde.getTypedefType().toString()
```
贡献指南
调研方向
Start with the supplied test.h example and run the three CodeQL queries against it, comparing getTypedefType() for the extern "C" typedefs with the other typedefs. Trace the FunctionDeclarationEntry and getTypedefType() entry points in the C++ library. Done means the query returns the expected TypedefType for typedefFunction and typedefFunction3 as well as the existing cases.
由索引模型根据 Issue 内容生成。
评估
- 技术栈
- cpp
- 领域
- devtools
- Issue 类型
- 缺陷
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 活跃度
- 停滞
- 描述清晰度
- 基本清楚
- 新手友好度
- 35/100