IRGuardCondition failure to detect NULL condition
- Lenguaje dominante
- CodeQL
- Estrellas
- 10.1k
- Forks
- 2.1k
- Merge medio
- 2 d 15 h
- PR fusionados (30 d)
- 141
Descripción
I wrote a small query to understand all the IRGuardConditions inside a function
```
predicate isNotNullCheck3(IRGuardCondition g, Expr e, boolean branch) {
branch = true
and
(g.getEnclosingFunction().hasName("func2")
or g.getEnclosingFunction().hasName("xkb_compose_table_new_from_file"))
and g.getAnOperand().getUse().getUnconvertedResultExpression() = e
}
```
Below is snippet of my custom function func2(...)
```
int func2(int num,test_struct *test){
if(!test) {
return 1;
}
if(num > 0) {
test = (test_struct *)calloc(num, sizeof(*test));
if(!test) {
return 1;
}
}
test[0].a = 1;
test[0].b = 2;
return 0;
}
```
Below is a function named xkb_compose_table_new_from_file from [libxkbcommon](https://github.com/xkbcommon/libxkbcommon/blob/master/src/compose/table.c#L93)
```
xkb_compose_table_new_from_file(struct xkb_context *ctx,
FILE *file,
const char *locale,
enum xkb_compose_format format,
enum xkb_compose_compile_flags flags)
{
struct xkb_compose_table *table;
bool ok;
if (flags & ~(XKB_COMPOSE_COMPILE_NO_FLAGS)) {
log_err_func(ctx, "unrecognized flags: %#x\n", flags);
return NULL;
}
if (format != XKB_COMPOSE_FORMAT_TEXT_V1) {
log_err_func(ctx, "unsupported compose format: %d\n", format);
return NULL;
}
table = xkb_compose_table_new(ctx, locale, format, flags);
if (!table)
return NULL;
ok = parse_file(table, file, "(unknown file)");
if (!ok) {
xkb_compose_table_unref(table);
return NULL;
}
return table;
}
```
The results for func2 are as expected. I see `CompareNE` and `CompareGT`
While for libxkbcommon, I see `Load: table` and `Load: ok` as IRGuardCondition rather than `CompareNE: (bool)...`
Any reason for this discrepancy?
Due to this issue, the predicate below is unable to detect NULL check
```
predicate isNotNullCheck2(IRGuardCondition g, Expr e, boolean branch) {
g.comparesEq(any(Instruction instr | instr.getUnconvertedResultExpression() = e).getAUse(),
any(ConstantValueInstruction const | const.getValue() = "0").getAUse(), 0, false, branch)
}
```
Guía de contribución
Línea de trabajo
Start by reproducing the IRGuardCondition query against func2 and xkb_compose_table_new_from_file, comparing the reported Load conditions with the CompareNE and CompareGT conditions. Inspect the isNotNullCheck3 and isNotNullCheck2 predicates and the relevant IRGuardCondition behavior. Done means the NULL checks are represented or queryable consistently, with the discrepancy explained and covered by a regression test if the payload identifies one.
Escrito por el modelo de indexación a partir del texto del issue.
Evaluación
- Stack tecnológico
- c
- Área
- compilers, devtools
- Tipo de issue
- Error
- Dificultad
- 4/5
- Tiempo estimado
- 3-5 días
- Estado de actividad
- Estancado
- Claridad
- Bastante claro
- Aptitud para principiantes
- 35/100