github / github/codeql

IRGuardCondition failure to detect NULL condition

Abierto
#15,186 14 comentarios 0 reacciones 0 asignados Ver en GitHub
C++ question
Lenguaje dominante
CodeQL
Estrellas
10.1k
Forks
2.1k
Merge medio
2 d 15 h
PR fusionados (30 d)
141

Descripción

I wrote a small query to understand all the IRGuardConditions inside a function
```
predicate isNotNullCheck3(IRGuardCondition g, Expr e, boolean branch) {

branch = true
and
(g.getEnclosingFunction().hasName("func2")
or g.getEnclosingFunction().hasName("xkb_compose_table_new_from_file"))
and g.getAnOperand().getUse().getUnconvertedResultExpression() = e
}
```
Below is snippet of my custom function func2(...)
```
int func2(int num,test_struct *test){
if(!test) {
return 1;
}
if(num > 0) {
test = (test_struct *)calloc(num, sizeof(*test));
if(!test) {
return 1;
}
}
test[0].a = 1;
test[0].b = 2;
return 0;
}
```
Below is a function named xkb_compose_table_new_from_file from [libxkbcommon](https://github.com/xkbcommon/libxkbcommon/blob/master/src/compose/table.c#L93)
```
xkb_compose_table_new_from_file(struct xkb_context *ctx,
FILE *file,
const char *locale,
enum xkb_compose_format format,
enum xkb_compose_compile_flags flags)
{
struct xkb_compose_table *table;
bool ok;

if (flags & ~(XKB_COMPOSE_COMPILE_NO_FLAGS)) {
log_err_func(ctx, "unrecognized flags: %#x\n", flags);
return NULL;
}

if (format != XKB_COMPOSE_FORMAT_TEXT_V1) {
log_err_func(ctx, "unsupported compose format: %d\n", format);
return NULL;
}

table = xkb_compose_table_new(ctx, locale, format, flags);
if (!table)
return NULL;

ok = parse_file(table, file, "(unknown file)");
if (!ok) {
xkb_compose_table_unref(table);
return NULL;
}

return table;
}
```
The results for func2 are as expected. I see `CompareNE` and `CompareGT`
Screenshot 2023-12-21 at 2 41 44 AM

While for libxkbcommon, I see `Load: table` and `Load: ok` as IRGuardCondition rather than `CompareNE: (bool)...`
Screenshot 2023-12-21 at 2 42 55 AM

Any reason for this discrepancy?
Due to this issue, the predicate below is unable to detect NULL check
```
predicate isNotNullCheck2(IRGuardCondition g, Expr e, boolean branch) {
g.comparesEq(any(Instruction instr | instr.getUnconvertedResultExpression() = e).getAUse(),
any(ConstantValueInstruction const | const.getValue() = "0").getAUse(), 0, false, branch)
}
```

Guía de contribución

Abrir la guía de contribución

Línea de trabajo

Start by reproducing the IRGuardCondition query against func2 and xkb_compose_table_new_from_file, comparing the reported Load conditions with the CompareNE and CompareGT conditions. Inspect the isNotNullCheck3 and isNotNullCheck2 predicates and the relevant IRGuardCondition behavior. Done means the NULL checks are represented or queryable consistently, with the discrepancy explained and covered by a regression test if the payload identifies one.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Stack tecnológico
c
Área
compilers, devtools
Tipo de issue
Error
Dificultad
4/5
Tiempo estimado
3-5 días
Estado de actividad
Estancado
Claridad
Bastante claro
Aptitud para principiantes
35/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.