github / github/codeql

IRGuardCondition failure to detect NULL condition

Đang mở
#15,186 14 bình luận 0 reaction 0 người được giao Xem trên GitHub
C++ question
Ngôn ngữ chính
CodeQL
Star
10.1k
Fork
2.1k
Merge trung bình
2 ngày 15 giờ
Pull request đã merge (30 ngày)
141

Mô tả

I wrote a small query to understand all the IRGuardConditions inside a function
```
predicate isNotNullCheck3(IRGuardCondition g, Expr e, boolean branch) {

branch = true
and
(g.getEnclosingFunction().hasName("func2")
or g.getEnclosingFunction().hasName("xkb_compose_table_new_from_file"))
and g.getAnOperand().getUse().getUnconvertedResultExpression() = e
}
```
Below is snippet of my custom function func2(...)
```
int func2(int num,test_struct *test){
if(!test) {
return 1;
}
if(num > 0) {
test = (test_struct *)calloc(num, sizeof(*test));
if(!test) {
return 1;
}
}
test[0].a = 1;
test[0].b = 2;
return 0;
}
```
Below is a function named xkb_compose_table_new_from_file from [libxkbcommon](https://github.com/xkbcommon/libxkbcommon/blob/master/src/compose/table.c#L93)
```
xkb_compose_table_new_from_file(struct xkb_context *ctx,
FILE *file,
const char *locale,
enum xkb_compose_format format,
enum xkb_compose_compile_flags flags)
{
struct xkb_compose_table *table;
bool ok;

if (flags & ~(XKB_COMPOSE_COMPILE_NO_FLAGS)) {
log_err_func(ctx, "unrecognized flags: %#x\n", flags);
return NULL;
}

if (format != XKB_COMPOSE_FORMAT_TEXT_V1) {
log_err_func(ctx, "unsupported compose format: %d\n", format);
return NULL;
}

table = xkb_compose_table_new(ctx, locale, format, flags);
if (!table)
return NULL;

ok = parse_file(table, file, "(unknown file)");
if (!ok) {
xkb_compose_table_unref(table);
return NULL;
}

return table;
}
```
The results for func2 are as expected. I see `CompareNE` and `CompareGT`
Screenshot 2023-12-21 at 2 41 44 AM

While for libxkbcommon, I see `Load: table` and `Load: ok` as IRGuardCondition rather than `CompareNE: (bool)...`
Screenshot 2023-12-21 at 2 42 55 AM

Any reason for this discrepancy?
Due to this issue, the predicate below is unable to detect NULL check
```
predicate isNotNullCheck2(IRGuardCondition g, Expr e, boolean branch) {
g.comparesEq(any(Instruction instr | instr.getUnconvertedResultExpression() = e).getAUse(),
any(ConstantValueInstruction const | const.getValue() = "0").getAUse(), 0, false, branch)
}
```

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.