github / github/codeql

False positives in cpp/use-after-free

Abierto
#15,676 1 comentario 0 reacciones 0 asignados Ver en GitHub
C++ false-positive
Lenguaje dominante
CodeQL
Estrellas
10.1k
Forks
2.1k
Merge medio
2 d 15 h
PR fusionados (30 d)
141

Descripción

I'm getting about 20 of these on my code but I'll only show one because they're all the same.

CodeQL is identifying this as a potential use after free because there's a `delete[]` on line 3 of this sample. But line 5 calls `new[]` so the pointer used on line 6 should never be dangerous to use. I don't know if CodeQL is confused by the number of pointers but this isn't an issue.

Step 1 pointer to operator delete[] output argument
Step 2 *m_CSEngine [post update] [m_arrSpeedInit]
Step 3 *m_pRaw [post update] [*m_CSEngine, m_arrSpeedInit]
Step 4 *this [post update] [*m_pRaw, *m_CSEngine, m_arrSpeedInit]
Step 5 *this [*m_pRaw, *m_CSEngine, m_arrSpeedInit]
Step 6 *m_pRaw [*m_CSEngine, m_arrSpeedInit]
Step 7 *m_CSEngine [m_arrSpeedInit]
Step 8 m_arrSpeedInit - Memory may have been previously freed by delete[].

```
if (((CRawDetectionPlate*)m_pRaw)->m_CSEngine->m_arrSpeedInit!=NULL)
{
delete []((CRawDetectionPlate*)m_pRaw)->m_CSEngine->m_arrSpeedInit; // <- Steps 1, 2, 3, 4
}
((CRawDetectionPlate*)m_pRaw)->m_CSEngine->m_arrSpeedInit = new int[((CRawDetectionPlate*)m_pRaw)->m_CSEngine->m_numberObj];
memcpy(((CRawDetectionPlate*)m_pRaw)->m_CSEngine->m_arrSpeedInit,(BYTE*)p+pos,((CRawDetectionPlate*)m_pRaw)->m_CSEngine->m_numberObj*sizeof(int)); // <- Steps 5, 6, 7, 8
```

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.