github / github/codeql

C: False positive about "Potential double free" with negative array indices

Abierto
#16,643 1 comentario 0 reacciones 0 asignados Ver en GitHub
C++ false-positive
Lenguaje dominante
CodeQL
Estrellas
10.1k
Forks
2.1k
Merge medio
2 d 15 h
PR fusionados (30 d)
141

Descripción

**Description of the false positive**

CodeQL warns about potential double free, in situations where there's clearly no such situation. It seems to be related to the use of negative indices

**Code samples or links to source code**

Cf https://github.com/MapServer/MapServer/security/code-scanning/3

The code at https://github.com/MapServer/MapServer/blob/0cb56232d4ca0e64d747efa1db602ff08e0ea42f/src/mapparser.c#L1787 (which is C code generated from a Bison grammar)
```
free((yyvsp[-2].strval));
free((yyvsp[0].strval));
```

generates "Memory pointed to by may already have been freed by. ", but this is obviously wrong as the memory locations are disjoint.

Extract of "Show path" in the report:
```
Step 1 pointer to free output argument
Source
src/mapparser.c:1787
}
}

free((yyvsp[-2].strval));
free((yyvsp[0].strval));
}
#line 1791 "/vagrant/mapparser.c" /* yacc.c:1646 */
Step 2 *access to array [post update] [YYSTYPE]
src/mapparser.c:1787
}
}

free((yyvsp[-2].strval));
free((yyvsp[0].strval));
}
#line 1791 "/vagrant/mapparser.c" /* yacc.c:1646 */
Step 3 *access to array [YYSTYPE]
src/mapparser.c:1788
}

free((yyvsp[-2].strval));
free((yyvsp[0].strval));
}
#line 1791 "/vagrant/mapparser.c" /* yacc.c:1646 */
break;
Step 4 strval
Sink
src/mapparser.c:1788
}

free((yyvsp[-2].strval));
free((yyvsp[0].strval));
Memory pointed to by
may already have been freed by
.
}
#line 1791 "/vagrant/mapparser.c" /* yacc.c:1646 */
break;
```

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.