github / github/codeql

[C++] Fails to detect control flow influence of nested “if”

Aberta
#18,099 5 comentários 0 reações 0 responsáveis Ver no GitHub
question
Linguagem predominante
CodeQL
Estrelas
10.1k
Forks
2.1k
Merge médio
2d 15h
PRs com merge (30d)
141

Descrição

The `controls` predicate in `GuardCondition` fails to detect a control flow influence from a nested `if`. In the following example the influence from `condition` to `call()` is only revealed in the first `if`, but not in the second.

```cpp
#include

void call()
{
}

void my_fn(bool outer, bool condition)
{

if (condition) // detected
{
throw std::exception();
}

if (outer)
{
if (condition) // not detected
{
throw std::exception();
}
}

call();
}
```

Query I tried:

```ql
import cpp
import semmle.code.cpp.controlflow.IRGuards

from Variable v, VariableAccess va, GuardCondition cond, Call c, int line
where
c.getTarget().getName() = "call" and
va.getTarget() = v and
v.getName() = "condition" and
cond.getAChild*() = va and
cond.controls(c.getBasicBlock(), _) and
line = va.getLocation().getStartLine()
select v, va, cond, c, line
```

Output I received:

```
| v | va | cond | c | line |
+-----------+-----------+-----------+--------------+------+
| condition | condition | condition | call to call | 10 |
```

I expected to also see an influence from line 17, but none is being found.

CodeQL version: 2.19.3

Guia de contribuição

Abrir o guia de contribuição

Direção de pesquisa

Start by reproducing the supplied C++ example with the query importing semmle.code.cpp.controlflow.IRGuards, then read GuardCondition and its controls predicate. The work is complete when the nested condition access on line 17 is reported as influencing call(), alongside the first condition.

Escrita pelo modelo de indexação a partir do texto da issue.

Avaliação

Stack de tecnologia
cpp
Domínio
compilers, devtools
Tipo de issue
Bug
Dificuldade
4/5
Tempo estimado
3-5 dias
Status de atividade
Estagnada
Clareza
Razoavelmente clara
Facilidade para iniciantes
38/100

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.