github / github/codeql

C: CodeQL seems to be confused by __attribute__((weak))

Abierto
#18,806 1 comentario 0 reacciones 0 asignados Ver en GitHub
question
Lenguaje dominante
CodeQL
Estrellas
10.1k
Forks
2.1k
Merge medio
2 d 18 h
PR fusionados (30 d)
152

Descripción

Hi all. I'm seeing some unexpected behavior, and I can't explain it - perhaps I'm misunderstanding C, or perhaps I've found a bug in CodeQL.

I create a project comprising two source files. The first, `a.c`:
```
#include
void __attribute__((weak)) foo() { printf("The weak func"); }
void main() { }
```
And the second, `b.c`:
```
#include
void foo() { printf("The strong func"); }
```
I build these with the Makefile (supplied for completeness, excuse my verbosity):
```
a:
gcc -o a a.c b.c
```
As you can see, `foo` is defined twice - once as `weak`.

I then run the following CodeQL query to list all functions, and an attribute of each.
```
from Function f select f, f.getAnAttribute().toString()
```
Via the following commands:
```
./codeql database create a --language=c --overwrite --source-root /home/aliz/a/
./codeql database analyze --format=csv --output=results a foo --rerun
```
This results in the following unexpected output:
```
"foo","foo","error","weak","/a.c","2","28","2","30"
"foo","foo","error","weak","/b.c","2","6","2","8"
```
As you can see, the two functions have been identified, but have both been marked with the `weak` attribute. I expected only the first to be marked as `weak`.
I initially thought this was due to some subtle C behavior beyond my understanding, but if we look a little closer, it does indeed appear that CodeQL has 'mixed up' the two functions. I run the following query, intended to list the string literals for each function:
```
from
StringLiteral str,
Function f
where
str.getEnclosingFunction() = f
select f, str.getValue()
```
This results in the following:
```
"foo","foo","error","The weak func
The strong func","/a.c","2","28","2","30"
"foo","foo","error","The weak func
The strong func","/b.c","2","6","2","8"
```
Here, the two functions have been reported, but each is reported as referencing _both_ strings, which appears incorrect to me - I would have expected something akin to the following to be returned:
```
"foo","foo","error","The weak func","/a.c","2","28","2","30"
"foo","foo","error","The strong func","/b.c","2","6","2","8"
```

Can anyone shed some light on the issue here? Have I really stumbled into a codeql bug, or is this due to some wizard-level C behavior? Thanks for any help!

Guía de contribución

Abrir la guía de contribución

Línea de trabajo

Reproduce el informe utilizando los archivos proporcionados a.c, b.c, Makefile y las consultas de CodeQL. Comienza con los comandos de creación y análisis de la base de datos y, después, inspecciona cómo se asocian el atributo weak y los literales de cadena contenedores con cada Function. El trabajo estará terminado cuando se determine si las asociaciones indicadas son incorrectas y se documente o corrija el comportamiento.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Stack tecnológico
c
Área
tooling
Tipo de issue
Error
Dificultad
4/5
Tiempo estimado
3-5 días
Estado de actividad
Estancado
Claridad
Bastante claro
Aptitud para principiantes
35/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.