github / github/codeql

C: CodeQL seems to be confused by __attribute__((weak))

オープン
#18,806 コメント 1 件 リアクション 0 件 担当者 0 名 GitHub で見る
question
主要言語
CodeQL
スター
10.1k
フォーク
2.1k
平均マージ
2日 15時間
マージ済み PR(30日)
141

説明

Hi all. I'm seeing some unexpected behavior, and I can't explain it - perhaps I'm misunderstanding C, or perhaps I've found a bug in CodeQL.

I create a project comprising two source files. The first, `a.c`:
```
#include
void __attribute__((weak)) foo() { printf("The weak func"); }
void main() { }
```
And the second, `b.c`:
```
#include
void foo() { printf("The strong func"); }
```
I build these with the Makefile (supplied for completeness, excuse my verbosity):
```
a:
gcc -o a a.c b.c
```
As you can see, `foo` is defined twice - once as `weak`.

I then run the following CodeQL query to list all functions, and an attribute of each.
```
from Function f select f, f.getAnAttribute().toString()
```
Via the following commands:
```
./codeql database create a --language=c --overwrite --source-root /home/aliz/a/
./codeql database analyze --format=csv --output=results a foo --rerun
```
This results in the following unexpected output:
```
"foo","foo","error","weak","/a.c","2","28","2","30"
"foo","foo","error","weak","/b.c","2","6","2","8"
```
As you can see, the two functions have been identified, but have both been marked with the `weak` attribute. I expected only the first to be marked as `weak`.
I initially thought this was due to some subtle C behavior beyond my understanding, but if we look a little closer, it does indeed appear that CodeQL has 'mixed up' the two functions. I run the following query, intended to list the string literals for each function:
```
from
StringLiteral str,
Function f
where
str.getEnclosingFunction() = f
select f, str.getValue()
```
This results in the following:
```
"foo","foo","error","The weak func
The strong func","/a.c","2","28","2","30"
"foo","foo","error","The weak func
The strong func","/b.c","2","6","2","8"
```
Here, the two functions have been reported, but each is reported as referencing _both_ strings, which appears incorrect to me - I would have expected something akin to the following to be returned:
```
"foo","foo","error","The weak func","/a.c","2","28","2","30"
"foo","foo","error","The strong func","/b.c","2","6","2","8"
```

Can anyone shed some light on the issue here? Have I really stumbled into a codeql bug, or is this due to some wizard-level C behavior? Thanks for any help!

コントリビューションガイド

コントリビューションガイドを開く

調査の方向性

Reproduce the report using the supplied a.c, b.c, Makefile, and CodeQL queries. Start with the database create and analyze commands, then inspect how the weak attribute and enclosing string literals are associated with each Function. Done means determining whether the reported associations are incorrect and documenting or correcting the behavior.

索引モデルが issue の本文から書いたものです。

評価

技術スタック
c
領域
tooling
issue の種類
バグ
難易度
4/5
見積もり時間
3〜5日
活発さ
停滞
明瞭さ
おおむね明確
初心者へのやさしさ
35/100

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。