False Positive: cpp/use-after-free on chained assignment after delete
- 主要语言
- CodeQL
- 星标
- 10.1k
- 派生
- 2.1k
- 平均合并
- 2 天 15 小时
- 30 天内合并 PR
- 141
描述
**Description of the false positive**
I have encountered a false positive with the rule cpp/use-after-free.
CodeQL incorrectly flags a variable as being "used after free" when it is assigned via a chained assignment immediately following a delete[].
The analyzer seems to propagate the "freed" state of the dereferenced pointer to the local variable, failing to recognize that the new operator in the right-hand side of the assignment refreshes the pointer before the local variable reads it.
**Code samples or links to source code**
```
#include
void reallocateBuffer(char** sharedPtr, int size) {
// 1. Memory is freed
delete[] *sharedPtr;
char* localPtr;
// 2. Chained assignment:
// C++ guarantees right-to-left associativity.
// 'new' happens first, updates '*sharedPtr', and THEN 'localPtr' takes that value.
localPtr = *sharedPtr = new char[size];
// 3. CodeQL flags 'localPtr' as Use-After-Free here
if (localPtr) {
localPtr[0] = 'A';
}
}
int main() {
char* data = new char[10];
reallocateBuffer(&data, 50);
delete[] data;
return 0;
}
```
**Expected Behavior**
CodeQL should recognize that localPtr is assigned the result of the new allocation (via *sharedPtr) and is therefore safe to use.
**Actual Behavior**
CodeQL reports cpp/use-after-free on the line localPtr[0] = 'A';, claiming localPtr points to memory that was freed by delete[] *sharedPtr.
**Query / Rule ID**
cpp/use-after-free
贡献指南
调研方向
从 issue 中提到的 cpp/use-after-free 查询开始,并使用提供的 C++ 复现程序跟踪链式赋值上的报告。完成标准是分析器不再将 localPtr[0] 报告为 use-after-free,同时继续检测真正的案例。
由索引模型根据 Issue 内容生成。
评估
- 技术栈
- cpp
- 领域
- security
- Issue 类型
- 缺陷
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 活跃度
- 停滞
- 描述清晰度
- 基本清楚
- 新手友好度
- 48/100