github / github/codeql

False Positive: cpp/use-after-free on chained assignment after delete

未關閉
#21,187 1 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
false-positive
主要語言
CodeQL
星號
10.1k
分支
2.1k
平均合併
2 天 15 小時
30 天內合併 PR
141

描述

**Description of the false positive**

I have encountered a false positive with the rule cpp/use-after-free.
CodeQL incorrectly flags a variable as being "used after free" when it is assigned via a chained assignment immediately following a delete[].
The analyzer seems to propagate the "freed" state of the dereferenced pointer to the local variable, failing to recognize that the new operator in the right-hand side of the assignment refreshes the pointer before the local variable reads it.

**Code samples or links to source code**
```
#include

void reallocateBuffer(char** sharedPtr, int size) {
// 1. Memory is freed
delete[] *sharedPtr;

char* localPtr;

// 2. Chained assignment:
// C++ guarantees right-to-left associativity.
// 'new' happens first, updates '*sharedPtr', and THEN 'localPtr' takes that value.
localPtr = *sharedPtr = new char[size];

// 3. CodeQL flags 'localPtr' as Use-After-Free here
if (localPtr) {
localPtr[0] = 'A';
}
}

int main() {
char* data = new char[10];
reallocateBuffer(&data, 50);
delete[] data;
return 0;
}
```

**Expected Behavior**

CodeQL should recognize that localPtr is assigned the result of the new allocation (via *sharedPtr) and is therefore safe to use.

**Actual Behavior**

CodeQL reports cpp/use-after-free on the line localPtr[0] = 'A';, claiming localPtr points to memory that was freed by delete[] *sharedPtr.

**Query / Rule ID**
cpp/use-after-free

貢獻指南

開啟貢獻指南

研究方向

Start with the cpp/use-after-free query named in the issue and use the supplied C++ reproducer to trace the report on the chained assignment. Done means the analyzer no longer reports localPtr[0] as a use-after-free while continuing to detect genuine cases.

由索引模型根據 Issue 內容生成。

評估

技術堆疊
cpp
領域
security
Issue 類型
缺陷
難度
4/5
預估耗時
3-5 天
活躍度
停滯
描述清晰度
基本清楚
新手友好度
48/100

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。