`EXP39-C`: False positives related to compatible types, harmless casts

Aperta
#1,200 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
48/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
cpp
Ambito
devtools

Direzione di ricerca

Start with the EXP39-C implementation and compare its compatibleTypes predicate with common/types/Compatible.qll, paying particular attention to typedefs and pointer compatibility. Review how casted expressions are modeled as sources and sinks, then use the provided typedef and unused-cast examples to verify that harmless casts are no longer reported.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Difficulty-Medium false positive/false negative false-positive Impact-Medium Standard-CERT-C
Affected rules
  • EXP39-C
Description

First off, our implementation uses a compatibleTypes predicate that is incomplete and doesn't handle typedefs, and should be replaced with our common/types/Compatible.qll library. This results in thousands of false positives in certain codebases, usually due to casting to a project-specific typedef of a byte like GLBYTE*.

Secondly, while we use dataflow to trace realloc's that flow to a deref without a memset, we don't use dataflow to handle the more typical case of A* cast to B* followed by a deref. Instead, we have a type representing casted expressions that's both a sink and a source. (We check compatibility of the pointers in the cast in the select statement). This isn't strictly UB unless the pointer is dereferenced, and I do see examples of this in real code. As a related example, casts to void** are often flagged while void* is excluded. This isn't a rare exceptional use of void, it's really just a harmless cast.

Example
typedef char BYTE;
void example_function() {
  int x;
  (long *) &x; // harmless since it's unused
  BYTE *x_bytes = (BYTE *)&x; // Allowed since BYTE is a char.
}
Lingua principale
CodeQL
Stelle
227
Fork
82
Merge medio
6g 7h
PR unite (30g)
9

Guida per i contributori

Apri la guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di github/codeql-coding-standards

Tutte le issue di github/codeql-coding-standards

Issue simili

Altre issue su DevTools

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.