`EXP39-C`: False positives related to compatible types, harmless casts

Open
#1,200 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
cpp
Domain
devtools

Research direction

Start with the EXP39-C implementation and compare its compatibleTypes predicate with common/types/Compatible.qll, paying particular attention to typedefs and pointer compatibility. Review how casted expressions are modeled as sources and sinks, then use the provided typedef and unused-cast examples to verify that harmless casts are no longer reported.

Written by the indexing model from the issue text.

Description

Difficulty-Medium false positive/false negative false-positive Impact-Medium Standard-CERT-C
Affected rules
  • EXP39-C
Description

First off, our implementation uses a compatibleTypes predicate that is incomplete and doesn't handle typedefs, and should be replaced with our common/types/Compatible.qll library. This results in thousands of false positives in certain codebases, usually due to casting to a project-specific typedef of a byte like GLBYTE*.

Secondly, while we use dataflow to trace realloc's that flow to a deref without a memset, we don't use dataflow to handle the more typical case of A* cast to B* followed by a deref. Instead, we have a type representing casted expressions that's both a sink and a source. (We check compatibility of the pointers in the cast in the select statement). This isn't strictly UB unless the pointer is dereferenced, and I do see examples of this in real code. As a related example, casts to void** are often flagged while void* is excluded. This isn't a rare exceptional use of void, it's really just a harmless cast.

Example
typedef char BYTE;
void example_function() {
  int x;
  (long *) &x; // harmless since it's unused
  BYTE *x_bytes = (BYTE *)&x; // Allowed since BYTE is a char.
}
Dominant language
CodeQL
Stars
227
Forks
82
Avg merge
6d 7h
Merged PRs (30d)
9

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/codeql-coding-standards

All issues in github/codeql-coding-standards

Similar issues

More DevTools issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.