iframe-proxy | Sunbelt Computer Software

107 lines (94 loc) · 2.64 KB

 * @name Global variable may be used before initialization
 * @description Using an uninitialized variable may lead to undefined results.
 * @kind problem
 * @id cpp/global-use-before-init
 * @problem.severity warning
 * @security-severity 7.8
 * @tags reliability
 *       security
 *       external/cwe/cwe-457
import semmle.code.cpp.pointsto.CallGraph
predicate initFunc(GlobalVariable v, Function f) {
  exists(VariableAccess access |
    v.getAnAccess() = access and
    access.isUsedAsLValue() and
    access.getEnclosingFunction() = f
predicate useFunc(GlobalVariable v, Function f) {
  exists(VariableAccess access |
    v.getAnAccess() = access and
    access.isRValue() and
    access.getEnclosingFunction() = f
  not initFunc(v, f)
predicate uninitialisedBefore(GlobalVariable v, Function f) {
  f.hasGlobalName("main")
  exists(Call call, Function g |
    uninitialisedBefore(v, g) and
    call.getEnclosingFunction() = g and
    (not functionInitialises(f, v) or locallyUninitialisedAt(v, call)) and
    resolvedCall(call, f)
predicate functionInitialises(Function f, GlobalVariable v) {
  exists(Call call |
    call.getEnclosingFunction() = f and
    initialisedBy(v, call)
// this predicate is restricted to global variables used in the
// same function as "call"
predicate locallyUninitialisedAt(GlobalVariable v, Call call) {
  functionInitialises(call.getEnclosingFunction(), v) and
    firstCall(call)
    exists(Call mid |
      locallyUninitialisedAt(v, mid) and not initialisedBy(v, mid) and callPair(mid, call)
predicate initialisedBy(GlobalVariable v, Call call) {
  exists(Function f |
    resolvedCall(call, f) and
    initialises(v, f)
predicate initialises(GlobalVariable v, Function f) {
  initFunc(v, f)
  exists(Function mid | initialises(v, mid) and allCalls(f, mid))
predicate firstCall(Call call) { beforeCall(call) }
predicate beforeCall(ControlFlowNode node) {
  exists(Function f | f.getBlock() = node)
  exists(ControlFlowNode mid |
    beforeCall(mid) and
    not mid instanceof Call and
    node = mid.getASuccessor()
predicate callPair(Call call, Call successor) { callReaches(call, successor) }
predicate callReaches(Call call, ControlFlowNode successor) {
  call.getASuccessor() = successor
  exists(ControlFlowNode mid |
    callReaches(call, mid) and
    not mid instanceof Call and
    mid.getASuccessor() = successor
from GlobalVariable v, Function f
  uninitialisedBefore(v, f) and
  useFunc(v, f)
  "The variable '" + v.getName() +
    " is used in this function but may not be initialized when it is called."

Sunbelt Computer Software

PL/B Language Development and Support

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Sunbelt Computer Software

PL/B Language Development and Support

Uh oh!

FilesExpand file tree

GlobalUseBeforeInit.ql

Latest commit

History

GlobalUseBeforeInit.ql

File metadata and controls