FilesExpand file tree

 main

/

ReturnStackAllocatedObject.ql

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

34 lines (30 loc) · 1.19 KB

 main

/

ReturnStackAllocatedObject.ql

Copy path

Top

File metadata and controls

• Code
• Blame

34 lines (30 loc) · 1.19 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

/**

* @name Pointer to stack object used as return value

* @description Using a pointer to stack memory after the function has returned gives undefined results.

* @kind problem

* @id cpp/return-stack-allocated-object

* @problem.severity warning

* @security-severity 2.1

* @tags reliability

* security

* external/cwe/cwe-562

* @deprecated This query is not suitable for production use and has been deprecated. Use

* cpp/return-stack-allocated-memory instead.

*/

import semmle.code.cpp.pointsto.PointsTo

class ReturnPointsToExpr extends PointsToExpr {

override predicate interesting() {

exists(ReturnStmt ret | ret.getExpr().getFullyConverted() = this) and

pointerValue(this)

}

ReturnStmt getReturnStmt() { result.getExpr().getFullyConverted() = this }

}

from ReturnPointsToExpr ret, StackVariable local, float confidence

where

ret.pointsTo() = local and

ret.getReturnStmt().getEnclosingFunction() = local.getFunction() and

confidence = ret.confidence() and

confidence > 0.01

select ret,

"This may return a pointer to '" + local.getName() + "' (declared on line " +

local.getADeclarationLocation().getStartLine().toString() + "), which is stack allocated."