FilesExpand file tree

 main

/

InconsistentNullnessTesting.ql

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

32 lines (30 loc) · 1.17 KB

 main

/

InconsistentNullnessTesting.ql

Copy path

Top

File metadata and controls

• Code
• Blame

32 lines (30 loc) · 1.17 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

/**

* @name Inconsistent null check of pointer

* @description A dereferenced pointer is not checked for nullness in this location, but it is checked in other locations. Dereferencing a null pointer leads to undefined results.

* @kind problem

* @id cpp/inconsistent-nullness-testing

* @problem.severity warning

* @security-severity 7.5

* @tags reliability

* security

* external/cwe/cwe-476

*/

import cpp

from StackVariable v, ControlFlowNode def, VariableAccess checked, VariableAccess unchecked

where

checked = v.getAnAccess() and

// The check can often be in a macro for handling exception

not checked.isInMacroExpansion() and

dereferenced(checked) and

unchecked = v.getAnAccess() and

dereferenced(unchecked) and

definitionUsePair(v, def, checked) and

definitionUsePair(v, def, unchecked) and

checkedValid(v, checked) and

not checkedValid(v, unchecked) and

not unchecked.getParent+() instanceof SizeofOperator and

forall(ControlFlowNode other | definitionUsePair(v, other, checked) |

definitionUsePair(v, other, unchecked)

)

select unchecked,

"This dereference is not guarded by a non-null check, whereas other dereferences are guarded."