Skip to content

Commit b944f3b

Browse files
committed
C++: Fix FP.
1 parent e373341 commit b944f3b

File tree

2 files changed

+16
-2
lines changed

2 files changed

+16
-2
lines changed

cpp/ql/src/experimental/Security/CWE/CWE-416/IteratorToExpiredContainer.ql

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,20 @@ module DestroyedToBeginConfig implements DataFlow::ConfigSig {
8080
predicate isSource(DataFlow::Node source) { source = getADestroyedNode() }
8181

8282
predicate isSink(DataFlow::Node sink) { isSinkImpl(sink, _) }
83+
84+
DataFlow::FlowFeature getAFeature() {
85+
// By blocking argument-to-parameter flow we ensure that we don't enter a
86+
// function body where the temporary outlives anything inside the function.
87+
// This prevents false positives in cases like:
88+
// ```cpp
89+
// void foo(const std::vector<int>& v) {
90+
// for(auto x : v) { ... } // this is fine since v outlives the loop
91+
// }
92+
// ...
93+
// foo(create_temporary())
94+
// ```
95+
result instanceof DataFlow::FeatureHasSinkCallContext
96+
}
8397
}
8498

8599
module DestroyedToBeginFlow = DataFlow::Global<DestroyedToBeginConfig>;

cpp/ql/test/experimental/query-tests/Security/CWE/CWE-416/test.cpp

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -744,8 +744,8 @@ std::vector<int> first_in_returnValue_2() {
744744
}
745745

746746
void test2() {
747-
iterate(returnValue()); // GOOD [FALSE POSITIVE] (see *)
748-
iterate(returnValue()[0]); // GOOD [FALSE POSITIVE] (see *)
747+
iterate(returnValue()); // GOOD
748+
iterate(returnValue()[0]); // GOOD
749749

750750
for (auto x : ref_to_first_in_returnValue_1()) {}
751751

0 commit comments

Comments
 (0)