diff --git a/cpp/ql/src/Likely Bugs/Memory Management/ReturnStackAllocatedMemory.ql b/cpp/ql/src/Likely Bugs/Memory Management/ReturnStackAllocatedMemory.ql index 02678beaf124..b87889103322 100644 --- a/cpp/ql/src/Likely Bugs/Memory Management/ReturnStackAllocatedMemory.ql +++ b/cpp/ql/src/Likely Bugs/Memory Management/ReturnStackAllocatedMemory.ql @@ -92,6 +92,8 @@ class ReturnStackAllocatedMemoryConfig extends MustFlowConfiguration { or node2.(PointerOffsetInstruction).getLeftOperand() = node1 } + + override predicate isBarrier(Instruction n) { n.getResultType() instanceof ErroneousType } } from diff --git a/cpp/ql/src/change-notes/2024-12-18-return-stack-allocated-memory.md b/cpp/ql/src/change-notes/2024-12-18-return-stack-allocated-memory.md new file mode 100644 index 000000000000..76f5b9d7eaed --- /dev/null +++ b/cpp/ql/src/change-notes/2024-12-18-return-stack-allocated-memory.md @@ -0,0 +1,4 @@ +--- +category: minorAnalysis +--- +* The "Returning stack-allocated memory" query (`cpp/return-stack-allocated-memory`) no longer produces results if there is an extraction error in the returned expression. diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/test.cpp index 44afcd7ee5f8..abc21aa74d81 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/test.cpp +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/test.cpp @@ -248,4 +248,5 @@ char* test_strdupa(const char* s) { void* test_strndupa(const char* s, size_t size) { char* s2 = strndupa(s, size); return s2; // BAD -} \ No newline at end of file +} + diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/test_errors.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/test_errors.cpp new file mode 100644 index 000000000000..4306d85157b8 --- /dev/null +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/test_errors.cpp @@ -0,0 +1,16 @@ +// semmle-extractor-options: --expect_errors + +UNKNOWN_TYPE test_error_value() { + UNKNOWN_TYPE x; + return x; // GOOD: Error return type +} + +void* test_error_pointer() { + UNKNOWN_TYPE x; + return &x; // BAD [FALSE NEGATIVE] +} + +int* test_error_pointer_member() { + UNKNOWN_TYPE x; + return &x.y; // BAD [FALSE NEGATIVE] +}