Skip to content

Commit 5af66d1

Browse files
mbaludambaluda
authored
Merge pull request #289 from mbaluda-org/qcc-expected
Fix issues with c/qcc compatibility
2 parents 39f8f98 + 248683a commit 5af66d1

File tree

41 files changed

+620
-85
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

41 files changed

+620
-85
lines changed

‎.github/workflows/dispatch-matrix-test-on-comment.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ jobs:
3535
token: ${{ secrets.RELEASE_ENGINEERING_TOKEN }}
3636
repository: github/codeql-coding-standards-release-engineering
3737
event-type: matrix-test
38-
client-payload: '{"pr": "${{ github.event.number }}"}'
38+
client-payload: '{"pr": "${{ github.event.issue.number }}"}'
3939

4040
- uses: actions/github-script@v6
4141
if: ${{ github.event.issue.pull_request && contains(github.event.comment.body, '/test-matrix') }}

‎README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,3 +50,5 @@ All header files in [c/common/test/includes/standard-library](./c/common/test/in
5050
---
5151

5252
<sup>1</sup>This repository incorporates portions of the SEI CERT® Coding Standards available at https://wiki.sei.cmu.edu/confluence/display/seccode/SEI+CERT+Coding+Standards; however, such use does not necessarily constitute or imply an endorsement, recommendation, or favoring by Carnegie Mellon University or its Software Engineering Institute.
53+
54+

‎c/cert/src/rules/ENV32-C/ExitHandlersMustReturnNormally.ql

Lines changed: 27 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -14,14 +14,26 @@
1414
import cpp
1515
import codingstandards.c.cert
1616

17-
class ExitFunction extends Function {
18-
ExitFunction() { this.hasGlobalName(["_Exit", "exit", "quick_exit", "longjmp"]) }
17+
/**
18+
* Exit function or macro.
19+
*/
20+
class Exit extends Locatable {
21+
Exit() {
22+
["_Exit", "exit", "quick_exit", "longjmp"] = [this.(Function).getName(), this.(Macro).getName()]
23+
}
1924
}
2025

21-
class ExitFunctionCall extends FunctionCall {
22-
ExitFunctionCall() { this.getTarget() instanceof ExitFunction }
26+
class ExitExpr extends Expr {
27+
ExitExpr() {
28+
this.(FunctionCall).getTarget() instanceof Exit
29+
or
30+
any(MacroInvocation m | this = m.getExpr()).getMacro() instanceof Exit
31+
}
2332
}
2433

34+
/**
35+
* Functions that are registered as exit handlers.
36+
*/
2537
class RegisteredAtexit extends FunctionAccess {
2638
RegisteredAtexit() {
2739
exists(FunctionCall ae |
@@ -32,24 +44,26 @@ class RegisteredAtexit extends FunctionAccess {
3244
}
3345

3446
/**
35-
* Nodes of type Function, FunctionCall or FunctionAccess that \
36-
* are reachable from a redistered atexit handler and
47+
* Nodes of type Function, FunctionCall, FunctionAccess or ExitExpr
48+
* that are reachable from a registered atexit handler and
3749
* can reach an exit function.
3850
*/
3951
class InterestingNode extends ControlFlowNode {
4052
InterestingNode() {
4153
exists(Function f |
4254
(
4355
this = f and
44-
// exit functions are not part of edges
45-
not this = any(ExitFunction ec)
56+
// exit is not part of edges
57+
not this instanceof Exit
4658
or
4759
this.(FunctionCall).getTarget() = f
4860
or
4961
this.(FunctionAccess).getTarget() = f
62+
or
63+
this.(ExitExpr).getEnclosingFunction() = f
5064
) and
51-
// reaches an exit function
52-
f.calls*(any(ExitFunction e)) and
65+
// reaches an `ExitExpr`
66+
f.calls*(any(ExitExpr ee).getEnclosingFunction()) and
5367
// is reachable from a registered atexit function
5468
exists(RegisteredAtexit re | re.getTarget().calls*(f))
5569
)
@@ -62,14 +76,12 @@ class InterestingNode extends ControlFlowNode {
6276
* `Function` and `FunctionCall` in their body.
6377
*/
6478
query predicate edges(InterestingNode a, InterestingNode b) {
65-
a.(FunctionAccess).getTarget() = b
66-
or
67-
a.(FunctionCall).getTarget() = b
68-
or
79+
a.(FunctionAccess).getTarget() = b or
80+
a.(FunctionCall).getTarget() = b or
6981
a.(Function).calls(_, b)
7082
}
7183

72-
from RegisteredAtexit hr, Function f, ExitFunctionCall e
84+
from RegisteredAtexit hr, Function f, ExitExpr e
7385
where edges(hr, f) and edges+(f, e)
7486
select f, hr, e, "The function is $@ and $@. It must instead terminate by returning.", hr,
7587
"registered as `exit handler`", e, "calls an `exit function`"

‎c/cert/src/rules/ERR33-C/DetectAndHandleStandardLibraryErrors.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -441,7 +441,7 @@ ControlFlowNode ferrorNotchecked(FileWriteFunctionCall write) {
441441
not isShortCircuitedEdge(mid, result) and
442442
result = mid.getASuccessor() and
443443
//Stop recursion on call to ferror on the correct file
444-
not accessSameTarget(result.(FerrorCall).getArgument(0), write.getFileExpr())
444+
not sameFileSource(result.(FerrorCall), write)
445445
)
446446
}
447447

‎c/cert/src/rules/EXP43-C/DoNotPassAliasedPointerToRestrictQualifiedParam.ql

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,9 +25,26 @@ class FunctionWithRestrictParameters extends Function {
2525
Parameter restrictPtrParam;
2626

2727
FunctionWithRestrictParameters() {
28-
restrictPtrParam = this.getAParameter() and
2928
restrictPtrParam.getUnspecifiedType() instanceof PointerOrArrayType and
30-
restrictPtrParam.getType().hasSpecifier("restrict")
29+
(
30+
restrictPtrParam.getType().hasSpecifier(["restrict"]) and
31+
restrictPtrParam = this.getAParameter()
32+
or
33+
this.hasGlobalName(["strcpy", "strncpy", "strcat", "strncat", "memcpy"]) and
34+
restrictPtrParam = this.getParameter([0, 1])
35+
or
36+
this.hasGlobalName(["strcpy_s", "strncpy_s", "strcat_s", "strncat_s", "memcpy_s"]) and
37+
restrictPtrParam = this.getParameter([0, 2])
38+
or
39+
this.hasGlobalName(["strtok_s"]) and
40+
restrictPtrParam = this.getAParameter()
41+
or
42+
this.hasGlobalName(["printf", "printf_s", "scanf", "scanf_s"]) and
43+
restrictPtrParam = this.getParameter(0)
44+
or
45+
this.hasGlobalName(["sprintf", "sprintf_s", "snprintf", "snprintf_s"]) and
46+
restrictPtrParam = this.getParameter(3)
47+
)
3148
}
3249

3350
Parameter getARestrictPtrParam() { result = restrictPtrParam }

‎c/cert/src/rules/STR32-C/NonNullTerminatedToFunctionThatExpectsAString.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -271,7 +271,7 @@ CWE-123 – STR31-C =
271271

272272
## Implementation notes
273273

274-
None
274+
Wide character types are not handled correctly on the `aarch64le` architecture. This can lead to false negative alerts.
275275

276276
## References
277277

‎c/cert/src/rules/STR38-C/DoNotConfuseNarrowAndWideFunctions.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,7 @@ Search for vulnerabilities resulting from the violation of this rule on the [CER
131131
132132
## Implementation notes
133133
134-
None
134+
Wide character types are not handled correctly on the `aarch64le` architecture. This can lead to false negative alerts.
135135
136136
## References
137137

‎c/cert/src/rules/STR38-C/DoNotConfuseNarrowAndWideFunctions.ql

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,5 @@ where
6363
c instanceof WideToNarrowCast and actual = "wide" and expected = "narrow"
6464
)
6565
select call,
66-
"Call to function $@ with a " + actual + " character string $@ where a " + expected +
67-
" character string $@ is expected.", call.getTarget(), call.getTarget().getName(), arg,
68-
"argument", p, "parameter"
66+
"Call to function `" + call.getTarget().getName() + "` with a " + actual +
67+
" character string $@ where a " + expected + " character string is expected.", arg, "argument"

‎c/cert/test/rules/ARR39-C/DoNotAddOrSubtractAScaledIntegerToAPointer.expected.qcc

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
edges
2+
| test.c:7:13:7:14 | p1 | test.c:9:9:9:10 | p1 |
3+
| test.c:16:19:16:41 | __builtin_offsetof | test.c:18:26:18:31 | offset |
4+
| test.c:16:19:16:41 | __builtin_offsetof | test.c:29:6:29:11 | offset |
5+
| test.c:17:17:17:26 | sizeof(<expr>) | test.c:23:9:23:12 | size |
6+
| test.c:29:6:29:11 | offset | test.c:7:13:7:14 | p1 |
7+
nodes
8+
| test.c:7:13:7:14 | p1 | semmle.label | p1 |
9+
| test.c:9:9:9:10 | p1 | semmle.label | p1 |
10+
| test.c:16:19:16:41 | __builtin_offsetof | semmle.label | __builtin_offsetof |
11+
| test.c:17:17:17:26 | sizeof(<expr>) | semmle.label | sizeof(<expr>) |
12+
| test.c:18:26:18:31 | offset | semmle.label | offset |
13+
| test.c:23:9:23:12 | size | semmle.label | size |
14+
| test.c:25:9:25:18 | sizeof(<expr>) | semmle.label | sizeof(<expr>) |
15+
| test.c:27:17:27:26 | sizeof(<expr>) | semmle.label | sizeof(<expr>) |
16+
| test.c:29:6:29:11 | offset | semmle.label | offset |
17+
subpaths
18+
#select
19+
| test.c:9:9:9:10 | p1 | test.c:16:19:16:41 | __builtin_offsetof | test.c:9:9:9:10 | p1 | Scaled integer used in pointer arithmetic. |
20+
| test.c:18:26:18:31 | offset | test.c:16:19:16:41 | __builtin_offsetof | test.c:18:26:18:31 | offset | Scaled integer used in pointer arithmetic. |
21+
| test.c:23:9:23:12 | size | test.c:17:17:17:26 | sizeof(<expr>) | test.c:23:9:23:12 | size | Scaled integer used in pointer arithmetic. |
22+
| test.c:25:9:25:18 | sizeof(<expr>) | test.c:25:9:25:18 | sizeof(<expr>) | test.c:25:9:25:18 | sizeof(<expr>) | Scaled integer used in pointer arithmetic. |
23+
| test.c:27:17:27:26 | sizeof(<expr>) | test.c:27:17:27:26 | sizeof(<expr>) | test.c:27:17:27:26 | sizeof(<expr>) | Scaled integer used in pointer arithmetic. |

‎c/cert/test/rules/CON40-C/AtomicVariableTwiceInExpression.expected.qcc

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
| test.c:7:18:7:39 | ATOMIC_VAR_INIT(VALUE) | Atomic variable possibly referred to twice in an $@. | test.c:33:3:33:10 | ... += ... | expression |
2+
| test.c:7:18:7:39 | ATOMIC_VAR_INIT(VALUE) | Atomic variable possibly referred to twice in an $@. | test.c:34:3:34:13 | ... = ... | expression |
3+
| test.c:11:3:11:23 | atomic_store(PTR,VAL) | Atomic variable possibly referred to twice in an $@. | test.c:11:3:11:23 | atomic_store(PTR,VAL) | expression |
4+
| test.c:12:3:12:35 | atomic_store_explicit(PTR,VAL,MO) | Atomic variable possibly referred to twice in an $@. | test.c:12:3:12:35 | atomic_store_explicit(PTR,VAL,MO) | expression |
5+
| test.c:25:3:25:49 | atomic_compare_exchange_weak(PTR,VAL,DES) | Atomic variable possibly referred to twice in an $@. | test.c:25:3:25:49 | atomic_compare_exchange_weak(PTR,VAL,DES) | expression |
6+
| test.c:26:3:27:42 | atomic_compare_exchange_weak_explicit(PTR,VAL,DES,SUC,FAIL) | Atomic variable possibly referred to twice in an $@. | test.c:26:3:27:42 | atomic_compare_exchange_weak_explicit(PTR,VAL,DES,SUC,FAIL) | expression |

‎c/cert/test/rules/CON41-C/WrapFunctionsThatCanFailSpuriouslyInLoop.expected.qcc

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
| test.c:6:8:6:46 | atomic_compare_exchange_weak(PTR,VAL,DES) | Function that can spuriously fail not wrapped in a loop. |
2+
| test.c:10:3:10:41 | atomic_compare_exchange_weak(PTR,VAL,DES) | Function that can spuriously fail not wrapped in a loop. |
3+
| test.c:12:8:13:47 | atomic_compare_exchange_weak_explicit(PTR,VAL,DES,SUC,FAIL) | Function that can spuriously fail not wrapped in a loop. |
4+
| test.c:17:3:17:56 | atomic_compare_exchange_weak_explicit(PTR,VAL,DES,SUC,FAIL) | Function that can spuriously fail not wrapped in a loop. |

‎c/cert/test/rules/ENV32-C/ExitHandlersMustReturnNormally.expected.qcc

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
edges
2+
| test.c:8:6:8:13 | exit1bad | test.c:11:5:11:8 | call to exit |
3+
| test.c:20:14:20:21 | exit1bad | test.c:8:6:8:13 | exit1bad |
4+
| test.c:41:6:41:10 | exit2 | test.c:42:3:42:17 | call to siglongjmp |
5+
| test.c:46:21:46:25 | exit2 | test.c:41:6:41:10 | exit2 |
6+
| test.c:62:6:62:17 | exit3_helper | test.c:62:27:62:41 | call to siglongjmp |
7+
| test.c:64:6:64:10 | exit3 | test.c:65:3:65:14 | call to exit3_helper |
8+
| test.c:65:3:65:14 | call to exit3_helper | test.c:62:6:62:17 | exit3_helper |
9+
| test.c:69:14:69:18 | exit3 | test.c:64:6:64:10 | exit3 |
10+
#select
11+
| test.c:8:6:8:13 | exit1bad | test.c:20:14:20:21 | exit1bad | test.c:11:5:11:8 | call to exit | The function is $@ and $@. It must instead terminate by returning. | test.c:20:14:20:21 | exit1bad | registered as `exit handler` | test.c:11:5:11:8 | call to exit | calls an `exit function` |
12+
| test.c:41:6:41:10 | exit2 | test.c:46:21:46:25 | exit2 | test.c:42:3:42:17 | call to siglongjmp | The function is $@ and $@. It must instead terminate by returning. | test.c:46:21:46:25 | exit2 | registered as `exit handler` | test.c:42:3:42:17 | call to siglongjmp | calls an `exit function` |
13+
| test.c:64:6:64:10 | exit3 | test.c:69:14:69:18 | exit3 | test.c:62:27:62:41 | call to siglongjmp | The function is $@ and $@. It must instead terminate by returning. | test.c:69:14:69:18 | exit3 | registered as `exit handler` | test.c:62:27:62:41 | call to siglongjmp | calls an `exit function` |

‎c/cert/test/rules/ERR30-C/ErrnoReadBeforeReturn.expected.qcc

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
| test.c:69:7:69:11 | * ... | Do not read `errno` before checking the return value of function $@. | test.c:68:3:68:7 | call to ftell | call to ftell |
2+
| test.c:69:7:69:11 | call to __get_errno_ptr | Do not read `errno` before checking the return value of function $@. | test.c:68:3:68:7 | call to ftell | call to ftell |
3+
| test.c:70:5:70:10 | call to perror | Do not read `errno` before checking the return value of function $@. | test.c:68:3:68:7 | call to ftell | call to ftell |

‎c/cert/test/rules/EXP39-C/DoNotAccessVariableViaPointerOfIncompatibleType.expected.qcc

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
edges
2+
| test.c:49:8:49:9 | s3 | test.c:50:8:50:9 | s1 |
3+
| test.c:60:16:60:18 | E1A | test.c:61:16:61:17 | e1 |
4+
| test.c:60:16:60:18 | E1A | test.c:65:10:65:12 | & ... |
5+
| test.c:68:22:68:22 | v | test.c:68:41:68:41 | v |
6+
| test.c:72:13:72:15 | & ... | test.c:68:22:68:22 | v |
7+
| test.c:74:13:74:15 | & ... | test.c:68:22:68:22 | v |
8+
| test.c:97:32:97:37 | call to malloc | test.c:98:40:98:41 | s2 |
9+
| test.c:97:32:97:37 | call to malloc | test.c:98:40:98:41 | s2 |
10+
| test.c:98:32:98:38 | call to realloc | test.c:99:3:99:4 | s3 |
11+
| test.c:98:32:98:38 | call to realloc | test.c:100:10:100:11 | s3 |
12+
| test.c:98:40:98:41 | s2 | test.c:98:32:98:38 | call to realloc |
13+
nodes
14+
| file:///opt/qcc/qnx-sdp/target/qnx7/usr/include/stdlib.h:98:42:98:47 | __func | semmle.label | __func |
15+
| file:///opt/qcc/qnx-sdp/target/qnx7/usr/include/stdlib.h:98:50:98:53 | 0 | semmle.label | 0 |
16+
| test.c:6:19:6:20 | & ... | semmle.label | & ... |
17+
| test.c:11:10:11:11 | & ... | semmle.label | & ... |
18+
| test.c:13:17:13:19 | & ... | semmle.label | & ... |
19+
| test.c:15:17:15:19 | & ... | semmle.label | & ... |
20+
| test.c:19:18:19:20 | & ... | semmle.label | & ... |
21+
| test.c:20:20:20:22 | & ... | semmle.label | & ... |
22+
| test.c:22:11:22:13 | & ... | semmle.label | & ... |
23+
| test.c:27:17:27:19 | & ... | semmle.label | & ... |
24+
| test.c:28:10:28:12 | & ... | semmle.label | & ... |
25+
| test.c:29:13:29:15 | & ... | semmle.label | & ... |
26+
| test.c:30:19:30:21 | & ... | semmle.label | & ... |
27+
| test.c:31:16:31:18 | & ... | semmle.label | & ... |
28+
| test.c:47:8:47:9 | s2 | semmle.label | s2 |
29+
| test.c:49:8:49:9 | s3 | semmle.label | s3 |
30+
| test.c:49:8:49:9 | s3 | semmle.label | s3 |
31+
| test.c:50:8:50:9 | s1 | semmle.label | s1 |
32+
| test.c:60:16:60:18 | E1A | semmle.label | E1A |
33+
| test.c:60:16:60:18 | E1A | semmle.label | E1A |
34+
| test.c:61:16:61:17 | e1 | semmle.label | e1 |
35+
| test.c:65:10:65:12 | & ... | semmle.label | & ... |
36+
| test.c:68:22:68:22 | v | semmle.label | v |
37+
| test.c:68:41:68:41 | v | semmle.label | v |
38+
| test.c:72:13:72:15 | & ... | semmle.label | & ... |
39+
| test.c:72:13:72:15 | & ... | semmle.label | & ... |
40+
| test.c:74:13:74:15 | & ... | semmle.label | & ... |
41+
| test.c:74:13:74:15 | & ... | semmle.label | & ... |
42+
| test.c:97:32:97:37 | call to malloc | semmle.label | call to malloc |
43+
| test.c:97:32:97:37 | call to malloc | semmle.label | call to malloc |
44+
| test.c:98:32:98:38 | call to realloc | semmle.label | call to realloc |
45+
| test.c:98:32:98:38 | call to realloc | semmle.label | call to realloc |
46+
| test.c:98:32:98:38 | call to realloc | semmle.label | call to realloc |
47+
| test.c:98:40:98:41 | s2 | semmle.label | s2 |
48+
| test.c:98:40:98:41 | s2 | semmle.label | s2 |
49+
| test.c:99:3:99:4 | s3 | semmle.label | s3 |
50+
| test.c:100:10:100:11 | s3 | semmle.label | s3 |
51+
subpaths
52+
#select
53+
| test.c:6:19:6:20 | & ... | test.c:6:19:6:20 | & ... | test.c:6:19:6:20 | & ... | Cast from float to int results in an incompatible pointer base type. |
54+
| test.c:11:10:11:11 | & ... | test.c:11:10:11:11 | & ... | test.c:11:10:11:11 | & ... | Cast from short[2] to int results in an incompatible pointer base type. |
55+
| test.c:13:17:13:19 | & ... | test.c:13:17:13:19 | & ... | test.c:13:17:13:19 | & ... | Cast from short[2] to short[4] results in an incompatible pointer base type. |
56+
| test.c:19:18:19:20 | & ... | test.c:19:18:19:20 | & ... | test.c:19:18:19:20 | & ... | Cast from char to signed char results in an incompatible pointer base type. |
57+
| test.c:30:19:30:21 | & ... | test.c:30:19:30:21 | & ... | test.c:30:19:30:21 | & ... | Cast from int to unsigned int results in an incompatible pointer base type. |
58+
| test.c:47:8:47:9 | s2 | test.c:47:8:47:9 | s2 | test.c:47:8:47:9 | s2 | Cast from struct <unnamed> to struct <unnamed> results in an incompatible pointer base type. |
59+
| test.c:49:8:49:9 | s3 | test.c:49:8:49:9 | s3 | test.c:49:8:49:9 | s3 | Cast from S1 to struct <unnamed> results in an incompatible pointer base type. |
60+
| test.c:50:8:50:9 | s1 | test.c:50:8:50:9 | s1 | test.c:50:8:50:9 | s1 | Cast from struct <unnamed> to S1 results in an incompatible pointer base type. |
61+
| test.c:68:41:68:41 | v | test.c:72:13:72:15 | & ... | test.c:68:41:68:41 | v | Cast from float to int results in an incompatible pointer base type. |
62+
| test.c:99:3:99:4 | s3 | test.c:98:40:98:41 | s2 | test.c:99:3:99:4 | s3 | Cast from S2 to S3 results in an incompatible pointer base type. |

‎c/cert/test/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.expected.qcc

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
edges
2+
| test.c:20:15:20:23 | array to pointer conversion | test.c:21:8:21:16 | (const char *)... |
3+
| test.c:20:15:20:23 | array to pointer conversion | test.c:21:8:21:16 | file_name |
4+
| test.c:20:15:20:23 | array to pointer conversion | test.c:21:8:21:16 | file_name indirection |
5+
| test.c:20:15:20:23 | file_name | test.c:21:8:21:16 | (const char *)... |
6+
| test.c:20:15:20:23 | file_name | test.c:21:8:21:16 | file_name |
7+
| test.c:20:15:20:23 | file_name | test.c:21:8:21:16 | file_name indirection |
8+
| test.c:20:15:20:23 | scanf output argument | test.c:21:8:21:16 | (const char *)... |
9+
| test.c:20:15:20:23 | scanf output argument | test.c:21:8:21:16 | file_name |
10+
| test.c:20:15:20:23 | scanf output argument | test.c:21:8:21:16 | file_name indirection |
11+
| test.c:45:15:45:23 | array to pointer conversion | test.c:46:29:46:37 | (LPCTSTR)... |
12+
| test.c:45:15:45:23 | array to pointer conversion | test.c:46:29:46:37 | file_name |
13+
| test.c:45:15:45:23 | array to pointer conversion | test.c:46:29:46:37 | file_name indirection |
14+
| test.c:45:15:45:23 | file_name | test.c:46:29:46:37 | (LPCTSTR)... |
15+
| test.c:45:15:45:23 | file_name | test.c:46:29:46:37 | file_name |
16+
| test.c:45:15:45:23 | file_name | test.c:46:29:46:37 | file_name indirection |
17+
| test.c:45:15:45:23 | scanf output argument | test.c:46:29:46:37 | (LPCTSTR)... |
18+
| test.c:45:15:45:23 | scanf output argument | test.c:46:29:46:37 | file_name |
19+
| test.c:45:15:45:23 | scanf output argument | test.c:46:29:46:37 | file_name indirection |
20+
subpaths
21+
nodes
22+
| test.c:20:15:20:23 | array to pointer conversion | semmle.label | array to pointer conversion |
23+
| test.c:20:15:20:23 | file_name | semmle.label | file_name |
24+
| test.c:20:15:20:23 | scanf output argument | semmle.label | scanf output argument |
25+
| test.c:21:8:21:16 | (const char *)... | semmle.label | (const char *)... |
26+
| test.c:21:8:21:16 | (const char *)... | semmle.label | (const char *)... |
27+
| test.c:21:8:21:16 | file_name | semmle.label | file_name |
28+
| test.c:21:8:21:16 | file_name indirection | semmle.label | file_name indirection |
29+
| test.c:21:8:21:16 | file_name indirection | semmle.label | file_name indirection |
30+
| test.c:45:15:45:23 | array to pointer conversion | semmle.label | array to pointer conversion |
31+
| test.c:45:15:45:23 | file_name | semmle.label | file_name |
32+
| test.c:45:15:45:23 | scanf output argument | semmle.label | scanf output argument |
33+
| test.c:46:29:46:37 | (LPCTSTR)... | semmle.label | (LPCTSTR)... |
34+
| test.c:46:29:46:37 | (LPCTSTR)... | semmle.label | (LPCTSTR)... |
35+
| test.c:46:29:46:37 | file_name | semmle.label | file_name |
36+
| test.c:46:29:46:37 | file_name indirection | semmle.label | file_name indirection |
37+
| test.c:46:29:46:37 | file_name indirection | semmle.label | file_name indirection |
38+
#select
39+
| test.c:21:8:21:16 | file_name | test.c:20:15:20:23 | file_name | test.c:21:8:21:16 | file_name | This argument to a file access function is derived from $@ and then passed to func(file_name), which calls fopen(__filename) | test.c:20:15:20:23 | file_name | user input (scanf) |
40+
| test.c:46:29:46:37 | file_name | test.c:45:15:45:23 | file_name | test.c:46:29:46:37 | file_name | This argument to a file access function is derived from $@ and then passed to CreateFile(lpFileName) | test.c:45:15:45:23 | file_name | user input (scanf) |

0 commit comments

Comments
 (0)