codeql icon indicating copy to clipboard operation
codeql copied to clipboard

C++: Rewrite MemoryNeverFreed to use the DataFlow library

Open rdmarsh2 opened this issue 1 year ago • 1 comments

rdmarsh2 avatar Feb 21 '24 21:02 rdmarsh2

Instead, how about we create an IR query that tracks flow from an InitializeDynamicAllocation that isn't conflated with all-aliased- memory, and find all the ones that don't flow to a deallocation.

Since these aren't all-aliased-memory, the IR's "mostly sound" alias analysis should ensure that we don't miss any potential aliases going into a deallocation, right? So if we have a non-all-aliased-memory memory produced by an InitializeDynamicAllocation and don't manage to find any flow to a deallocation function, then the "mostly soundness" of the IR should give us a good result, no?

Obviously, since the IR's alias analysis conflates stuff into all-aliased-memory quite quickly, this will give us quite a lot of FNs, but it will hopefully produce mostly good TPs for the results we do produce, right? 🤞

I tried this out and didn't get great results - in particular the IR's handling of new allocations that get assigned to fields of a non-aliased object doesn't have them escape the function or become aliased. I think we'd need either a new alias analysis or additional outbound indirection instructions to handle that case.

rdmarsh2 avatar Feb 29 '24 20:02 rdmarsh2