Skip to content

Commit 31b1e40

Browse files
committed
C++: Prevent join-on-enclosing-callable in 'cpp/return-stack-allocated-memory'.
1 parent bbb2847 commit 31b1e40

File tree

1 file changed

+11
-2
lines changed

1 file changed

+11
-2
lines changed

cpp/ql/src/Likely Bugs/Memory Management/ReturnStackAllocatedMemory.ql

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -75,14 +75,23 @@ class ReturnStackAllocatedMemoryConfig extends MustFlowConfiguration {
7575
}
7676
}
7777

78+
predicate instrHasEnclosingCallable(VariableAddressInstruction var, Function f) {
79+
f = var.getEnclosingFunction()
80+
}
81+
82+
predicate nodeHasEnclosingCallable(DataFlow::Node node, Function f) {
83+
f = node.getEnclosingCallable()
84+
}
85+
7886
from
7987
MustFlowPathNode source, MustFlowPathNode sink, VariableAddressInstruction var,
80-
ReturnStackAllocatedMemoryConfig conf
88+
ReturnStackAllocatedMemoryConfig conf, Function f
8189
where
8290
conf.hasFlowPath(source, sink) and
8391
source.getNode().asInstruction() = var and
8492
// Only raise an alert if we're returning from the _same_ callable as the on that
8593
// declared the stack variable.
86-
var.getEnclosingFunction() = sink.getNode().getEnclosingCallable()
94+
instrHasEnclosingCallable(var, pragma[only_bind_into](f)) and
95+
nodeHasEnclosingCallable(sink.getNode(), pragma[only_bind_into](f))
8796
select sink.getNode(), source, sink, "May return stack-allocated memory from $@.", var.getAst(),
8897
var.getAst().toString()

0 commit comments

Comments
 (0)