Skip to content

Commit 3c88590

Browse files
MathiasVPMathiasVP
committed
C++: Accept test changes for the new use-after-query.
1 parent 725004a commit 3c88590

File tree

6 files changed

+184
-38
lines changed

6 files changed

+184
-38
lines changed

‎cpp/ql/test/query-tests/Critical/MemoryFreed/MemoryFreed.expected

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,69 @@
2626
| test.cpp:128:15:128:16 | v4 |
2727
| test.cpp:185:10:185:12 | cpy |
2828
| test.cpp:199:10:199:12 | cpy |
29+
| test_free.cpp:11:10:11:10 | a |
30+
| test_free.cpp:14:10:14:10 | a |
31+
| test_free.cpp:16:10:16:10 | a |
32+
| test_free.cpp:18:18:18:18 | a |
33+
| test_free.cpp:23:10:23:10 | a |
34+
| test_free.cpp:25:10:25:10 | a |
35+
| test_free.cpp:26:10:26:10 | b |
36+
| test_free.cpp:30:10:30:10 | a |
37+
| test_free.cpp:31:27:31:27 | a |
38+
| test_free.cpp:35:10:35:10 | a |
39+
| test_free.cpp:37:27:37:27 | a |
40+
| test_free.cpp:42:27:42:27 | a |
41+
| test_free.cpp:44:27:44:27 | a |
42+
| test_free.cpp:46:10:46:10 | a |
43+
| test_free.cpp:50:27:50:27 | a |
44+
| test_free.cpp:51:10:51:10 | a |
45+
| test_free.cpp:55:27:55:27 | a |
46+
| test_free.cpp:57:10:57:10 | a |
47+
| test_free.cpp:61:10:61:10 | a |
48+
| test_free.cpp:63:10:63:10 | b |
49+
| test_free.cpp:69:10:69:10 | a |
50+
| test_free.cpp:72:14:72:14 | a |
51+
| test_free.cpp:83:12:83:12 | a |
52+
| test_free.cpp:85:12:85:12 | a |
53+
| test_free.cpp:90:10:90:10 | a |
54+
| test_free.cpp:95:10:95:10 | a |
55+
| test_free.cpp:101:10:101:10 | a |
56+
| test_free.cpp:102:23:102:23 | a |
57+
| test_free.cpp:103:10:103:10 | a |
58+
| test_free.cpp:104:10:104:10 | b |
59+
| test_free.cpp:107:23:107:23 | a |
60+
| test_free.cpp:112:14:112:14 | a |
61+
| test_free.cpp:114:10:114:10 | b |
62+
| test_free.cpp:118:23:118:23 | a |
63+
| test_free.cpp:119:17:119:17 | b |
64+
| test_free.cpp:121:14:121:14 | a |
65+
| test_free.cpp:126:10:126:11 | * ... |
66+
| test_free.cpp:128:10:128:11 | * ... |
67+
| test_free.cpp:129:10:129:11 | * ... |
68+
| test_free.cpp:131:10:131:13 | access to array |
69+
| test_free.cpp:132:10:132:13 | access to array |
70+
| test_free.cpp:143:27:143:30 | data |
71+
| test_free.cpp:145:14:145:22 | * ... |
72+
| test_free.cpp:148:10:148:17 | list_ptr |
73+
| test_free.cpp:152:27:152:27 | a |
74+
| test_free.cpp:154:10:154:10 | a |
75+
| test_free.cpp:159:14:159:15 | * ... |
76+
| test_free.cpp:162:10:162:10 | a |
77+
| test_free.cpp:167:23:167:23 | a |
78+
| test_free.cpp:173:10:173:10 | a |
79+
| test_free.cpp:181:10:181:10 | a |
80+
| test_free.cpp:183:10:183:10 | a |
81+
| test_free.cpp:185:10:185:10 | a |
82+
| test_free.cpp:188:10:188:10 | a |
83+
| test_free.cpp:193:20:193:20 | a |
84+
| test_free.cpp:199:20:199:20 | a |
85+
| test_free.cpp:205:10:205:10 | a |
86+
| test_free.cpp:207:10:207:10 | a |
87+
| test_free.cpp:209:10:209:10 | a |
88+
| test_free.cpp:213:10:213:10 | a |
89+
| test_free.cpp:216:10:216:10 | a |
90+
| test_free.cpp:220:10:220:10 | a |
91+
| test_free.cpp:227:24:227:45 | memory_descriptor_list |
2992
| virtual.cpp:18:10:18:10 | a |
3093
| virtual.cpp:19:10:19:10 | c |
3194
| virtual.cpp:38:10:38:10 | b |

‎cpp/ql/test/query-tests/Critical/MemoryFreed/MemoryMayNotBeFreed.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
| test_free.cpp:36:22:36:35 | ... = ... | This memory allocation may not be released at $@. | test_free.cpp:38:1:38:1 | return ... | this exit point |

‎cpp/ql/test/query-tests/Critical/MemoryFreed/MemoryNeverFreed.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,3 +11,4 @@
1111
| test.cpp:156:3:156:26 | new | This memory is never freed. |
1212
| test.cpp:157:3:157:26 | new[] | This memory is never freed. |
1313
| test.cpp:169:14:169:19 | call to strdup | This memory is never freed. |
14+
| test_free.cpp:167:15:167:21 | call to realloc | This memory is never freed. |

‎cpp/ql/test/query-tests/Critical/MemoryFreed/test_free.cpp

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@ int asprintf(char ** strp, const char * fmt, ...);
99

1010
void* test_double_free1(int *a) {
1111
free(a); // GOOD
12-
a[5] = 5;
13-
*a = 5;
12+
a[5] = 5; // BAD
13+
*a = 5; // BAD
1414
free(a); // BAD
1515
a = (int*) malloc(8);
1616
free(a); // GOOD
@@ -40,9 +40,9 @@ void test_dominance2(void *a) {
4040
void test_post_dominance1(int *a)
4141
{
4242
if (condition()) free(a); // GOOD
43-
if (condition()) a[2] = 5;
43+
if (condition()) a[2] = 5; // GOOD
4444
if (condition()) free(a); // GOOD
45-
a[2] = 5;
45+
a[2] = 5; // BAD
4646
free(a); // BAD
4747
}
4848

@@ -61,14 +61,14 @@ void test_use_after_free6(int *a, int *b) {
6161
free(a);
6262
a=b;
6363
free(b);
64-
if (condition()) a[0] = 5;
64+
if (condition()) a[0] = 5; // BAD [NOT DETECTED]
6565
}
6666

6767
void test_use_after_free7(int *a) {
6868
a[0] = 42;
6969
free(a);
7070

71-
if (a[3]) {
71+
if (a[3]) { // BAD
7272
free(a); // BAD
7373
}
7474
}
@@ -81,20 +81,20 @@ class A {
8181
void test_new1() {
8282
A *a = new A();
8383
delete(a);
84-
a->f();
84+
a->f(); // BAD [NOT DETECTED]
8585
delete(a); // BAD [NOT DETECTED]
8686
}
8787

8888
void test_dereference1(A *a) {
89-
a->f();
89+
a->f(); // GOOD
9090
free(a);
91-
a->f();
91+
a->f(); // BAD
9292
}
9393

9494
void* use_after_free(void *a) {
9595
free(a);
96-
use(a);
97-
return a;
96+
use(a); // BAD
97+
return a; // BAD
9898
}
9999

100100
void test_realloc1(void *a) {
@@ -139,23 +139,23 @@ struct list {
139139

140140
void test_loop1(struct list ** list_ptr) {
141141
struct list *next;
142-
while (*list_ptr) {
142+
while (*list_ptr) { // GOOD
143143
free((*list_ptr)->data); // GOOD
144-
next = (*list_ptr)->next;
144+
next = (*list_ptr)->next; // GOOD
145145
free(*list_ptr); // GOOD
146-
*list_ptr = next;
146+
*list_ptr = next; // GOOD
147147
}
148148
free(list_ptr); // GOOD
149149
}
150150

151151
void test_use_after_free8(struct list * a) {
152152
if (condition()) free(a);
153-
a->data = malloc(10);
153+
a->data = malloc(10); // BAD
154154
free(a); // BAD
155155
}
156156

157157
void test_loop2(char ** a) {
158-
while (*a) {
158+
while (*a) { // GOOD
159159
free(*a); // GOOD
160160
a++;
161161
}
@@ -171,17 +171,17 @@ void* test_realloc4() {
171171

172172
void test_sizeof(int *a) {
173173
free(a);
174-
int x = sizeof(a[0]);
174+
int x = sizeof(a[0]); // GOOD
175175
}
176176

177177
void call_by_reference(char * &a);
178178
int custom_alloc_func(char ** a);
179179

180180
void test_reassign(char *a) {
181181
free(a); // GOOD
182-
asprintf(&a, "Hello world");
182+
asprintf(&a, "Hello world"); // GOOD
183183
free(a); //GOOD
184-
call_by_reference(a);
184+
call_by_reference(a); // GOOD
185185
free(a); // GOOD
186186
int v;
187187
if (v = custom_alloc_func(&a)) return;

‎cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree.expected

Lines changed: 74 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,74 @@
1-
| test.cpp:36:6:36:9 | data | Memory pointed to by 'data' may have $@. | test.cpp:35:2:35:5 | call to free | been previously freed |
2-
| test.cpp:70:7:70:10 | data | Memory pointed to by 'data' may have $@. | test.cpp:67:2:67:5 | call to free | been previously freed |
3-
| test.cpp:107:6:107:9 | data | Memory pointed to by 'data' may have $@. | test.cpp:105:2:105:5 | call to free | been previously freed |
4-
| test.cpp:117:6:117:9 | data | Memory pointed to by 'data' may have $@. | test.cpp:115:2:115:5 | call to free | been previously freed |
5-
| test.cpp:150:2:150:2 | c | Memory pointed to by 'c' may have $@. | test.cpp:149:2:149:10 | delete | been previously freed |
6-
| test.cpp:151:4:151:4 | c | Memory pointed to by 'c' may have $@. | test.cpp:149:2:149:10 | delete | been previously freed |
7-
| test.cpp:170:6:170:9 | data | Memory pointed to by 'data' may have $@. | test.cpp:165:2:165:5 | call to free | been previously freed |
8-
| test.cpp:193:6:193:9 | data | Memory pointed to by 'data' may have $@. | test.cpp:191:3:191:6 | call to free | been previously freed |
9-
| test.cpp:201:6:201:6 | x | Memory pointed to by 'x' may have $@. | test.cpp:200:2:200:9 | delete | been previously freed |
1+
edges
2+
| test.cpp:39:7:39:10 | data | test.cpp:41:6:41:9 | data |
3+
| test.cpp:39:7:39:10 | data | test.cpp:41:6:41:9 | data |
4+
| test.cpp:75:7:75:10 | data | test.cpp:79:7:79:10 | data |
5+
| test.cpp:75:7:75:10 | data | test.cpp:79:7:79:10 | data |
6+
| test.cpp:106:7:106:10 | data | test.cpp:108:6:108:9 | data |
7+
| test.cpp:106:7:106:10 | data | test.cpp:108:6:108:9 | data |
8+
| test.cpp:116:7:116:10 | data | test.cpp:119:6:119:9 | data |
9+
| test.cpp:116:7:116:10 | data | test.cpp:119:6:119:9 | data |
10+
| test.cpp:127:7:127:10 | data | test.cpp:130:6:130:9 | data |
11+
| test.cpp:127:7:127:10 | data | test.cpp:130:6:130:9 | data |
12+
| test.cpp:138:7:138:10 | data | test.cpp:141:6:141:9 | data |
13+
| test.cpp:138:7:138:10 | data | test.cpp:141:6:141:9 | data |
14+
| test.cpp:181:7:181:10 | data | test.cpp:186:6:186:9 | data |
15+
| test.cpp:181:7:181:10 | data | test.cpp:186:6:186:9 | data |
16+
| test.cpp:192:7:192:10 | data | test.cpp:197:6:197:9 | data |
17+
| test.cpp:192:7:192:10 | data | test.cpp:197:6:197:9 | data |
18+
| test.cpp:203:7:203:10 | data | test.cpp:209:6:209:9 | data |
19+
| test.cpp:203:7:203:10 | data | test.cpp:209:6:209:9 | data |
20+
| test.cpp:207:8:207:11 | data | test.cpp:209:6:209:9 | data |
21+
| test.cpp:207:8:207:11 | data | test.cpp:209:6:209:9 | data |
22+
nodes
23+
| test.cpp:39:7:39:10 | data | semmle.label | data |
24+
| test.cpp:39:7:39:10 | data | semmle.label | data |
25+
| test.cpp:41:6:41:9 | data | semmle.label | data |
26+
| test.cpp:75:7:75:10 | data | semmle.label | data |
27+
| test.cpp:75:7:75:10 | data | semmle.label | data |
28+
| test.cpp:79:7:79:10 | data | semmle.label | data |
29+
| test.cpp:106:7:106:10 | data | semmle.label | data |
30+
| test.cpp:106:7:106:10 | data | semmle.label | data |
31+
| test.cpp:108:6:108:9 | data | semmle.label | data |
32+
| test.cpp:116:7:116:10 | data | semmle.label | data |
33+
| test.cpp:116:7:116:10 | data | semmle.label | data |
34+
| test.cpp:119:6:119:9 | data | semmle.label | data |
35+
| test.cpp:127:7:127:10 | data | semmle.label | data |
36+
| test.cpp:127:7:127:10 | data | semmle.label | data |
37+
| test.cpp:130:6:130:9 | data | semmle.label | data |
38+
| test.cpp:138:7:138:10 | data | semmle.label | data |
39+
| test.cpp:138:7:138:10 | data | semmle.label | data |
40+
| test.cpp:141:6:141:9 | data | semmle.label | data |
41+
| test.cpp:181:7:181:10 | data | semmle.label | data |
42+
| test.cpp:181:7:181:10 | data | semmle.label | data |
43+
| test.cpp:186:6:186:9 | data | semmle.label | data |
44+
| test.cpp:192:7:192:10 | data | semmle.label | data |
45+
| test.cpp:192:7:192:10 | data | semmle.label | data |
46+
| test.cpp:197:6:197:9 | data | semmle.label | data |
47+
| test.cpp:203:7:203:10 | data | semmle.label | data |
48+
| test.cpp:203:7:203:10 | data | semmle.label | data |
49+
| test.cpp:207:8:207:11 | data | semmle.label | data |
50+
| test.cpp:207:8:207:11 | data | semmle.label | data |
51+
| test.cpp:209:6:209:9 | data | semmle.label | data |
52+
| test.cpp:209:6:209:9 | data | semmle.label | data |
53+
subpaths
54+
#select
55+
| test.cpp:41:6:41:9 | data | test.cpp:39:7:39:10 | data | test.cpp:41:6:41:9 | data | Memory may have been previously freed by $@. | test.cpp:39:2:39:5 | call to free | call to free |
56+
| test.cpp:41:6:41:9 | data | test.cpp:39:7:39:10 | data | test.cpp:41:6:41:9 | data | Memory may have been previously freed by $@. | test.cpp:39:2:39:5 | call to free | call to free |
57+
| test.cpp:79:7:79:10 | data | test.cpp:75:7:75:10 | data | test.cpp:79:7:79:10 | data | Memory may have been previously freed by $@. | test.cpp:75:2:75:5 | call to free | call to free |
58+
| test.cpp:79:7:79:10 | data | test.cpp:75:7:75:10 | data | test.cpp:79:7:79:10 | data | Memory may have been previously freed by $@. | test.cpp:75:2:75:5 | call to free | call to free |
59+
| test.cpp:108:6:108:9 | data | test.cpp:106:7:106:10 | data | test.cpp:108:6:108:9 | data | Memory may have been previously freed by $@. | test.cpp:106:2:106:5 | call to free | call to free |
60+
| test.cpp:108:6:108:9 | data | test.cpp:106:7:106:10 | data | test.cpp:108:6:108:9 | data | Memory may have been previously freed by $@. | test.cpp:106:2:106:5 | call to free | call to free |
61+
| test.cpp:119:6:119:9 | data | test.cpp:116:7:116:10 | data | test.cpp:119:6:119:9 | data | Memory may have been previously freed by $@. | test.cpp:116:2:116:5 | call to free | call to free |
62+
| test.cpp:119:6:119:9 | data | test.cpp:116:7:116:10 | data | test.cpp:119:6:119:9 | data | Memory may have been previously freed by $@. | test.cpp:116:2:116:5 | call to free | call to free |
63+
| test.cpp:130:6:130:9 | data | test.cpp:127:7:127:10 | data | test.cpp:130:6:130:9 | data | Memory may have been previously freed by $@. | test.cpp:127:2:127:5 | call to free | call to free |
64+
| test.cpp:130:6:130:9 | data | test.cpp:127:7:127:10 | data | test.cpp:130:6:130:9 | data | Memory may have been previously freed by $@. | test.cpp:127:2:127:5 | call to free | call to free |
65+
| test.cpp:141:6:141:9 | data | test.cpp:138:7:138:10 | data | test.cpp:141:6:141:9 | data | Memory may have been previously freed by $@. | test.cpp:138:2:138:5 | call to free | call to free |
66+
| test.cpp:141:6:141:9 | data | test.cpp:138:7:138:10 | data | test.cpp:141:6:141:9 | data | Memory may have been previously freed by $@. | test.cpp:138:2:138:5 | call to free | call to free |
67+
| test.cpp:186:6:186:9 | data | test.cpp:181:7:181:10 | data | test.cpp:186:6:186:9 | data | Memory may have been previously freed by $@. | test.cpp:181:2:181:5 | call to free | call to free |
68+
| test.cpp:186:6:186:9 | data | test.cpp:181:7:181:10 | data | test.cpp:186:6:186:9 | data | Memory may have been previously freed by $@. | test.cpp:181:2:181:5 | call to free | call to free |
69+
| test.cpp:197:6:197:9 | data | test.cpp:192:7:192:10 | data | test.cpp:197:6:197:9 | data | Memory may have been previously freed by $@. | test.cpp:192:2:192:5 | call to free | call to free |
70+
| test.cpp:197:6:197:9 | data | test.cpp:192:7:192:10 | data | test.cpp:197:6:197:9 | data | Memory may have been previously freed by $@. | test.cpp:192:2:192:5 | call to free | call to free |
71+
| test.cpp:209:6:209:9 | data | test.cpp:203:7:203:10 | data | test.cpp:209:6:209:9 | data | Memory may have been previously freed by $@. | test.cpp:203:2:203:5 | call to free | call to free |
72+
| test.cpp:209:6:209:9 | data | test.cpp:203:7:203:10 | data | test.cpp:209:6:209:9 | data | Memory may have been previously freed by $@. | test.cpp:203:2:203:5 | call to free | call to free |
73+
| test.cpp:209:6:209:9 | data | test.cpp:207:8:207:11 | data | test.cpp:209:6:209:9 | data | Memory may have been previously freed by $@. | test.cpp:207:3:207:6 | call to free | call to free |
74+
| test.cpp:209:6:209:9 | data | test.cpp:207:8:207:11 | data | test.cpp:209:6:209:9 | data | Memory may have been previously freed by $@. | test.cpp:207:3:207:6 | call to free | call to free |

0 commit comments

Comments
 (0)