C++: Naively copy the 'surprising lifetimes' query from Coding Standards and add required metadata.

Author: MathiasVP

cpp/ql/src/experimental/Security/CWE/CWE-416/UseAfterExpiredLifetime.cpp

@@ -0,0 +1,34 @@
+void c_api(const char*);
+
+void bad_call_c_api() {
+  // BAD: the memory returned by `c_str()` is freed when the temporary string is destroyed
+  const char* p = std::string("hello").c_str();
+  c_api(p);
+}
+
+void good_call_c_api() {
+  // GOOD: the "hello" string outlives the pointer returned by `c_str()`, so it's safe to pass it to `c_api()`
+  std::string hello("hello");
+  const char* p = hello.c_str();
+  c_api(p);
+}
+
+void bad_remove_even_numbers(std::vector<int>& v) {
+    // BAD: the iterator is invalidated after the call to `erase`.
+  for(std::vector<int>::iterator it = v.begin(); it != v.end(); ++it) {
+    if(*it % 2 == 0) {
+      v.erase(it);
+    }
+  }
+}
+
+void good_remove_even_numbers(std::vector<int>& v) {
+  // GOOD: `erase` returns the iterator to the next element.
+  for(std::vector<int>::iterator it = v.begin(); it != v.end(); ) {
+    if(*it % 2 == 0) {
+      it = v.erase(it);
+    } else {
+      ++it;
+    }
+  }
+}

cpp/ql/src/experimental/Security/CWE/CWE-416/UseAfterExpiredLifetime.qhelp

@@ -0,0 +1,63 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+<overview>
+<p>
+Using an object after its lifetime has ended results in undefined behavior.
+When an object's lifetime has ended it relinquishes ownership of its resources and the memory it occupied may be reused for other purposes.
+If the object is accessed after its lifetime has ended, the program may crash or behave in unexpected ways.
+</p>
+
+</overview>
+<recommendation>
+
+<p>
+Ensure that no objct is accessed after its lifetime has ended.
+Use RAII ("Resource Acquisition Is Initialization") to manage the lifetime of objects, and avoid manual memory management, if possible.
+</p>
+
+</recommendation>
+<example>
+<p>
+The following two functions demonstrate common lifetime violations when working with the C++ standard library.
+
+The <code>bad_call_c_api</code> function contains a use of an expired lifetime.
+First, a temporary object of type <code>std::string</code> is constructed, and a pointer to its internal buffer is stored in a local variable.
+Once the <code>c_str()</code> call returns, the temporary object is destroyed, and the memory pointed to by <code>p</code> is freed.
+Thus, any attempt to dereference <code>p</code> inside <code>c_api</code> will result in a use-after-free vulnerability.
+
+The <code>good_call_c_api</code> function contains a fixed version of the first example.
+The variable <code>hello</code> is declared as a local variable, and the pointer to its internal buffer is stored in <code>p</code>.
+The lifetime of hello outlives the call to <code>c_api</code>, so the pointer stored in <code>p</code> remains valid throughout the call to <code>c_api</code>.
+</p>
+
+<p>
+The <code>bad_remove_even_numbers</code> function demonstrates a potential issue with iterator invalidation.
+Each C++ standard library container comes with a specification of which operations invalidates iterators pointing into the container.
+For example, calling <code>erase</code> on an object of type <code>std::vector&lt;T&gt;</code> invalidates all its iterators, and thus any attempt to dereference the iterator can result in a use-after-free vulnerability.
+
+The <code>good_remove_even_numbers</code> function contains a fixd version of the third example.
+The <code>erase</code> function returns an iterator to the element following the last element removed, and this return value is used to ensure that <code>it</code> remains valid after the call to <code>erase</code>.
+
+</p>
+<sample src="UseAfterExpiredLifetime.cpp" />
+
+</example>
+<references>
+
+<li>CERT C Coding Standard:
+<a href="https://wiki.sei.cmu.edu/confluence/display/c/MEM30-C.+Do+not+access+freed+memory">MEM30-C. Do not access freed memory</a>.</li>
+<li>
+OWASP:
+<a href="https://owasp.org/www-community/vulnerabilities/Using_freed_memory">Using freed memory</a>.
+</li>
+<li>
+<a href="https://github.com/isocpp/CppCoreGuidelines/blob/master/docs/Lifetime.pdf">Lifetime safety: Preventing common dangling</a>
+</li>
+<li>
+<a href="https://en.cppreference.com/w/cpp/container">Containers library</a>
+</li>
+
+</references>
+</qhelp>