Skip to content

Commit 6ad7a95

Browse files
geoffw0geoffw0
committed
Merge branch 'main' into badalloc
2 parents c993938 + bc92a99 commit 6ad7a95

File tree

17 files changed

+1247
-6
lines changed

17 files changed

+1247
-6
lines changed

‎rust/ql/lib/codeql/rust/frameworks/libc.model.yml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
extensions:
2+
- addsTo:
3+
pack: codeql/rust-all
4+
extensible: sourceModel
5+
data:
6+
- ["repo:https://github.com/rust-lang/libc:libc", "::free", "Argument[0]", "pointer-invalidate", "manual"]
27
- addsTo:
38
pack: codeql/rust-all
49
extensible: sinkModel

‎rust/ql/lib/codeql/rust/frameworks/stdlib/lang-alloc.model.yml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,10 @@
11
extensions:
2+
- addsTo:
3+
pack: codeql/rust-all
4+
extensible: sourceModel
5+
data:
6+
# Alloc
7+
- ["lang:alloc", "crate::alloc::dealloc", "Argument[0]", "pointer-invalidate", "manual"]
28
- addsTo:
39
pack: codeql/rust-all
410
extensible: sinkModel
@@ -19,3 +25,13 @@ extensions:
1925
- ["lang:alloc", "<crate::alloc::Global as crate::alloc::Allocator>::allocate_zeroed", "Argument[0]", "alloc-layout", "manual"]
2026
- ["lang:alloc", "<crate::alloc::Global as crate::alloc::Allocator>::grow", "Argument[2]", "alloc-layout", "manual"]
2127
- ["lang:alloc", "<crate::alloc::Global as crate::alloc::Allocator>::grow_zeroed", "Argument[2]", "alloc-layout", "manual"]
28+
- addsTo:
29+
pack: codeql/rust-all
30+
extensible: summaryModel
31+
data:
32+
# Fmt
33+
- ["lang:alloc", "crate::fmt::format", "Argument[0]", "ReturnValue", "taint", "manual"]
34+
# String
35+
- ["lang:alloc", "<crate::string::String>::as_str", "Argument[self]", "ReturnValue", "taint", "manual"]
36+
- ["lang:alloc", "<crate::string::String>::as_bytes", "Argument[self]", "ReturnValue", "taint", "manual"]
37+
- ["lang:alloc", "<_ as crate::string::ToString>::to_string", "Argument[self]", "ReturnValue", "taint", "manual"]

‎rust/ql/lib/codeql/rust/frameworks/stdlib/lang-core.model.yml

Lines changed: 21 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,6 @@ extensions:
33
pack: codeql/rust-all
44
extensible: summaryModel
55
data:
6-
# Fmt
7-
- ["lang:alloc", "crate::fmt::format", "Argument[0]", "ReturnValue", "taint", "manual"]
86
# Iterator
97
- ["lang:core", "<[_]>::iter", "Argument[Self].Element", "ReturnValue.Element", "value", "manual"]
108
- ["lang:core", "<[_]>::iter_mut", "Argument[Self].Element", "ReturnValue.Element", "value", "manual"]
@@ -43,7 +41,24 @@ extensions:
4341
- ["lang:core", "crate::ptr::write_volatile", "Argument[1]", "Argument[0].Reference", "value", "manual"]
4442
# Str
4543
- ["lang:core", "<str>::parse", "Argument[self]", "ReturnValue.Field[crate::result::Result::Ok(0)]", "taint", "manual"]
46-
# String
47-
- ["lang:alloc", "<crate::string::String>::as_str", "Argument[self]", "ReturnValue", "taint", "manual"]
48-
- ["lang:alloc", "<crate::string::String>::as_bytes", "Argument[self]", "ReturnValue", "taint", "manual"]
49-
- ["lang:alloc", "<_ as crate::string::ToString>::to_string", "Argument[self]", "ReturnValue", "taint", "manual"]
44+
- addsTo:
45+
pack: codeql/rust-all
46+
extensible: sourceModel
47+
data:
48+
# Ptr
49+
- ["lang:core", "crate::ptr::drop_in_place", "Argument[0]", "pointer-invalidate", "manual"]
50+
- ["lang:core", "crate::ptr::dangling", "ReturnValue", "pointer-invalidate", "manual"]
51+
- ["lang:core", "crate::ptr::dangling_mut", "ReturnValue", "pointer-invalidate", "manual"]
52+
- ["lang:core", "crate::ptr::null", "ReturnValue", "pointer-invalidate", "manual"]
53+
- addsTo:
54+
pack: codeql/rust-all
55+
extensible: sinkModel
56+
data:
57+
# Ptr
58+
- ["lang:core", "crate::ptr::read", "Argument[0]", "pointer-access", "manual"]
59+
- ["lang:core", "crate::ptr::read_unaligned", "Argument[0]", "pointer-access", "manual"]
60+
- ["lang:core", "crate::ptr::read_volatile", "Argument[0]", "pointer-access", "manual"]
61+
- ["lang:core", "crate::ptr::write", "Argument[0]", "pointer-access", "manual"]
62+
- ["lang:core", "crate::ptr::write_bytes", "Argument[0]", "pointer-access", "manual"]
63+
- ["lang:core", "crate::ptr::write_unaligned", "Argument[0]", "pointer-access", "manual"]
64+
- ["lang:core", "crate::ptr::write_volatile", "Argument[0]", "pointer-access", "manual"]

‎rust/ql/lib/codeql/rust/security/AccessInvalidPointerExtensions.qll

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
/**
2+
* Provides classes and predicates for reasoning about accesses to invalid
3+
* pointers.
4+
*/
5+
6+
import rust
7+
private import codeql.rust.dataflow.DataFlow
8+
private import codeql.rust.dataflow.FlowSource
9+
private import codeql.rust.dataflow.FlowSink
10+
private import codeql.rust.Concepts
11+
private import codeql.rust.dataflow.internal.Node
12+
13+
/**
14+
* Provides default sources, sinks and barriers for detecting accesses to
15+
* invalid pointers, as well as extension points for adding your own.
16+
*/
17+
module AccessInvalidPointer {
18+
/**
19+
* A data flow source for invalid pointer accesses, that is, an operation
20+
* where a pointer becomes invalid.
21+
*/
22+
abstract class Source extends DataFlow::Node { }
23+
24+
/**
25+
* A data flow sink for invalid pointer accesses, that is, a pointer
26+
* dereference.
27+
*/
28+
abstract class Sink extends QuerySink::Range {
29+
override string getSinkType() { result = "AccessInvalidPointer" }
30+
}
31+
32+
/**
33+
* A barrier for invalid pointer accesses.
34+
*/
35+
abstract class Barrier extends DataFlow::Node { }
36+
37+
/**
38+
* A pointer invalidation from model data.
39+
*
40+
* Note: we don't currently support invalidation via the object itself rather than via a pointer, such as:
41+
* ```
42+
* drop(obj)
43+
* ```
44+
*/
45+
private class ModelsAsDataSource extends Source {
46+
ModelsAsDataSource() { sourceNode(this, "pointer-invalidate") }
47+
}
48+
49+
/**
50+
* A pointer access using the unary `*` operator.
51+
*/
52+
private class DereferenceSink extends Sink {
53+
DereferenceSink() {
54+
exists(PrefixExpr p | p.getOperatorName() = "*" and p.getExpr() = this.asExpr().getExpr())
55+
}
56+
}
57+
58+
/**
59+
* A pointer access from model data.
60+
*/
61+
private class ModelsAsDataSink extends Sink {
62+
ModelsAsDataSink() { sinkNode(this, "pointer-access") }
63+
}
64+
}

‎rust/ql/src/queries/security/CWE-825/AccessInvalidPointer.qhelp

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
<overview>
6+
7+
<p>
8+
Dereferencing an invalid or dangling pointer may cause undefined behavior. Memory may be corrupted
9+
causing the program to crash or behave incorrectly, in some cases exposing the program to
10+
potential attacks.
11+
</p>
12+
13+
</overview>
14+
<recommendation>
15+
16+
<p>
17+
When dereferencing a pointer in <code>unsafe</code> code, take care that the pointer is valid and
18+
points to the intended data. Code may need to be rearranged or additional checks added to ensure
19+
safety in all circumstances. If possible, rewrite the code using safe Rust types to avoid this
20+
kind of problem altogether.
21+
</p>
22+
23+
</recommendation>
24+
<example>
25+
26+
<p>
27+
In the following example, <code>std::ptr::drop_in_place</code> is used to execute the destructor
28+
of an object. However, a pointer to that object is dereferenced later in the program, causing
29+
undefined behavior:
30+
</p>
31+
32+
<sample src="AccessInvalidPointerBad.rs" />
33+
34+
<p>
35+
In this case, undefined behavior can be avoided by rearranging the code so that the dereferencing
36+
comes before the call to <code>std::ptr::drop_in_place</code>:
37+
</p>
38+
39+
<sample src="AccessInvalidPointerGood.rs" />
40+
41+
</example>
42+
<references>
43+
44+
<li>Rust Documentation: <a href="https://doc.rust-lang.org/reference/behavior-considered-undefined.html#dangling-pointers">Behavior considered undefined &gt;&gt; Dangling pointers</a>.</li>
45+
<li>Rust Documentation: <a href="https://doc.rust-lang.org/std/ptr/index.html#safety">Module ptr - Safety</a>.</li>
46+
<li>Massachusetts Institute of Technology: <a href="https://web.mit.edu/rust-lang_v1.25/arch/amd64_ubuntu1404/share/doc/rust/html/book/second-edition/ch19-01-unsafe-rust.html#dereferencing-a-raw-pointer">Unsafe Rust - Dereferencing a Raw Pointer</a>.</li>
47+
48+
</references>
49+
</qhelp>

‎rust/ql/src/queries/security/CWE-825/AccessInvalidPointer.ql

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
/**
2+
* @name Access of invalid pointer
3+
* @description Dereferencing an invalid or dangling pointer causes undefined behavior and may result in memory corruption.
4+
* @kind path-problem
5+
* @problem.severity error
6+
* @security-severity 7.5
7+
* @precision high
8+
* @id rust/access-invalid-pointer
9+
* @tags reliability
10+
* security
11+
* external/cwe/cwe-476
12+
* external/cwe/cwe-825
13+
*/
14+
15+
import rust
16+
import codeql.rust.dataflow.DataFlow
17+
import codeql.rust.dataflow.TaintTracking
18+
import codeql.rust.security.AccessInvalidPointerExtensions
19+
import AccessInvalidPointerFlow::PathGraph
20+
21+
/**
22+
* A data flow configuration for accesses to invalid pointers.
23+
*/
24+
module AccessInvalidPointerConfig implements DataFlow::ConfigSig {
25+
predicate isSource(DataFlow::Node node) { node instanceof AccessInvalidPointer::Source }
26+
27+
predicate isSink(DataFlow::Node node) { node instanceof AccessInvalidPointer::Sink }
28+
29+
predicate isBarrier(DataFlow::Node barrier) { barrier instanceof AccessInvalidPointer::Barrier }
30+
31+
predicate isBarrierOut(DataFlow::Node node) {
32+
// make sinks barriers so that we only report the closest instance
33+
isSink(node)
34+
}
35+
}
36+
37+
module AccessInvalidPointerFlow = TaintTracking::Global<AccessInvalidPointerConfig>;
38+
39+
from AccessInvalidPointerFlow::PathNode sourceNode, AccessInvalidPointerFlow::PathNode sinkNode
40+
where AccessInvalidPointerFlow::flowPath(sourceNode, sinkNode)
41+
select sinkNode.getNode(), sourceNode, sinkNode,
42+
"This operation dereferences a pointer that may be $@.", sourceNode.getNode(), "invalid"

‎rust/ql/src/queries/security/CWE-825/AccessInvalidPointerBad.rs

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
2+
unsafe {
3+
std::ptr::drop_in_place(ptr); // executes the destructor of `*ptr`
4+
}
5+
6+
// ...
7+
8+
unsafe {
9+
do_something(&*ptr); // BAD: dereferences `ptr`
10+
}

‎rust/ql/src/queries/security/CWE-825/AccessInvalidPointerGood.rs

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
2+
unsafe {
3+
do_something(&*ptr); // GOOD: dereferences `ptr` while it is still valid
4+
}
5+
6+
// ...
7+
8+
{
9+
std::ptr::drop_in_place(ptr); // executes the destructor of `*ptr`
10+
}

‎rust/ql/src/queries/summary/Stats.qll

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ private import codeql.rust.Diagnostics
1515
private import codeql.rust.security.SensitiveData
1616
private import TaintReach
1717
// import all query extensions files, so that all extensions of `QuerySink` are found
18+
private import codeql.rust.security.AccessInvalidPointerExtensions
1819
private import codeql.rust.security.CleartextLoggingExtensions
1920
private import codeql.rust.security.SqlInjectionExtensions
2021
private import codeql.rust.security.WeakSensitiveDataHashingExtensions

‎rust/ql/test/query-tests/security/CWE-825/AccessInvalidPointer.expected

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
#select
2+
| deallocation.rs:26:15:26:16 | m1 | deallocation.rs:20:3:20:21 | ...::dealloc | deallocation.rs:26:15:26:16 | m1 | This operation dereferences a pointer that may be $@. | deallocation.rs:20:3:20:21 | ...::dealloc | invalid |
3+
| deallocation.rs:37:14:37:33 | ...::read::<...> | deallocation.rs:20:3:20:21 | ...::dealloc | deallocation.rs:37:14:37:33 | ...::read::<...> | This operation dereferences a pointer that may be $@. | deallocation.rs:20:3:20:21 | ...::dealloc | invalid |
4+
| deallocation.rs:44:6:44:7 | m1 | deallocation.rs:20:3:20:21 | ...::dealloc | deallocation.rs:44:6:44:7 | m1 | This operation dereferences a pointer that may be $@. | deallocation.rs:20:3:20:21 | ...::dealloc | invalid |
5+
| deallocation.rs:49:5:49:25 | ...::write::<...> | deallocation.rs:20:3:20:21 | ...::dealloc | deallocation.rs:49:5:49:25 | ...::write::<...> | This operation dereferences a pointer that may be $@. | deallocation.rs:20:3:20:21 | ...::dealloc | invalid |
6+
| deallocation.rs:76:16:76:17 | m2 | deallocation.rs:70:3:70:21 | ...::dealloc | deallocation.rs:76:16:76:17 | m2 | This operation dereferences a pointer that may be $@. | deallocation.rs:70:3:70:21 | ...::dealloc | invalid |
7+
| deallocation.rs:81:16:81:17 | m2 | deallocation.rs:70:3:70:21 | ...::dealloc | deallocation.rs:81:16:81:17 | m2 | This operation dereferences a pointer that may be $@. | deallocation.rs:70:3:70:21 | ...::dealloc | invalid |
8+
| deallocation.rs:86:7:86:8 | m2 | deallocation.rs:70:3:70:21 | ...::dealloc | deallocation.rs:86:7:86:8 | m2 | This operation dereferences a pointer that may be $@. | deallocation.rs:70:3:70:21 | ...::dealloc | invalid |
9+
| deallocation.rs:90:7:90:8 | m2 | deallocation.rs:70:3:70:21 | ...::dealloc | deallocation.rs:90:7:90:8 | m2 | This operation dereferences a pointer that may be $@. | deallocation.rs:70:3:70:21 | ...::dealloc | invalid |
10+
| deallocation.rs:95:5:95:31 | ...::write::<...> | deallocation.rs:70:3:70:21 | ...::dealloc | deallocation.rs:95:5:95:31 | ...::write::<...> | This operation dereferences a pointer that may be $@. | deallocation.rs:70:3:70:21 | ...::dealloc | invalid |
11+
| deallocation.rs:115:13:115:18 | my_ptr | deallocation.rs:112:3:112:12 | ...::free | deallocation.rs:115:13:115:18 | my_ptr | This operation dereferences a pointer that may be $@. | deallocation.rs:112:3:112:12 | ...::free | invalid |
12+
| deallocation.rs:130:14:130:15 | p1 | deallocation.rs:123:23:123:40 | ...::dangling | deallocation.rs:130:14:130:15 | p1 | This operation dereferences a pointer that may be $@. | deallocation.rs:123:23:123:40 | ...::dangling | invalid |
13+
| deallocation.rs:131:14:131:15 | p2 | deallocation.rs:124:21:124:42 | ...::dangling_mut | deallocation.rs:131:14:131:15 | p2 | This operation dereferences a pointer that may be $@. | deallocation.rs:124:21:124:42 | ...::dangling_mut | invalid |
14+
| deallocation.rs:132:14:132:15 | p3 | deallocation.rs:125:23:125:36 | ...::null | deallocation.rs:132:14:132:15 | p3 | This operation dereferences a pointer that may be $@. | deallocation.rs:125:23:125:36 | ...::null | invalid |
15+
| deallocation.rs:180:15:180:16 | p1 | deallocation.rs:176:3:176:25 | ...::drop_in_place | deallocation.rs:180:15:180:16 | p1 | This operation dereferences a pointer that may be $@. | deallocation.rs:176:3:176:25 | ...::drop_in_place | invalid |
16+
| deallocation.rs:248:18:248:20 | ptr | deallocation.rs:242:3:242:25 | ...::drop_in_place | deallocation.rs:248:18:248:20 | ptr | This operation dereferences a pointer that may be $@. | deallocation.rs:242:3:242:25 | ...::drop_in_place | invalid |
17+
edges
18+
| deallocation.rs:20:3:20:21 | ...::dealloc | deallocation.rs:20:23:20:24 | [post] m1 | provenance | Src:MaD:3 MaD:3 |
19+
| deallocation.rs:20:23:20:24 | [post] m1 | deallocation.rs:26:15:26:16 | m1 | provenance | |
20+
| deallocation.rs:20:23:20:24 | [post] m1 | deallocation.rs:37:35:37:36 | m1 | provenance | |
21+
| deallocation.rs:20:23:20:24 | [post] m1 | deallocation.rs:44:6:44:7 | m1 | provenance | |
22+
| deallocation.rs:20:23:20:24 | [post] m1 | deallocation.rs:49:27:49:28 | m1 | provenance | |
23+
| deallocation.rs:37:35:37:36 | m1 | deallocation.rs:37:14:37:33 | ...::read::<...> | provenance | MaD:1 Sink:MaD:1 |
24+
| deallocation.rs:49:27:49:28 | m1 | deallocation.rs:49:5:49:25 | ...::write::<...> | provenance | MaD:2 Sink:MaD:2 |
25+
| deallocation.rs:70:3:70:21 | ...::dealloc | deallocation.rs:70:23:70:35 | [post] m2 as ... | provenance | Src:MaD:3 MaD:3 |
26+
| deallocation.rs:70:23:70:35 | [post] m2 as ... | deallocation.rs:76:16:76:17 | m2 | provenance | |
27+
| deallocation.rs:70:23:70:35 | [post] m2 as ... | deallocation.rs:81:16:81:17 | m2 | provenance | |
28+
| deallocation.rs:70:23:70:35 | [post] m2 as ... | deallocation.rs:86:7:86:8 | m2 | provenance | |
29+
| deallocation.rs:70:23:70:35 | [post] m2 as ... | deallocation.rs:90:7:90:8 | m2 | provenance | |
30+
| deallocation.rs:70:23:70:35 | [post] m2 as ... | deallocation.rs:95:33:95:34 | m2 | provenance | |
31+
| deallocation.rs:95:33:95:34 | m2 | deallocation.rs:95:5:95:31 | ...::write::<...> | provenance | MaD:2 Sink:MaD:2 |
32+
| deallocation.rs:112:3:112:12 | ...::free | deallocation.rs:112:14:112:40 | [post] my_ptr as ... | provenance | Src:MaD:8 MaD:8 |
33+
| deallocation.rs:112:14:112:40 | [post] my_ptr as ... | deallocation.rs:115:13:115:18 | my_ptr | provenance | |
34+
| deallocation.rs:123:6:123:7 | p1 | deallocation.rs:130:14:130:15 | p1 | provenance | |
35+
| deallocation.rs:123:23:123:40 | ...::dangling | deallocation.rs:123:23:123:42 | ...::dangling(...) | provenance | Src:MaD:4 MaD:4 |
36+
| deallocation.rs:123:23:123:42 | ...::dangling(...) | deallocation.rs:123:6:123:7 | p1 | provenance | |
37+
| deallocation.rs:124:6:124:7 | p2 | deallocation.rs:131:14:131:15 | p2 | provenance | |
38+
| deallocation.rs:124:21:124:42 | ...::dangling_mut | deallocation.rs:124:21:124:44 | ...::dangling_mut(...) | provenance | Src:MaD:5 MaD:5 |
39+
| deallocation.rs:124:21:124:44 | ...::dangling_mut(...) | deallocation.rs:124:6:124:7 | p2 | provenance | |
40+
| deallocation.rs:125:6:125:7 | p3 | deallocation.rs:132:14:132:15 | p3 | provenance | |
41+
| deallocation.rs:125:23:125:36 | ...::null | deallocation.rs:125:23:125:38 | ...::null(...) | provenance | Src:MaD:7 MaD:7 |
42+
| deallocation.rs:125:23:125:38 | ...::null(...) | deallocation.rs:125:6:125:7 | p3 | provenance | |
43+
| deallocation.rs:176:3:176:25 | ...::drop_in_place | deallocation.rs:176:27:176:28 | [post] p1 | provenance | Src:MaD:6 MaD:6 |
44+
| deallocation.rs:176:27:176:28 | [post] p1 | deallocation.rs:180:15:180:16 | p1 | provenance | |
45+
| deallocation.rs:242:3:242:25 | ...::drop_in_place | deallocation.rs:242:27:242:29 | [post] ptr | provenance | Src:MaD:6 MaD:6 |
46+
| deallocation.rs:242:27:242:29 | [post] ptr | deallocation.rs:248:18:248:20 | ptr | provenance | |
47+
models
48+
| 1 | Sink: lang:core; crate::ptr::read; pointer-access; Argument[0] |
49+
| 2 | Sink: lang:core; crate::ptr::write; pointer-access; Argument[0] |
50+
| 3 | Source: lang:alloc; crate::alloc::dealloc; pointer-invalidate; Argument[0] |
51+
| 4 | Source: lang:core; crate::ptr::dangling; pointer-invalidate; ReturnValue |
52+
| 5 | Source: lang:core; crate::ptr::dangling_mut; pointer-invalidate; ReturnValue |
53+
| 6 | Source: lang:core; crate::ptr::drop_in_place; pointer-invalidate; Argument[0] |
54+
| 7 | Source: lang:core; crate::ptr::null; pointer-invalidate; ReturnValue |
55+
| 8 | Source: repo:https://github.com/rust-lang/libc:libc; ::free; pointer-invalidate; Argument[0] |
56+
nodes
57+
| deallocation.rs:20:3:20:21 | ...::dealloc | semmle.label | ...::dealloc |
58+
| deallocation.rs:20:23:20:24 | [post] m1 | semmle.label | [post] m1 |
59+
| deallocation.rs:26:15:26:16 | m1 | semmle.label | m1 |
60+
| deallocation.rs:37:14:37:33 | ...::read::<...> | semmle.label | ...::read::<...> |
61+
| deallocation.rs:37:35:37:36 | m1 | semmle.label | m1 |
62+
| deallocation.rs:44:6:44:7 | m1 | semmle.label | m1 |
63+
| deallocation.rs:49:5:49:25 | ...::write::<...> | semmle.label | ...::write::<...> |
64+
| deallocation.rs:49:27:49:28 | m1 | semmle.label | m1 |
65+
| deallocation.rs:70:3:70:21 | ...::dealloc | semmle.label | ...::dealloc |
66+
| deallocation.rs:70:23:70:35 | [post] m2 as ... | semmle.label | [post] m2 as ... |
67+
| deallocation.rs:76:16:76:17 | m2 | semmle.label | m2 |
68+
| deallocation.rs:81:16:81:17 | m2 | semmle.label | m2 |
69+
| deallocation.rs:86:7:86:8 | m2 | semmle.label | m2 |
70+
| deallocation.rs:90:7:90:8 | m2 | semmle.label | m2 |
71+
| deallocation.rs:95:5:95:31 | ...::write::<...> | semmle.label | ...::write::<...> |
72+
| deallocation.rs:95:33:95:34 | m2 | semmle.label | m2 |
73+
| deallocation.rs:112:3:112:12 | ...::free | semmle.label | ...::free |
74+
| deallocation.rs:112:14:112:40 | [post] my_ptr as ... | semmle.label | [post] my_ptr as ... |
75+
| deallocation.rs:115:13:115:18 | my_ptr | semmle.label | my_ptr |
76+
| deallocation.rs:123:6:123:7 | p1 | semmle.label | p1 |
77+
| deallocation.rs:123:23:123:40 | ...::dangling | semmle.label | ...::dangling |
78+
| deallocation.rs:123:23:123:42 | ...::dangling(...) | semmle.label | ...::dangling(...) |
79+
| deallocation.rs:124:6:124:7 | p2 | semmle.label | p2 |
80+
| deallocation.rs:124:21:124:42 | ...::dangling_mut | semmle.label | ...::dangling_mut |
81+
| deallocation.rs:124:21:124:44 | ...::dangling_mut(...) | semmle.label | ...::dangling_mut(...) |
82+
| deallocation.rs:125:6:125:7 | p3 | semmle.label | p3 |
83+
| deallocation.rs:125:23:125:36 | ...::null | semmle.label | ...::null |
84+
| deallocation.rs:125:23:125:38 | ...::null(...) | semmle.label | ...::null(...) |
85+
| deallocation.rs:130:14:130:15 | p1 | semmle.label | p1 |
86+
| deallocation.rs:131:14:131:15 | p2 | semmle.label | p2 |
87+
| deallocation.rs:132:14:132:15 | p3 | semmle.label | p3 |
88+
| deallocation.rs:176:3:176:25 | ...::drop_in_place | semmle.label | ...::drop_in_place |
89+
| deallocation.rs:176:27:176:28 | [post] p1 | semmle.label | [post] p1 |
90+
| deallocation.rs:180:15:180:16 | p1 | semmle.label | p1 |
91+
| deallocation.rs:242:3:242:25 | ...::drop_in_place | semmle.label | ...::drop_in_place |
92+
| deallocation.rs:242:27:242:29 | [post] ptr | semmle.label | [post] ptr |
93+
| deallocation.rs:248:18:248:20 | ptr | semmle.label | ptr |
94+
subpaths

0 commit comments

Comments
 (0)