Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

cpp/uncontrolled-allocation-size - false positive #11215

Open
ryao opened this issue Nov 10, 2022 · 3 comments
Open

cpp/uncontrolled-allocation-size - false positive #11215

ryao opened this issue Nov 10, 2022 · 3 comments
Labels
acknowledged GitHub staff acknowledges this issue false-positive

Comments

@ryao
Copy link

ryao commented Nov 10, 2022

Description of the false positive

CodeQL complains This allocation size is derived from user-input (a command-line argument) and might overflow. on a line of code that is basically calloc(1, size). When one of the arguments is 1, an overflow is impossible. Therefore, this is a false positive.

It should be possible to modify the query to stop reporting this issue whenever one of the arguments is 1. That should eliminate the false positive.

URL to the alert
https://github.com/ryao/zfs/security/code-scanning/785
@ryao ryao mentioned this issue Nov 10, 2022
Open
@ryao ryao changed the title CodeQL cpp/uncontrolled-allocation-size - false positive cpp/uncontrolled-allocation-size - false positive Nov 10, 2022
@MathiasVP
Copy link
Contributor

Hi @ryao,

Thanks for the report!

Indeed, this does look like a false positive. I've created an internal issue for this, and we'll let you know when this has been fixed 🙂.

@ryao
Copy link
Author

ryao commented Nov 16, 2022

Should this receive the acknowledged label?

@MathiasVP MathiasVP added the acknowledged GitHub staff acknowledges this issue label Nov 16, 2022
@MathiasVP
Copy link
Contributor

Yeah, it should. I've added it now.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
acknowledged GitHub staff acknowledges this issue false-positive
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@ryao @MathiasVP