New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Find a double free #12455
Comments
|
Thank you for your question! While there aren't any queries in the default suite that have to do with detecting "double free" errors, there is an experimental query that does this: Being experimental, there are no guarantees that it actually works on your code, but I guess you could give it a shot and see if it fits your use-case. |
|
Thank you for your helpful response to my inquiry. I attempted to utilize CWE-415/DoubleFree.ql to address my problem, but unfortunately it was not effective. However, I have since written a codeql query that has partially achieved the desired outcome, though it still requires some changes. Here is my codeql for your consideration: The current search can discover connections among lines (69, 91), (109, 128), and (110, 129), but there is still a need to identify connections for lines (111, 130) that have not yet been identified. Can you assist me in resolving this problem? @tausbn @bgianfo @krukow @twpayne Thank you very much! |
|
Please do not spam me with mentions. If it happens I again I will report you to GitHub for abuse. |
|
I think the issue with your query is that the occurrences of This goes beyond my knowledge of how the C analysis works, so I'll loop in someone from the C team to take a look at it. |
|
Hi @puya-pakshad, we have a couple of suggestions:
then extend This ought to catch the specific case you're interested in and many like it, but it won't cover everything. I also think you're going to start seeing false positive results if you aren't already (restricting
|
Description of the issue
I possess a source code and my goal is to identify any instances of double free vulnerabilities. Technically, the double free vulnerabilities within this source code are associated with three sets of free(): lines 109, 110, and 111, as well as their corresponding pairs at lines 128, 129, and 130. I have examined numerous .ql queries that have been created by the authors of codeql, but none of them have been effective in detecting double free vulnerabilities.
Would anyone be able to assist me with this matter, please?
`
The text was updated successfully, but these errors were encountered: