[C] How to query the variable expression used in array initialization?

[hyunsooda]

In the following C code,

1: void foo() {
2:     int myval = 1;
3:     myval += 2;
4:     int myarr[myval];
5:     ...
6: }

My initial goal was to investigate potential out-of-bounds access issues, exemplified by code like mayarr[myval+1] = 123. Initially, I attempted to retrieve the variable influencing the array initialization on line 4. However, after thorough searching and exploration, I concluded that there is no straightforward method to retrieve a variable that is exactly used in the array initialization.

In cases where the initialization code is statically deterministic, as in int myarr[20], the ArrayType.getArraySize() function can be used. Unfortunately, this approach does not apply to the code mentioned above, as the variable is not trivially compile-time deterministic.

The official example code also focuses on cases with statically deterministic initialization. Is there anyone who can assist me in devising a query to address the initial problem?

[mbg]

Hi @hyunsooda 👋🏻

Thank you for your question! You can get hold of the expression used to dynamically set the size of an array through the VlaDimensionStmt type. For example:

from VlaDimensionStmt s
select s, s.getDimensionExpr()

If run on your sample code, this will return one result where getDimensionExpr() points at the expression of just myval.

We expose a getValue() predicate on expressions, but that will only return a result if the value is constant, which it is not here. We have experimental experimental.semmle.code.cpp.rangeanalysis.ArrayLengthAnalysis and experimental.semmle.code.cpp.rangeanalysis.InBoundsPointerDeref libraries which might be of interest to you.

[hyunsooda]

Hi @mbg,

Apologies for the delayed response. Your comment greatly aided my understanding of CodeQL. I successfully resolved the initial issue and have extended it to create a PoC. Thank you!

from VariableAccess var_access, VlaDimensionStmt s
where 
  TaintTracking::localExprTaint(var_access, s.getDimensionExpr())
select s.getDimensionExpr(), upperBound(var_access)