Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Reduce false positives in CWE-416 check #433

Merged
merged 3 commits into from
Dec 19, 2023
Merged

Reduce false positives in CWE-416 check #433

merged 3 commits into from
Dec 19, 2023

Conversation

Enkelmann
Copy link
Contributor

Since tracking of nested parameter objects greatly increased the amount of tracked memory objects, it also greatly increased the amount of false positives found by the CWE-416 Use After Free check. This PR implements several heuristic mitigations designed to reduce the number of false positives found by the check:

  • If an object gets freed in the same call as it was created, the dangling status of its pointer is not propagated to callers. A common pattern is to free freshly created objects on errors and return a null pointer instead. But the analysis cannot yet track the invariant that the pointer is only returned when it is not freed, so we have to handle this pattern heuristically.
  • If an object gets freed and subsequently generates a Use After Free warning in the same call then the the fact that it was freed by the call is not propagated to the caller. This should reduce duplicate CWE warnings when objects get freed on error paths.
  • The function signature analysis now should not generate a parameter for the first element in an array if the function loops over it. Thus the CWE-416 analysis also does not track these elements and does not generate false positive warnings if the elements of an array are freed in a loop.
  • Free operations for recursive data structures like linked lists are heuristically identified and ignored by the analysis. This should prevent false positives for when such a data structure gets freed using a loop.

@Enkelmann Enkelmann merged commit d7cb4c9 into master Dec 19, 2023
10 checks passed
@Enkelmann Enkelmann deleted the uaf_fp_reduction branch December 19, 2023 06:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant