<!DOCTYPE qhelp PUBLIC

"-//Semmle//qhelp//EN"

"qhelp.dtd">

<qhelp>

<overview>

<p>Using variables with the same name is dangerous. However, such a situation inside the while loop can lead to a violation of the accessibility of the program. Requires the attention of developers.</p>

</overview>

<recommendation>

<p>We recommend not to use local variables inside a loop if their names are the same as the variables in the condition of this loop.</p>

</recommendation>

<example>

<p>The following example demonstrates an erroneous and corrected use of a local variable within a loop.</p>

<sample src="DeclarationOfVariableWithUnnecessarilyWideScope.c" />

</example>

<references>

<li>

CERT C Coding Standard:

<a href="https://wiki.sei.cmu.edu/confluence/display/c/DCL01-C.+Do+not+reuse+variable+names+in+subscopes">DCL01-C. Do not reuse variable names in subscopes</a>.

</li>

</references>

</qhelp>

import cpp

class DangerousWhileLoop extends WhileStmt {

Expr exp;

Declaration dl;

DangerousWhileLoop() {

this = dl.getParentScope().(BlockStmt).getParent*() and

exp = this.getCondition().getAChild*() and

not exp instanceof PointerFieldAccess and

not exp instanceof ValueFieldAccess and

exp.toString() = dl.getName() and

not exp.getParent*() instanceof CrementOperation and

not exp.getParent*() instanceof Assignment and

not exp.getParent*() instanceof FunctionCall

}

Declaration getDeclaration() { result = dl }

/** Holds when there are changes to the variables involved in the condition. */

predicate isUseThisVariable() {

exists(Variable v |

this.getCondition().getAChild*().(VariableAccess).getTarget() = v and

(

exists(Assignment aexp |

aexp = this.getStmt().getAChild*() and

(

aexp.getLValue().(ArrayExpr).getArrayBase().(VariableAccess).getTarget() = v

or

aexp.getLValue().(VariableAccess).getTarget() = v

)

)

or

exists(CrementOperation crm |

crm = this.getStmt().getAChild*() and

crm.getOperand().(VariableAccess).getTarget() = v

)

)

)

}

from DangerousWhileLoop lp

where not lp.isUseThisVariable()

select lp.getDeclaration(), "A variable with this name is used in the loop condition."