Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Implement Memory1 (RULE-8-7-1)#967

Open
jeongsoolee09 wants to merge 88 commits intomainfrom
jeongsoolee09/MISRA-C++-2023-Memory
Open

Implement Memory1 (RULE-8-7-1)#967
jeongsoolee09 wants to merge 88 commits intomainfrom
jeongsoolee09/MISRA-C++-2023-Memory

Conversation

@jeongsoolee09
Copy link
Copy Markdown
Collaborator

@jeongsoolee09 jeongsoolee09 commented Nov 18, 2025 •
edited by MichaelRFairhurst
Loading

Description

Implement Memory1 (RULE-8-7-1).

Change request type

  • Release or process automation (GitHub workflows, internal scripts)
  • Internal documentation
  • External documentation
  • Query files (.ql, .qll, .qls or unit tests)
  • External scripts (analysis report or other code shipped as part of a release)

Rules with added or modified queries

  • No rules added
  • Queries have been added for the following rules:
    • RULE-8-7-1
  • Queries have been modified for the following rules:
    • rule number here

Release change checklist

A change note (development_handbook.md#change-notes) is required for any pull request which modifies:

  • The structure or layout of the release artifacts.
  • The evaluation performance (memory, execution time) of an existing query.
  • The results of an existing query in any circumstance.

If you are only adding new rule queries, a change note is not required.

Author: Is a change note required?

  • Yes
  • No

🚨🚨🚨
Reviewer: Confirm that format of shared queries (not the .qll file, the
.ql file that imports it) is valid by running them within VS Code.

  • Confirmed

Reviewer: Confirm that either a change note is not required or the change note is required and has been added.

  • Confirmed

Query development review checklist

For PRs that add new queries or modify existing queries, the following checklist should be completed by both the author and reviewer:

Author

  • Have all the relevant rule package description files been checked in?
  • Have you verified that the metadata properties of each new query is set appropriately?
  • Do all the unit tests contain both "COMPLIANT" and "NON_COMPLIANT" cases?
  • Are the alert messages properly formatted and consistent with the style guide?
  • Have you run the queries on OpenPilot and verified that the performance and results are acceptable?
    As a rule of thumb, predicates specific to the query should take no more than 1 minute, and for simple queries be under 10 seconds. If this is not the case, this should be highlighted and agreed in the code review process.
  • Does the query have an appropriate level of in-query comments/documentation?
  • Have you considered/identified possible edge cases?
  • Does the query not reinvent features in the standard library?
  • Can the query be simplified further (not golfed!)

Reviewer

  • Have all the relevant rule package description files been checked in?
  • Have you verified that the metadata properties of each new query is set appropriately?
  • Do all the unit tests contain both "COMPLIANT" and "NON_COMPLIANT" cases?
  • Are the alert messages properly formatted and consistent with the style guide?
  • Have you run the queries on OpenPilot and verified that the performance and results are acceptable?
    As a rule of thumb, predicates specific to the query should take no more than 1 minute, and for simple queries be under 10 seconds. If this is not the case, this should be highlighted and agreed in the code review process.
  • Does the query have an appropriate level of in-query comments/documentation?
  • Have you considered/identified possible edge cases?
  • Does the query not reinvent features in the standard library?
  • Can the query be simplified further (not golfed!)

@jeongsoolee09 jeongsoolee09 self-assigned this Nov 18, 2025
@jeongsoolee09
Add Memory1 package files
a5d4127
@jeongsoolee09
Expose malloc, calloc and realloc
1a2cde8
@jeongsoolee09
Minor comments
c21e862
@jeongsoolee09
Checkpoint
c0b1e55
@jeongsoolee09
Split out source and sinks into their cases
9d3bab0
@jeongsoolee09
Checkpoint
a8a6db7
@jeongsoolee09
Merge branch 'main' into jeongsoolee09/MISRA-C++-2023-Memory
4464702
@jeongsoolee09
Checkpoint: Add DynamicAllocation case
e2c5870
@jeongsoolee09
First working draft
fe2a3c4
@jeongsoolee09
Refine into path-problem
5ea652b
@jeongsoolee09
Change TaintTracking to DataFlow
7b860d9
@jeongsoolee09
Finalize first working draft for stack / heap arrays
08b8bf7
@jeongsoolee09
Document code copy and clean up imports
062c62f
@jeongsoolee09
Add multidimensional arrays alloc'ed on stack
e264dfd
@jeongsoolee09
Add test.cpp and expected test results
4d2bc8b
@jeongsoolee09
Add exclusion for Memory1.qll
21500b8
@jeongsoolee09
Adjust precision of existing rule and add a supplementary rule
e9f39a2
@jeongsoolee09
Add supplementary query files
a62e2e1
@jeongsoolee09
Fix @kind from problem to path-problem
ca62995
@jeongsoolee09
Copy OutOfBounds.qll to cpp/common/src/codingstandards/cpp/
8abf097
@jeongsoolee09
Remove unused import codingstandards.cpp.Variable in OutOfBounds.qll
f5454de
@jeongsoolee09
Add PointerArgumentToCstringFunctionIsInvalid.ql and create testref f…
d82ed6e 
…or it
@jeongsoolee09
Copy test.c from ARR38-C and add strncpy
356bbf2
@jeongsoolee09
Add headers, Add defininitions to headers, remove cases without null …
4c4cf49 
…terminator, remove file pointer cases

1. Add headers, Adding missing headers: For obvious reasons.
2. Remove cases without null terminator: Both clang and g++ do not permit
   strings to be allocated that are declared to be shorter than the actual
   initializing expression. Since this is a C++ rule, we rule them out.
3. File pointer manipulation functions (e.g. fgets): Not required by the rule.
@jeongsoolee09
Remove testref and add qlref and expected
9ced913
@jeongsoolee09
Address case of strncat
1c5dc84
@jeongsoolee09
Remove unused predicate and update .expected
2f80208
@jeongsoolee09
Copy link
Copy Markdown
Collaborator Author

jeongsoolee09 commented Apr 21, 2026

Two things to note about the multidimensional arrays:

  1. If a row access and the row element access are apart from each other with a function boundary in between, the query loses indirection information. We probably need to add a level column to simulate push-pop behavior: taking an indirection edge during initialization pushes and accesses pops them.
  2. Currently, the relationship between FatPointer and DataFlow::Node is one-to-many, if we don't-care the level column. The multidimensional array accesses have duplicate alerts and this is probably what is causing it.

MichaelRFairhurst
MichaelRFairhurst requested changes Apr 22, 2026
View reviewed changes
Copy link
Copy Markdown
Collaborator

@MichaelRFairhurst MichaelRFairhurst left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

literally just minor tweaks!! This looks 🔥 great!

Comment thread cpp/common/src/codingstandards/cpp/OutOfBounds.qll
Comment thread cpp/misra/src/rules/RULE-8-7-1/PointerArithmeticFormsAnInvalidPointer.ql
Comment thread cpp/misra/src/rules/RULE-8-7-1/PointerArithmeticFormsAnInvalidPointer.ql Outdated
Comment thread cpp/misra/src/rules/RULE-8-7-1/PointerArithmeticFormsAnInvalidPointer.ql
Comment thread cpp/misra/test/rules/RULE-8-7-1/test.cpp Outdated
Comment thread cpp/misra/test/rules/RULE-8-7-1/test.cpp Outdated
Comment thread rule_packages/cpp/Memory1.json
Comment thread rule_packages/cpp/Memory1.json Outdated
Comment thread rule_packages/cpp/Memory1.json
Comment thread cpp/misra/src/rules/RULE-8-7-1/PointerArithmeticFormsAnInvalidPointer.ql
@jeongsoolee09
Experiment dealing including / excluding AddressOfExpr
4f55c77
@jeongsoolee09
Remove FALSE_NEGATIVE labels from offshoots-to-left cases
ebd1e58 
These are no longer false negatives, is now reported correctly
with the new algorith (`srcSinkLengthMap`).
@jeongsoolee09
Clean up logic in ArrayDeclaration
e8cb6b5
@jeongsoolee09
Fix formatting
b3fb756
@jeongsoolee09
Flag a case as false negative
a21c8ba 
This is consistently broken across all queries that depend on it:

- c/misra/src/rules/RULE-21-17/StringFunctionPointerArgumentOutOfBounds.ql
- c/misra/src/rules/RULE-21-18/StringLibrarySizeArgumentOutOfBounds.ql
- c/cert/src/rules/ARR30-C/DoNotFormOutOfBoundsPointersOrArraySubscripts.ql
- c/cert/src/rules/ARR38-C/LibraryFunctionArgumentOutOfBounds.ql
@jeongsoolee09
Update the expected results of both queries
b560fef 
This is the aftermath of fixing the formatting.
@jeongsoolee09
Update rule description file of Memory1
60ddfaa
@MichaelRFairhurst
Copy link
Copy Markdown
Collaborator

MichaelRFairhurst commented Apr 23, 2026

LGTM once the build passes!

@jeongsoolee09 jeongsoolee09 enabled auto-merge April 24, 2026 01:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@MichaelRFairhurst MichaelRFairhurst MichaelRFairhurst approved these changes

Assignees

@jeongsoolee09 jeongsoolee09

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@jeongsoolee09 @MichaelRFairhurst