new expression parsing failure

[MFaisalZaki]

CodeQL fails to parse new expressions like:

  short s;
  long *lp = ::new (&s) long;

This issue arose when trying to implement SEI CERT C++ rules using CodeQL.

[geoffw0]

What exactly is the behaviour you want that you are not seeing? The call to ::new should be accessible as a NewExpr in CodeQL, and you can use getPlacementPointer() to get the &s.

[MFaisalZaki]

When I am trying to run this query

from NewOrNewArrayExpr fncall
select fncall.getAllocatorCall().getAnArgument()

in order to check the allocation type long matches the enclosing variable type it generates an <error expr> and the &s.

[MathiasVP]

Thanks for reporting this issue @MFaisalZaki. I've created an internal issue for tracking this.

[jketema]

Hi @MFaisalZaki,

Just for my understanding. When you tried to parse the placement new from your example, did you also #include <new>? This is generally also needed with compilers like gcc and clang. They will also not parse the code without it.

When I locally try this and #include <new>, the fragment parses for me.

[MFaisalZaki]

@jketema That's true; you must include #include <new> to compile the code. However, I have used the MSVC compiler, not GCC/clang.

[jketema]

Hi @MFaisalZaki

Thanks for the clarification. There's definitely an issue here, which we'll keep tracking.

in order to check the allocation type long matches the enclosing variable type it generates an <error expr> and the &s.

Note that the <error expr> takes the place of the size argument of the new operator, so even if it was correctly captured, it would not give you the long type, but only its size.

To compare the allocation type and the type of the placement pointer, a better approach is to use the predicates directly defined on NewExpr, as @geoffw0 already suggests, and then look at the underlying types:

import cpp

from NewExpr new, Expr placementPtr
where placementPtr = new.getPlacementPointer()
select placementPtr, placementPtr.getUnderlyingType().(PointerType).getBaseType(),
  new.getAllocatedType().getUnderlyingType()

For your example this give me:

| test.cpp:64:21:64:22 | & ... | file://:0:0:0:0 | short | file://:0:0:0:0 | long |