update

Author: dummyx

codeql-custom-queries-cpp/lib/guard_checker.qll

@@ -33,6 +33,29 @@ predicate isGcTrigger(Function function) {
   )
 }
 
+/**
+ * Functions that call known allocation/GC-triggering routines (e.g., rb_str_new, rb_ary_push).
+ * This widens GC trigger detection to cover common Ruby API allocators beyond gc_enter.
+ */
+predicate isAllocOrGcFunction(Function function) {
+  exists(FunctionCall call |
+    call.getEnclosingFunction() = function and
+    isAllocOrGcCall(call)
+  )
+}
+
+predicate isAllocOrGcCall(FunctionCall call) {
+  call.getTarget().getName() in [
+      "rb_str_new", "rb_str_buf_new", "rb_str_resize", "rb_str_concat", "rb_str_append",
+      "rb_ary_new", "rb_ary_push", "rb_ary_concat", "rb_ary_store",
+      "rb_hash_new", "rb_hash_aset", "rb_hash_lookup2",
+      "rb_obj_alloc", "rb_class_new_instance", "rb_funcall",
+      "ALLOC", "ALLOC_N", "REALLOC_N"
+    ]
+  or
+  call.getTarget() instanceof GcTriggerFunction
+}
+
 predicate isGcTrigger1(Function function) {
   exists(Expr s, Call call |
     s.getEnclosingFunction() = function and
@@ -94,7 +117,7 @@ predicate isGcTriggerWithFunctionPointer(Function function) {
 }
 
 class GcTriggerFunction extends Function {
-  GcTriggerFunction() { isGcTrigger(this) }
+  GcTriggerFunction() { isGcTrigger(this) or isAllocOrGcFunction(this) }
 }
 
 class GcTriggerFunctionWithFunctionPointer extends Function {
@@ -109,45 +132,6 @@ class GcTriggerCall extends FunctionCall {
   }
 }
 
-class GcTriggerCallWithFunctionPointer extends Expr {
-  GcTriggerCallWithFunctionPointer() {
-    if this instanceof FunctionCall
-    then this.(FunctionCall).getTarget() instanceof GcTriggerFunctionWithFunctionPointer
-    else (
-      if this instanceof VariableAccess
-      then this.(VariableAccess).getTarget().getType() instanceof FunctionPointerType
-      else none()
-    )
-  }
-}
-
-predicate isArgumentNotSafe(GcTriggerFunction gcTriggerFunc, int i, ValueVariable v) {
-  exists(GcTriggerCall innerGcTriggerCall, VariableAccess pAccess |
-    gcTriggerFunc.getAPredecessor+() = innerGcTriggerCall and
-    pAccess = innerGcTriggerCall.getASuccessor+() and
-    gcTriggerFunc.getParameter(i).getAnAccess() = pAccess
-  )
-  or
-  exists(GcTriggerCall recursiveGcTriggerCall, int j |
-    recursiveGcTriggerCall = gcTriggerFunc.getAPredecessor+() and
-    gcTriggerFunc.getParameter(i).getAnAccess() = recursiveGcTriggerCall.getAnArgumentSubExpr(j) and
-    isArgumentNotSafe(recursiveGcTriggerCall.getTarget(), j, v)
-  )
-}
-
-
-/*
-predicate pointerPassedNotSafe(GcTriggerCall gtc, ControlFlowNode pAccess, ValueVariable v) {
-  gtc.getAnArgument() = pAccess and (not gtc.getAnArgument().(ValueAccess).getTarget() = v)
-  and
-  exists(GcTriggerCall innerGcTriggerCall, VariableAccess pAccess |
-    gcTriggerFunc.getAPredecessor+() = innerGcTriggerCall and
-    pAccess = innerGcTriggerCall.getASuccessor+() and
-    gcTriggerFunc.getParameter(i).getAnAccess() = pAccess
-  )
-}
-  */
-
 predicate needsGuard(
   ValueVariable v, PointerVariable innerPointer, GcTriggerCall gtc,
   ControlFlowNode pointerAccess, ControlFlowNode innerPointerTaking
@@ -164,6 +148,8 @@ predicate needsGuard(
   (
     isPointerUsedAfterGcTrigger(pointerAccess, gtc)
     or
+    pointerPassedToGcAlloc(gtc, pointerAccess)
+    or
     exists(GcTriggerCall gtcInter |
       gtcInter.getAnArgument() = pointerAccess or gtc.getAnArgument() = innerPointerTaking
     )
@@ -214,13 +200,6 @@ string getGuardInsertionLineBR(ValueVariable v) {
   else result = v.getParentScope().getLocation().getEndLine().toString()
 }
 
-string getGuardInsertionLineBRLA(ValueVariable v) {
-  exists(ValueAccess lva |
-    not exists(ValueAccess va | va = lva.getASuccessor+()) and
-    result = lva.getLocation().getEndLine().toString()
-  )
-}
-
 predicate isTarget(ValueVariable v) {
   v.getEnclosingElement() instanceof TopLevelFunction and
   // v.getIniti and

codeql-custom-queries-cpp/lib/patterns.qll

@@ -114,6 +114,30 @@ predicate isPointerUsedAfterGcTrigger(
   gcTriggerCall.getASuccessor+() = pointerUsageAccess
 }
 
+/**
+ * Interprocedural: pointer argument is passed to a callee that performs an
+ * allocation/GC-triggering call using that parameter.
+ */
+predicate pointerPassedToGcAlloc(FunctionCall call, PointerVariableAccess pAccess) {
+  exists(int i |
+    call.getAnArgumentSubExpr(i) = pAccess and
+    calleeParameterUsedInAlloc(call.getTarget(), i)
+  )
+}
+
+predicate calleeParameterUsedInAlloc(Function callee, int idx) {
+  exists(FunctionCall innerCall, VariableAccess paramUse |
+    innerCall.getEnclosingFunction() = callee and
+    isAllocOrGcCall(innerCall) and
+    (
+      innerCall.getAnArgument() = paramUse and
+      paramUse.getTarget() = callee.getParameter(idx)
+      or
+      innerCall.getAnArgument().getAChild*() = callee.getParameter(idx).getAnAccess()
+    )
+  )
+}
+
 
 /*
 predicate passedToGcTrigger(ValueVariable v, ValueAccess initVAccess, FunctionCall gcTriggerCall) {

codeql-custom-queries-cpp/redundant_guards_vo.ql

@@ -0,0 +1,13 @@
+import cpp
+import lib.guard_checker
+
+from ValueVariable v
+where
+  not exists(
+    PointerVariable p, GcTriggerCall gtc, PointerVariableAccess pointerUsageAccess,
+    PointerDerivationAction innerPointerTaking
+  |
+    needsGuard(v, p, gtc, pointerUsageAccess, innerPointerTaking)
+  ) and
+  hasGuard(v)
+select v

codeql-custom-queries-cpp/test-cases/README.md

@@ -0,0 +1,35 @@
+Quick C fixtures mirroring real RB_GC_GUARD patterns from CRuby (weakmap, prism, yjit) plus a missing-guard case and a redundant-guard case.
+
+## Layout
+- `ruby_stubs.h` – minimal VALUE/RB_GC_GUARD/GC-trigger/pointer-extractor shims to keep the fixtures self contained.
+- `weakmap_like.c` – pointer extracted via `RSTRING_PTR`, GC trigger happens, guard placed after last pointer use (expected **good guard**).
+- `prism_like.c` – loop over locals, inner pointer via `rb_id2name`, guarded (expected **good guard**).
+- `yjit_like.c` – multiple VALUEs guarded after GC-triggering hash updates (expected **good guards**).
+- `missing_guard.c` – pointer extracted then GC trigger but no guard (expected **missing_guard** finding).
+- `redundant_guard.c` – guard without any pointer extraction/GC trigger (expected **redundant_guard** finding).
+- `interproc_missing_guard.c` – derived pointer passed to another function that triggers GC and uses the pointer (expected **missing_guard** if interprocedural pointer use is modeled).
+- `array_guard.c` – `RARRAY_PTR` inner pointer used after `rb_ary_push`, guarded (expected **good guard**).
+- `data_ptr_guard.c` – `DATA_PTR` inner pointer used after `rb_str_new`, guarded (expected **good guard**).
+- `inline_missing_guard.c` – inline `RSTRING_PTR` argument to `rb_str_new` reused later without guard (expected **missing_guard** via inline pattern).
+- `inline_guarded.c` – inline pointer extraction with guard present (expected **good guard**).
+- `redundant_inline_guard.c` – pointer extracted but no GC trigger; guard present (expected **redundant_guard**).
+- `redundant_param_guard.c` – guard on parameter without pointer extraction or GC trigger (expected **redundant_guard**).
+
+## Quick run with CodeQL
+```bash
+# From repo root
+cd codeql-custom-queries-cpp/test-cases
+
+# Build a small database (requires clang or cc)
+codeql database create ../test-db --language=cpp --source-root . \
+  --command="cc -c *.c"
+
+# Run queries
+codeql query run ../missing_guards.ql --database ../test-db --output ../missing_guards.bqrs
+codeql bqrs decode --format=csv --output ../missing_guards.csv ../missing_guards.bqrs
+
+codeql query run ../redundant_guards.ql --database ../test-db --output ../redundant_guards.bqrs
+codeql bqrs decode --format=csv --output ../redundant_guards.csv ../redundant_guards.bqrs
+```
+
+You can swap in other queries (e.g., `good_guards.ql`, `all_guarded_variables.ql`) against the same database.

codeql-custom-queries-cpp/test-cases/array_guard.c

@@ -0,0 +1,10 @@
+#include "ruby_stubs.h"
+
+/* Array inner pointer survives push; guard the VALUE holding it */
+VALUE array_guard_example(VALUE ary) {
+    VALUE *ptr = (VALUE *)RARRAY_PTR(ary); /* inner pointer */
+    rb_ary_push(ary, LONG2NUM(42));        /* GC trigger */
+    VALUE first = ptr[0];                  /* pointer reused */
+    RB_GC_GUARD(ary);                      /* guard after pointer use */
+    return first;
+}

codeql-custom-queries-cpp/test-cases/array_guard.o

@@ -0,0 +1,12 @@
+#include "ruby_stubs.h"
+
+struct foo { int x; };
+
+/* DATA_PTR-derived pointer used after GC trigger; guard the VALUE */
+VALUE data_ptr_guard_example(VALUE obj) {
+    struct foo *p = (struct foo *)DATA_PTR(obj); /* inner pointer */
+    VALUE res = rb_str_new("foo", 3);            /* GC trigger */
+    p->x = 7;                                    /* pointer reused */
+    RB_GC_GUARD(obj);                            /* guard after use */
+    return res;
+}

codeql-custom-queries-cpp/test-cases/data_ptr_guard.c

@@ -0,0 +1,10 @@
+#include "ruby_stubs.h"
+
+/* Inline pointer extraction reused with guard present */
+VALUE inline_guarded(VALUE str) {
+    VALUE part = rb_str_new(RSTRING_PTR(str), 3);  /* GC trigger with inline ptr */
+    VALUE later = rb_str_new(RSTRING_PTR(str), 2); /* reuse inline ptr pattern */
+    VALUE out = rb_str_concat(part, later);
+    RB_GC_GUARD(str);                              /* guard original VALUE */
+    return out;
+}