CPP: Add query for CWE-570 detect and handle memory allocation errors.

[ihsinme]

In this query I am trying to find situations of incorrect handling of memory allocation using the new operator.
This error is quite common in projects and can lead to a violation of the logic of the program or to an unhandled crash.

of course, we can consider any selection without processing to be incorrect, but in this request I am considering exactly the situation of confusion. when the developer confused what kind of processing to apply. this allows us to understand that he tried to handle the case when the memory will not be allocated, but did not handle it correctly.

this is my first test file in C ++, it turned out to be rather weak, in the future I will think about improving it.

[ihsinme]

Information about the found and accepted fix in the project:

google/sentencepiece#581
assimp/assimp#3569

[geoffw0]

Hi, this looks like an interesting query for spotting simple errors in the use of new. As always I appreciate that you have included tests and qhelp. I think the query logic could be cleaner in a few places, but the comments make it fairly clear what is going on.

I intend to try this query out on LGTM and see what kinds of results we get. Based on what you're trying to do, I hope the results will be quite good. :)

[ihsinme]

thanks for your comments.
I ask you to give me the opportunity to correct these comments on my own, even if it will take more time, but this will allow better writing of the following queries.

[ihsinme]

I would like to hear your opinion.

[geoffw0]

LGTM, the CI tests are now running...

[geoffw0]

The checks have raised a couple of issues:

ql/cpp/ql/src/experimental/Security/CWE/CWE-570/WrongInDetectingAndHandlingMemoryAllocationErrors.ql would change by autoformatting.

i.e. the query file needs autoformatting.

ql/cpp/ql/src/experimental/Security/CWE/CWE-570/WrongInDetectingAndHandlingMemoryAllocationErrors.qhelp:6:269: The entity name must immediately follow the '&' in the entity reference.

I think the & should be escaped as &.

[geoffw0]

Great, merging...