Skip to content

Conversation

@MathiasVP
Copy link
Collaborator

This is a new cute little library I made as a response to a request from @bdrodes. The library makes it easy to construct paths that shows how an expression constructed from a set of nested macro expansions ends up in a piece of code. For example, let's say we want to find uses of sizeof(int) and we see code like this:

#define DEBUG 1

#define MY_SIZEOF(x) sizeof(x)

#ifdef DEBUG
#define MY_FOO(y) MY_SIZEOF(y)
#else
#define MY_FOO(y) 0
#endif

int test() {
  return MY_FOO(int);
}

If you simply create a query that finds occurences of sizeof(int) you'll flag up the returned expression. However, it's not clear to a user why that expression is being alerted on. With this library we can do:

/**
 * @kind path-problem
 */

import cpp
import semmle.code.cpp.macroflow.MacroFlow

module MyConfig implements MacroFlow::ConfigSig {
  predicate isSink(Expr e) { e.(SizeofTypeOperator).getTypeOperand() instanceof IntType }
}

module Flow = MacroFlow::Make<MyConfig>;

import Flow::PathGraph

from Flow::Node n1, Flow::Node n2, Expr e
where Flow::flowsTo(n1, n2, e)
select e, n1, n2, "Use of sizeof with integer type."

and we then get:

image

which makes it clear to a user where that sizeof is coming from.

I think this library could be really useful in general for C/C++ queries going forward. I may even upstream it to GitHub if I can find a good place to use it.

@MathiasVP MathiasVP merged commit eba5208 into main Dec 2, 2025
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants