github-learning-lab[bot]
commented
3 years ago :keyboard: Activity: Find all the calls to memcpy
- Edit the file
6_memcpy_calls.ql - Use the auto-completion feature to find the class that represents function calls, and declare a variable that belongs to this class.
- Use auto-completion again on your function call variable to guess the predicate that tells us the target function that is being called.
- Combine this with your logic from step 4 to make sure the target function is named
memcpy. - Once you're happy with the results, submit your solution.
Tip: You can have a look at this C++ example in the CodeQL cookbook. Note that your query will be simpler as you won't need to consider the declaringType.
Note: Once you have good results, you can try to make your query more compact by omitting the intermediate Function variable. The 2 queries below are equivalent:
from Class1 c1, Class2 c2
where
c1.getClass2() = c2 and
c2.getProp() = "something"
select c1from Class1 c1
where c1.getClass2().getProp() = "something"
select c1
b1tg
Step 6: Relating two variables
In step 4, you wrote a query that finds the definitions of functions named
memcpyin the codebase. Now, we want to find all the calls tomemcpyin the codebase.One way to do this is to declare two variables: one to represent functions, and one to represent function calls. Then you will have to create a relationship between these variables in the
wheresection, so that they are restricted to only functions that are namedmemcpy, and calls to exactly those functions.