github / codeql

CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security
https://codeql.github.com
MIT License
7.55k stars 1.51k forks source link

C++: support the search order of header files used by clang/gcc #16648

Closed qwerty472123 closed 3 weeks ago

qwerty472123 commented 4 months ago

As a example:

#include "b.h"
hi_c c;
#include "c.h"
hello_c c;
#include "a/a.h"
# clang++ -I b -I c -c test.cpp -otest
In file included from test.cpp:1:
In file included from ./a/a.h:1:
In file included from b/b.h:1:
c/c.h:1:1: error: unknown type name 'hello_c'
hello_c c;
^
1 error generated.
# g++ -I b -I c -c test.cpp -otest
In file included from b/b.h:1:0,
                 from a/a.h:1,
                 from test.cpp:1:
c/c.h:1:1: error: ‘hello_c’ does not name a type
 hello_c c;
 ^~~~~~~

however, when use codeql extractor by /usr/local/bin/codeql/cpp/tools/linux64/extractor --mimic clang++ -I b -I c -c test.cpp -otest, it shows

"a/c.h", line 1: error: identifier "hi_c" is undefined
  hi_c c;
  ^

[E 09:26:49 145792] Warning[extractor-c++]: In construct_text_message: "a/c.h", line 1: error: identifier "hi_c" is undefined
  hi_c c;
  ^

It includes a/c.h, which is the same with MSVC, but gcc/clang includes c/c.h.

Clang and GCC using a static context for search directory, but MSVC use a dynamic context, which caused the problem.

I wanna CodeQL extractor to support the behavior of Clang and GCC for more consistent result with the clang compiled ELF.

jketema commented 4 months ago

Hi @qwerty472123,

Thanks for your report. This indeed seems incorrect. I've opened an internal issue to track this.

jketema commented 3 weeks ago

This will be fixed in CodeQL 2.19.0, which should be released within the next couple of weeks.