search

github / codeql

CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security
https://codeql.github.com
MIT License
7.6k stars 1.52k forks source link

LGTM.com - false positive - cs/dereferenced-value-is-always-null when passed by ref to a method like Array.Resize #2753

Open ahsonkhan opened 4 years ago

ahsonkhan commented 4 years ago

Description of the false positive

In general, the cs/dereferenced-value-is-always-null rule makes sense: https://lgtm.com/rules/1506094316834/

However, if a local is passed to a method by ref, it is possible that the method changes its value. In particular, if an array is null, Array.Resize will set it to not null. This applies generally to any method that accepts a parameter by ref.

https://github.com/dotnet/runtime/blob/c5805025613513ca71b905d3cdafdcba0769960d/src/libraries/System.Private.CoreLib/src/System/Array.cs#L43-L61

URL to the alert on the project page on LGTM.com

https://lgtm.com/projects/g/dotnet/corefx/snapshot/4fed824926d1c659c494bd5261fbae0236b2e9da/files/src/System.Runtime.Serialization.Formatters/src/System/Runtime/Serialization/FormatterServices.cs?sort=name&dir=ASC&mode=heatmap#x520a4bc6d0c2a055:1

calumgrant commented 4 years ago

Many thanks for your report, and I agree that this is definitely a false positive. We shall work on a fix for this.

Whathecode commented 4 months ago

This applies generally to any method that accepts a parameter by ref.

We just ran into the same issue. This rule does not take the ref keyword into account. I suggest to change the title of this bug report to make clear it impacts a broader scope.

Any update on this?