Skip to content

DescriptorNeverClosed.ql identifies only sockets (not file handles) #2623

@marcrepo

Description

@marcrepo

Description of the issue
The wiki description for the DescriptorNeverClosed Library
(URL: https://help.semmle.com/wiki/display/CCPPOBJ/Open+descriptor+never+closed)
states that this library identifies both socket handles and file handles that have not been
closed. However, it appears the query only searches for socket handles that have not been closed.

In the DescriptorNeverClosed.ql file (URL: https://github.com/Semmle/ql/blob/master/cpp/ql/src/Critical/DescriptorNeverClosed.ql)
the handles being search for by the query are initially acquired with the allocateDescriptorCall predicate that appears in the where clause (line 29 of the DescriptorNeverClosed.ql file).

However, the implementation of this predicate, which is found in https://github.com/Semmle/ql/blob/3a95cd5e9c15f02208c73d3972f6283a27ca8657/cpp/ql/src/semmle/code/cpp/pointsto/PointsTo.qll

has the following implementation - which only searches for socket handles (starting line 699):

predicate allocateDescriptorCall(FunctionCall fc) {
exists(string name |
name = "socket" and
fc.getTarget().hasGlobalName(name)
)
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    C++questionFurther information is requested

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions