CodeQL library for C/C++
codeql/cpp-all 0.13.0 (changelog, source)
Search

Predicate EscapesTree_Cached::variableAddressEscapesTree

Holds if e is a fully-converted expression that evaluates to an address derived from the address of va and is stored in a variable or passed across functions. This means e is the Expr.getFullyConverted-form of:

  • The right-hand side of an assignment or initialization;
  • A function argument or return value;
  • The argument to throw.
  • An entry in an AggregateLiteral, including the compiler-generated ClassAggregateLiteral that initializes a LambdaExpression; or
  • An expression in an inline assembly statement.

This predicate includes pointers or reference to const types. See variableAddressEscapesTreeNonConst for a version of this predicate that does not.

If va has reference type, the escape analysis concerns the value pointed to by the reference rather than the reference itself. The C++ language does not allow taking the address of a reference in any way, so this predicate would never produce any results for the reference itself. Callers that are not interested in the value referred to by references should exclude variable accesses to reference-typed values.

Import path

import semmle.code.cpp.dataflow.EscapesTree
predicate variableAddressEscapesTree(VariableAccess va, Expr e)