CodeQL library for C/C++
codeql/cpp-all 0.9.3 ( changelog , source )

Member predicate AliasFunction :: parameterNeverEscapes

Holds if the address passed to the parameter at the specified index is never retained after the function returns.


int* g;
int* func(int* p, int* q, int* r, int* s, int n) {
  *s = 1;  // `s` does not escape.
  g = p;  // Stored in global. `p` escapes.
  if (rand()) {
    return q;  // `q` escapes via the return value.
  else {
    return r + n;  // `r` escapes via the return value, even though an offset has been added.

For the above function, the following terms hold:

  • parameterEscapesOnlyViaReturn(1)
  • parameterEscapesOnlyViaReturn(2)
  • parameterNeverEscapes(3)
predicate parameterNeverEscapes ( int index )