CodeQL documentation

CodeQL library for C and C++

When analyzing C or C++ code, you can use the large collection of classes in the CodeQL library for C and C++.

About the CodeQL library for C and C++

There is an extensive library for analyzing CodeQL databases extracted from C/C++ projects. The classes in this library present the data from a database in an object-oriented form and provide abstractions and predicates to help you with common analysis tasks. The library is implemented as a set of QL modules, that is, files with the extension .qll. The module cpp.qll imports all the core C/C++ library modules, so you can include the complete library by beginning your query with:

import cpp

The rest of this topic summarizes the available CodeQL classes and corresponding C/C++ constructs.

Commonly-used library classes

The most commonly used standard library classes are listed below. The listing is broken down by functionality. Each library class is annotated with a C/C++ construct it corresponds to.

Declaration classes

This table lists Declaration classes representing C/C++ declarations.

Example syntax

CodeQL class

Remarks

int var ;

GlobalVariable

namespace N {float var ;}

NamespaceVariable

int func ( void ) {float var ;}

LocalVariable

See also Initializer

class C {int var ;}

MemberVariable

int func (const char param );

Function

template < typename T >
void func ( T param);

TemplateFunction

int func (const char* format , ...)
{}

FormattingFunction

func < int, float > ();

FunctionTemplateInstantiation

template < typename T >
func < int, T > () {}

FunctionTemplateSpecialization

class C {
int func ( float param );};

MemberFunction

class C {
int func ( float param ) const;};

ConstMemberFunction

class C {virtual int func () {} };

VirtualFunction

class C {C () {}};

Constructor

C::operator float () const;

ConversionOperator

class C {~ C ( void ) {}};

Destructor

class C {
C ( const D & d ) {}};

ConversionConstructor

C & C :: operator= (const C & );

CopyAssignmentOperator

C & C :: operator= ( C && );

MoveAssignmentOperator

C :: C (const C & );

CopyConstructor

C :: C ( C && );

MoveConstructor

C :: C (void);

NoArgConstructor

Default constructor

enum en { val1 , val2}

EnumConstant

friend void func ( int );
friend class B ;

FriendDecl

int func ( void ) {
enum en { val1 , val2};}

LocalEnum

class C {
enum en { val1 , val2}}

NestedEnum

enum class en : short { val1 , val2}

ScopedEnum

class C {
virtual void func ( int ) = 0;};

AbstractClass

template < int , float > class C {};

ClassTemplateInstantiation

template < > class C < Type > {};

FullClassTemplateSpecialization

template < typename T >
class C < T , 5 > {};

PartialClassTemplateSpecialization

int func ( void ) {class C {};}

LocalClass

class C {class D {};};

NestedClass

class C {
Type var ;
Type func ( Parameter) {}};

Class

struct S {
Type var ;
Type func ( Parameter) {}};
union U {
Type var1 ;
Type var2 ;};
template < typename T >
struct C : T {};

ProxyClass

Appears only in uninstantiated templates

int func ( void ) {
struct S {};}

LocalStruct

class C {
struct S {};};

NestedStruct

int * func ( void ) {union U {};}

LocalUnion

class C {union U {};};

NestedUnion

typedef int T ;

TypedefType

int func ( void ) {
typedef int T ;}

LocalTypedefType

class C {
typedef int T ;};

NestedTypedefType

class V :public B{};

ClassDerivation

class V :virtual B{};

VirtualClassDerivation

template < typename T >
class C {};

TemplateClass

int foo ( Type param1 , Type param2);

Parameter

template <typename T > T t ;

TemplateVariable

Since C++14

Statement classes

This table lists subclasses of Stmt representing C/C++ statements.

Example syntax

CodeQL class

Remarks

__asm__ (" movb %bh, (%eax) ");

AsmStmt

Specific to a given CPU instruction set

{ Stmt}

BlockStmt

catch ( Parameter ) BlockStmt

CatchBlock

catch ( ... ) BlockStmt

CatchAnyBlock

goto * labelptr ;

ComputedGotoStmt

GNU extension; use with LabelLiteral

Type i , j ;

DeclStmt

if ( Expr ) Stmt else Stmt

IfStmt

switch ( Expr ) { SwitchCase}

SwitchStmt

do Stmt while ( Expr )

DoStmt

for ( DeclStmt ; Expr ; Expr ) Stmt

ForStmt

for ( DeclStmt : Expr ) Stmt

RangeBasedForStmt

while ( Expr ) Stmt

WhileStmt

Expr ;

ExprStmt

__try {} __except ( Expr ) {}

MicrosoftTryExceptStmt

Structured exception handling (SEH) under Windows

__try {} __finally {}

MicrosoftTryFinallyStmt

Structured exception handling (SEH) under Windows

return Expr ;

ReturnStmt

case Expr :

SwitchCase

try { Stmt} CatchBlockCatchAnyBlock

TryStmt

void func (void) try { Stmt}

FunctionTryStmt

;

EmptyStmt

break;

BreakStmt

continue;

ContinueStmt

goto LabelStmt ;

GotoStmt

slabel :

LabelStmt

float arr [ Expr ] [ Expr ];

VlaDeclStmt

C99 variable-length array

Expression classes

This table lists subclasses of Expr representing C/C++ expressions.

Example syntax

CodeQL class(es)

Remarks

{ Expr}

alignof ( Expr )

AlignofExprOperator

alignof ( Type )

AlignofTypeOperator

Expr [ Expr ]

ArrayExpr

__assume ( Expr )

AssumeExpr

Microsoft extension

static_assert ( Expr , StringLiteral ) _Static_assert ( Expr , StringLiteral )

StaticAssert

C++11
C11

__noop;

BuiltInNoOp

Microsoft extension

Expr ( Expr)

ExprCall

func ( Expr)
instance . func ( Expr)

FunctionCall

Expr , Expr

CommaExpr

if ( Type arg = Expr )

ConditionDeclExpr

( Type ) Expr

CStyleCast

const_cast < Type > ( Expr )

ConstCast

dynamic_cast < Type > ( Expr )

DynamicCast

reinterpret_cast < Type > ( Expr )

ReinterpretCast

static_cast < Type > ( Expr )

StaticCast

template < typename... T >
auto sum ( T t )
{ return ( t + ... + 0 ); }

FoldExpr

Appears only in uninstantiated templates

int func ( format , ... );

FormattingFunctionCall

[ = ] ( float b ) -> float
{ return captured * b ; }

LambdaExpression

C++11

^ int ( int x , int y ) {
{ Stmt; return x + y ; }

BlockExpr

Apple extension

void * labelptr = && label ;

LabelLiteral

GNU extension; use with ComputedGotoStmt

“%3d %s\n”

FormatLiteral

0xdbceffca

HexLiteral

0167

OctalLiteral

‘c’

CharLiteral

“abcdefgh”, L”wide”

StringLiteral

new Type [ Expr ]

NewArrayExpr

new Type

NewExpr

delete [ ] Expr ;

DeleteArrayExpr

delete Expr ;

DeleteExpr

noexcept ( Expr )

NoExceptExpr

Expr = Expr

AssignExpr

See also Initializer

Expr += Expr

Expr /= Expr

AssignDivExpr

Expr *= Expr

AssignMulExpr

Expr %= Expr

AssignRemExpr

Expr -= Expr

Expr &= Expr

AssignAndExpr

Expr <<= Expr

AssignLShiftExpr

Expr ``

=`` Expr

AssignOrExpr

Expr >>= Expr

AssignRShiftExpr

Expr ^= Expr

AssignXorExpr

Expr + Expr



C99
C99

Expr / Expr


C99

Expr >? Expr

MaxExpr

GNU extension

Expr <? Expr

MinExpr

GNU extension

Expr * Expr


C99

Expr % Expr

RemExpr

Expr - Expr




C99
C99

Expr & Expr

BitwiseAndExpr

Expr | Expr

BitwiseOrExpr

Expr ^ Expr

BitwiseXorExpr

Expr << Expr

LShiftExpr

Expr >> Expr

RShiftExpr

Expr && Expr

LogicalAndExpr

Expr || Expr

LogicalOrExpr

Expr == Expr

EQExpr

Expr != Expr

NEExpr

Expr >= Expr

GEExpr

Expr > Expr

GTExpr

Expr <= Expr

LEExpr

Expr < Expr

LTExpr

Expr ? Expr : Expr

ConditionalExpr

& Expr

AddressOfExpr

* Expr

PointerDereferenceExpr

Expr --

PostfixDecrExpr

-- Expr

PrefixDecrExpr

Expr ++

PostfixIncrExpr

++ Expr

PrefixIncrExpr

__imag ( Expr )

ImaginaryPartExpr

GNU extension

__real ( Expr )

RealPartExpr

GNU extension

- Expr

UnaryMinusExpr

+ Expr

UnaryPlusExpr

~ Expr


GNU extension

! Expr

NotExpr

int vect __attribute__
( ( vector_size ( 16 ) ) )
= { 3 , 8 , 32 , 33 };

VectorFillOperation

GNU extension

sizeof ( Expr )

SizeofExprOperator

sizeof ( Type )

SizeofTypeOperator

template < typename... T >
int count ( T &&... t )
{ return sizeof... ( t ); }

SizeofPackOperator

( { Stmt; Expr } )

StmtExpr

GNU/Clang extension

this

ThisExpr

throw ( Expr );

ThrowExpr

throw;

ReThrowExpr

typeid ( Expr )
typeid ( Type )

TypeidOperator

__uuidof ( Expr )

UuidofOperator

Microsoft extension

Type classes

This table lists subclasses of Type representing C/C++ types.

Example syntax

CodeQL class

Remarks

void

VoidType

_Bool or bool

BoolType

char16_t

Char16Type

C11, C++11

char32_t

Char32Type

C11, C++11

char

PlainCharType

signed char

SignedCharType

unsigned char

UnsignedCharType

int

IntType

long long

LongLongType

long

LongType

short

ShortType

wchar_t

WideCharType

nullptr_t

NullPointerType

double

DoubleType

long double

LongDoubleType

float

FloatType

auto

AutoType

decltype ( Expr )

Decltype

Type [ n ]

ArrayType

Type ( ^ blockptr ) ( Parameter)

BlockType

Apple extension

Type ( * funcptr ) ( Parameter)

FunctionPointerType

Type ( & funcref ) ( Parameter)

FunctionReferenceType

Type __attribute__ ( ( vector_size ( n ) ) )

GNUVectorType

Type *

PointerType

Type &

LValueReferenceType

Type &&

RValueReferenceType

Type ( Class *:: membptr ) ( Parameter)

PointerToMemberType

template < template < typename > class C >

TemplateTemplateParameter

template < typename T >

TemplateParameter

Preprocessor classes

This table lists Preprocessor classes representing C/C++ preprocessing directives.

Example syntax

CodeQL class

Remarks

#elif condition

PreprocessorElif

#if condition

PreprocessorIf

#ifdef macro

PreprocessorIfdef

#ifndef macro

PreprocessorIfndef

#else

PreprocessorElse

#endif

PreprocessorEndif

#line line_number file_name

PreprocessorLine

#pragma pragma_property

PreprocessorPragma

#undef macro

PreprocessorUndef

#warning message

PreprocessorWarning

#error message

PreprocessorError

#include file_name

Include

#import file_name

Import

Apple/NeXT extension

#include_next file_name

IncludeNext

Apple/NeXT extension

#define macro

Macro

Further reading

  • © GitHub, Inc.
  • Terms
  • Privacy