3 ms·

I've played with Semmle's product, which I think is called QL now, and I was very impressed. It's a way to write queries about your code, like "show me lines wh

I've played with Semmle's product, which I think is called QL now, and I was very impressed. It's a way to write queries about your code, like "show me lines where the address to a non-packed struct is passed to fwrite() or send()," for example. clang-query might be conceptually similar (and open source), but QL has some sort of graph database captured at compile time that is extremely fast to query. QL's DSL may also be more intuitive and/or sophisticated than clang's, but I haven't used either in a while. Unless they've extended it since, QL does not actually simulate execution, so it cannot find some of the same bug patterns that other analyzers can.

Tibbes 8y ago
The dataflow analysis libraries in QL have significantly improved since 2015, and were used to find the ICMP vulnerability mentioned in the article. See the blog post for the query used. [1] Dataflow analysis is a form of execution simulation that estimates the flow of control and data from one part of the program to another. Of course, there are many forms of simulation, and they vary in accuracy and the expense of computing them. [1]: https://lgtm.com/blog/apple_xnu_icmp_error_CVE-2018-4407 https://lgtm.com/blog/apple_xnu_icmp_error_CVE-2018-4407