Merge pull request #22764 from geoffw0/destructorrelease

C++: Fix false positives for cpp/resource-not-released-in-destructor

Author: geoffw0

cpp/ql/src/change-notes/2026-10-06-resource-release-aliases.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `cpp/resource-not-released-in-destructor` query now recognizes resources released through local aliases, reducing false-positive results.

cpp/ql/src/jsf/4.10 Classes/AV Rule 79.ql

@@ -89,7 +89,7 @@ Expr exprOrDereference(Expr e) {
  */
 private predicate exprReleases(Expr e, Expr released, string kind) {
   // `e` is a call to a release function and `released` is the released argument
-  releaseExpr(e, released, kind)
+  releaseExpr(e, pragma[only_bind_into](globalValueNumber(released).getAnExpr()), kind)
   or
   exists(int arg, VariableAccess access, Function f |
     // `e` is a call to a function that releases one of it's parameters,

cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/AV Rule 79.expected

@@ -14,10 +14,10 @@
 | DeleteThis.cpp:127:3:127:20 | ... = ... | Resource d is acquired by class MyClass9 but not released anywhere in this class. |
 | ExternalOwners.cpp:49:3:49:20 | ... = ... | Resource a is acquired by class MyScreen but not released anywhere in this class. |
 | Lambda.cpp:24:3:24:21 | ... = ... | Resource r4 is acquired by class testLambda but not released anywhere in this class. |
-| ListDelete.cpp:21:3:21:21 | ... = ... | Resource first is acquired by class MyThingColection but not released anywhere in this class. |
 | NoDestructor.cpp:23:3:23:20 | ... = ... | Resource n is acquired by class MyClass5 but not released anywhere in this class. |
 | PlacementNew.cpp:36:3:36:36 | ... = ... | Resource p1 is acquired by class MyTestForPlacementNew but not released anywhere in this class. |
 | SelfRegistering.cpp:25:3:25:24 | ... = ... | Resource side is acquired by class MyOwner but not released anywhere in this class. |
+| TemplateDestructor.cpp:55:5:55:23 | ... = ... | Resource ptr is acquired by class OverwrittenAlias but not released anywhere in this class. |
 | Variants.cpp:26:3:26:13 | ... = ... | Resource f is acquired by class MyClass4 but not released anywhere in this class. |
 | Variants.cpp:69:3:69:17 | ... = ... | Resource a is acquired by class MyClass6 but not released anywhere in this class. |
 | Variants.cpp:70:3:70:36 | ... = ... | Resource b is acquired by class MyClass6 but not released anywhere in this class. |

cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/ListDelete.cpp

@@ -18,7 +18,7 @@ class MyThingColection
 {
 public:
 	MyThingColection() {
-		first = new MyThing; // $ SPURIOUS: Alert // GOOD (all deleted in destructor) [FALSE POSITIVE]
+		first = new MyThing; // GOOD (all deleted in destructor)
 
 		first->next = new MyThing; // GOOD (all deleted in destructor)
 

cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/TemplateDestructor.cpp

@@ -0,0 +1,77 @@
+template <typename T>
+class TemplateArray {
+public:
+  TemplateArray() : ptr(nullptr) {}
+
+  ~TemplateArray() {
+    reset();
+  }
+
+  void init(unsigned size) {
+    ptr = new T[size]; // GOOD
+  }
+
+  void reset() {
+    T *tmp = ptr;
+    ptr = nullptr;
+    delete[] tmp;
+  }
+
+private:
+  T *ptr;
+};
+
+class NonTemplateArray {
+public:
+  NonTemplateArray() : ptr(nullptr) {}
+
+  ~NonTemplateArray() {
+    reset();
+  }
+
+  void init(unsigned size) {
+    ptr = new int[size]; // GOOD
+  }
+
+  void reset() {
+    int *tmp = ptr;
+    ptr = nullptr;
+    delete[] tmp;
+  }
+
+private:
+  int *ptr;
+};
+
+class OverwrittenAlias {
+public:
+  OverwrittenAlias() : ptr(nullptr) {}
+
+  ~OverwrittenAlias() {
+    reset();
+  }
+
+  void init(unsigned size) {
+    ptr = new int[size]; // $ Alert
+  }
+
+  void reset() {
+    int *tmp = ptr;
+    tmp = new int[1];
+    delete[] tmp;
+  }
+
+private:
+  int *ptr;
+};
+
+void testArrays() {
+  TemplateArray<int> templateArray;
+  templateArray.init(10);
+
+  NonTemplateArray nonTemplateArray;
+  nonTemplateArray.init(10);
+
+  OverwrittenAlias overwrittenAlias;
+  overwrittenAlias.init(10);
+}