[C/C++] Get a function from __attribute__((__cleanup__(foo))) as a Function class instance

[mrc0mmand]

Hello!

I'd like go through all variables in our project which have the __cleanup__(foo) attribute set and then check various attributes of the cleanup function itself. However, after some research I can't figure out how to get the foo function as an instance of the Function class instead of a plain string.

I minimized the test case into following lines:

Test.ql

// vi: syntax=ql:
import cpp

from LocalVariable v, string fun
where
    v.getAnAttribute().hasName("cleanup") and
    fun = v.getAnAttribute().getAnArgument().getValueText()
select v, fun

test.c

static inline void foo(char **p) {
    if (*p)
        *p = free(*p);
}

static inline void erase_char(char *p) {
    *p = '\0';
}

int main(void) {
    __attribute__((__cleanup__(foo))) char *b_full_attribute;
    __attribute__((__cleanup__(erase_char))) char g_not_a_pointer;

    puts(b_full_attribute);
    printf("%c\n", g_not_a_pointer);

    return 0;
}

This correctly extracts the cleanup functions, but just as simple strings, since the Attribute class has no method to "covert" them into a Function instance.

| test.c:12:45:12:60 | b_full_attribute | foo |
| test.c:13:51:13:65 | g_not_a_pointer | erase_char |

Am I overlooking something pretty obvious or it's not possible in the current state?

Thank you!

[mrc0mmand]

sigh, of course it was something obvious, I just had to step back from the computer for a bit:

// vi: syntax=ql:
import cpp

predicate functionHasAccess(string fun) {
    exists(Function f | f.getName() = fun and f.getAnAttribute().hasName("access") | f.getAnAttribute().getAnArgument().getValueText() = "write_only")
}

from LocalVariable v, string fun
where
    v.getAnAttribute().hasName("cleanup") and
    fun = v.getAnAttribute().getAnArgument().getValueText() and
    functionHasAccess(fun)
select v, fun