- The syntax for models-as-data rows has been extended to make it easier to select sources, sinks, and summaries that involve templated functions and classes. Additionally, the syntax has also been extended to make it easier to specify models with arbitrary levels of indirection. See
dataflow/ExternalFlow.qll
for the updated documentation and specification for the model format. - It is now possible to extend the classes
AllocationFunction
andDeallocationFunction
via data extensions. Extensions of these classes should be added to thelib/ext/allocation
andlib/ext/deallocation
directories respectively.
- The queries "Potential double free" (
cpp/double-free
) and "Potential use after free" (cpp/use-after-free
) now produce fewer false positives. - The "Guards" library (
semmle.code.cpp.controlflow.Guards
) now also infers guards from calls to the builtin operation__builtin_expect
. As a result, some queries may produce fewer false positives.