Finding unbalanced reference counting

[CaledoniaProject]

I'm trying to find out the missing calls to ref_del. The source code is like the following:

struct ref_data
{
    int count;
};
void ref_add(struct ref_data *data) { data->count ++; }
void ref_del(struct ref_data *data) { data->count --; }

void ref_test()
{
    struct ref_data p1, p2;
    ref_add(&p1);
    ref_add(&p2);
    ref_del(&p2);
}

For all calls to ref_add, I want to find out if ref_del is not called for the same struct, and within the same enclosing function. This looked quite complex, is it possible to do it in codeql?

[rdmarsh2]

If you're just looking for that simple case, I'd recommend using the global value numbering library to match up equivalent expressions, and then using the exists quantifier to check for ref_del calls. A more advanced intraprocedural query could use the guards library or StackVariableReachability. Handling the general case of unbalanced reference counting with control flow, complicated object lifetimes, and interprocedural flows isn't something we currently do. It's certainly possible to implement in QL, but it would take a substantial amount of library work to do well.