Add CodeQL query to warn about null metadata in print functions

.github/codeql-queries/exiv2-cpp-queries/null_metadata_in_print.ql

@@ -0,0 +1,65 @@
+/**
+ * @name Null metadata in print function
+ * @description Print functions need to check that the metadata isn't null before calling methods on it.
+ * @kind problem
+ * @problem.severity warning
+ * @id cpp/null-metadata-in-print
+ */
+
+import cpp
+import semmle.code.cpp.controlflow.Guards
+import semmle.code.cpp.controlflow.Nullness
+import semmle.code.cpp.rangeanalysis.RangeAnalysisUtils
+
+// Find all the print functions by looking for TagInfo initializers
+// like this one:
+// https://github.com/Exiv2/exiv2/blob/6b186a4cd276ac11b3ea69951c2112f4c4814b9a/src/canonmn_int.cpp#L660-L679
+class PrintFunction extends Function {
+  PrintFunction() {
+    exists(Initializer i, Field f |
+      i.getExpr().(ArrayAggregateLiteral).getAChild().(ClassAggregateLiteral).getAFieldExpr(f) =
+        this.getAnAccess() and
+      f.getName() = "printFct_"
+    )
+  }
+}
+
+predicate metadataDeref(Expr metadata) {
+  exists(Call call | call.getQualifier() = metadata)
+  or
+  exists(FunctionCall call, int argIndex, Function f |
+    call.getArgument(argIndex) = metadata and
+    f = call.getTarget() and
+    metadataDeref(f.getParameter(argIndex).getAnAccess())
+  )
+}
+
+predicate unsafePointerParam(Function f, int paramIndex, Expr use) {
+  exists(Parameter p |
+    p = f.getParameter(paramIndex) and
+    use = p.getAnAccess() and
+    unsafePointerExpr(use) and
+    not exists(GuardCondition nonNullCheck, BasicBlock block, boolean branch |
+      validCheckExpr(nonNullCheck, p) and
+      nonNullCheck.controls(block, branch) and
+      block.contains(use)
+    )
+  )
+}
+
+predicate unsafePointerExpr(Expr e) {
+  exists(Call call |
+    call.getQualifier() = e and
+    e.getType().getUnspecifiedType() instanceof PointerType
+  )
+  or
+  exists(FunctionCall call, int argIndex, Function f |
+    call.getArgument(argIndex) = e and
+    f = call.getTarget() and
+    unsafePointerParam(f, argIndex, _)
+  )
+}
+
+from PrintFunction printfcn, Parameter p, Expr metadata
+where unsafePointerParam(printfcn, 2, metadata)
+select metadata, "Print functions need to check that the metadata isn't null."