CodeQL reports false positives when Buffers are reused from the pool. A Buffer receives tainted data, gets returned to the pool via buf_pool_release() (which calls buf_reset() → memset()), then later buf_pool_get() returns it. CodeQL incorrectly flags the reused Buffer as still tainted.

Changes

Custom CodeQL query pack (.github/codeql-custom-queries/):

• CustomSanitizers.qll - Defines BufferPoolSanitizer class recognizing these functions clear taint:
  • buf_reset(buf) - clears with memset
  • buf_pool_release(&buf) - calls buf_reset internally
  • memset(ptr, 0, size) - explicit zeroing
  • buf_pool_get() - returns sanitized buffer
• TaintWithBufferSanitizers.ql - Taint tracking query using the sanitizers
• qlpack.yml - Query pack definition
• README.md - Documents the false positive pattern

CodeQL configuration:

• Updated .github/codeql.yml to include custom query pack

The GitHub Actions workflow automatically picks up these queries on next run.

class BufferPoolSanitizer extends DataFlow::Node {
  BufferPoolSanitizer() {
    exists(FunctionCall call |
      call.getTarget().getName() = "buf_pool_release" and
      this.asExpr() = call.getArgument(0)
    )
    or
    exists(FunctionCall call |
      call.getTarget().getName() = "buf_pool_get" and
      this.asExpr() = call
    )
    // ... other sanitizers
  }
}

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.