java.lang.NegativeArraySizeException with CodeQL CLI 2.7.5

[KeuntaeShin]

Today, i changed the binary of CodeQL CLI from 2.7.3 to 2.7.5:

Before
Version: CodeQL command-line toolchain release 2.7.3.
Target language: cpp
Target source: Linux kernel

After
Version: CodeQL command-line toolchain release 2.7.5.
Target language: cpp
Target source: Linux kernel

A command i used:

codeql database create database_kernel --language=cpp --command="a custom build script"

A new message has been appeared at the last stage of command:

Finalizing database at [directory path].
Oops! A fatal internal error occurred.
java.lang.NegativeArraySizeException: -130951
at com.semmle.inmemory.trap.TrapScanner.getLineContents(TrapScanner.java:620)
at com.semmle.inmemory.trap.TRAPReader.logError(TRAPReader.java:454)
at com.semmle.inmemory.trap.TRAPReader.importTuples(TRAPReader.java:432)
at com.semmle.inmemory.trap.TRAPReader.importTuples(TRAPReader.java:407)
at com.semmle.inmemory.trap.TRAPLinker.lambda$getTasks$4(TRAPLinker.java:229)
at com.semmle.util.concurrent.FutureUtils.lambda$mapAsync_$8(FutureUtils.java:136)
at java.base/java.util.concurrent.CompletableFuture$AsyncSupply.run(Unknown Source)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at java.base/java.lang.Thread.run(Unknown Source)

Moreover, no database:

$ ls -la
total 32
drwxrwxr-x 7 babo babo 4096 Jan 19 10:47 .
drwxrwxr-x 16 babo babo 4096 Jan 19 10:23 ..
-rw-rw-r-- 1 babo babo 957 Jan 19 10:23 codeql-database.yml
drwxrwxr-x 3 babo babo 4096 Jan 19 10:47 db-cpp
drwxrwxr-x 2 babo babo 4096 Jan 19 10:23 log
drwxrwxr-x 5 babo babo 4096 Jan 19 10:24 src
drwxrwxr-x 3 babo babo 4096 Jan 19 10:24 trap
drwxrwxr-x 6 babo babo 4096 Jan 19 10:24 working

Conversely, the CodeQL CLI 2.7.3 made a database successfully:

$ ls -la
total 50060
drwxrwxr-x 4 babo babo 4096 Jan 17 14:33 .
drwxrwxr-x 16 babo babo 4096 Jan 19 10:23 ..
-rw-rw-r-- 1 babo babo 259 Jan 17 14:32 codeql-database.yml
drwxrwxr-x 3 babo babo 4096 Jan 17 14:32 db-cpp
drwxrwxr-x 2 babo babo 4096 Jan 17 13:24 log
-rw------- 1 babo babo 51240160 Jan 17 14:33 src.zip

[tausbn]

Thank you for your report!

We are working for a fix for this issue. It should hopefully be included in the next release of the CodeQL CLI.

[edoardopirovano]

Many thanks for this report! This is very concerning and high priority for us - we've got a fix currently undergoing testing and will be making a 2.7.6 release early next week to get it out as soon as possible.

[KeuntaeShin]

Many thanks for this report! This is very concerning and high priority for us - we've got a fix currently undergoing testing and will be making a 2.7.6 release early next week to get it out as soon as possible.

Hi @edoardopirovano , I'd like to actively contribute to the private project of CodeQL to figure out challenges and solve them, especially the extractor for cpp. Please feel free to share your (and your internal team's) thoughts if possible.

[edoardopirovano]

Hi @edoardopirovano , I'd like to actively contribute to the private project of CodeQL to figure out challenges and solve them, especially the extractor for cpp. Please feel free to share your (and your internal team's) thoughts if possible.

Unfortunately, we can't currently accept contributions to the closed-source parts of CodeQL (specifically, the CodeQL compiler and evaluator as well as some of the language-specific evaluators including cpp). So, short of applying for a job at GitHub (which I would certainly encourage you to do if that's of interest), I'm afraid you won't be able to make any contributions.

In principle we'd like to make more of our code base open-source but there's currently quite a few obstacles to that. In particular, we'd need to do significant refactorings to separate out the parts of the code we do want to open-source. Additionally, a number of our tests analyze code that isn't open-source and was obtained from customers, so we would have to re-write all our internal tests to only using open-source code before we could release them.