Supplemental Windows Driver CodeQL Queries

This section lists and describes a handful of CodeQL queries that are included as part of the Microsoft GitHub CodeQL repository that are specific to driver development for the Windows platform.

List of Queries

Query Name	Description
WDK Deprecated API	Finds instances of deprecated pool-allocation APIs
UseAfterFree	Finds select instances of UseAfterFree defects in driver source code (high-precision)
Probable UseAfterFree	Finds almost all instances of UseAfterFree defects in driver source code (low-precision)
PaddingByteInformationDisclosure	Checks for newly allocated structs or classes that are initialized member-by-member as they may leak information if they include padding bytes.
BadOverflowGuard	Checking for overflow of an addition by comparing against one of the arguments of the addition. Fails if the size of all the argument types are smaller than 4 bytes.
InfiniteLoop	Finds comparisons between types of different widths in a loop condition which can cause the loop to fail to terminate.
UninitializedPtrField	Looks for a pointer field which was not initialized during or since class construction will cause a null pointer dereference.
HardcodedIVCNG	Finds incorrect usage of initialization vectors.