Detecting Iterator Invalidation with CodeQL

Summary: A Trail of Bits intern developed Itergator, a set of CodeQL classes and queries that detect iterator invalidation in C++ by building a graph of potentially invalidating function calls and relating them to iterator acquisition through data flow. Itergator found real bugs, including one in Cataclysm: Dark Days Ahead where a call to zones.erase invalidated an iterator, and one in Apple's fork of LLVM for Swift where the invalidation sat 12 function calls deep.
Why it matters: Iterator invalidation is undefined behavior that has been weaponized in high-value targets before, and the LLVM bug shows an invalidation can hide 12 calls away from the code that triggers it, well past what manual review or shallow tooling will catch.

Read the original at Trail of Bits Blog ↗