Final analysis for return of stack variable address class
 *created  "Fri Nov 20 11:36:31 2015" *by "Paul E. Black"
 *modified "Mon Dec 14 08:35:28 2015" *by "Paul E. Black"

Once for all classes, go to ../ExtractWarnings and run extract_warnings:
$ make
This assigns each warning in the Frama-C reports to a particular
weakness class and produces a csv format file.

For this class, go to ../ExtractSites/ and run
get_ret_stack_addr_sites.py to build ret_stack_addr_sites.xml.
Documentation is there.

rebuild any needed files and check
$ make

There is significant mismatch between our site extractor and Frama-C's
warnings.  Our site extractor reports the line where a stack address is
returned.  Frama-C reports the line where an expired address is used.
Consider the following code from
CWE562_Return_of_Stack_Variable_Address__return_buf_01.c:

static char *helperBad() {
    char charString[] = "helperBad string";
    return charString;
}

    printLine(helperBad());
Our extractor reports the "return" line, while Frama-C reports the
printLine(), where it is used.

Because there were only two test cases, we checked them manually.  We
did not believe it was worth the trouble to derive a new site
definition and to write code to report them.


Frama-C did catch a previously unnoticed systematic mistake in the
Juliet set.  The Frama-C error was "making use of address of object
past its lifetime".  In the supposed good versions of NULL pointer
dereference cases, the following type of code occurs in many
variations.  This comes from CWE476_NULL_Pointer_Dereference__int_01.c
    int * data;
    {
        int tmpData = 5;
        data = &tmpData;
    }
    printIntLine(*data);
Since tmpData is in a inner scope, the lifetime of the memory
allocated to the variable ends at the closing parenthesis.  Thus the
dereference in printIntLine() is invalid.  CWE-825 Expired Pointer
Dereference seems to cover this.  The examples for that CWE are all
about use-after-free, but the descriptions seem to cover this.

Most compilers don't release the stack frame until the end of the
function, but the above agrees with the C standard.
