# CodeQL C/C++ Query Catalog vs fold Detectors — Gap Matrix

> Generated 2026-05-29. Comparison of CodeQL's ~200 C/C++ queries against fold's 29 detectors.

## Coverage Summary

| Category | CodeQL Queries | fold Has | fold Missing |
|----------|---------------|----------|-------------|
| Memory safety | ~30 | 7 | 23 |
| Injection / taint | ~25 | 1 | 24 |
| Data flow | ~20 | 0 | 20 |
| Information disclosure | ~15 | 0 | 15 |
| Resource management | ~12 | 3 | 9 |
| Concurrency | ~8 | 0 | 8 |
| Style / best practice | ~40 | 0 | 40 |
| Cryptography | ~10 | 0 | 10 |
| Command injection | ~5 | 0 | 5 |
| **Total** | **~200** | **11** | **~130** |

## Key Gaps fold Could Address

### Phase 1 — Syntactic (RecursiveASTVisitor, no Z3)

| CodeQL Query | fold Detector | Notes |
|-------------|---------------|-------|
| cpp/badly-bounded-write | `deprecated-strcpy` | Detect `strcpy`, `strcat`, `sprintf` usage |
| cpp/dangerous-function-overflow | `deprecated-api` | Extend existing detector |
| cpp/incorrect-allocation-error-handling | `unchecked-malloc` | Check malloc return for nullptr |
| cpp/suspicious-pointer-scaling | `pointer-arithmetic` | Detect suspicious arithmetic on typed pointers |
| cpp/weak-cryptographic-algorithm | `weak-crypto` | MD5, SHA1, DES in security contexts |
| cpp/hardcoded-credentials | `hardcoded-credential` | String constants matching credential patterns |
| cpp/uncontrolled-format-string | `format-string` | printf(user_input) patterns |
| cpp/cleartext-storage | `cleartext-storage` | Sensitive data written without encryption |

### Phase 2 — Z3-powered

| CodeQL Query | fold Z3 Detector | Notes |
|-------------|-----------------|-------|
| cpp/path-injection | Path traversal with origin tracking | Extend existing taint origin |
| cpp/command-injection | Command injection with origin tracking | Extend existing |
| cpp/sql-injection | SQL injection | String concatenation + DB call patterns |
| cpp/uncontrolled-process-operation | Process injection | Similar to command injection |
| cpp/tainted-format-string | Format string with taint | Z3 proves format string is user-controlled |

### Phase 3 — Architecture expansion

| CodeQL Query | What fold needs |
|-------------|----------------|
| cpp/overrun-write | Buffer size tracking in Z3 (OOB already tracks arrays) |
| cpp/overrun-write | Extend HeapModel for buffer sizes |
| cpp/user-controlled-bypass | Full taint tracking across TUs |
| All concurrency queries | Thread interleaving model (beyond fold's current scope) |

## What fold Already Does Better Than CodeQL

| Capability | fold | CodeQL |
|-----------|------|--------|
| Z3-proved findings | Yes (proved confidence) | No (all findings are heuristic) |
| Dead branch detection | Yes (UNSAT path) | Yes (unreachable code) |
| Semantic equivalence | Yes (Type-4 clones via Z3) | No |
| Binary scanning | Yes (r2 + dlopen fuzzing) | No |
| Bound model guarantees | Yes (bounded, explicit) | No (unbounded, may miss) |