I want to statically check the vulnerabilities of c c++ code with codeql, such as: double free, array out of bounds, resource Allocates,releases unpaired etc., where can I get a ql scripts to use. This SDK:https://github.com/github/codeql is too chaos,too many,can I got a comprehensive ql scripts? if I write the ql queries myself，Whether to learn relevant grammar？
Wanna some answers,thanks a lot~! ^_^
It highly depends on the context in which you want to use CodeQL. The license only permits you to use it on open source projects and for academic research (read the complete license for more information). If you want to add CodeQL code scanning to your GitHub repository, you can take a look at About code scanning with CodeQL.
If you want to write queries yourself, the documentation is probably a good place to start. They also have a guide for getting started with CodeQL for C and C++, and tutorials. The language reference might be useful as well, but probably only once you have become familiar with it a bit.
The CodeQL query help for C and C++ might be helpful as well, to see which queries already exist, and also how they are implemented. But of course it does not hurt to try to implement them yourself as well to get some practice.
