Skip to content

Commit 177f943

Browse files
MathiasVPMathiasVP
committed
C++: Respond to review comments and accept test changes.
1 parent f3f9a04 commit 177f943

File tree

9 files changed

+72
-27
lines changed

9 files changed

+72
-27
lines changed

‎cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll

Lines changed: 15 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -251,28 +251,32 @@ private predicate getWrittenField(Instruction instr, Field f, Class c) {
251251
}
252252

253253
private predicate fieldStoreStepChi(Node node1, FieldContent f, PostUpdateNode node2) {
254-
exists(StoreValueOperand operand, ChiInstruction chi |
254+
exists(ChiPartialOperand operand, ChiInstruction chi |
255+
chi.getPartialOperand() = operand and
255256
node1.asOperand() = operand and
256257
node2.asInstruction() = chi and
257-
chi.getPartial() = operand.getUse() and
258258
exists(Class c |
259259
c = chi.getResultType() and
260260
exists(int startBit, int endBit |
261261
chi.getUpdatedInterval(startBit, endBit) and
262262
f.hasOffset(c, startBit, endBit)
263263
)
264264
or
265-
getWrittenField(operand.getUse(), f.getAField(), c) and
265+
getWrittenField(operand.getDef(), f.getAField(), c) and
266266
f.hasOffset(c, _, _)
267267
)
268268
)
269269
}
270270

271271
private predicate arrayStoreStepChi(Node node1, ArrayContent a, PostUpdateNode node2) {
272272
a = TArrayContent() and
273-
exists(StoreValueOperand operand, StoreInstruction store |
274-
store.getSourceValueOperand() = operand and
273+
exists(ChiPartialOperand operand, ChiInstruction chi, StoreInstruction store |
274+
chi.getPartialOperand() = operand and
275+
store = operand.getDef() and
275276
node1.asOperand() = operand and
277+
// This `ChiInstruction` will always have a non-conflated result because both `ArrayStoreNode`
278+
// and `PointerStoreNode` require it in their characteristic predicates.
279+
node2.asInstruction() = chi and
276280
(
277281
// `x[i] = taint()`
278282
// This matches the characteristic predicate in `ArrayStoreNode`.
@@ -281,10 +285,7 @@ private predicate arrayStoreStepChi(Node node1, ArrayContent a, PostUpdateNode n
281285
// `*p = taint()`
282286
// This matches the characteristic predicate in `PointerStoreNode`.
283287
store.getDestinationAddress().(CopyValueInstruction).getUnary() instanceof LoadInstruction
284-
) and
285-
// This `ChiInstruction` will always have a non-conflated result because both `ArrayStoreNode`
286-
// and `PointerStoreNode` require it in their characteristic predicates.
287-
node2.asInstruction().(ChiInstruction).getPartial() = store
288+
)
288289
)
289290
}
290291

@@ -385,10 +386,10 @@ private Instruction skipOneCopyValueInstructionRec(CopyValueInstruction copy) {
385386
result = skipOneCopyValueInstructionRec(copy.getUnary())
386387
}
387388

388-
private Instruction skipCopyValueInstructions(Instruction instr) {
389-
not result instanceof CopyValueInstruction and result = instr
389+
private Instruction skipCopyValueInstructions(Operand op) {
390+
not result instanceof CopyValueInstruction and result = op.getDef()
390391
or
391-
result = skipOneCopyValueInstructionRec(instr)
392+
result = skipOneCopyValueInstructionRec(op.getDef())
392393
}
393394

394395
private predicate arrayReadStep(Node node1, ArrayContent a, Node node2) {
@@ -398,7 +399,7 @@ private predicate arrayReadStep(Node node1, ArrayContent a, Node node2) {
398399
operand.isDefinitionInexact() and
399400
node1.asInstruction() = operand.getAnyDef() and
400401
operand = node2.asOperand() and
401-
address = skipCopyValueInstructions(operand.getUse().(LoadInstruction).getSourceAddress()) and
402+
address = skipCopyValueInstructions(operand.getAddressOperand()) and
402403
(
403404
address instanceof LoadInstruction or
404405
address instanceof ArrayToPointerConvertInstruction or
@@ -419,7 +420,7 @@ private predicate arrayReadStep(Node node1, ArrayContent a, Node node2) {
419420
* use(x);
420421
* ```
421422
* the load on `x` in `use(x)` will exactly overlap with its definition (in this case the definition
422-
* is a `BufferMayWriteSideEffect`). This predicate pops the `ArrayContent` (pushed by the store in `f`)
423+
* is a `WriteSideEffect`). This predicate pops the `ArrayContent` (pushed by the store in `f`)
423424
* from the access path.
424425
*/
425426
private predicate exactReadStep(Node node1, ArrayContent a, Node node2) {

‎cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -396,16 +396,16 @@ private FieldAddressInstruction getFieldInstruction(Instruction instr) {
396396

397397
/**
398398
* The target of a `fieldStoreStepAfterArraySuppression` store step, which is used to convert
399-
* an `ArrayContent` to a `FieldContent` when the `BufferMayWriteSideEffect` instruction stores
399+
* an `ArrayContent` to a `FieldContent` when the `WriteSideEffect` instruction stores
400400
* into a field. See the QLDoc for `suppressArrayRead` for an example of where such a conversion
401401
* is inserted.
402402
*/
403-
private class BufferMayWriteSideEffectFieldStoreQualifierNode extends PartialDefinitionNode {
403+
private class WriteSideEffectFieldStoreQualifierNode extends PartialDefinitionNode {
404404
override ChiInstruction instr;
405-
BufferMayWriteSideEffectInstruction write;
405+
WriteSideEffectInstruction write;
406406
FieldAddressInstruction field;
407407

408-
BufferMayWriteSideEffectFieldStoreQualifierNode() {
408+
WriteSideEffectFieldStoreQualifierNode() {
409409
not instr.isResultConflated() and
410410
instr.getPartial() = write and
411411
field = getFieldInstruction(write.getDestinationAddress())

‎cpp/ql/test/library-tests/dataflow/fields/dataflow-ir-consistency.expected

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,14 @@ postWithInFlow
121121
| complex.cpp:12:22:12:27 | Chi | PostUpdateNode should not be the target of local flow. |
122122
| complex.cpp:14:26:14:26 | Chi | PostUpdateNode should not be the target of local flow. |
123123
| complex.cpp:14:33:14:33 | Chi | PostUpdateNode should not be the target of local flow. |
124+
| complex.cpp:22:11:22:17 | Chi | PostUpdateNode should not be the target of local flow. |
125+
| complex.cpp:25:7:25:7 | Chi | PostUpdateNode should not be the target of local flow. |
126+
| complex.cpp:42:16:42:16 | Chi | PostUpdateNode should not be the target of local flow. |
127+
| complex.cpp:43:16:43:16 | Chi | PostUpdateNode should not be the target of local flow. |
128+
| complex.cpp:53:12:53:12 | Chi | PostUpdateNode should not be the target of local flow. |
129+
| complex.cpp:54:12:54:12 | Chi | PostUpdateNode should not be the target of local flow. |
130+
| complex.cpp:55:12:55:12 | Chi | PostUpdateNode should not be the target of local flow. |
131+
| complex.cpp:56:12:56:12 | Chi | PostUpdateNode should not be the target of local flow. |
124132
| constructors.cpp:20:24:20:29 | Chi | PostUpdateNode should not be the target of local flow. |
125133
| constructors.cpp:21:24:21:29 | Chi | PostUpdateNode should not be the target of local flow. |
126134
| constructors.cpp:23:28:23:28 | Chi | PostUpdateNode should not be the target of local flow. |

‎cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,18 +127,34 @@ edges
127127
| by_reference.cpp:128:15:128:23 | Chi [a] | by_reference.cpp:136:16:136:16 | a |
128128
| by_reference.cpp:128:15:128:23 | taint_a_ref output argument [array content] | by_reference.cpp:128:15:128:23 | Chi |
129129
| complex.cpp:40:17:40:17 | *b [a_] | complex.cpp:42:18:42:18 | call to a |
130+
| complex.cpp:40:17:40:17 | *b [b_] | complex.cpp:42:16:42:16 | Chi [b_] |
130131
| complex.cpp:40:17:40:17 | *b [b_] | complex.cpp:42:16:42:16 | a output argument [b_] |
131132
| complex.cpp:40:17:40:17 | *b [b_] | complex.cpp:43:18:43:18 | call to b |
133+
| complex.cpp:42:16:42:16 | Chi [b_] | complex.cpp:43:18:43:18 | call to b |
134+
| complex.cpp:42:16:42:16 | a output argument [b_] | complex.cpp:42:16:42:16 | Chi [b_] |
132135
| complex.cpp:42:16:42:16 | a output argument [b_] | complex.cpp:43:18:43:18 | call to b |
136+
| complex.cpp:53:12:53:12 | Chi [a_] | complex.cpp:40:17:40:17 | *b [a_] |
133137
| complex.cpp:53:12:53:12 | setA output argument [a_] | complex.cpp:40:17:40:17 | *b [a_] |
138+
| complex.cpp:53:12:53:12 | setA output argument [a_] | complex.cpp:53:12:53:12 | Chi [a_] |
134139
| complex.cpp:53:19:53:28 | call to user_input | complex.cpp:53:12:53:12 | setA output argument [a_] |
140+
| complex.cpp:54:12:54:12 | Chi [b_] | complex.cpp:40:17:40:17 | *b [b_] |
135141
| complex.cpp:54:12:54:12 | setB output argument [b_] | complex.cpp:40:17:40:17 | *b [b_] |
142+
| complex.cpp:54:12:54:12 | setB output argument [b_] | complex.cpp:54:12:54:12 | Chi [b_] |
136143
| complex.cpp:54:19:54:28 | call to user_input | complex.cpp:54:12:54:12 | setB output argument [b_] |
144+
| complex.cpp:55:12:55:12 | Chi [a_] | complex.cpp:40:17:40:17 | *b [a_] |
145+
| complex.cpp:55:12:55:12 | Chi [a_] | complex.cpp:56:12:56:12 | Chi [a_] |
146+
| complex.cpp:55:12:55:12 | Chi [a_] | complex.cpp:56:12:56:12 | setB output argument [a_] |
137147
| complex.cpp:55:12:55:12 | setA output argument [a_] | complex.cpp:40:17:40:17 | *b [a_] |
148+
| complex.cpp:55:12:55:12 | setA output argument [a_] | complex.cpp:55:12:55:12 | Chi [a_] |
149+
| complex.cpp:55:12:55:12 | setA output argument [a_] | complex.cpp:56:12:56:12 | Chi [a_] |
138150
| complex.cpp:55:12:55:12 | setA output argument [a_] | complex.cpp:56:12:56:12 | setB output argument [a_] |
139151
| complex.cpp:55:19:55:28 | call to user_input | complex.cpp:55:12:55:12 | setA output argument [a_] |
152+
| complex.cpp:56:12:56:12 | Chi [a_] | complex.cpp:40:17:40:17 | *b [a_] |
153+
| complex.cpp:56:12:56:12 | Chi [b_] | complex.cpp:40:17:40:17 | *b [b_] |
140154
| complex.cpp:56:12:56:12 | setB output argument [a_] | complex.cpp:40:17:40:17 | *b [a_] |
155+
| complex.cpp:56:12:56:12 | setB output argument [a_] | complex.cpp:56:12:56:12 | Chi [a_] |
141156
| complex.cpp:56:12:56:12 | setB output argument [b_] | complex.cpp:40:17:40:17 | *b [b_] |
157+
| complex.cpp:56:12:56:12 | setB output argument [b_] | complex.cpp:56:12:56:12 | Chi [b_] |
142158
| complex.cpp:56:19:56:28 | call to user_input | complex.cpp:56:12:56:12 | setB output argument [b_] |
143159
| constructors.cpp:26:15:26:15 | *f [a_] | constructors.cpp:28:12:28:12 | call to a |
144160
| constructors.cpp:26:15:26:15 | *f [b_] | constructors.cpp:28:10:28:10 | a output argument [b_] |
@@ -340,15 +356,21 @@ nodes
340356
| by_reference.cpp:136:16:136:16 | a | semmle.label | a |
341357
| complex.cpp:40:17:40:17 | *b [a_] | semmle.label | *b [a_] |
342358
| complex.cpp:40:17:40:17 | *b [b_] | semmle.label | *b [b_] |
359+
| complex.cpp:42:16:42:16 | Chi [b_] | semmle.label | Chi [b_] |
343360
| complex.cpp:42:16:42:16 | a output argument [b_] | semmle.label | a output argument [b_] |
344361
| complex.cpp:42:18:42:18 | call to a | semmle.label | call to a |
345362
| complex.cpp:43:18:43:18 | call to b | semmle.label | call to b |
363+
| complex.cpp:53:12:53:12 | Chi [a_] | semmle.label | Chi [a_] |
346364
| complex.cpp:53:12:53:12 | setA output argument [a_] | semmle.label | setA output argument [a_] |
347365
| complex.cpp:53:19:53:28 | call to user_input | semmle.label | call to user_input |
366+
| complex.cpp:54:12:54:12 | Chi [b_] | semmle.label | Chi [b_] |
348367
| complex.cpp:54:12:54:12 | setB output argument [b_] | semmle.label | setB output argument [b_] |
349368
| complex.cpp:54:19:54:28 | call to user_input | semmle.label | call to user_input |
369+
| complex.cpp:55:12:55:12 | Chi [a_] | semmle.label | Chi [a_] |
350370
| complex.cpp:55:12:55:12 | setA output argument [a_] | semmle.label | setA output argument [a_] |
351371
| complex.cpp:55:19:55:28 | call to user_input | semmle.label | call to user_input |
372+
| complex.cpp:56:12:56:12 | Chi [a_] | semmle.label | Chi [a_] |
373+
| complex.cpp:56:12:56:12 | Chi [b_] | semmle.label | Chi [b_] |
352374
| complex.cpp:56:12:56:12 | setB output argument [a_] | semmle.label | setB output argument [a_] |
353375
| complex.cpp:56:12:56:12 | setB output argument [b_] | semmle.label | setB output argument [b_] |
354376
| complex.cpp:56:19:56:28 | call to user_input | semmle.label | call to user_input |

‎cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.expected

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -294,22 +294,16 @@
294294
| complex.cpp:11:22:11:23 | a_ | AST only |
295295
| complex.cpp:12:22:12:23 | b_ | AST only |
296296
| complex.cpp:42:8:42:8 | b | AST only |
297-
| complex.cpp:42:10:42:14 | inner | AST only |
298297
| complex.cpp:42:16:42:16 | f | AST only |
299298
| complex.cpp:43:8:43:8 | b | AST only |
300-
| complex.cpp:43:10:43:14 | inner | AST only |
301299
| complex.cpp:43:16:43:16 | f | AST only |
302300
| complex.cpp:53:3:53:4 | b1 | AST only |
303-
| complex.cpp:53:6:53:10 | inner | AST only |
304301
| complex.cpp:53:12:53:12 | f | AST only |
305302
| complex.cpp:54:3:54:4 | b2 | AST only |
306-
| complex.cpp:54:6:54:10 | inner | AST only |
307303
| complex.cpp:54:12:54:12 | f | AST only |
308304
| complex.cpp:55:3:55:4 | b3 | AST only |
309-
| complex.cpp:55:6:55:10 | inner | AST only |
310305
| complex.cpp:55:12:55:12 | f | AST only |
311306
| complex.cpp:56:3:56:4 | b3 | AST only |
312-
| complex.cpp:56:6:56:10 | inner | AST only |
313307
| complex.cpp:56:12:56:12 | f | AST only |
314308
| complex.cpp:59:7:59:8 | b1 | AST only |
315309
| complex.cpp:62:7:62:8 | b2 | AST only |

‎cpp/ql/test/library-tests/dataflow/fields/partial-definition-ir.expected

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,12 @@
5151
| by_reference.cpp:128:15:128:20 | pouter |
5252
| complex.cpp:11:22:11:23 | this |
5353
| complex.cpp:12:22:12:23 | this |
54+
| complex.cpp:42:10:42:14 | inner |
55+
| complex.cpp:43:10:43:14 | inner |
56+
| complex.cpp:53:6:53:10 | inner |
57+
| complex.cpp:54:6:54:10 | inner |
58+
| complex.cpp:55:6:55:10 | inner |
59+
| complex.cpp:56:6:56:10 | inner |
5460
| constructors.cpp:20:24:20:25 | this |
5561
| constructors.cpp:21:24:21:25 | this |
5662
| qualifiers.cpp:9:30:9:33 | this |

‎cpp/ql/test/library-tests/syntax-zoo/dataflow-ir-consistency.expected

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1491,6 +1491,7 @@ postWithInFlow
14911491
| conditional_destructors.cpp:18:13:18:19 | Chi | PostUpdateNode should not be the target of local flow. |
14921492
| cpp11.cpp:65:19:65:45 | Store | PostUpdateNode should not be the target of local flow. |
14931493
| cpp11.cpp:82:17:82:55 | Chi | PostUpdateNode should not be the target of local flow. |
1494+
| cpp11.cpp:82:17:82:55 | Chi | PostUpdateNode should not be the target of local flow. |
14941495
| cpp11.cpp:82:45:82:48 | Chi | PostUpdateNode should not be the target of local flow. |
14951496
| defdestructordeleteexpr.cpp:4:9:4:15 | Chi | PostUpdateNode should not be the target of local flow. |
14961497
| deleteexpr.cpp:7:9:7:15 | Chi | PostUpdateNode should not be the target of local flow. |
@@ -1541,6 +1542,18 @@ postWithInFlow
15411542
| ir.cpp:659:9:659:14 | Chi | PostUpdateNode should not be the target of local flow. |
15421543
| ir.cpp:660:13:660:13 | Chi | PostUpdateNode should not be the target of local flow. |
15431544
| ir.cpp:661:9:661:13 | Chi | PostUpdateNode should not be the target of local flow. |
1545+
| ir.cpp:662:9:662:19 | Chi | PostUpdateNode should not be the target of local flow. |
1546+
| ir.cpp:663:5:663:5 | Chi | PostUpdateNode should not be the target of local flow. |
1547+
| ir.cpp:745:8:745:8 | Chi | PostUpdateNode should not be the target of local flow. |
1548+
| ir.cpp:745:8:745:8 | Chi | PostUpdateNode should not be the target of local flow. |
1549+
| ir.cpp:748:10:748:10 | Chi | PostUpdateNode should not be the target of local flow. |
1550+
| ir.cpp:754:8:754:8 | Chi | PostUpdateNode should not be the target of local flow. |
1551+
| ir.cpp:757:12:757:12 | Chi | PostUpdateNode should not be the target of local flow. |
1552+
| ir.cpp:763:8:763:8 | Chi | PostUpdateNode should not be the target of local flow. |
1553+
| ir.cpp:766:13:766:13 | Chi | PostUpdateNode should not be the target of local flow. |
1554+
| ir.cpp:775:15:775:15 | Chi | PostUpdateNode should not be the target of local flow. |
1555+
| ir.cpp:784:15:784:15 | Chi | PostUpdateNode should not be the target of local flow. |
1556+
| ir.cpp:793:15:793:15 | Chi | PostUpdateNode should not be the target of local flow. |
15441557
| ir.cpp:943:3:943:11 | Chi | PostUpdateNode should not be the target of local flow. |
15451558
| ir.cpp:947:3:947:25 | Chi | PostUpdateNode should not be the target of local flow. |
15461559
| ir.cpp:962:17:962:47 | Chi | PostUpdateNode should not be the target of local flow. |
@@ -1561,3 +1574,4 @@ postWithInFlow
15611574
| range_analysis.c:102:5:102:15 | Chi | PostUpdateNode should not be the target of local flow. |
15621575
| static_init_templates.cpp:3:2:3:8 | Chi | PostUpdateNode should not be the target of local flow. |
15631576
| static_init_templates.cpp:21:2:21:12 | Chi | PostUpdateNode should not be the target of local flow. |
1577+
| static_init_templates.cpp:240:7:240:7 | Chi | PostUpdateNode should not be the target of local flow. |

‎cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.expected

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -143,7 +143,7 @@ nodes
143143
| test.cpp:235:2:235:9 | Argument 0 | semmle.label | Argument 0 |
144144
| test.cpp:237:2:237:8 | Argument 0 | semmle.label | Argument 0 |
145145
| test.cpp:241:2:241:32 | Chi [array content] | semmle.label | Chi [array content] |
146-
| test.cpp:241:2:241:32 | StoreValue | semmle.label | StoreValue |
146+
| test.cpp:241:2:241:32 | ChiPartial | semmle.label | ChiPartial |
147147
| test.cpp:241:18:241:23 | call to getenv | semmle.label | call to getenv |
148148
| test.cpp:241:18:241:31 | (const char *)... | semmle.label | (const char *)... |
149149
| test.cpp:249:20:249:25 | call to getenv | semmle.label | call to getenv |

‎cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/uncontrolled/ArithmeticUncontrolled.expected

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -109,11 +109,11 @@ nodes
109109
| test.cpp:8:9:8:12 | call to rand | semmle.label | call to rand |
110110
| test.cpp:8:9:8:12 | call to rand | semmle.label | call to rand |
111111
| test.cpp:13:2:13:15 | Chi [array content] | semmle.label | Chi [array content] |
112-
| test.cpp:13:2:13:15 | StoreValue | semmle.label | StoreValue |
112+
| test.cpp:13:2:13:15 | ChiPartial | semmle.label | ChiPartial |
113113
| test.cpp:13:10:13:13 | call to rand | semmle.label | call to rand |
114114
| test.cpp:13:10:13:13 | call to rand | semmle.label | call to rand |
115115
| test.cpp:18:2:18:14 | Chi [array content] | semmle.label | Chi [array content] |
116-
| test.cpp:18:2:18:14 | StoreValue | semmle.label | StoreValue |
116+
| test.cpp:18:2:18:14 | ChiPartial | semmle.label | ChiPartial |
117117
| test.cpp:18:9:18:12 | call to rand | semmle.label | call to rand |
118118
| test.cpp:18:9:18:12 | call to rand | semmle.label | call to rand |
119119
| test.cpp:24:11:24:18 | call to get_rand | semmle.label | call to get_rand |

0 commit comments

Comments
 (0)