Skip to content

Commit 7434702

Browse files
authored
Merge pull request github#1735 from rdmarsh2/rdmarsh/cpp/ir-dataflow-def-by-ref-2
C++: side effect IR instructions for pointer arguments
2 parents fdc29aa + d1e2ddc commit 7434702

38 files changed

+2202
-1031
lines changed

config/identical-files.json

Lines changed: 28 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -47,31 +47,36 @@
4747
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Instruction.qll",
4848
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll",
4949
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll",
50-
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/Instruction.qll"
50+
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/Instruction.qll",
51+
"csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/Instruction.qll"
5152
],
5253
"IR IRBlock": [
5354
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRBlock.qll",
5455
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRBlock.qll",
5556
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRBlock.qll",
56-
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/IRBlock.qll"
57+
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/IRBlock.qll",
58+
"csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/IRBlock.qll"
5759
],
5860
"IR IRVariable": [
5961
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRVariable.qll",
6062
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRVariable.qll",
6163
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRVariable.qll",
62-
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/IRVariable.qll"
64+
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/IRVariable.qll",
65+
"csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/IRVariable.qll"
6366
],
6467
"IR IRFunction": [
6568
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRFunction.qll",
6669
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRFunction.qll",
6770
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRFunction.qll",
68-
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/IRFunction.qll"
71+
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/IRFunction.qll",
72+
"csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/IRFunction.qll"
6973
],
7074
"IR Operand": [
7175
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Operand.qll",
7276
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Operand.qll",
7377
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Operand.qll",
74-
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/Operand.qll"
78+
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/Operand.qll",
79+
"csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/Operand.qll"
7580
],
7681
"IR Operand Tag": [
7782
"cpp/ql/src/semmle/code/cpp/ir/implementation/internal/OperandTag.qll",
@@ -85,19 +90,22 @@
8590
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IR.qll",
8691
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IR.qll",
8792
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IR.qll",
88-
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/IR.qll"
93+
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/IR.qll",
94+
"csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/IR.qll"
8995
],
9096
"IR IRSanity": [
9197
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRSanity.qll",
9298
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRSanity.qll",
9399
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRSanity.qll",
94-
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/IRSanity.qll"
100+
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/IRSanity.qll",
101+
"csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/IRSanity.qll"
95102
],
96103
"IR PrintIR": [
97104
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/PrintIR.qll",
98105
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/PrintIR.qll",
99106
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/PrintIR.qll",
100-
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/PrintIR.qll"
107+
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/PrintIR.qll",
108+
"csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/PrintIR.qll"
101109
],
102110
"IR IntegerConstant": [
103111
"cpp/ql/src/semmle/code/cpp/ir/internal/IntegerConstant.qll",
@@ -205,21 +213,27 @@
205213
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/reachability/PrintDominance.qll"
206214
],
207215
"C# IR InstructionImports": [
208-
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/internal/InstructionImports.qll"
216+
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/internal/InstructionImports.qll",
217+
"csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/internal/InstructionImports.qll"
209218
],
210219
"C# IR IRImports": [
211-
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/internal/IRImports.qll"
220+
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/internal/IRImports.qll",
221+
"csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/internal/IRImports.qll"
212222
],
213223
"C# IR IRBlockImports": [
214-
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/internal/IRBlockImports.qll"
224+
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/internal/IRBlockImports.qll",
225+
"csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/internal/IRBlockImports.qll"
215226
],
216227
"C# IR IRVariableImports": [
217-
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/internal/IRVariableImports.qll"
228+
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/internal/IRVariableImports.qll",
229+
"csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/internal/IRVariableImports.qll"
218230
],
219231
"C# IR OperandImports": [
220-
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/internal/OperandImports.qll"
232+
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/internal/OperandImports.qll",
233+
"csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/internal/OperandImports.qll"
221234
],
222235
"C# IR PrintIRImports": [
223-
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/internal/PrintIRImports.qll"
236+
"csharp/ql/src/semmle/code/csharp/ir/implementation/raw/internal/PrintIRImports.qll",
237+
"csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/internal/PrintIRImports.qll"
224238
]
225239
}

cpp/ql/src/semmle/code/cpp/Parameter.qll

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,3 +158,10 @@ class Parameter extends LocalScopeVariable, @parameter {
158158
)
159159
}
160160
}
161+
162+
/**
163+
* An `int` that is a parameter index for some function. This is needed for binding in certain cases.
164+
*/
165+
class ParameterIndex extends int {
166+
ParameterIndex() { exists(Parameter p | this = p.getIndex()) }
167+
}

cpp/ql/src/semmle/code/cpp/ir/implementation/Opcode.qll

Lines changed: 39 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -66,11 +66,14 @@ private newtype TOpcode =
6666
TCallSideEffect() or
6767
TCallReadSideEffect() or
6868
TIndirectReadSideEffect() or
69-
TIndirectWriteSideEffect() or
69+
TIndirectMustWriteSideEffect() or
7070
TIndirectMayWriteSideEffect() or
7171
TBufferReadSideEffect() or
72-
TBufferWriteSideEffect() or
72+
TBufferMustWriteSideEffect() or
7373
TBufferMayWriteSideEffect() or
74+
TSizedBufferReadSideEffect() or
75+
TSizedBufferMustWriteSideEffect() or
76+
TSizedBufferMayWriteSideEffect() or
7477
TChi() or
7578
TInlineAsm() or
7679
TUnreached() or
@@ -135,17 +138,28 @@ abstract class ReadSideEffectOpcode extends SideEffectOpcode { }
135138
*/
136139
abstract class WriteSideEffectOpcode extends SideEffectOpcode { }
137140

141+
/**
142+
* An opcode that definitely writes to a set of memory locations as a side effect.
143+
*/
144+
abstract class MustWriteSideEffectOpcode extends WriteSideEffectOpcode { }
145+
138146
/**
139147
* An opcode that may overwrite some, all, or none of an existing set of memory locations. Modeled
140148
* as a read of the original contents, plus a "may" write of the new contents.
141149
*/
142-
abstract class MayWriteSideEffectOpcode extends SideEffectOpcode { }
150+
abstract class MayWriteSideEffectOpcode extends WriteSideEffectOpcode { }
143151

144152
/**
145-
* An opcode that accesses a buffer via an `AddressOperand` and a `BufferSizeOperand`.
153+
* An opcode that accesses a buffer via an `AddressOperand`.
146154
*/
147155
abstract class BufferAccessOpcode extends MemoryAccessOpcode { }
148156

157+
/**
158+
* An opcode that accesses a buffer via an `AddressOperand` with a `BufferSizeOperand` specifying
159+
* the number of elements accessed.
160+
*/
161+
abstract class SizedBufferAccessOpcode extends BufferAccessOpcode { }
162+
149163
module Opcode {
150164
class NoOp extends Opcode, TNoOp {
151165
final override string toString() { result = "NoOp" }
@@ -416,9 +430,9 @@ module Opcode {
416430
final override string toString() { result = "IndirectReadSideEffect" }
417431
}
418432

419-
class IndirectWriteSideEffect extends WriteSideEffectOpcode, MemoryAccessOpcode,
420-
TIndirectWriteSideEffect {
421-
final override string toString() { result = "IndirectWriteSideEffect" }
433+
class IndirectMustWriteSideEffect extends MustWriteSideEffectOpcode, MemoryAccessOpcode,
434+
TIndirectMustWriteSideEffect {
435+
final override string toString() { result = "IndirectMustWriteSideEffect" }
422436
}
423437

424438
class IndirectMayWriteSideEffect extends MayWriteSideEffectOpcode, MemoryAccessOpcode,
@@ -430,16 +444,31 @@ module Opcode {
430444
final override string toString() { result = "BufferReadSideEffect" }
431445
}
432446

433-
class BufferWriteSideEffect extends WriteSideEffectOpcode, BufferAccessOpcode,
434-
TBufferWriteSideEffect {
435-
final override string toString() { result = "BufferWriteSideEffect" }
447+
class BufferMustWriteSideEffect extends MustWriteSideEffectOpcode, BufferAccessOpcode,
448+
TBufferMustWriteSideEffect {
449+
final override string toString() { result = "BufferMustWriteSideEffect" }
436450
}
437451

438452
class BufferMayWriteSideEffect extends MayWriteSideEffectOpcode, BufferAccessOpcode,
439453
TBufferMayWriteSideEffect {
440454
final override string toString() { result = "BufferMayWriteSideEffect" }
441455
}
442456

457+
class SizedBufferReadSideEffect extends ReadSideEffectOpcode, SizedBufferAccessOpcode,
458+
TSizedBufferReadSideEffect {
459+
final override string toString() { result = "SizedBufferReadSideEffect" }
460+
}
461+
462+
class SizedBufferMustWriteSideEffect extends MustWriteSideEffectOpcode, SizedBufferAccessOpcode,
463+
TSizedBufferMustWriteSideEffect {
464+
final override string toString() { result = "SizedBufferMustWriteSideEffect" }
465+
}
466+
467+
class SizedBufferMayWriteSideEffect extends MayWriteSideEffectOpcode, SizedBufferAccessOpcode,
468+
TSizedBufferMayWriteSideEffect {
469+
final override string toString() { result = "SizedBufferMayWriteSideEffect" }
470+
}
471+
443472
class Chi extends Opcode, TChi {
444473
final override string toString() { result = "Chi" }
445474
}

cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll

Lines changed: 80 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ module InstructionSanity {
3030
or
3131
opcode instanceof MemoryAccessOpcode and tag instanceof AddressOperandTag
3232
or
33-
opcode instanceof BufferAccessOpcode and tag instanceof BufferSizeOperand
33+
opcode instanceof SizedBufferAccessOpcode and tag instanceof BufferSizeOperandTag
3434
or
3535
opcode instanceof OpcodeWithCondition and tag instanceof ConditionOperandTag
3636
or
@@ -48,8 +48,8 @@ module InstructionSanity {
4848
or
4949
(
5050
opcode instanceof ReadSideEffectOpcode or
51-
opcode instanceof MayWriteSideEffectOpcode or
52-
opcode instanceof Opcode::InlineAsm
51+
opcode instanceof Opcode::InlineAsm or
52+
opcode instanceof Opcode::CallSideEffect
5353
) and
5454
tag instanceof SideEffectOperandTag
5555
)
@@ -609,7 +609,7 @@ class VariableInstruction extends Instruction {
609609

610610
VariableInstruction() { var = Construction::getInstructionVariable(this) }
611611

612-
final override string getImmediateString() { result = var.toString() }
612+
override string getImmediateString() { result = var.toString() }
613613

614614
final IRVariable getVariable() { result = var }
615615
}
@@ -644,6 +644,16 @@ class ConstantValueInstruction extends Instruction {
644644
final string getValue() { result = value }
645645
}
646646

647+
class IndexedInstruction extends Instruction {
648+
int index;
649+
650+
IndexedInstruction() { index = Construction::getInstructionIndex(this) }
651+
652+
final override string getImmediateString() { result = index.toString() }
653+
654+
final int getIndex() { result = index }
655+
}
656+
647657
class EnterFunctionInstruction extends Instruction {
648658
EnterFunctionInstruction() { getOpcode() instanceof Opcode::EnterFunction }
649659
}
@@ -1175,20 +1185,48 @@ class CallReadSideEffectInstruction extends SideEffectInstruction {
11751185
*/
11761186
class IndirectReadSideEffectInstruction extends SideEffectInstruction {
11771187
IndirectReadSideEffectInstruction() { getOpcode() instanceof Opcode::IndirectReadSideEffect }
1188+
1189+
Instruction getArgumentDef() { result = getAnOperand().(AddressOperand).getDef() }
11781190
}
11791191

11801192
/**
11811193
* An instruction representing the read of an indirect buffer parameter within a function call.
11821194
*/
11831195
class BufferReadSideEffectInstruction extends SideEffectInstruction {
11841196
BufferReadSideEffectInstruction() { getOpcode() instanceof Opcode::BufferReadSideEffect }
1197+
1198+
Instruction getArgumentDef() { result = getAnOperand().(AddressOperand).getDef() }
1199+
}
1200+
1201+
/**
1202+
* An instruction representing the read of an indirect buffer parameter within a function call.
1203+
*/
1204+
class SizedBufferReadSideEffectInstruction extends SideEffectInstruction {
1205+
SizedBufferReadSideEffectInstruction() {
1206+
getOpcode() instanceof Opcode::SizedBufferReadSideEffect
1207+
}
1208+
1209+
Instruction getArgumentDef() { result = getAnOperand().(AddressOperand).getDef() }
1210+
1211+
Instruction getSizeDef() { result = getAnOperand().(BufferSizeOperand).getDef() }
1212+
}
1213+
1214+
/**
1215+
* An instruction representing a side effect of a function call.
1216+
*/
1217+
class WriteSideEffectInstruction extends SideEffectInstruction {
1218+
WriteSideEffectInstruction() { getOpcode() instanceof WriteSideEffectOpcode }
1219+
1220+
Instruction getArgumentDef() { result = getAnOperand().(AddressOperand).getDef() }
11851221
}
11861222

11871223
/**
11881224
* An instruction representing the write of an indirect parameter within a function call.
11891225
*/
1190-
class IndirectWriteSideEffectInstruction extends SideEffectInstruction {
1191-
IndirectWriteSideEffectInstruction() { getOpcode() instanceof Opcode::IndirectWriteSideEffect }
1226+
class IndirectMustWriteSideEffectInstruction extends WriteSideEffectInstruction {
1227+
IndirectMustWriteSideEffectInstruction() {
1228+
getOpcode() instanceof Opcode::IndirectMustWriteSideEffect
1229+
}
11921230

11931231
final override MemoryAccessKind getResultMemoryAccess() { result instanceof IndirectMemoryAccess }
11941232
}
@@ -1197,18 +1235,34 @@ class IndirectWriteSideEffectInstruction extends SideEffectInstruction {
11971235
* An instruction representing the write of an indirect buffer parameter within a function call. The
11981236
* entire buffer is overwritten.
11991237
*/
1200-
class BufferWriteSideEffectInstruction extends SideEffectInstruction {
1201-
BufferWriteSideEffectInstruction() { getOpcode() instanceof Opcode::BufferWriteSideEffect }
1238+
class BufferMustWriteSideEffectInstruction extends WriteSideEffectInstruction {
1239+
BufferMustWriteSideEffectInstruction() {
1240+
getOpcode() instanceof Opcode::BufferMustWriteSideEffect
1241+
}
12021242

12031243
final override MemoryAccessKind getResultMemoryAccess() { result instanceof BufferMemoryAccess }
12041244
}
12051245

1246+
/**
1247+
* An instruction representing the write of an indirect buffer parameter within a function call. The
1248+
* entire buffer is overwritten.
1249+
*/
1250+
class SizedBufferMustWriteSideEffectInstruction extends WriteSideEffectInstruction {
1251+
SizedBufferMustWriteSideEffectInstruction() {
1252+
getOpcode() instanceof Opcode::SizedBufferMustWriteSideEffect
1253+
}
1254+
1255+
final override MemoryAccessKind getResultMemoryAccess() { result instanceof BufferMemoryAccess }
1256+
1257+
Instruction getSizeDef() { result = getAnOperand().(BufferSizeOperand).getDef() }
1258+
}
1259+
12061260
/**
12071261
* An instruction representing the potential write of an indirect parameter within a function call.
12081262
* Unlike `IndirectWriteSideEffectInstruction`, the ___location might not be completely overwritten.
12091263
* written.
12101264
*/
1211-
class IndirectMayWriteSideEffectInstruction extends SideEffectInstruction {
1265+
class IndirectMayWriteSideEffectInstruction extends WriteSideEffectInstruction {
12121266
IndirectMayWriteSideEffectInstruction() {
12131267
getOpcode() instanceof Opcode::IndirectMayWriteSideEffect
12141268
}
@@ -1222,14 +1276,30 @@ class IndirectMayWriteSideEffectInstruction extends SideEffectInstruction {
12221276
* An instruction representing the write of an indirect buffer parameter within a function call.
12231277
* Unlike `BufferWriteSideEffectInstruction`, the buffer might not be completely overwritten.
12241278
*/
1225-
class BufferMayWriteSideEffectInstruction extends SideEffectInstruction {
1279+
class BufferMayWriteSideEffectInstruction extends WriteSideEffectInstruction {
12261280
BufferMayWriteSideEffectInstruction() { getOpcode() instanceof Opcode::BufferMayWriteSideEffect }
12271281

12281282
final override MemoryAccessKind getResultMemoryAccess() {
12291283
result instanceof BufferMayMemoryAccess
12301284
}
12311285
}
12321286

1287+
/**
1288+
* An instruction representing the write of an indirect buffer parameter within a function call.
1289+
* Unlike `BufferWriteSideEffectInstruction`, the buffer might not be completely overwritten.
1290+
*/
1291+
class SizedBufferMayWriteSideEffectInstruction extends WriteSideEffectInstruction {
1292+
SizedBufferMayWriteSideEffectInstruction() {
1293+
getOpcode() instanceof Opcode::SizedBufferMayWriteSideEffect
1294+
}
1295+
1296+
final override MemoryAccessKind getResultMemoryAccess() {
1297+
result instanceof BufferMayMemoryAccess
1298+
}
1299+
1300+
Instruction getSizeDef() { result = getAnOperand().(BufferSizeOperand).getDef() }
1301+
}
1302+
12331303
/**
12341304
* An instruction representing a GNU or MSVC inline assembly statement.
12351305
*/

0 commit comments

Comments
 (0)