|
| 1 | +private import cpp |
| 2 | +private import semmle.code.cpp.ir.IR |
| 3 | +private import codeql.typeflow.TypeFlow |
| 4 | + |
| 5 | +private module Input implements TypeFlowInput<Location> { |
| 6 | + /** Holds if `alloc` dynamically allocates a single object. */ |
| 7 | + private predicate isSingleObjectAllocation(AllocationExpr alloc) { |
| 8 | + // i.e., `new int`; |
| 9 | + alloc instanceof NewExpr |
| 10 | + or |
| 11 | + // i.e., `malloc(sizeof(int))` |
| 12 | + exists(SizeofTypeOperator sizeOf | sizeOf = alloc.getSizeExpr() | |
| 13 | + not sizeOf.getTypeOperand().getUnspecifiedType() instanceof ArrayType |
| 14 | + ) |
| 15 | + } |
| 16 | + |
| 17 | + /** |
| 18 | + * Holds if `i` is the result of a dynamic allocation. |
| 19 | + * |
| 20 | + * `isObject` is `true` if the allocation allocated a single object, |
| 21 | + * and `false` otherwise. |
| 22 | + */ |
| 23 | + private predicate isAllocation(Instruction i, boolean isObject) { |
| 24 | + exists(AllocationExpr alloc | alloc = i.getUnconvertedResultExpression() | |
| 25 | + if isSingleObjectAllocation(alloc) then isObject = true else isObject = false |
| 26 | + ) |
| 27 | + } |
| 28 | + |
| 29 | + private predicate hasExactSingleType(Instruction i) { |
| 30 | + // The address of a variable is always a single object |
| 31 | + i instanceof VariableAddressInstruction |
| 32 | + or |
| 33 | + // A reference always points to a single object |
| 34 | + i.getResultLanguageType().hasUnspecifiedType(any(ReferenceType rt), false) |
| 35 | + or |
| 36 | + // `this` is never an array |
| 37 | + i instanceof InitializeThisInstruction |
| 38 | + or |
| 39 | + // An allocation of a non-array object |
| 40 | + isAllocation(i, true) |
| 41 | + } |
| 42 | + |
| 43 | + private predicate hasExactBufferType(Instruction i) { |
| 44 | + // Anything with an array type is a buffer |
| 45 | + i.getResultLanguageType().hasUnspecifiedType(any(ArrayType at), false) |
| 46 | + or |
| 47 | + // An allocation expression that we couldn't conclude allocated a single |
| 48 | + // expression is assigned a buffer type. |
| 49 | + isAllocation(i, false) |
| 50 | + } |
| 51 | + |
| 52 | + private newtype TTypeFlowNode = |
| 53 | + TInstructionNode(Instruction i) or |
| 54 | + TFunctionNode(IRFunction func) |
| 55 | + |
| 56 | + abstract class TypeFlowNode extends TTypeFlowNode { |
| 57 | + /** Gets a textual representation of this node. */ |
| 58 | + abstract string toString(); |
| 59 | + |
| 60 | + /** |
| 61 | + * Gets the type of this node. This type may not be the most precise |
| 62 | + * possible type, but will be used as a starting point of the analysis. |
| 63 | + */ |
| 64 | + abstract Type getType(); |
| 65 | + |
| 66 | + /** Gets the location of this node. */ |
| 67 | + abstract Location getLocation(); |
| 68 | + |
| 69 | + /** Gets the underlying `Instruction` of this node, if any. */ |
| 70 | + Instruction asInstruction() { none() } |
| 71 | + |
| 72 | + /** Gets the underlying `IRFunction` of this node, if any. */ |
| 73 | + IRFunction asFunction() { none() } |
| 74 | + |
| 75 | + /** Holds if the value of this node is always null. */ |
| 76 | + abstract predicate isNullValue(); |
| 77 | + } |
| 78 | + |
| 79 | + private class InstructionNode extends TypeFlowNode, TInstructionNode { |
| 80 | + Instruction instr; |
| 81 | + |
| 82 | + InstructionNode() { this = TInstructionNode(instr) } |
| 83 | + |
| 84 | + override string toString() { result = instr.toString() } |
| 85 | + |
| 86 | + override Type getType() { |
| 87 | + if hasExactSingleType(instr) then result.isSingle() else result.isBuffer() |
| 88 | + } |
| 89 | + |
| 90 | + override Location getLocation() { result = instr.getLocation() } |
| 91 | + |
| 92 | + override Instruction asInstruction() { result = instr } |
| 93 | + |
| 94 | + override predicate isNullValue() { |
| 95 | + instr.(ConstantInstruction).getValue() = "0" and |
| 96 | + instr.getResultIRType() instanceof IRAddressType |
| 97 | + } |
| 98 | + } |
| 99 | + |
| 100 | + /** Gets the `TypeFlowNode` corresponding to `i`. */ |
| 101 | + additional InstructionNode instructionNode(Instruction i) { result.asInstruction() = i } |
| 102 | + |
| 103 | + private class FunctionNode extends TypeFlowNode, TFunctionNode { |
| 104 | + IRFunction func; |
| 105 | + |
| 106 | + FunctionNode() { this = TFunctionNode(func) } |
| 107 | + |
| 108 | + override string toString() { result = func.toString() } |
| 109 | + |
| 110 | + Instruction getReturnValueInstruction() { |
| 111 | + result = func.getReturnInstruction().(ReturnValueInstruction).getReturnValue() |
| 112 | + } |
| 113 | + |
| 114 | + override Type getType() { result = instructionNode(this.getReturnValueInstruction()).getType() } |
| 115 | + |
| 116 | + override Location getLocation() { result = func.getLocation() } |
| 117 | + |
| 118 | + override IRFunction asFunction() { result = func } |
| 119 | + |
| 120 | + override predicate isNullValue() { |
| 121 | + instructionNode(this.getReturnValueInstruction()).isNullValue() |
| 122 | + } |
| 123 | + } |
| 124 | + |
| 125 | + /** |
| 126 | + * Gets an ultimiate definition of `phi`. That is, an input to `phi` that is |
| 127 | + * not itself a `PhiInstruction`. |
| 128 | + */ |
| 129 | + private Instruction getAnUltimateLocalDefinition(PhiInstruction phi) { |
| 130 | + result = phi.getAnInput*() and not result instanceof PhiInstruction |
| 131 | + } |
| 132 | + |
| 133 | + /** |
| 134 | + * Holds if this function is private (i.e., cannot be accessed outside its |
| 135 | + * compilation unit). This means we can use a closed-world assumption about |
| 136 | + * calls to this function. |
| 137 | + */ |
| 138 | + private predicate isPrivate(Function func) { |
| 139 | + // static functions have internal linkage |
| 140 | + func.isStatic() |
| 141 | + or |
| 142 | + // anonymous namespaces have internal linkage |
| 143 | + func.getNamespace().getParentNamespace*().isAnonymous() |
| 144 | + or |
| 145 | + // private member functions are only called internally from inside the class |
| 146 | + func.(MemberFunction).isPrivate() |
| 147 | + } |
| 148 | + |
| 149 | + /** |
| 150 | + * Holds if `arg` is an argument for the parameter `p` in a private callable. |
| 151 | + */ |
| 152 | + pragma[nomagic] |
| 153 | + private predicate privateParamArg(InitializeParameterInstruction p, Instruction arg) { |
| 154 | + exists(CallInstruction call, int i, Function func | |
| 155 | + call.getArgument(pragma[only_bind_into](i)) = arg and |
| 156 | + func = call.getStaticCallTarget() and |
| 157 | + func.getParameter(pragma[only_bind_into](i)) = p.getParameter() and |
| 158 | + isPrivate(func) |
| 159 | + ) |
| 160 | + } |
| 161 | + |
| 162 | + predicate joinStep(TypeFlowNode n1, TypeFlowNode n2) { |
| 163 | + // instruction -> phi |
| 164 | + getAnUltimateLocalDefinition(n2.asInstruction()) = n1.asInstruction() |
| 165 | + or |
| 166 | + // return value -> function |
| 167 | + n2.(FunctionNode).getReturnValueInstruction() = n1.asInstruction() |
| 168 | + or |
| 169 | + // function -> call |
| 170 | + exists(Function func | func = n1.asFunction().getFunction() | |
| 171 | + not func.isVirtual() and |
| 172 | + n2.asInstruction().(CallInstruction).getStaticCallTarget() = func |
| 173 | + ) |
| 174 | + or |
| 175 | + // Argument -> parameter where the parameter's enclosing function |
| 176 | + // is "private". |
| 177 | + exists(Instruction arg, Instruction p | |
| 178 | + privateParamArg(p, arg) and |
| 179 | + n1.asInstruction() = arg and |
| 180 | + n2.asInstruction() = p |
| 181 | + ) |
| 182 | + } |
| 183 | + |
| 184 | + /** |
| 185 | + * Holds if knowing whether `i1` points to a single object or buffer implies |
| 186 | + * knowing whether `i2` points to a single object or buffer. |
| 187 | + */ |
| 188 | + private predicate instructionStep(Instruction i1, Instruction i2) { |
| 189 | + i2.(CopyInstruction).getSourceValue() = i1 |
| 190 | + or |
| 191 | + i2.(CopyValueInstruction).getSourceValue() = i1 |
| 192 | + or |
| 193 | + i2.(ConvertInstruction).getUnary() = i1 |
| 194 | + or |
| 195 | + i2.(CheckedConvertOrNullInstruction).getUnary() = i1 |
| 196 | + or |
| 197 | + i2.(InheritanceConversionInstruction).getUnary() = i1 |
| 198 | + or |
| 199 | + i2.(PointerArithmeticInstruction).getLeft() = i1 |
| 200 | + } |
| 201 | + |
| 202 | + predicate step(TypeFlowNode n1, TypeFlowNode n2) { |
| 203 | + instructionStep(n1.asInstruction(), n2.asInstruction()) |
| 204 | + } |
| 205 | + |
| 206 | + predicate isNullValue(TypeFlowNode n) { n.isNullValue() } |
| 207 | + |
| 208 | + private newtype TType = |
| 209 | + TSingle() or |
| 210 | + TBuffer() |
| 211 | + |
| 212 | + class Type extends TType { |
| 213 | + string toString() { |
| 214 | + this.isSingle() and |
| 215 | + result = "Single" |
| 216 | + or |
| 217 | + this.isBuffer() and |
| 218 | + result = "Buffer" |
| 219 | + } |
| 220 | + |
| 221 | + /** Holds if this type is the type that represents a single object. */ |
| 222 | + predicate isSingle() { this = TSingle() } |
| 223 | + |
| 224 | + /** Holds if this type is the type that represents a buffer. */ |
| 225 | + predicate isBuffer() { this = TBuffer() } |
| 226 | + |
| 227 | + /** |
| 228 | + * Gets a super type of this type, if any. |
| 229 | + * |
| 230 | + * The type relation is `Single <: Buffer`. |
| 231 | + */ |
| 232 | + Type getASupertype() { |
| 233 | + this.isSingle() and |
| 234 | + result.isBuffer() |
| 235 | + } |
| 236 | + } |
| 237 | + |
| 238 | + predicate exactTypeBase(TypeFlowNode n, Type t) { |
| 239 | + exists(Instruction instr | instr = n.asInstruction() | |
| 240 | + hasExactSingleType(instr) and t.isSingle() |
| 241 | + or |
| 242 | + hasExactBufferType(instr) and t.isBuffer() |
| 243 | + ) |
| 244 | + } |
| 245 | + |
| 246 | + pragma[nomagic] |
| 247 | + private predicate upcastCand(TypeFlowNode n, Type t1, Type t2) { |
| 248 | + exists(TypeFlowNode next | |
| 249 | + step(n, next) |
| 250 | + or |
| 251 | + joinStep(n, next) |
| 252 | + | |
| 253 | + n.getType() = t1 and |
| 254 | + next.getType() = t2 and |
| 255 | + t1 != t2 |
| 256 | + ) |
| 257 | + } |
| 258 | + |
| 259 | + private predicate upcast(TypeFlowNode n, Type t1) { |
| 260 | + exists(Type t2 | upcastCand(n, t1, t2) | |
| 261 | + // No need for transitive closure since the subtyping relation is just `Single <: Buffer` |
| 262 | + t1.getASupertype() = t2 |
| 263 | + ) |
| 264 | + } |
| 265 | + |
| 266 | + predicate typeFlowBaseCand(TypeFlowNode n, Type t) { upcast(n, t) } |
| 267 | +} |
| 268 | + |
| 269 | +private module TypeFlow = Make<Location, Input>; |
| 270 | + |
| 271 | +/** |
| 272 | + * Holds if `i` is an instruction that computes an address that points to a |
| 273 | + * single object (as opposed to pointing into a buffer). |
| 274 | + */ |
| 275 | +pragma[nomagic] |
| 276 | +predicate isPointerToSingleObject(Instruction i) { |
| 277 | + TypeFlow::bestTypeFlow(Input::instructionNode(i), any(Input::Type t | t.isSingle()), _) |
| 278 | +} |
0 commit comments