Rust: Implement the query.

Author: geoffw0

rust/ql/lib/codeql/rust/security/AccessAfterLifetimeExtensions.qll

@@ -0,0 +1,93 @@
+/**
+ * Provides classes and predicates for reasoning about accesses to a pointer
+ * after its lifetime has ended.
+ */
+
+import rust
+private import codeql.rust.dataflow.DataFlow
+private import codeql.rust.security.AccessInvalidPointerExtensions
+
+/**
+ * Provides default sources, sinks and barriers for detecting accesses to a
+ * pointer after its lifetime has ended, as well as extension points for
+ * adding your own. Note that a particular `(source, sink)` pair must be
+ * checked with `dereferenceAfterLifetime` to determine if it is a result.
+ */
+module AccessAfterLifetime {
+  /**
+   * A data flow source for accesses to a pointer after its lifetime has ended,
+   * that is, creation of a pointer or reference.
+   */
+  abstract class Source extends DataFlow::Node {
+    /**
+     * Gets the value this pointer or reference points to.
+     */
+    abstract Expr getTargetValue();
+  }
+
+  /**
+   * A data flow sink for accesses to a pointer after its lifetime has ended,
+   * that is, a dereference. We re-use the same sinks as for the accesses to
+   * invalid pointers query.
+   */
+  class Sink = AccessInvalidPointer::Sink;
+
+  /**
+   * A barrier for accesses to a pointer after its lifetime has ended.
+   */
+  abstract class Barrier extends DataFlow::Node { }
+
+  /**
+   * Holds if the pair `(source, sink)` that represents a flow from a
+   * pointer or reference to a dereference of that pointer or reference,
+   * and the dereference is outside the lifetime of the target value.
+   */
+  bindingset[source, sink]
+  predicate dereferenceAfterLifetime(Source source, Sink sink) {
+    exists(BlockExpr valueScope, BlockExpr accessScope |
+      valueScope(source.getTargetValue(), valueScope) and
+      accessScope = sink.asExpr().getExpr().getEnclosingBlock() and
+      not maybeOnStack(valueScope, accessScope)
+    )
+  }
+
+  /**
+   * Holds if `value` accesses a variable with scope `scope`.
+   */
+  private predicate valueScope(Expr value, BlockExpr scope) {
+    // variable access
+    scope = value.(VariableAccess).getVariable().getEnclosingBlock()
+    or
+    // field access
+    valueScope(value.(FieldExpr).getContainer(), scope)
+  }
+
+  /**
+   * Holds if block `a` contains block `b`, in the sense that a variable in
+   * `a` may be on the stack during execution of `b`. This is interprocedural,
+   * but is an overapproximation that doesn't accurately track call contexts
+   * (for example if `f` and `g` both call `b`, then then depending on the
+   * caller a variable in `f` or `g` may or may-not be on the stack during `b`).
+   */
+  private predicate maybeOnStack(BlockExpr a, BlockExpr b) {
+    // `b` is a child of `a`
+    a = b.getEnclosingBlock*()
+    or
+    // propagate through function calls
+    exists(CallExprBase ce |
+      maybeOnStack(a, ce.getEnclosingBlock()) and
+      ce.getStaticTarget() = b.getEnclosingCallable()
+    )
+  }
+
+  /**
+   * A source that is a `RefExpr`.
+   */
+  private class RefExprSource extends Source {
+    Expr targetValue;
+
+    RefExprSource() { this.asExpr().getExpr().(RefExpr).getExpr() = targetValue }
+
+    override Expr getTargetValue() { result = targetValue }
+  }
+}

rust/ql/src/queries/security/CWE-825/AccessAfterLifetime.ql

@@ -13,7 +13,33 @@
  */
 
 import rust
+import codeql.rust.dataflow.DataFlow
+import codeql.rust.dataflow.TaintTracking
+import codeql.rust.security.AccessAfterLifetimeExtensions
+import AccessAfterLifetimeFlow::PathGraph
 
-from int n
-where none()
-select n
+/**
+ * A data flow configuration for detecting accesses to a pointer after its
+ * lifetime has ended.
+ */
+module AccessAfterLifetimeConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node node) { node instanceof AccessAfterLifetime::Source }
+
+  predicate isSink(DataFlow::Node node) { node instanceof AccessAfterLifetime::Sink }
+
+  predicate isBarrier(DataFlow::Node barrier) { barrier instanceof AccessAfterLifetime::Barrier }
+}
+
+module AccessAfterLifetimeFlow = TaintTracking::Global<AccessAfterLifetimeConfig>;
+
+from
+  AccessAfterLifetimeFlow::PathNode sourceNode, AccessAfterLifetimeFlow::PathNode sinkNode,
+  Expr targetValue
+where
+  // flow from a pointer or reference to the dereference
+  AccessAfterLifetimeFlow::flowPath(sourceNode, sinkNode) and
+  targetValue = sourceNode.getNode().(AccessAfterLifetime::Source).getTargetValue() and
+  // check that the dereference is outside the lifetime of the target
+  AccessAfterLifetime::dereferenceAfterLifetime(sourceNode.getNode(), sinkNode.getNode())
+select sinkNode.getNode(), sourceNode, sinkNode,
+  "Access of a pointer to $@ after it's lifetime has ended.", targetValue, targetValue.toString()