Skip to content

Commit d6fd83d

Browse files
committed
C++: move resolveCall to its own file for perf
This avoids a performance issue in DataFlowImpl::localFlowStep when the DataFlow::Configuration subclasses in DefaultTaintTracking are active in the same query as other Configuration subclasses. ResolveCall.qll is kept internal for the moment.
1 parent a9add04 commit d6fd83d

File tree

3 files changed

+25
-16
lines changed

3 files changed

+25
-16
lines changed

cpp/ql/lib/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll

Lines changed: 1 addition & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ private import semmle.code.cpp.ir.dataflow.DataFlow
44
private import semmle.code.cpp.ir.dataflow.internal.DataFlowUtil
55
private import semmle.code.cpp.ir.dataflow.DataFlow3
66
private import semmle.code.cpp.ir.IR
7-
private import semmle.code.cpp.ir.dataflow.internal.DataFlowDispatch as Dispatch
7+
private import semmle.code.cpp.ir.dataflow.internal.ResolveCall
88
private import semmle.code.cpp.controlflow.IRGuards
99
private import semmle.code.cpp.models.interfaces.Taint
1010
private import semmle.code.cpp.models.interfaces.DataFlow
@@ -355,20 +355,6 @@ predicate taintedIncludingGlobalVars(Expr source, Element tainted, string global
355355
*/
356356
GlobalOrNamespaceVariable globalVarFromId(string id) { id = result.getQualifiedName() }
357357

358-
/**
359-
* Resolve potential target function(s) for `call`.
360-
*
361-
* If `call` is a call through a function pointer (`ExprCall`) or
362-
* targets a virtual method, simple data flow analysis is performed
363-
* in order to identify target(s).
364-
*/
365-
Function resolveCall(Call call) {
366-
exists(CallInstruction callInstruction |
367-
callInstruction.getAST() = call and
368-
result = Dispatch::viableCallable(callInstruction)
369-
)
370-
}
371-
372358
/**
373359
* Provides definitions for augmenting source/sink pairs with data-flow paths
374360
* between them. From a `@kind path-problem` query, import this module in the
Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
/**
2+
* Provides a predicate for non-contextual virtual dispatch and function
3+
* pointer resolution, built on top of the `DataFlowDispatch` library.
4+
*/
5+
6+
import cpp
7+
private import semmle.code.cpp.ir.ValueNumbering
8+
private import DataFlowDispatch
9+
private import semmle.code.cpp.ir.IR
10+
11+
/**
12+
* Resolve potential target function(s) for `call`.
13+
*
14+
* If `call` is a call through a function pointer (`ExprCall`) or
15+
* targets a virtual method, simple data flow analysis is performed
16+
* in order to identify target(s).
17+
*/
18+
Function resolveCall(Call call) {
19+
exists(CallInstruction callInstruction |
20+
callInstruction.getAST() = call and
21+
result = viableCallable(callInstruction)
22+
)
23+
}

cpp/ql/lib/semmle/code/cpp/security/FunctionWithWrappers.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717

1818
import cpp
1919
import PrintfLike
20-
private import TaintTracking
20+
private import semmle.code.cpp.ir.dataflow.internal.ResolveCall
2121

2222
bindingset[index]
2323
private string toCause(Function func, int index) {

0 commit comments

Comments
 (0)