Skip to content

Commit fe20fb4

Browse files
geoffw0geoffw0
committed
Rust: More robust fix for closures.
1 parent 21b4bae commit fe20fb4

File tree

2 files changed

+9
-62
lines changed

2 files changed

+9
-62
lines changed

‎rust/ql/lib/codeql/rust/security/AccessAfterLifetimeExtensions.qll

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -47,10 +47,7 @@ module AccessAfterLifetime {
4747
exists(BlockExpr valueScope, BlockExpr accessScope |
4848
valueScope(source.getTarget(), target, valueScope) and
4949
accessScope = sink.asExpr().getExpr().getEnclosingBlock() and
50-
not maybeOnStack(valueScope, accessScope) and
51-
// exclude results where the access is in a closure, since we don't
52-
// model where a closure is actually called here.
53-
not accessScope.getEnclosingBlock*() = any(ClosureExpr ce).getBody()
50+
not maybeOnStack(valueScope, accessScope)
5451
)
5552
}
5653

@@ -94,4 +91,12 @@ module AccessAfterLifetime {
9491

9592
override Expr getTarget() { result = targetValue }
9693
}
94+
95+
/**
96+
* A barrier for nodes inside closures, as we don't model lifetimes of
97+
* variables through closures properly.
98+
*/
99+
private class ClosureBarrier extends Barrier {
100+
ClosureBarrier() { this.asExpr().getExpr().getEnclosingCallable() instanceof ClosureExpr }
101+
}
97102
}

‎rust/ql/test/query-tests/security/CWE-825/AccessAfterLifetime.expected

Lines changed: 0 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -161,31 +161,6 @@ edges
161161
| lifetime.rs:450:2:450:10 | return p1 | lifetime.rs:460:13:460:31 | get_ptr_from_ref(...) | provenance | |
162162
| lifetime.rs:454:6:454:7 | p1 | lifetime.rs:459:13:459:14 | p1 | provenance | |
163163
| lifetime.rs:454:11:454:29 | get_ptr_from_ref(...) | lifetime.rs:454:6:454:7 | p1 | provenance | |
164-
| lifetime.rs:509:16:509:29 | ...: ... | lifetime.rs:514:2:527:2 | return ... [captured p3] | provenance | |
165-
| lifetime.rs:509:32:509:45 | ...: ... | lifetime.rs:514:2:527:2 | return ... [captured p4] | provenance | |
166-
| lifetime.rs:512:23:512:32 | &my_local1 | lifetime.rs:514:2:527:2 | return ... [captured p1] | provenance | |
167-
| lifetime.rs:514:2:527:2 | return ... [captured p1] | lifetime.rs:542:13:543:14 | get_closure(...) [captured p1] | provenance | |
168-
| lifetime.rs:515:7:515:8 | p2 | lifetime.rs:519:14:519:15 | p2 | provenance | |
169-
| lifetime.rs:515:24:515:33 | &my_local2 | lifetime.rs:515:7:515:8 | p2 | provenance | |
170-
| lifetime.rs:530:17:530:31 | ...: ... | lifetime.rs:533:10:533:12 | ptr | provenance | |
171-
| lifetime.rs:533:10:533:12 | ptr | lifetime.rs:550:28:550:29 | ... | provenance | |
172-
| lifetime.rs:534:3:534:12 | &my_local5 | lifetime.rs:550:32:550:33 | ... | provenance | |
173-
| lifetime.rs:542:3:542:9 | closure [captured p1] | lifetime.rs:548:2:548:8 | closure [captured p1] | provenance | |
174-
| lifetime.rs:542:3:542:9 | closure [captured p3] | lifetime.rs:548:2:548:8 | closure [captured p3] | provenance | |
175-
| lifetime.rs:542:3:542:9 | closure [captured p4] | lifetime.rs:548:2:548:8 | closure [captured p4] | provenance | |
176-
| lifetime.rs:542:13:543:14 | get_closure(...) [captured p1] | lifetime.rs:542:3:542:9 | closure [captured p1] | provenance | |
177-
| lifetime.rs:542:13:543:14 | get_closure(...) [captured p3] | lifetime.rs:542:3:542:9 | closure [captured p3] | provenance | |
178-
| lifetime.rs:542:13:543:14 | get_closure(...) [captured p4] | lifetime.rs:542:3:542:9 | closure [captured p4] | provenance | |
179-
| lifetime.rs:542:26:542:35 | &my_local3 | lifetime.rs:509:16:509:29 | ...: ... | provenance | |
180-
| lifetime.rs:542:26:542:35 | &my_local3 | lifetime.rs:542:13:543:14 | get_closure(...) [captured p3] | provenance | |
181-
| lifetime.rs:543:4:543:13 | &my_local4 | lifetime.rs:509:32:509:45 | ...: ... | provenance | |
182-
| lifetime.rs:543:4:543:13 | &my_local4 | lifetime.rs:542:13:543:14 | get_closure(...) [captured p4] | provenance | |
183-
| lifetime.rs:548:2:548:8 | closure [captured p1] | lifetime.rs:518:14:518:15 | p1 | provenance | |
184-
| lifetime.rs:548:2:548:8 | closure [captured p3] | lifetime.rs:520:14:520:15 | p3 | provenance | |
185-
| lifetime.rs:548:2:548:8 | closure [captured p4] | lifetime.rs:521:14:521:15 | p4 | provenance | |
186-
| lifetime.rs:550:15:550:24 | &my_local3 | lifetime.rs:530:17:530:31 | ...: ... | provenance | |
187-
| lifetime.rs:550:28:550:29 | ... | lifetime.rs:552:14:552:15 | p1 | provenance | |
188-
| lifetime.rs:550:32:550:33 | ... | lifetime.rs:553:14:553:15 | p2 | provenance | |
189164
| lifetime.rs:568:7:568:8 | p2 | lifetime.rs:572:14:572:15 | p2 | provenance | |
190165
| lifetime.rs:568:24:568:33 | &my_local2 | lifetime.rs:568:7:568:8 | p2 | provenance | |
191166
| lifetime.rs:630:3:630:6 | str2 | lifetime.rs:633:15:633:18 | str2 | provenance | |
@@ -376,37 +351,6 @@ nodes
376351
| lifetime.rs:454:11:454:29 | get_ptr_from_ref(...) | semmle.label | get_ptr_from_ref(...) |
377352
| lifetime.rs:459:13:459:14 | p1 | semmle.label | p1 |
378353
| lifetime.rs:460:13:460:31 | get_ptr_from_ref(...) | semmle.label | get_ptr_from_ref(...) |
379-
| lifetime.rs:509:16:509:29 | ...: ... | semmle.label | ...: ... |
380-
| lifetime.rs:509:32:509:45 | ...: ... | semmle.label | ...: ... |
381-
| lifetime.rs:512:23:512:32 | &my_local1 | semmle.label | &my_local1 |
382-
| lifetime.rs:514:2:527:2 | return ... [captured p1] | semmle.label | return ... [captured p1] |
383-
| lifetime.rs:514:2:527:2 | return ... [captured p3] | semmle.label | return ... [captured p3] |
384-
| lifetime.rs:514:2:527:2 | return ... [captured p4] | semmle.label | return ... [captured p4] |
385-
| lifetime.rs:515:7:515:8 | p2 | semmle.label | p2 |
386-
| lifetime.rs:515:24:515:33 | &my_local2 | semmle.label | &my_local2 |
387-
| lifetime.rs:518:14:518:15 | p1 | semmle.label | p1 |
388-
| lifetime.rs:519:14:519:15 | p2 | semmle.label | p2 |
389-
| lifetime.rs:520:14:520:15 | p3 | semmle.label | p3 |
390-
| lifetime.rs:521:14:521:15 | p4 | semmle.label | p4 |
391-
| lifetime.rs:530:17:530:31 | ...: ... | semmle.label | ...: ... |
392-
| lifetime.rs:533:10:533:12 | ptr | semmle.label | ptr |
393-
| lifetime.rs:534:3:534:12 | &my_local5 | semmle.label | &my_local5 |
394-
| lifetime.rs:542:3:542:9 | closure [captured p1] | semmle.label | closure [captured p1] |
395-
| lifetime.rs:542:3:542:9 | closure [captured p3] | semmle.label | closure [captured p3] |
396-
| lifetime.rs:542:3:542:9 | closure [captured p4] | semmle.label | closure [captured p4] |
397-
| lifetime.rs:542:13:543:14 | get_closure(...) [captured p1] | semmle.label | get_closure(...) [captured p1] |
398-
| lifetime.rs:542:13:543:14 | get_closure(...) [captured p3] | semmle.label | get_closure(...) [captured p3] |
399-
| lifetime.rs:542:13:543:14 | get_closure(...) [captured p4] | semmle.label | get_closure(...) [captured p4] |
400-
| lifetime.rs:542:26:542:35 | &my_local3 | semmle.label | &my_local3 |
401-
| lifetime.rs:543:4:543:13 | &my_local4 | semmle.label | &my_local4 |
402-
| lifetime.rs:548:2:548:8 | closure [captured p1] | semmle.label | closure [captured p1] |
403-
| lifetime.rs:548:2:548:8 | closure [captured p3] | semmle.label | closure [captured p3] |
404-
| lifetime.rs:548:2:548:8 | closure [captured p4] | semmle.label | closure [captured p4] |
405-
| lifetime.rs:550:15:550:24 | &my_local3 | semmle.label | &my_local3 |
406-
| lifetime.rs:550:28:550:29 | ... | semmle.label | ... |
407-
| lifetime.rs:550:32:550:33 | ... | semmle.label | ... |
408-
| lifetime.rs:552:14:552:15 | p1 | semmle.label | p1 |
409-
| lifetime.rs:553:14:553:15 | p2 | semmle.label | p2 |
410354
| lifetime.rs:568:7:568:8 | p2 | semmle.label | p2 |
411355
| lifetime.rs:568:24:568:33 | &my_local2 | semmle.label | &my_local2 |
412356
| lifetime.rs:572:14:572:15 | p2 | semmle.label | p2 |
@@ -440,5 +384,3 @@ nodes
440384
| lifetime.rs:724:2:724:12 | ptr | semmle.label | ptr |
441385
| lifetime.rs:725:2:725:12 | ptr | semmle.label | ptr |
442386
subpaths
443-
| lifetime.rs:542:26:542:35 | &my_local3 | lifetime.rs:509:16:509:29 | ...: ... | lifetime.rs:514:2:527:2 | return ... [captured p3] | lifetime.rs:542:13:543:14 | get_closure(...) [captured p3] |
444-
| lifetime.rs:543:4:543:13 | &my_local4 | lifetime.rs:509:32:509:45 | ...: ... | lifetime.rs:514:2:527:2 | return ... [captured p4] | lifetime.rs:542:13:543:14 | get_closure(...) [captured p4] |

0 commit comments

Comments
 (0)