Output all the possible paths for the path query

[jackfromeast]

I’m trying to select complete call chains in a C CodeQL database using a simple path query. In particular, I want to get all possible paths from function A to function D, including a chain like A -> B -> C -> D as explicit path steps in the results.

However, it looks like CodeQL is doing some kind of optimization and only shows some paths, not all possible ones.

I’ve verified that all the individual edges exist (A -> B, B -> C, C -> D), and that the chain B -> C -> D can be found. But when I query from A to D, the path viewer does not show the full A -> B -> C -> D chain. Instead, I only see a shorter/alternative path (like A->B->E->F->G->...->D).

Is there a way to get CodeQL to enumerate all valid paths between two functions, instead of just one “representative” path? Or my understanding is completely wrong.

Here is a simplified version of my query:

/**
 * @kind path-problem
 */

import cpp
import semmle.code.cpp.ir.dataflow.ResolveCall

predicate hasCallEdge(Function a, Function b) {
  // resolve any calls inside the `a` function.
  resolveCall(any(Call call | call.getEnclosingFunction() = a)) = b
}

query predicate edges(Function a, Function b) { hasCallEdge(a, b) }

from Function start, Function end
where 
  edges+(start, end)
  and start.getName() = "A"
  and end.getName() = "D"
select reentrantCall, start, end, 
  "Call chain from handler $@ to function $@ containing re-entrant call", 
  start, start.getName(),
  end, end.getName()

[aschackmull]

In general a path-problem query works like this: The QL part computes a graph (the edges predicate) and a set of node pairs (that's your start, end pair in the select). The result interpretation then computes a number of representative paths in the graph for each node pair and shows you these. The default number of paths per result is 4 (IIRC), and you can adjust that to suit your needs by tweaking the VSCode setting codeQL.runningQueries.maxPaths.
It does not make sense to ask for all paths, since there may be an infinite number (when a graph has cycles). We generally impose a limit on the number of paths, since even when the set of paths is finite, it can easily be exponential.

[owen-mc]

Note that if there are particular points that you want the path to go through then you can use flow states in your data flow config so that you only find paths which go through those points.

[jackfromeast]

Thank you all! That answers my question!