Skip to content

Commit 331fbf3

Browse files
redsun82redsun82
committed
Merge branch 'main' into redsun82/gen-file-docs
2 parents dcb2117 + ff6b8c4 commit 331fbf3

File tree

264 files changed

+20530
-2392
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

264 files changed

+20530
-2392
lines changed

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/MustFlow.qll

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,11 @@ abstract class MustFlowConfiguration extends string {
3131
*/
3232
abstract predicate isSink(Operand sink);
3333

34+
/**
35+
* Holds if data flow through `instr` is prohibited.
36+
*/
37+
predicate isBarrier(Instruction instr) { none() }
38+
3439
/**
3540
* Holds if the additional flow step from `node1` to `node2` must be taken
3641
* into account in the analysis.
@@ -48,18 +53,21 @@ abstract class MustFlowConfiguration extends string {
4853
*/
4954
final predicate hasFlowPath(MustFlowPathNode source, MustFlowPathSink sink) {
5055
this.isSource(source.getInstruction()) and
51-
source.getASuccessor+() = sink
56+
source.getASuccessor*() = sink
5257
}
5358
}
5459

5560
/** Holds if `node` flows from a source. */
5661
pragma[nomagic]
5762
private predicate flowsFromSource(Instruction node, MustFlowConfiguration config) {
58-
config.isSource(node)
59-
or
60-
exists(Instruction mid |
61-
step(mid, node, config) and
62-
flowsFromSource(mid, pragma[only_bind_into](config))
63+
not config.isBarrier(node) and
64+
(
65+
config.isSource(node)
66+
or
67+
exists(Instruction mid |
68+
step(mid, node, config) and
69+
flowsFromSource(mid, pragma[only_bind_into](config))
70+
)
6371
)
6472
}
6573

‎cpp/ql/lib/semmle/code/cpp/models/implementations/Inet.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -157,7 +157,7 @@ private class Getaddrinfo extends TaintFunction, ArrayFunction, RemoteFlowSource
157157
override predicate hasArrayWithNullTerminator(int bufParam) { bufParam in [0, 1] }
158158

159159
override predicate hasRemoteFlowSource(FunctionOutput output, string description) {
160-
output.isParameterDeref(3) and
160+
output.isParameterDeref(3, 2) and
161161
description = "address returned by " + this.getName()
162162
}
163163
}

‎cpp/ql/lib/semmle/code/cpp/models/implementations/Send.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ private class Send extends AliasFunction, ArrayFunction, SideEffectFunction, Rem
5858
override ParameterIndex getParameterSizeIndex(ParameterIndex i) { i = 1 and result = 2 }
5959

6060
override predicate hasRemoteFlowSink(FunctionInput input, string description) {
61-
input.isParameterDeref(1) and description = "buffer sent by " + this.getName()
61+
input.isParameterDeref(1, 1) and description = "buffer sent by " + this.getName()
6262
}
6363

6464
override predicate hasSocketInput(FunctionInput input) { input.isParameter(0) }

‎cpp/ql/lib/semmle/code/cpp/models/interfaces/FunctionInputsAndOutputs.qll

Lines changed: 15 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ import semmle.code.cpp.Parameter
88

99
private newtype TFunctionInput =
1010
TInParameter(ParameterIndex i) or
11-
TInParameterDeref(ParameterIndex i) or
11+
TInParameterDeref(ParameterIndex i, int indirectionIndex) { indirectionIndex = [1, 2] } or
1212
TInQualifierObject() or
1313
TInQualifierAddress() or
1414
TInReturnValueDeref()
@@ -245,15 +245,18 @@ class InParameter extends FunctionInput, TInParameter {
245245
*/
246246
class InParameterDeref extends FunctionInput, TInParameterDeref {
247247
ParameterIndex index;
248+
int indirectionIndex;
248249

249-
InParameterDeref() { this = TInParameterDeref(index) }
250+
InParameterDeref() { this = TInParameterDeref(index, indirectionIndex) }
250251

251252
override string toString() { result = "InParameterDeref " + index.toString() }
252253

253254
/** Gets the zero-based index of the parameter. */
254255
ParameterIndex getIndex() { result = index }
255256

256-
override predicate isParameterDeref(ParameterIndex i) { i = index }
257+
override predicate isParameterDeref(ParameterIndex i, int indirection) {
258+
i = index and indirectionIndex = indirection
259+
}
257260
}
258261

259262
/**
@@ -321,10 +324,10 @@ class InReturnValueDeref extends FunctionInput, TInReturnValueDeref {
321324
}
322325

323326
private newtype TFunctionOutput =
324-
TOutParameterDeref(ParameterIndex i) or
327+
TOutParameterDeref(ParameterIndex i, int indirectionIndex) { indirectionIndex = [1, 2] } or
325328
TOutQualifierObject() or
326329
TOutReturnValue() or
327-
TOutReturnValueDeref()
330+
TOutReturnValueDeref(int indirections) { indirections = [1, 2] }
328331

329332
/**
330333
* An output from a function. This can be:
@@ -498,17 +501,16 @@ class FunctionOutput extends TFunctionOutput {
498501
*/
499502
class OutParameterDeref extends FunctionOutput, TOutParameterDeref {
500503
ParameterIndex index;
504+
int indirectionIndex;
501505

502-
OutParameterDeref() { this = TOutParameterDeref(index) }
506+
OutParameterDeref() { this = TOutParameterDeref(index, indirectionIndex) }
503507

504508
override string toString() { result = "OutParameterDeref " + index.toString() }
505509

506510
ParameterIndex getIndex() { result = index }
507511

508-
override predicate isParameterDeref(ParameterIndex i) { i = index }
509-
510512
override predicate isParameterDeref(ParameterIndex i, int ind) {
511-
this.isParameterDeref(i) and ind = 1
513+
i = index and ind = indirectionIndex
512514
}
513515
}
514516

@@ -572,4 +574,8 @@ class OutReturnValueDeref extends FunctionOutput, TOutReturnValueDeref {
572574
override string toString() { result = "OutReturnValueDeref" }
573575

574576
override predicate isReturnValueDeref() { any() }
577+
578+
override predicate isReturnValueDeref(int indirectionIndex) {
579+
this = TOutReturnValueDeref(indirectionIndex)
580+
}
575581
}

‎cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/RangeAnalysis.qll

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,7 @@ private import semmle.code.cpp.valuenumbering.GlobalValueNumbering
1717
* `upper` is true, and can be traced back to a guard represented by `reason`.
1818
*/
1919
predicate bounded(Expr e, Bound b, float delta, boolean upper, Reason reason) {
20-
exists(SemanticExprConfig::Expr semExpr |
21-
semExpr.getUnconverted().getUnconvertedResultExpression() = e
22-
|
20+
exists(SemanticExprConfig::Expr semExpr | semExpr.getUnconvertedResultExpression() = e |
2321
semBounded(semExpr, b, delta, upper, reason)
2422
)
2523
}
@@ -30,9 +28,7 @@ predicate bounded(Expr e, Bound b, float delta, boolean upper, Reason reason) {
3028
* The `Expr` may be a conversion.
3129
*/
3230
predicate convertedBounded(Expr e, Bound b, float delta, boolean upper, Reason reason) {
33-
exists(SemanticExprConfig::Expr semExpr |
34-
semExpr.getConverted().getConvertedResultExpression() = e
35-
|
31+
exists(SemanticExprConfig::Expr semExpr | semExpr.getConvertedResultExpression() = e |
3632
semBounded(semExpr, b, delta, upper, reason)
3733
)
3834
}

‎cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/SimpleRangeAnalysis.qll

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -100,7 +100,7 @@ predicate exprMightOverflowNegatively(Expr expr) {
100100
lowerBound(expr) < exprMinVal(expr)
101101
or
102102
exists(SemanticExprConfig::Expr semExpr |
103-
semExpr.getUnconverted().getAst() = expr and
103+
semExpr.getAst() = expr and
104104
ConstantStage::potentiallyOverflowingExpr(false, semExpr) and
105105
not ConstantStage::initialBounded(semExpr, _, _, false, _, _, _)
106106
)
@@ -126,7 +126,7 @@ predicate exprMightOverflowPositively(Expr expr) {
126126
upperBound(expr) > exprMaxVal(expr)
127127
or
128128
exists(SemanticExprConfig::Expr semExpr |
129-
semExpr.getUnconverted().getAst() = expr and
129+
semExpr.getAst() = expr and
130130
ConstantStage::potentiallyOverflowingExpr(true, semExpr) and
131131
not ConstantStage::initialBounded(semExpr, _, _, true, _, _, _)
132132
)

‎cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/internal/semantic/SemanticCFG.qll

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,6 @@ class SemBasicBlock extends Specific::BasicBlock {
1212
/** Holds if this block (transitively) dominates `otherblock`. */
1313
final predicate bbDominates(SemBasicBlock otherBlock) { Specific::bbDominates(this, otherBlock) }
1414

15-
/** Holds if this block has dominance information. */
16-
final predicate hasDominanceInformation() { Specific::hasDominanceInformation(this) }
17-
1815
/** Gets an expression that is evaluated in this basic block. */
1916
final SemExpr getAnExpr() { result.getBasicBlock() = this }
2017

‎cpp/ql/lib/semmle/code/cpp/rangeanalysis/new/internal/semantic/SemanticExpr.qll

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44

55
private import Semantic
66
private import SemanticExprSpecific::SemanticExprConfig as Specific
7+
private import SemanticType
78

89
/**
910
* An language-neutral expression.
@@ -241,8 +242,21 @@ class SemConvertExpr extends SemUnaryExpr {
241242
SemConvertExpr() { opcode instanceof Opcode::Convert }
242243
}
243244

245+
private import semmle.code.cpp.ir.IR as IR
246+
247+
/** A conversion instruction which is guaranteed to not overflow. */
248+
private class SafeConversion extends IR::ConvertInstruction {
249+
SafeConversion() {
250+
exists(SemType tFrom, SemType tTo |
251+
tFrom = getSemanticType(super.getUnary().getResultIRType()) and
252+
tTo = getSemanticType(super.getResultIRType()) and
253+
conversionCannotOverflow(tFrom, tTo)
254+
)
255+
}
256+
}
257+
244258
class SemCopyValueExpr extends SemUnaryExpr {
245-
SemCopyValueExpr() { opcode instanceof Opcode::CopyValue }
259+
SemCopyValueExpr() { opcode instanceof Opcode::CopyValue or this instanceof SafeConversion }
246260
}
247261

248262
class SemNegateExpr extends SemUnaryExpr {

0 commit comments

Comments
 (0)