Skip to content

Commit cbd4662

Browse files
MathiasVPMathiasVP
committed
Merge branch 'main' into skip-safe-conversions-in-range-analysis
2 parents 125c013 + 62d2f23 commit cbd4662

File tree

307 files changed

+15365
-3713
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

307 files changed

+15365
-3713
lines changed

‎.github/workflows/ruby-build.yml

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ jobs:
5050
echo "/usr/local/opt/gnu-tar/libexec/gnubin" >> $GITHUB_PATH
5151
- name: Install cargo-cross
5252
if: runner.os == 'Linux'
53-
run: cargo install cross --version 0.2.1
53+
run: cargo install cross --version 0.2.5
5454
- uses: ./.github/actions/os-version
5555
id: os_version
5656
- name: Cache entire extractor
@@ -85,7 +85,12 @@ jobs:
8585
# This ensures we don't depend on glibc > 2.17.
8686
- name: Release build (linux)
8787
if: steps.cache-extractor.outputs.cache-hit != 'true' && runner.os == 'Linux'
88-
run: cd extractor && cross build --release
88+
run: |
89+
cd extractor
90+
cross build --release
91+
mv target/x86_64-unknown-linux-gnu/release/extractor target/release/
92+
mv target/x86_64-unknown-linux-gnu/release/autobuilder target/release/
93+
mv target/x86_64-unknown-linux-gnu/release/generator target/release/
8994
- name: Release build (windows and macos)
9095
if: steps.cache-extractor.outputs.cache-hit != 'true' && runner.os != 'Linux'
9196
run: cd extractor && cargo build --release

‎cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/RangeAnalysisStage.qll

Lines changed: 31 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -591,24 +591,6 @@ module RangeStage<DeltaSig D, BoundSig<D> Bounds, LangSig<D> LangParam, UtilSig<
591591
delta = D::fromInt(0) and
592592
(upper = true or upper = false)
593593
or
594-
exists(SemExpr x | e2.(SemAddExpr).hasOperands(e1, x) |
595-
// `x instanceof ConstantIntegerExpr` is covered by valueFlowStep
596-
not x instanceof SemConstantIntegerExpr and
597-
not e1 instanceof SemConstantIntegerExpr and
598-
if strictlyPositiveIntegralExpr(x)
599-
then upper = false and delta = D::fromInt(1)
600-
else
601-
if semPositive(x)
602-
then upper = false and delta = D::fromInt(0)
603-
else
604-
if strictlyNegativeIntegralExpr(x)
605-
then upper = true and delta = D::fromInt(-1)
606-
else
607-
if semNegative(x)
608-
then upper = true and delta = D::fromInt(0)
609-
else none()
610-
)
611-
or
612594
exists(SemExpr x, SemSubExpr sub |
613595
e2 = sub and
614596
sub.getLeftOperand() = e1 and
@@ -1043,13 +1025,44 @@ module RangeStage<DeltaSig D, BoundSig<D> Bounds, LangSig<D> LangParam, UtilSig<
10431025
delta = D::fromFloat(f) and
10441026
if semPositive(e) then f >= 0 else any()
10451027
)
1028+
or
1029+
exists(
1030+
SemBound bLeft, SemBound bRight, D::Delta dLeft, D::Delta dRight, boolean fbeLeft,
1031+
boolean fbeRight, D::Delta odLeft, D::Delta odRight, SemReason rLeft, SemReason rRight
1032+
|
1033+
boundedAddOperand(e, upper, bLeft, false, dLeft, fbeLeft, odLeft, rLeft) and
1034+
boundedAddOperand(e, upper, bRight, true, dRight, fbeRight, odRight, rRight) and
1035+
delta = D::fromFloat(D::toFloat(dLeft) + D::toFloat(dRight)) and
1036+
fromBackEdge = fbeLeft.booleanOr(fbeRight)
1037+
|
1038+
b = bLeft and origdelta = odLeft and reason = rLeft and bRight instanceof SemZeroBound
1039+
or
1040+
b = bRight and origdelta = odRight and reason = rRight and bLeft instanceof SemZeroBound
1041+
)
10461042
)
10471043
}
10481044

1045+
pragma[nomagic]
10491046
private predicate boundedConditionalExpr(
10501047
SemConditionalExpr cond, SemBound b, boolean upper, boolean branch, D::Delta delta,
10511048
boolean fromBackEdge, D::Delta origdelta, SemReason reason
10521049
) {
10531050
bounded(cond.getBranchExpr(branch), b, delta, upper, fromBackEdge, origdelta, reason)
10541051
}
1052+
1053+
pragma[nomagic]
1054+
private predicate boundedAddOperand(
1055+
SemAddExpr add, boolean upper, SemBound b, boolean isLeft, D::Delta delta, boolean fromBackEdge,
1056+
D::Delta origdelta, SemReason reason
1057+
) {
1058+
// `semValueFlowStep` already handles the case where one of the operands is a constant.
1059+
not semValueFlowStep(add, _, _) and
1060+
(
1061+
isLeft = true and
1062+
bounded(add.getLeftOperand(), b, delta, upper, fromBackEdge, origdelta, reason)
1063+
or
1064+
isLeft = false and
1065+
bounded(add.getRightOperand(), b, delta, upper, fromBackEdge, origdelta, reason)
1066+
)
1067+
}
10551068
}

‎cpp/ql/lib/qlpack.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,3 +8,4 @@ upgrades: upgrades
88
dependencies:
99
codeql/ssa: ${workspace}
1010
codeql/tutorial: ${workspace}
11+
codeql/util: ${workspace}

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowPrivate.qll

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ private import DataFlowUtil
33
private import DataFlowDispatch
44
private import FlowVar
55
private import DataFlowImplConsistency
6+
import codeql.util.Unit
67

78
/** Gets the callable in which this node occurs. */
89
DataFlowCallable nodeGetEnclosingCallable(Node n) { result = n.getEnclosingCallable() }
@@ -264,15 +265,6 @@ int accessPathLimit() { result = 5 }
264265
*/
265266
predicate forceHighPrecision(Content c) { none() }
266267

267-
/** The unit type. */
268-
private newtype TUnit = TMkUnit()
269-
270-
/** The trivial type with a single element. */
271-
class Unit extends TUnit {
272-
/** Gets a textual representation of this element. */
273-
string toString() { result = "unit" }
274-
}
275-
276268
/** Holds if `n` should be hidden from path explanations. */
277269
predicate nodeIsHidden(Node n) { none() }
278270

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ private import DataFlowImplConsistency
66
private import semmle.code.cpp.ir.internal.IRCppLanguage
77
private import SsaInternals as Ssa
88
private import DataFlowImplCommon as DataFlowImplCommon
9+
import codeql.util.Unit
910

1011
cached
1112
private module Cached {
@@ -799,15 +800,6 @@ int accessPathLimit() { result = 5 }
799800
*/
800801
predicate forceHighPrecision(Content c) { none() }
801802

802-
/** The unit type. */
803-
private newtype TUnit = TMkUnit()
804-
805-
/** The trivial type with a single element. */
806-
class Unit extends TUnit {
807-
/** Gets a textual representation of this element. */
808-
string toString() { result = "unit" }
809-
}
810-
811803
/** Holds if `n` should be hidden from path explanations. */
812804
predicate nodeIsHidden(Node n) {
813805
n instanceof OperandNode and

‎cpp/ql/src/experimental/Likely Bugs/OverrunWriteProductFlow.ql

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -62,11 +62,16 @@ predicate hasSize(AllocationExpr alloc, DataFlow::Node n, string state) {
6262
predicate isSinkPairImpl(
6363
CallInstruction c, DataFlow::Node bufSink, DataFlow::Node sizeSink, int delta, Expr eBuf
6464
) {
65-
exists(int bufIndex, int sizeIndex, Instruction sizeInstr, Instruction bufInstr |
65+
exists(
66+
int bufIndex, int sizeIndex, Instruction sizeInstr, Instruction bufInstr, ArrayFunction func
67+
|
6668
bufInstr = bufSink.asInstruction() and
6769
c.getArgument(bufIndex) = bufInstr and
6870
sizeInstr = sizeSink.asInstruction() and
69-
c.getStaticCallTarget().(ArrayFunction).hasArrayWithVariableSize(bufIndex, sizeIndex) and
71+
c.getStaticCallTarget() = func and
72+
pragma[only_bind_into](func)
73+
.hasArrayWithVariableSize(pragma[only_bind_into](bufIndex),
74+
pragma[only_bind_into](sizeIndex)) and
7075
bounded(c.getArgument(sizeIndex), sizeInstr, delta) and
7176
eBuf = bufInstr.getUnconvertedResultExpression()
7277
)

‎cpp/ql/test/library-tests/CPP-205/elements.expected

Lines changed: 19 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,21 @@
1-
| CPP-205.cpp:0:0:0:0 | CPP-205.cpp | |
2-
| CPP-205.cpp:1:20:1:20 | T | |
3-
| CPP-205.cpp:1:20:1:20 | definition of T | |
4-
| CPP-205.cpp:2:5:2:5 | definition of fn | function declaration entry for int fn<int>(int) |
5-
| CPP-205.cpp:2:5:2:5 | fn | function int fn<int>(int) |
6-
| CPP-205.cpp:2:5:2:6 | definition of fn | function declaration entry for int fn<T>(T) |
7-
| CPP-205.cpp:2:5:2:6 | fn | function int fn<T>(T) |
8-
| CPP-205.cpp:2:10:2:12 | definition of out | parameter declaration entry for int fn<T>(T) |
9-
| CPP-205.cpp:2:10:2:12 | definition of out | parameter declaration entry for int fn<int>(int) |
10-
| CPP-205.cpp:2:10:2:12 | out | parameter for int fn<T>(T) |
11-
| CPP-205.cpp:2:10:2:12 | out | parameter for int fn<int>(int) |
12-
| CPP-205.cpp:2:15:5:1 | { ... } | |
13-
| CPP-205.cpp:2:15:5:1 | { ... } | |
14-
| CPP-205.cpp:3:3:3:33 | declaration | |
15-
| CPP-205.cpp:3:3:3:33 | declaration | |
16-
| CPP-205.cpp:3:15:3:15 | declaration of y | |
17-
| CPP-205.cpp:3:15:3:15 | y | |
18-
| CPP-205.cpp:3:17:3:31 | 5 | |
19-
| CPP-205.cpp:4:3:4:11 | return ... | |
20-
| CPP-205.cpp:4:3:4:11 | return ... | |
21-
| CPP-205.cpp:4:10:4:10 | 0 | |
22-
| CPP-205.cpp:4:10:4:10 | 0 | |
1+
| CPP-205.cpp:2:5:2:5 | definition of fn | function declaration entry for int fn<int>(int), isFromTemplateInstantiation(fn) |
2+
| CPP-205.cpp:2:5:2:5 | fn | function int fn<int>(int), isFromTemplateInstantiation(fn) |
3+
| CPP-205.cpp:2:5:2:6 | definition of fn | function declaration entry for int fn<T>(T), isFromUninstantiatedTemplate(fn) |
4+
| CPP-205.cpp:2:5:2:6 | fn | function int fn<T>(T), isFromUninstantiatedTemplate(fn) |
5+
| CPP-205.cpp:2:10:2:12 | definition of out | isFromTemplateInstantiation(fn), parameter declaration entry for int fn<int>(int) |
6+
| CPP-205.cpp:2:10:2:12 | definition of out | isFromUninstantiatedTemplate(fn), parameter declaration entry for int fn<T>(T) |
7+
| CPP-205.cpp:2:10:2:12 | out | isFromTemplateInstantiation(fn), parameter for int fn<int>(int) |
8+
| CPP-205.cpp:2:10:2:12 | out | isFromUninstantiatedTemplate(fn), parameter for int fn<T>(T) |
9+
| CPP-205.cpp:2:15:5:1 | { ... } | isFromTemplateInstantiation(fn) |
10+
| CPP-205.cpp:2:15:5:1 | { ... } | isFromUninstantiatedTemplate(fn) |
11+
| CPP-205.cpp:3:3:3:33 | declaration | isFromTemplateInstantiation(fn) |
12+
| CPP-205.cpp:3:3:3:33 | declaration | isFromUninstantiatedTemplate(fn) |
13+
| CPP-205.cpp:3:15:3:15 | declaration of y | isFromUninstantiatedTemplate(fn) |
14+
| CPP-205.cpp:3:15:3:15 | y | isFromUninstantiatedTemplate(fn) |
15+
| CPP-205.cpp:3:17:3:31 | 5 | isFromTemplateInstantiation(fn) |
16+
| CPP-205.cpp:4:3:4:11 | return ... | isFromTemplateInstantiation(fn) |
17+
| CPP-205.cpp:4:3:4:11 | return ... | isFromUninstantiatedTemplate(fn) |
18+
| CPP-205.cpp:4:10:4:10 | 0 | isFromTemplateInstantiation(fn) |
19+
| CPP-205.cpp:4:10:4:10 | 0 | isFromUninstantiatedTemplate(fn) |
2320
| CPP-205.cpp:7:5:7:8 | definition of main | function declaration entry for int main() |
2421
| CPP-205.cpp:7:5:7:8 | main | function int main() |
25-
| CPP-205.cpp:7:12:9:1 | { ... } | |
26-
| CPP-205.cpp:8:3:8:15 | return ... | |
27-
| CPP-205.cpp:8:10:8:11 | call to fn | |
28-
| CPP-205.cpp:8:13:8:13 | 0 | |
29-
| file://:0:0:0:0 | (unnamed parameter 0) | parameter for __va_list_tag& __va_list_tag::operator=(__va_list_tag const&) |
30-
| file://:0:0:0:0 | (unnamed parameter 0) | parameter for __va_list_tag& __va_list_tag::operator=(__va_list_tag&&) |
31-
| file://:0:0:0:0 | __super | |
32-
| file://:0:0:0:0 | __va_list_tag | |
33-
| file://:0:0:0:0 | operator= | function __va_list_tag& __va_list_tag::operator=(__va_list_tag const&) |
34-
| file://:0:0:0:0 | operator= | function __va_list_tag& __va_list_tag::operator=(__va_list_tag&&) |
35-
| file://:0:0:0:0 | y | |

‎cpp/ql/test/library-tests/CPP-205/elements.ql

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,20 @@ string describe(Element e) {
1414
result =
1515
"parameter declaration entry for " +
1616
getIdentityString(e.(ParameterDeclarationEntry).getFunctionDeclarationEntry().getFunction())
17+
or
18+
exists(Element template |
19+
e.isFromTemplateInstantiation(template) and
20+
result = "isFromTemplateInstantiation(" + template.toString() + ")"
21+
)
22+
or
23+
exists(Element template |
24+
e.isFromUninstantiatedTemplate(template) and
25+
result = "isFromUninstantiatedTemplate(" + template.toString() + ")"
26+
)
1727
}
1828

1929
from Element e
2030
where
21-
not e.getLocation() instanceof UnknownLocation and
31+
e.getLocation().getFile().getBaseName() != "" and
2232
not e instanceof Folder
23-
select e, concat(describe(e), ", ")
33+
select e, strictconcat(describe(e), ", ")

0 commit comments

Comments
 (0)