Skip to content

Commit 1db24dd

Browse files
MathiasVPMathiasVP
committed
C++: Fix missing types. We now assign the node corresponding to **p
an `UnknownType`.
1 parent 4e16bb6 commit 1db24dd

File tree

4 files changed

+25
-59
lines changed

4 files changed

+25
-59
lines changed

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -809,7 +809,7 @@ private class PostIndirectReturnOutNode extends IndirectReturnOutNode, PostUpdat
809809
*
810810
* Returns `t`, but stripped of the outer-most `indirectionIndex` number of indirections.
811811
*/
812-
Type getTypeImpl(Type t, int indirectionIndex) {
812+
private Type getTypeImpl0(Type t, int indirectionIndex) {
813813
indirectionIndex = 0 and
814814
result = t
815815
or
@@ -819,12 +819,30 @@ Type getTypeImpl(Type t, int indirectionIndex) {
819819
// We need to avoid the case where `stripPointer(t) = t` (which can happen on
820820
// iterators that specify a `value_type` that is the iterator itself). Such a type
821821
// would create an infinite loop otherwise. For these cases we simply don't produce
822-
// a result for `getType`.
822+
// a result for `getTypeImpl`.
823823
stripped.getUnspecifiedType() != t.getUnspecifiedType() and
824-
result = getTypeImpl(stripped, indirectionIndex - 1)
824+
result = getTypeImpl0(stripped, indirectionIndex - 1)
825825
)
826826
}
827827

828+
/**
829+
* INTERNAL: Do not use.
830+
*
831+
* Returns `t`, but stripped of the outer-most `indirectionIndex` number of indirections.
832+
*
833+
* If `indirectionIndex` cannot be stripped off `t`, an `UnknownType` is returned.
834+
*/
835+
bindingset[indirectionIndex]
836+
Type getTypeImpl(Type t, int indirectionIndex) {
837+
result = getTypeImpl0(t, indirectionIndex)
838+
or
839+
// If we cannot produce the right type we return an error type.
840+
// This can sometimes happen when we don't know the real
841+
// type of a void pointer.
842+
not exists(getTypeImpl0(t, indirectionIndex)) and
843+
result instanceof UnknownType
844+
}
845+
828846
/**
829847
* INTERNAL: Do not use.
830848
*

‎cpp/ql/test/library-tests/dataflow/dataflow-tests/type-bugs.expected

Lines changed: 0 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -1,59 +1,3 @@
11
failures
22
astTypeBugs
33
irTypeBugs
4-
| dispatch.cpp:60:18:60:29 | dispatch.cpp:60:18:60:29 | dispatch.cpp:60:18:60:29 | new indirection |
5-
| dispatch.cpp:60:18:60:29 | dispatch.cpp:60:18:60:29 | dispatch.cpp:60:18:60:29 | new indirection |
6-
| dispatch.cpp:60:18:60:29 | dispatch.cpp:60:18:60:29 | dispatch.cpp:60:18:60:29 | new indirection |
7-
| dispatch.cpp:61:18:61:29 | dispatch.cpp:61:18:61:29 | dispatch.cpp:61:18:61:29 | new indirection |
8-
| dispatch.cpp:61:18:61:29 | dispatch.cpp:61:18:61:29 | dispatch.cpp:61:18:61:29 | new indirection |
9-
| dispatch.cpp:61:18:61:29 | dispatch.cpp:61:18:61:29 | dispatch.cpp:61:18:61:29 | new indirection |
10-
| dispatch.cpp:65:10:65:21 | dispatch.cpp:65:10:65:21 | dispatch.cpp:65:10:65:21 | new indirection |
11-
| dispatch.cpp:65:10:65:21 | dispatch.cpp:65:10:65:21 | dispatch.cpp:65:10:65:21 | new indirection |
12-
| dispatch.cpp:65:10:65:21 | dispatch.cpp:65:10:65:21 | dispatch.cpp:65:10:65:21 | new indirection |
13-
| example.c:8:24:8:32 | example.c:8:24:8:32 | example.c:8:24:8:32 | something indirection |
14-
| example.c:28:14:28:25 | example.c:28:14:28:25 | example.c:28:14:28:25 | & ... indirection |
15-
| example.c:28:14:28:25 | example.c:28:14:28:25 | example.c:28:14:28:25 | (void *)... indirection |
16-
| example.c:28:14:28:25 | example.c:28:14:28:25 | example.c:28:14:28:25 | doSomething output argument |
17-
| file://:0:0:0:0 | file://:0:0:0:0 | file://:0:0:0:0 | (unnamed parameter 0) indirection |
18-
| file://:0:0:0:0 | file://:0:0:0:0 | file://:0:0:0:0 | overflow_arg_area indirection |
19-
| file://:0:0:0:0 | file://:0:0:0:0 | file://:0:0:0:0 | reg_save_area indirection |
20-
| test.cpp:380:20:380:23 | test.cpp:380:20:380:23 | test.cpp:380:20:380:23 | dest indirection |
21-
| test.cpp:380:38:380:40 | test.cpp:380:38:380:40 | test.cpp:380:38:380:40 | src indirection |
22-
| test.cpp:384:3:384:8 | test.cpp:384:3:384:8 | test.cpp:384:3:384:8 | call to memcpy indirection |
23-
| test.cpp:384:10:384:13 | test.cpp:384:10:384:13 | test.cpp:384:10:384:13 | & ... indirection |
24-
| test.cpp:384:10:384:13 | test.cpp:384:10:384:13 | test.cpp:384:10:384:13 | (void *)... indirection |
25-
| test.cpp:384:10:384:13 | test.cpp:384:10:384:13 | test.cpp:384:10:384:13 | memcpy output argument |
26-
| test.cpp:384:16:384:23 | test.cpp:384:16:384:23 | test.cpp:384:16:384:23 | & ... indirection |
27-
| test.cpp:384:16:384:23 | test.cpp:384:16:384:23 | test.cpp:384:16:384:23 | (const void *)... indirection |
28-
| test.cpp:391:3:391:8 | test.cpp:391:3:391:8 | test.cpp:391:3:391:8 | call to memcpy indirection |
29-
| test.cpp:391:10:391:13 | test.cpp:391:10:391:13 | test.cpp:391:10:391:13 | & ... indirection |
30-
| test.cpp:391:10:391:13 | test.cpp:391:10:391:13 | test.cpp:391:10:391:13 | (void *)... indirection |
31-
| test.cpp:391:10:391:13 | test.cpp:391:10:391:13 | test.cpp:391:10:391:13 | memcpy output argument |
32-
| test.cpp:391:16:391:23 | test.cpp:391:16:391:23 | test.cpp:391:16:391:23 | & ... indirection |
33-
| test.cpp:391:16:391:23 | test.cpp:391:16:391:23 | test.cpp:391:16:391:23 | (const void *)... indirection |
34-
| test.cpp:400:3:400:8 | test.cpp:400:3:400:8 | test.cpp:400:3:400:8 | call to memcpy indirection |
35-
| test.cpp:400:10:400:13 | test.cpp:400:10:400:13 | test.cpp:400:10:400:13 | & ... indirection |
36-
| test.cpp:400:10:400:13 | test.cpp:400:10:400:13 | test.cpp:400:10:400:13 | (void *)... indirection |
37-
| test.cpp:400:10:400:13 | test.cpp:400:10:400:13 | test.cpp:400:10:400:13 | memcpy output argument |
38-
| test.cpp:400:16:400:22 | test.cpp:400:16:400:22 | test.cpp:400:16:400:22 | & ... indirection |
39-
| test.cpp:400:16:400:22 | test.cpp:400:16:400:22 | test.cpp:400:16:400:22 | (const void *)... indirection |
40-
| test.cpp:407:3:407:8 | test.cpp:407:3:407:8 | test.cpp:407:3:407:8 | call to memcpy indirection |
41-
| test.cpp:407:10:407:13 | test.cpp:407:10:407:13 | test.cpp:407:10:407:13 | & ... indirection |
42-
| test.cpp:407:10:407:13 | test.cpp:407:10:407:13 | test.cpp:407:10:407:13 | (void *)... indirection |
43-
| test.cpp:407:10:407:13 | test.cpp:407:10:407:13 | test.cpp:407:10:407:13 | memcpy output argument |
44-
| test.cpp:407:16:407:22 | test.cpp:407:16:407:22 | test.cpp:407:16:407:22 | & ... indirection |
45-
| test.cpp:407:16:407:22 | test.cpp:407:16:407:22 | test.cpp:407:16:407:22 | (const void *)... indirection |
46-
| test.cpp:481:24:481:27 | test.cpp:481:24:481:27 | test.cpp:481:24:481:27 | (unnamed parameter 0) indirection |
47-
| test.cpp:488:21:488:30 | test.cpp:488:21:488:30 | test.cpp:488:21:488:30 | (void *)... indirection |
48-
| test.cpp:488:21:488:30 | test.cpp:488:21:488:30 | test.cpp:488:21:488:30 | content indirection |
49-
| test.cpp:488:21:488:30 | test.cpp:488:21:488:30 | test.cpp:488:21:488:30 | writes_to_content output argument |
50-
| test.cpp:615:9:615:9 | test.cpp:615:9:615:9 | test.cpp:615:9:615:9 | definition of q indirection |
51-
| test.cpp:615:9:615:9 | test.cpp:615:9:615:9 | test.cpp:615:9:615:9 | definition of q indirection |
52-
| test.cpp:615:9:615:9 | test.cpp:615:9:615:9 | test.cpp:615:9:615:9 | q indirection |
53-
| test.cpp:615:13:615:21 | test.cpp:615:13:615:21 | test.cpp:615:13:615:21 | & ... indirection |
54-
| test.cpp:615:13:615:21 | test.cpp:615:13:615:21 | test.cpp:615:13:615:21 | (void *)... indirection |
55-
| test.cpp:615:13:615:21 | test.cpp:615:13:615:21 | test.cpp:615:13:615:21 | (void *)... indirection |
56-
| test.cpp:616:17:616:17 | test.cpp:616:17:616:17 | test.cpp:616:17:616:17 | q indirection |
57-
| test.cpp:616:17:616:17 | test.cpp:616:17:616:17 | test.cpp:616:17:616:17 | q indirection |
58-
| test.cpp:616:17:616:17 | test.cpp:616:17:616:17 | test.cpp:616:17:616:17 | q indirection |
59-
| test.cpp:616:17:616:17 | test.cpp:616:17:616:17 | test.cpp:616:17:616:17 | q indirection |

‎cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -199,6 +199,7 @@
199199
| realistic.cpp:26:5:26:10 | offset | AST only |
200200
| realistic.cpp:49:20:49:22 | baz | AST only |
201201
| realistic.cpp:53:35:53:43 | bufferLen | AST only |
202+
| realistic.cpp:54:50:54:61 | call to user_input | IR only |
202203
| realistic.cpp:55:16:55:18 | foo | IR only |
203204
| realistic.cpp:55:23:55:25 | access to array | IR only |
204205
| realistic.cpp:55:28:55:36 | baz | IR only |
@@ -207,6 +208,7 @@
207208
| realistic.cpp:57:99:57:101 | access to array | IR only |
208209
| realistic.cpp:57:104:57:112 | baz | IR only |
209210
| realistic.cpp:57:114:57:122 | userInput | IR only |
211+
| realistic.cpp:60:21:60:52 | buffer | IR only |
210212
| realistic.cpp:60:25:60:27 | foo | IR only |
211213
| realistic.cpp:60:32:60:34 | access to array | IR only |
212214
| realistic.cpp:60:37:60:45 | baz | IR only |

‎cpp/ql/test/library-tests/dataflow/fields/partial-definition-ir.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -512,6 +512,7 @@
512512
| realistic.cpp:54:27:54:29 | baz |
513513
| realistic.cpp:54:32:54:40 | userInput |
514514
| realistic.cpp:54:42:54:47 | buffer |
515+
| realistic.cpp:54:50:54:59 | call to user_input |
515516
| realistic.cpp:55:12:55:14 | foo |
516517
| realistic.cpp:55:12:55:21 | access to array |
517518
| realistic.cpp:55:23:55:25 | baz |
@@ -525,6 +526,7 @@
525526
| realistic.cpp:60:21:60:30 | access to array |
526527
| realistic.cpp:60:32:60:34 | baz |
527528
| realistic.cpp:60:37:60:45 | userInput |
529+
| realistic.cpp:60:47:60:52 | buffer |
528530
| realistic.cpp:60:55:60:57 | foo |
529531
| realistic.cpp:60:55:60:64 | access to array |
530532
| realistic.cpp:60:66:60:68 | baz |

0 commit comments

Comments
 (0)