Skip to content

Commit 50190ef

Browse files
MathiasVPMathiasVP
committed
C++: Don't limit instruction and operand reuse to those cases where we have a result for 'isUseImpl'.
1 parent 2d0f73d commit 50190ef

File tree

14 files changed

+79
-533
lines changed

14 files changed

+79
-533
lines changed

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -220,9 +220,10 @@ private module IndirectOperands {
220220
int indirectionIndex;
221221

222222
IndirectOperandFromIRRepr() {
223-
exists(Operand repr |
224-
repr = Ssa::getIRRepresentationOfIndirectOperand(operand, indirectionIndex) and
225-
nodeHasOperand(this, repr, indirectionIndex - 1)
223+
exists(Operand repr, int indirectionIndexRepr |
224+
Ssa::hasIRRepresentationOfIndirectOperand(operand, indirectionIndex, repr,
225+
indirectionIndexRepr) and
226+
nodeHasOperand(this, repr, indirectionIndexRepr)
226227
)
227228
}
228229

@@ -262,9 +263,10 @@ private module IndirectInstructions {
262263
int indirectionIndex;
263264

264265
IndirectInstructionFromIRRepr() {
265-
exists(Instruction repr |
266-
repr = Ssa::getIRRepresentationOfIndirectInstruction(instr, indirectionIndex) and
267-
nodeHasInstruction(this, repr, indirectionIndex - 1)
266+
exists(Instruction repr, int indirectionIndexRepr |
267+
Ssa::hasIRRepresentationOfIndirectInstruction(instr, indirectionIndex, repr,
268+
indirectionIndexRepr) and
269+
nodeHasInstruction(this, repr, indirectionIndexRepr)
268270
)
269271
}
270272

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ predicate hasRawIndirectOperand(Operand op, int indirectionIndex) {
7474
type = getLanguageType(op) and
7575
m = countIndirectionsForCppType(type) and
7676
indirectionIndex = [1 .. m] and
77-
not exists(getIRRepresentationOfIndirectOperand(op, indirectionIndex))
77+
not hasIRRepresentationOfIndirectOperand(op, indirectionIndex, _, _)
7878
)
7979
}
8080

@@ -88,7 +88,7 @@ predicate hasRawIndirectInstruction(Instruction instr, int indirectionIndex) {
8888
type = getResultLanguageType(instr) and
8989
m = countIndirectionsForCppType(type) and
9090
indirectionIndex = [1 .. m] and
91-
not exists(getIRRepresentationOfIndirectInstruction(instr, indirectionIndex))
91+
not hasIRRepresentationOfIndirectInstruction(instr, indirectionIndex, _, _)
9292
)
9393
}
9494

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternalsCommon.qll

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -781,11 +781,14 @@ private module Cached {
781781
* instead associated with the operand returned by this predicate.
782782
*/
783783
cached
784-
Operand getIRRepresentationOfIndirectOperand(Operand operand, int indirectionIndex) {
784+
predicate hasIRRepresentationOfIndirectOperand(
785+
Operand operand, int indirectionIndex, Operand operandRepr, int indirectionIndexRepr
786+
) {
787+
indirectionIndex = [1 .. countIndirectionsForCppType(getLanguageType(operand))] and
785788
exists(Instruction load |
786789
isDereference(load, operand) and
787-
result = unique( | | getAUse(load)) and
788-
isUseImpl(operand, _, indirectionIndex - 1)
790+
operandRepr = unique( | | getAUse(load)) and
791+
indirectionIndexRepr = indirectionIndex - 1
789792
)
790793
}
791794

@@ -797,12 +800,15 @@ private module Cached {
797800
* instead associated with the instruction returned by this predicate.
798801
*/
799802
cached
800-
Instruction getIRRepresentationOfIndirectInstruction(Instruction instr, int indirectionIndex) {
803+
predicate hasIRRepresentationOfIndirectInstruction(
804+
Instruction instr, int indirectionIndex, Instruction instrRepr, int indirectionIndexRepr
805+
) {
806+
indirectionIndex = [1 .. countIndirectionsForCppType(getResultLanguageType(instr))] and
801807
exists(Instruction load, Operand address |
802808
address.getDef() = instr and
803809
isDereference(load, address) and
804-
isUseImpl(address, _, indirectionIndex - 1) and
805-
result = load
810+
instrRepr = load and
811+
indirectionIndexRepr = indirectionIndex - 1
806812
)
807813
}
808814

‎cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected

Lines changed: 46 additions & 355 deletions
Large diffs are not rendered by default.

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,5 +3,6 @@ WARNING: Module DataFlow has been deprecated and may be removed in future (taint
33
WARNING: Module DataFlow has been deprecated and may be removed in future (taint.ql:61,22-30)
44
WARNING: Module DataFlow has been deprecated and may be removed in future (taint.ql:68,25-33)
55
WARNING: Module TaintTracking has been deprecated and may be removed in future (taint.ql:73,20-33)
6-
failures
76
testFailures
7+
| vector.cpp:532:10:532:12 | call to operator[] | Unexpected result: ir= |
8+
failures

‎cpp/ql/test/query-tests/Security/CWE/CWE-078/SAMATE/ExecTainted/ExecTainted.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ edges
22
| tests.cpp:26:15:26:23 | badSource indirection | tests.cpp:51:12:51:20 | call to badSource indirection |
33
| tests.cpp:33:34:33:39 | call to getenv indirection | tests.cpp:38:39:38:49 | environment indirection |
44
| tests.cpp:38:25:38:36 | strncat output argument | tests.cpp:26:15:26:23 | badSource indirection |
5+
| tests.cpp:38:25:38:36 | strncat output argument | tests.cpp:38:25:38:36 | strncat output argument |
56
| tests.cpp:38:39:38:49 | environment indirection | tests.cpp:38:25:38:36 | strncat output argument |
67
| tests.cpp:51:12:51:20 | call to badSource indirection | tests.cpp:53:16:53:19 | data indirection |
78
nodes

‎cpp/ql/test/query-tests/Security/CWE/CWE-078/semmle/ExecTainted/ExecTainted.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,11 @@ edges
33
| test.cpp:15:27:15:30 | argv indirection | test.cpp:22:45:22:52 | userName indirection |
44
| test.cpp:22:13:22:20 | sprintf output argument | test.cpp:23:12:23:19 | command1 indirection |
55
| test.cpp:22:45:22:52 | userName indirection | test.cpp:22:13:22:20 | sprintf output argument |
6+
| test.cpp:22:45:22:52 | userName indirection | test.cpp:22:45:22:52 | userName indirection |
67
| test.cpp:47:21:47:26 | call to getenv indirection | test.cpp:50:35:50:43 | envCflags indirection |
78
| test.cpp:50:11:50:17 | sprintf output argument | test.cpp:51:10:51:16 | command indirection |
89
| test.cpp:50:35:50:43 | envCflags indirection | test.cpp:50:11:50:17 | sprintf output argument |
10+
| test.cpp:50:35:50:43 | envCflags indirection | test.cpp:50:35:50:43 | envCflags indirection |
911
| test.cpp:62:9:62:16 | fread output argument | test.cpp:64:20:64:27 | filename indirection |
1012
| test.cpp:64:11:64:17 | strncat output argument | test.cpp:65:10:65:16 | command indirection |
1113
| test.cpp:64:20:64:27 | filename indirection | test.cpp:64:11:64:17 | strncat output argument |

‎cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OverrunWriteProductFlow.expected

Lines changed: 3 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -4,38 +4,29 @@ edges
44
| test.cpp:18:10:18:15 | str indirection [post update] [string] | test.cpp:19:5:19:7 | str indirection [string] |
55
| test.cpp:18:19:18:24 | call to malloc | test.cpp:18:5:18:30 | ... = ... |
66
| test.cpp:19:5:19:7 | str indirection [string] | test.cpp:16:11:16:21 | mk_string_t indirection [string] |
7+
| test.cpp:19:5:19:7 | str indirection [string] | test.cpp:19:5:19:7 | str indirection [string] |
78
| test.cpp:39:21:39:31 | call to mk_string_t indirection [string] | test.cpp:42:13:42:15 | str indirection [string] |
89
| test.cpp:39:21:39:31 | call to mk_string_t indirection [string] | test.cpp:72:17:72:19 | str indirection [string] |
910
| test.cpp:39:21:39:31 | call to mk_string_t indirection [string] | test.cpp:80:17:80:19 | str indirection [string] |
1011
| test.cpp:42:13:42:15 | str indirection [string] | test.cpp:42:18:42:23 | string |
11-
| test.cpp:42:13:42:15 | str indirection [string] | test.cpp:42:18:42:23 | string indirection |
12-
| test.cpp:42:18:42:23 | string indirection | test.cpp:42:18:42:23 | string |
1312
| test.cpp:72:17:72:19 | str indirection [string] | test.cpp:72:22:72:27 | string |
14-
| test.cpp:72:17:72:19 | str indirection [string] | test.cpp:72:22:72:27 | string indirection |
15-
| test.cpp:72:22:72:27 | string indirection | test.cpp:72:22:72:27 | string |
1613
| test.cpp:80:17:80:19 | str indirection [string] | test.cpp:80:22:80:27 | string |
17-
| test.cpp:80:17:80:19 | str indirection [string] | test.cpp:80:22:80:27 | string indirection |
18-
| test.cpp:80:22:80:27 | string indirection | test.cpp:80:22:80:27 | string |
1914
| test.cpp:88:11:88:30 | mk_string_t_plus_one indirection [string] | test.cpp:96:21:96:40 | call to mk_string_t_plus_one indirection [string] |
2015
| test.cpp:90:5:90:34 | ... = ... | test.cpp:90:10:90:15 | str indirection [post update] [string] |
2116
| test.cpp:90:10:90:15 | str indirection [post update] [string] | test.cpp:91:5:91:7 | str indirection [string] |
2217
| test.cpp:90:19:90:24 | call to malloc | test.cpp:90:5:90:34 | ... = ... |
2318
| test.cpp:91:5:91:7 | str indirection [string] | test.cpp:88:11:88:30 | mk_string_t_plus_one indirection [string] |
19+
| test.cpp:91:5:91:7 | str indirection [string] | test.cpp:91:5:91:7 | str indirection [string] |
2420
| test.cpp:96:21:96:40 | call to mk_string_t_plus_one indirection [string] | test.cpp:99:13:99:15 | str indirection [string] |
2521
| test.cpp:96:21:96:40 | call to mk_string_t_plus_one indirection [string] | test.cpp:129:17:129:19 | str indirection [string] |
2622
| test.cpp:96:21:96:40 | call to mk_string_t_plus_one indirection [string] | test.cpp:137:17:137:19 | str indirection [string] |
2723
| test.cpp:99:13:99:15 | str indirection [string] | test.cpp:99:18:99:23 | string |
28-
| test.cpp:99:13:99:15 | str indirection [string] | test.cpp:99:18:99:23 | string indirection |
29-
| test.cpp:99:18:99:23 | string indirection | test.cpp:99:18:99:23 | string |
3024
| test.cpp:129:17:129:19 | str indirection [string] | test.cpp:129:22:129:27 | string |
31-
| test.cpp:129:17:129:19 | str indirection [string] | test.cpp:129:22:129:27 | string indirection |
32-
| test.cpp:129:22:129:27 | string indirection | test.cpp:129:22:129:27 | string |
3325
| test.cpp:137:17:137:19 | str indirection [string] | test.cpp:137:22:137:27 | string |
34-
| test.cpp:137:17:137:19 | str indirection [string] | test.cpp:137:22:137:27 | string indirection |
35-
| test.cpp:137:22:137:27 | string indirection | test.cpp:137:22:137:27 | string |
3626
| test.cpp:147:5:147:34 | ... = ... | test.cpp:147:10:147:15 | str indirection [post update] [string] |
3727
| test.cpp:147:10:147:15 | str indirection [post update] [string] | test.cpp:148:5:148:7 | str indirection [string] |
3828
| test.cpp:147:19:147:24 | call to malloc | test.cpp:147:5:147:34 | ... = ... |
29+
| test.cpp:148:5:148:7 | str indirection [string] | test.cpp:148:5:148:7 | str indirection [string] |
3930
| test.cpp:148:5:148:7 | str indirection [string] | test.cpp:152:13:152:15 | str indirection [string] |
4031
| test.cpp:148:5:148:7 | str indirection [string] | test.cpp:154:13:154:15 | str indirection [string] |
4132
| test.cpp:148:5:148:7 | str indirection [string] | test.cpp:156:13:156:15 | str indirection [string] |
@@ -46,32 +37,14 @@ edges
4637
| test.cpp:148:5:148:7 | str indirection [string] | test.cpp:203:17:203:19 | str indirection [string] |
4738
| test.cpp:148:5:148:7 | str indirection [string] | test.cpp:207:17:207:19 | str indirection [string] |
4839
| test.cpp:152:13:152:15 | str indirection [string] | test.cpp:152:18:152:23 | string |
49-
| test.cpp:152:13:152:15 | str indirection [string] | test.cpp:152:18:152:23 | string indirection |
50-
| test.cpp:152:18:152:23 | string indirection | test.cpp:152:18:152:23 | string |
5140
| test.cpp:154:13:154:15 | str indirection [string] | test.cpp:154:18:154:23 | string |
52-
| test.cpp:154:13:154:15 | str indirection [string] | test.cpp:154:18:154:23 | string indirection |
53-
| test.cpp:154:18:154:23 | string indirection | test.cpp:154:18:154:23 | string |
5441
| test.cpp:156:13:156:15 | str indirection [string] | test.cpp:156:18:156:23 | string |
55-
| test.cpp:156:13:156:15 | str indirection [string] | test.cpp:156:18:156:23 | string indirection |
56-
| test.cpp:156:18:156:23 | string indirection | test.cpp:156:18:156:23 | string |
5742
| test.cpp:175:17:175:19 | str indirection [string] | test.cpp:175:22:175:27 | string |
58-
| test.cpp:175:17:175:19 | str indirection [string] | test.cpp:175:22:175:27 | string indirection |
59-
| test.cpp:175:22:175:27 | string indirection | test.cpp:175:22:175:27 | string |
6043
| test.cpp:187:17:187:19 | str indirection [string] | test.cpp:187:22:187:27 | string |
61-
| test.cpp:187:17:187:19 | str indirection [string] | test.cpp:187:22:187:27 | string indirection |
62-
| test.cpp:187:22:187:27 | string indirection | test.cpp:187:22:187:27 | string |
6344
| test.cpp:195:17:195:19 | str indirection [string] | test.cpp:195:22:195:27 | string |
64-
| test.cpp:195:17:195:19 | str indirection [string] | test.cpp:195:22:195:27 | string indirection |
65-
| test.cpp:195:22:195:27 | string indirection | test.cpp:195:22:195:27 | string |
6645
| test.cpp:199:17:199:19 | str indirection [string] | test.cpp:199:22:199:27 | string |
67-
| test.cpp:199:17:199:19 | str indirection [string] | test.cpp:199:22:199:27 | string indirection |
68-
| test.cpp:199:22:199:27 | string indirection | test.cpp:199:22:199:27 | string |
6946
| test.cpp:203:17:203:19 | str indirection [string] | test.cpp:203:22:203:27 | string |
70-
| test.cpp:203:17:203:19 | str indirection [string] | test.cpp:203:22:203:27 | string indirection |
71-
| test.cpp:203:22:203:27 | string indirection | test.cpp:203:22:203:27 | string |
7247
| test.cpp:207:17:207:19 | str indirection [string] | test.cpp:207:22:207:27 | string |
73-
| test.cpp:207:17:207:19 | str indirection [string] | test.cpp:207:22:207:27 | string indirection |
74-
| test.cpp:207:22:207:27 | string indirection | test.cpp:207:22:207:27 | string |
7548
| test.cpp:214:24:214:24 | p | test.cpp:216:10:216:10 | p |
7649
| test.cpp:220:43:220:48 | call to malloc | test.cpp:222:15:222:20 | buffer |
7750
| test.cpp:222:15:222:20 | buffer | test.cpp:214:24:214:24 | p |
@@ -83,8 +56,6 @@ edges
8356
| test.cpp:242:22:242:27 | buffer | test.cpp:235:40:235:45 | buffer |
8457
| test.cpp:242:22:242:27 | buffer | test.cpp:242:16:242:19 | set_string output argument [string] |
8558
| test.cpp:243:12:243:14 | str indirection [string] | test.cpp:243:12:243:21 | string |
86-
| test.cpp:243:12:243:14 | str indirection [string] | test.cpp:243:16:243:21 | string indirection |
87-
| test.cpp:243:16:243:21 | string indirection | test.cpp:243:12:243:21 | string |
8859
| test.cpp:249:20:249:27 | call to my_alloc | test.cpp:250:12:250:12 | p |
8960
| test.cpp:256:17:256:22 | call to malloc | test.cpp:257:12:257:12 | p |
9061
| test.cpp:262:22:262:27 | call to malloc | test.cpp:266:12:266:12 | p |
@@ -98,13 +69,10 @@ nodes
9869
| test.cpp:39:21:39:31 | call to mk_string_t indirection [string] | semmle.label | call to mk_string_t indirection [string] |
9970
| test.cpp:42:13:42:15 | str indirection [string] | semmle.label | str indirection [string] |
10071
| test.cpp:42:18:42:23 | string | semmle.label | string |
101-
| test.cpp:42:18:42:23 | string indirection | semmle.label | string indirection |
10272
| test.cpp:72:17:72:19 | str indirection [string] | semmle.label | str indirection [string] |
10373
| test.cpp:72:22:72:27 | string | semmle.label | string |
104-
| test.cpp:72:22:72:27 | string indirection | semmle.label | string indirection |
10574
| test.cpp:80:17:80:19 | str indirection [string] | semmle.label | str indirection [string] |
10675
| test.cpp:80:22:80:27 | string | semmle.label | string |
107-
| test.cpp:80:22:80:27 | string indirection | semmle.label | string indirection |
10876
| test.cpp:88:11:88:30 | mk_string_t_plus_one indirection [string] | semmle.label | mk_string_t_plus_one indirection [string] |
10977
| test.cpp:90:5:90:34 | ... = ... | semmle.label | ... = ... |
11078
| test.cpp:90:10:90:15 | str indirection [post update] [string] | semmle.label | str indirection [post update] [string] |
@@ -113,44 +81,32 @@ nodes
11381
| test.cpp:96:21:96:40 | call to mk_string_t_plus_one indirection [string] | semmle.label | call to mk_string_t_plus_one indirection [string] |
11482
| test.cpp:99:13:99:15 | str indirection [string] | semmle.label | str indirection [string] |
11583
| test.cpp:99:18:99:23 | string | semmle.label | string |
116-
| test.cpp:99:18:99:23 | string indirection | semmle.label | string indirection |
11784
| test.cpp:129:17:129:19 | str indirection [string] | semmle.label | str indirection [string] |
11885
| test.cpp:129:22:129:27 | string | semmle.label | string |
119-
| test.cpp:129:22:129:27 | string indirection | semmle.label | string indirection |
12086
| test.cpp:137:17:137:19 | str indirection [string] | semmle.label | str indirection [string] |
12187
| test.cpp:137:22:137:27 | string | semmle.label | string |
122-
| test.cpp:137:22:137:27 | string indirection | semmle.label | string indirection |
12388
| test.cpp:147:5:147:34 | ... = ... | semmle.label | ... = ... |
12489
| test.cpp:147:10:147:15 | str indirection [post update] [string] | semmle.label | str indirection [post update] [string] |
12590
| test.cpp:147:19:147:24 | call to malloc | semmle.label | call to malloc |
12691
| test.cpp:148:5:148:7 | str indirection [string] | semmle.label | str indirection [string] |
12792
| test.cpp:152:13:152:15 | str indirection [string] | semmle.label | str indirection [string] |
12893
| test.cpp:152:18:152:23 | string | semmle.label | string |
129-
| test.cpp:152:18:152:23 | string indirection | semmle.label | string indirection |
13094
| test.cpp:154:13:154:15 | str indirection [string] | semmle.label | str indirection [string] |
13195
| test.cpp:154:18:154:23 | string | semmle.label | string |
132-
| test.cpp:154:18:154:23 | string indirection | semmle.label | string indirection |
13396
| test.cpp:156:13:156:15 | str indirection [string] | semmle.label | str indirection [string] |
13497
| test.cpp:156:18:156:23 | string | semmle.label | string |
135-
| test.cpp:156:18:156:23 | string indirection | semmle.label | string indirection |
13698
| test.cpp:175:17:175:19 | str indirection [string] | semmle.label | str indirection [string] |
13799
| test.cpp:175:22:175:27 | string | semmle.label | string |
138-
| test.cpp:175:22:175:27 | string indirection | semmle.label | string indirection |
139100
| test.cpp:187:17:187:19 | str indirection [string] | semmle.label | str indirection [string] |
140101
| test.cpp:187:22:187:27 | string | semmle.label | string |
141-
| test.cpp:187:22:187:27 | string indirection | semmle.label | string indirection |
142102
| test.cpp:195:17:195:19 | str indirection [string] | semmle.label | str indirection [string] |
143103
| test.cpp:195:22:195:27 | string | semmle.label | string |
144-
| test.cpp:195:22:195:27 | string indirection | semmle.label | string indirection |
145104
| test.cpp:199:17:199:19 | str indirection [string] | semmle.label | str indirection [string] |
146105
| test.cpp:199:22:199:27 | string | semmle.label | string |
147-
| test.cpp:199:22:199:27 | string indirection | semmle.label | string indirection |
148106
| test.cpp:203:17:203:19 | str indirection [string] | semmle.label | str indirection [string] |
149107
| test.cpp:203:22:203:27 | string | semmle.label | string |
150-
| test.cpp:203:22:203:27 | string indirection | semmle.label | string indirection |
151108
| test.cpp:207:17:207:19 | str indirection [string] | semmle.label | str indirection [string] |
152109
| test.cpp:207:22:207:27 | string | semmle.label | string |
153-
| test.cpp:207:22:207:27 | string indirection | semmle.label | string indirection |
154110
| test.cpp:214:24:214:24 | p | semmle.label | p |
155111
| test.cpp:216:10:216:10 | p | semmle.label | p |
156112
| test.cpp:220:43:220:48 | call to malloc | semmle.label | call to malloc |
@@ -165,7 +121,6 @@ nodes
165121
| test.cpp:242:22:242:27 | buffer | semmle.label | buffer |
166122
| test.cpp:243:12:243:14 | str indirection [string] | semmle.label | str indirection [string] |
167123
| test.cpp:243:12:243:21 | string | semmle.label | string |
168-
| test.cpp:243:16:243:21 | string indirection | semmle.label | string indirection |
169124
| test.cpp:249:20:249:27 | call to my_alloc | semmle.label | call to my_alloc |
170125
| test.cpp:250:12:250:12 | p | semmle.label | p |
171126
| test.cpp:256:17:256:22 | call to malloc | semmle.label | call to malloc |

0 commit comments

Comments
 (0)