Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 08db4cd

Browse files
jbjjbj
authored
Merge pull request #744 from geoffw0/format
CPP: Autoformat some untidy files
2 parents b966a87 + 87569d1 commit 08db4cd

10 files changed

Lines changed: 231 additions & 170 deletions

File tree

‎cpp/ql/src/Critical/DeadCodeCondition.ql‎

Lines changed: 38 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -7,51 +7,64 @@
77
* @tags reliability
88
* external/cwe/cwe-561
99
*/
10+
1011
import cpp
1112

12-
predicate testAndBranch(Expr e, Stmt branch)
13-
{
14-
exists(IfStmt ifstmt | ifstmt.getCondition() = e and
15-
(ifstmt.getThen() = branch or ifstmt.getElse() = branch))
13+
predicate testAndBranch(Expr e, Stmt branch) {
14+
exists(IfStmt ifstmt |
15+
ifstmt.getCondition() = e and
16+
(ifstmt.getThen() = branch or ifstmt.getElse() = branch)
17+
)
1618
or
17-
exists(WhileStmt while | while.getCondition() = e and
18-
while.getStmt() = branch)
19+
exists(WhileStmt while |
20+
while.getCondition() = e and
21+
while.getStmt() = branch
22+
)
1923
}
2024

21-
predicate choice(LocalScopeVariable v, Stmt branch, string value)
22-
{
25+
predicate choice(LocalScopeVariable v, Stmt branch, string value) {
2326
exists(AnalysedExpr e |
2427
testAndBranch(e, branch) and
2528
(
2629
(e.getNullSuccessor(v) = branch and value = "null")
2730
or
2831
(e.getNonNullSuccessor(v) = branch and value = "non-null")
29-
))
32+
)
33+
)
3034
}
3135

32-
33-
predicate guarded(LocalScopeVariable v, Stmt loopstart, AnalysedExpr child)
34-
{
36+
predicate guarded(LocalScopeVariable v, Stmt loopstart, AnalysedExpr child) {
3537
choice(v, loopstart, _) and
3638
loopstart.getChildStmt*() = child.getEnclosingStmt() and
3739
(definition(v, child) or exists(child.getNullSuccessor(v)))
3840
}
3941

40-
predicate addressLeak(Variable v, Stmt leak)
41-
{
42+
predicate addressLeak(Variable v, Stmt leak) {
4243
exists(VariableAccess access |
4344
v.getAnAccess() = access and
4445
access.getEnclosingStmt() = leak and
45-
access.isAddressOfAccess())
46+
access.isAddressOfAccess()
47+
)
4648
}
4749

48-
from LocalScopeVariable v, Stmt branch, AnalysedExpr cond, string context, string test, string testresult
49-
where choice(v, branch, context)
50-
and forall(ControlFlowNode def | definition(v, def) and definitionReaches(def, cond) | not guarded(v, branch, def))
51-
and not cond.isDef(v)
52-
and guarded(v, branch, cond)
53-
and exists(cond.getNullSuccessor(v))
54-
and not addressLeak(v, branch.getChildStmt*())
55-
and ((cond.isNullCheck(v) and test = "null") or (cond.isValidCheck(v) and test = "non-null"))
56-
and (if context = test then testresult = "succeed" else testresult = "fail")
57-
select cond, "Variable '" + v.getName() + "' is always " + context + " here, this check will always " + testresult + "."
50+
from
51+
LocalScopeVariable v, Stmt branch, AnalysedExpr cond, string context, string test,
52+
string testresult
53+
where
54+
choice(v, branch, context) and
55+
forall(ControlFlowNode def | definition(v, def) and definitionReaches(def, cond) |
56+
not guarded(v, branch, def)
57+
) and
58+
not cond.isDef(v) and
59+
guarded(v, branch, cond) and
60+
exists(cond.getNullSuccessor(v)) and
61+
not addressLeak(v, branch.getChildStmt*()) and
62+
(
63+
(cond.isNullCheck(v) and test = "null")
64+
or
65+
(cond.isValidCheck(v) and test = "non-null")
66+
) and
67+
(if context = test then testresult = "succeed" else testresult = "fail")
68+
select cond,
69+
"Variable '" + v.getName() + "' is always " + context + " here, this check will always " +
70+
testresult + "."

‎cpp/ql/src/Critical/NotInitialised.ql‎

Lines changed: 32 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -7,34 +7,46 @@
77
* @tags reliability
88
* external/cwe/cwe-457
99
*/
10+
1011
import cpp
1112

1213
// See also InitialisationNotRun.ql and GlobalUseBeforeInit.ql
1314

14-
// Holds if s defines variable v (conservative)
15+
/**
16+
* Holds if `s` defines variable `v` (conservative).
17+
*/
1518
predicate defines(ControlFlowNode s, Variable lv) {
1619
exists(VariableAccess va | va = s and va.getTarget() = lv and va.isUsedAsLValue())
1720
}
1821

19-
// Holds if s uses variable v (conservative)
22+
/**
23+
* Holds if `s` uses variable `v` (conservative).
24+
*/
2025
predicate uses(ControlFlowNode s, Variable lv) {
21-
exists(VariableAccess va | va = s and va.getTarget() = lv and va.isRValue()
22-
and not va.getParent+() instanceof SizeofOperator)
26+
exists(VariableAccess va |
27+
va = s and
28+
va.getTarget() = lv and
29+
va.isRValue() and
30+
not va.getParent+() instanceof SizeofOperator
31+
)
2332
}
2433

25-
// Holds if there is a path from the declaration of lv to n such that lv is
26-
// definitely not defined before n
34+
/**
35+
* Holds if there is a path from the declaration of `lv` to `n` such that `lv` is
36+
* definitely not defined before `n`.
37+
*/
2738
predicate noDefPath(LocalVariable lv, ControlFlowNode n) {
28-
n.(DeclStmt).getADeclaration() = lv and not exists(lv.getInitializer())
29-
or exists(ControlFlowNode p | noDefPath(lv, p) and n = p.getASuccessor() and not defines(p, lv))
39+
n.(DeclStmt).getADeclaration() = lv and not exists(lv.getInitializer())
40+
or
41+
exists(ControlFlowNode p | noDefPath(lv, p) and n = p.getASuccessor() and not defines(p, lv))
3042
}
3143

32-
predicate isAggregateType(Type t) {
33-
t instanceof Class or t instanceof ArrayType
34-
}
44+
predicate isAggregateType(Type t) { t instanceof Class or t instanceof ArrayType }
3545

36-
// Holds if va is a use of a local variable that has not been previously
37-
// defined
46+
/**
47+
* Holds if `va` is a use of a local variable that has not been previously
48+
* defined.
49+
*/
3850
predicate undefinedLocalUse(VariableAccess va) {
3951
exists(LocalVariable lv |
4052
// it is hard to tell when a struct or array has been initialized, so we
@@ -43,17 +55,21 @@ predicate undefinedLocalUse(VariableAccess va) {
4355
not lv.getType().hasName("va_list") and
4456
va = lv.getAnAccess() and
4557
noDefPath(lv, va) and
46-
uses(va, lv))
58+
uses(va, lv)
59+
)
4760
}
4861

49-
// Holds if gv is a potentially uninitialized global variable
62+
/**
63+
* Holds if `gv` is a potentially uninitialized global variable.
64+
*/
5065
predicate uninitialisedGlobal(GlobalVariable gv) {
5166
exists(VariableAccess va |
5267
not isAggregateType(gv.getUnderlyingType()) and
5368
va = gv.getAnAccess() and
5469
va.isRValue() and
5570
not gv.hasInitializer() and
56-
not gv.hasSpecifier("extern"))
71+
not gv.hasSpecifier("extern")
72+
)
5773
}
5874

5975
from Element elt

‎cpp/ql/src/Critical/SizeCheck.ql‎

Lines changed: 29 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -11,56 +11,61 @@
1111
* external/cwe/cwe-131
1212
* external/cwe/cwe-122
1313
*/
14+
1415
import cpp
1516

16-
class Allocation extends FunctionCall
17-
{
17+
class Allocation extends FunctionCall {
1818
Allocation() {
1919
exists(string name |
2020
this.getTarget().hasQualifiedName(name) and
21-
(name = "malloc" or name = "calloc" or name = "realloc"))
21+
(name = "malloc" or name = "calloc" or name = "realloc")
22+
)
2223
}
2324

2425
string getName() { result = this.getTarget().getQualifiedName() }
2526

2627
int getSize() {
27-
(this.getName() = "malloc" and
28-
this.getArgument(0).getValue().toInt() = result)
28+
(
29+
this.getName() = "malloc" and
30+
this.getArgument(0).getValue().toInt() = result
31+
)
2932
or
30-
(this.getName() = "realloc" and
31-
this.getArgument(1).getValue().toInt() = result)
33+
(
34+
this.getName() = "realloc" and
35+
this.getArgument(1).getValue().toInt() = result
36+
)
3237
or
33-
(this.getName() = "calloc" and
34-
result =
35-
this.getArgument(0).getValue().toInt() *
36-
this.getArgument(1).getValue().toInt())
38+
(
39+
this.getName() = "calloc" and
40+
result = this.getArgument(0).getValue().toInt() * this.getArgument(1).getValue().toInt()
41+
)
3742
}
3843
}
3944

40-
predicate baseType(Allocation alloc, Type base)
41-
{
45+
predicate baseType(Allocation alloc, Type base) {
4246
exists(PointerType pointer |
4347
pointer.getBaseType() = base and
4448
(
4549
exists(AssignExpr assign |
46-
assign.getRValue() = alloc and assign.getLValue().getType() = pointer)
50+
assign.getRValue() = alloc and assign.getLValue().getType() = pointer
51+
)
4752
or
48-
exists(Variable v |
49-
v.getInitializer().getExpr() = alloc and v.getType() = pointer)
53+
exists(Variable v | v.getInitializer().getExpr() = alloc and v.getType() = pointer)
5054
)
5155
)
5256
}
5357

54-
predicate decideOnSize(Type t, int size)
55-
{
58+
predicate decideOnSize(Type t, int size) {
5659
// If the codebase has more than one type with the same name, it can have more than one size.
5760
size = min(t.getSize())
5861
}
5962

6063
from Allocation alloc, Type base, int basesize, int allocated
61-
where baseType(alloc, base)
62-
and allocated = alloc.getSize()
63-
and decideOnSize(base, basesize)
64-
and basesize > allocated
65-
select alloc, "Type '" + base.getName() + "' is " + basesize.toString() +
66-
" bytes, but only " + allocated.toString() + " bytes are allocated."
64+
where
65+
baseType(alloc, base) and
66+
allocated = alloc.getSize() and
67+
decideOnSize(base, basesize) and
68+
basesize > allocated
69+
select alloc,
70+
"Type '" + base.getName() + "' is " + basesize.toString() + " bytes, but only " +
71+
allocated.toString() + " bytes are allocated."

‎cpp/ql/src/Critical/SizeCheck2.ql‎

Lines changed: 31 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -11,54 +11,60 @@
1111
* external/cwe/cwe-131
1212
* external/cwe/cwe-122
1313
*/
14+
1415
import cpp
1516

16-
class Allocation extends FunctionCall
17-
{
17+
class Allocation extends FunctionCall {
1818
Allocation() {
1919
exists(string name |
2020
this.getTarget().hasQualifiedName(name) and
21-
(name = "malloc" or name = "calloc" or name = "realloc"))
21+
(name = "malloc" or name = "calloc" or name = "realloc")
22+
)
2223
}
2324

2425
string getName() { result = this.getTarget().getQualifiedName() }
2526

2627
int getSize() {
27-
(this.getName() = "malloc" and
28-
this.getArgument(0).getValue().toInt() = result)
28+
(
29+
this.getName() = "malloc" and
30+
this.getArgument(0).getValue().toInt() = result
31+
)
2932
or
30-
(this.getName() = "realloc" and
31-
this.getArgument(1).getValue().toInt() = result)
33+
(
34+
this.getName() = "realloc" and
35+
this.getArgument(1).getValue().toInt() = result
36+
)
3237
or
33-
(this.getName() = "calloc" and
34-
result =
35-
this.getArgument(0).getValue().toInt() *
36-
this.getArgument(1).getValue().toInt())
38+
(
39+
this.getName() = "calloc" and
40+
result = this.getArgument(0).getValue().toInt() * this.getArgument(1).getValue().toInt()
41+
)
3742
}
3843
}
3944

40-
predicate baseType(Allocation alloc, Type base)
41-
{
45+
predicate baseType(Allocation alloc, Type base) {
4246
exists(PointerType pointer |
4347
pointer.getBaseType() = base and
4448
(
4549
exists(AssignExpr assign |
46-
assign.getRValue() = alloc and assign.getLValue().getType() = pointer)
50+
assign.getRValue() = alloc and assign.getLValue().getType() = pointer
51+
)
4752
or
48-
exists(Variable v |
49-
v.getInitializer().getExpr() = alloc and v.getType() = pointer)
53+
exists(Variable v | v.getInitializer().getExpr() = alloc and v.getType() = pointer)
5054
)
5155
)
5256
}
5357

5458
from Allocation alloc, Type base, int basesize, int allocated
55-
where baseType(alloc, base)
56-
and allocated = alloc.getSize()
59+
where
60+
baseType(alloc, base) and
61+
allocated = alloc.getSize() and
5762
// If the codebase has more than one type with the same name, check if any matches
58-
and not exists(int size | base.getSize() = size |
59-
size = 0
60-
or (allocated / size) * size = allocated)
61-
and basesize = min(base.getSize())
62-
select alloc, "Allocated memory (" + allocated.toString() +
63-
" bytes) is not a multiple of the size of '" +
64-
base.getName() + "' (" + basesize.toString() + " bytes)."
63+
not exists(int size | base.getSize() = size |
64+
size = 0 or
65+
(allocated / size) * size = allocated
66+
) and
67+
basesize = min(base.getSize())
68+
select alloc,
69+
"Allocated memory (" + allocated.toString() + " bytes) is not a multiple of the size of '" +
70+
base.getName() + "' (" + basesize.toString() + " bytes)."

‎cpp/ql/src/Header Cleanup/Cleanup-DuplicateIncludeGuard.ql‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
* maintainability
1010
* modularity
1111
*/
12+
1213
import cpp
1314
import semmle.code.cpp.headers.MultipleInclusion
1415

@@ -20,9 +21,15 @@ import semmle.code.cpp.headers.MultipleInclusion
2021
* However one case must be a correctIncludeGuard to prove that this macro really is intended
2122
* to be an include guard.
2223
*/
24+
2325
from HeaderFile hf, PreprocessorDirective ifndef, string macroName, int num
24-
where hasIncludeGuard(hf, ifndef, _, macroName)
25-
and exists(HeaderFile other | hasIncludeGuard(other, _, _, macroName) and hf.getShortName() != other.getShortName())
26-
and num = strictcount(HeaderFile other | hasIncludeGuard(other, _, _, macroName))
27-
and correctIncludeGuard(_, _, _, _, macroName)
28-
select ifndef, "The macro name '" + macroName + "' of this include guard is used in " + num + " different header files."
26+
where
27+
hasIncludeGuard(hf, ifndef, _, macroName) and
28+
exists(HeaderFile other |
29+
hasIncludeGuard(other, _, _, macroName) and hf.getShortName() != other.getShortName()
30+
) and
31+
num = strictcount(HeaderFile other | hasIncludeGuard(other, _, _, macroName)) and
32+
correctIncludeGuard(_, _, _, _, macroName)
33+
select ifndef,
34+
"The macro name '" + macroName + "' of this include guard is used in " + num +
35+
" different header files."

0 commit comments

Comments
 (0)