C++: Improve indirectionForModelledFunction.

geoffw0 · geoffw0 · commit 13734d4e62d8 · 2024-04-09T12:06:03.000+01:00
diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll
@@ -264,20 +264,23 @@ module Private {
 module Public = Impl::Public;
 
 /**
- * Gets the number of indirections that can be returned by the function
- * modelled using the given MaD row.
+ * Gets a number of indirections that can be returned by a function
+ * modelled using models-as-data.
  */
-int indirectionForModelledFunction(
-  string namespace, string type, boolean subtypes, string name, string signature, string ext,
-  string input, string output, string kind, string provenance
-) {
-  summaryModel(namespace, type, subtypes, name, signature, ext, input, output, kind, provenance) and
-  (
-    // Return the number of stars in `ReturnValue[...]`
-    result = output.regexpCapture("ReturnValue\\[(\\*+)\\]", 1).length()
-    or
-    // There are no brackets the result is 0
-    output = "ReturnValue" and
-    result = 0
+int returnIndirectionForModelledFunction() {
+  exists(string inputOutput |
+    (
+      sourceModel(_, _, _, _, _, _, inputOutput, _, _) or
+      sinkModel(_, _, _, _, _, _, inputOutput, _, _) or
+      summaryModel(_, _, _, _, _, _, inputOutput, _, _, _) or
+      summaryModel(_, _, _, _, _, _, _, inputOutput, _, _)
+    ) and (
+      // Return the number of stars in `ReturnValue[...]`
+      result = inputOutput.regexpCapture("ReturnValue\\[(\\*+)\\]", 1).length()
+      or
+      // There are no brackets the result is 0
+      inputOutput = "ReturnValue" and
+      result = 0
+    )
   )
 }
diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
@@ -460,7 +460,7 @@ private newtype TReturnKind =
     Ssa::hasIndirectOperand(any(ReturnValueInstruction ret).getReturnAddressOperand(),
       indirectionIndex + 1) // We subtract one because the return loads the value.
     or
-    indirectionIndex = FlowSummaryImpl::indirectionForModelledFunction(_, _, _, _, _, _, _, _, _, _)
+    indirectionIndex = FlowSummaryImpl::returnIndirectionForModelledFunction()
   } or
   TIndirectReturnKind(int argumentIndex, int indirectionIndex) {
     exists(Ssa::FinalParameterUse use |
diff --git a/cpp/ql/test/library-tests/dataflow/source-sink-tests/local-flow.expected b/cpp/ql/test/library-tests/dataflow/source-sink-tests/local-flow.expected
@@ -1,11 +1,2 @@
 testFailures
-| sources-and-sinks.cpp:78:20:78:36 | // $ local_source | Missing result:local_source= |
-| sources-and-sinks.cpp:79:21:79:37 | // $ local_source | Missing result:local_source= |
-| sources-and-sinks.cpp:80:25:80:41 | // $ local_source | Missing result:local_source= |
-| sources-and-sinks.cpp:81:28:81:44 | // $ local_source | Missing result:local_source= |
-| sources-and-sinks.cpp:82:32:82:48 | // $ local_source | Missing result:local_source= |
-| sources-and-sinks.cpp:83:22:83:38 | // $ local_source | Missing result:local_source= |
-| sources-and-sinks.cpp:84:26:84:42 | // $ local_source | Missing result:local_source= |
-| sources-and-sinks.cpp:85:30:85:46 | // $ local_source | Missing result:local_source= |
-| sources-and-sinks.cpp:86:34:86:50 | // $ local_source | Missing result:local_source= |
 failures
diff --git a/cpp/ql/test/library-tests/dataflow/source-sink-tests/remote-flow.expected b/cpp/ql/test/library-tests/dataflow/source-sink-tests/remote-flow.expected
@@ -1,6 +1,2 @@
 testFailures
-| sources-and-sinks.cpp:73:25:73:42 | // $ remote_source | Missing result:remote_source= |
-| sources-and-sinks.cpp:74:29:74:46 | // $ remote_source | Missing result:remote_source= |
-| sources-and-sinks.cpp:75:33:75:50 | // $ remote_source | Missing result:remote_source= |
-| sources-and-sinks.cpp:76:37:76:54 | // $ remote_source | Missing result:remote_source= |
 failures
