Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 14deb06

Browse files
committed
C++: Implement Argument + Parameter indirection.
1 parent 638bfff commit 14deb06

4 files changed

Lines changed: 38 additions & 20 deletions

File tree

cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll

Lines changed: 22 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -52,25 +52,33 @@ module Input implements InputSig<DataFlowImplSpecific::CppDataFlow> {
5252

5353
bindingset[token]
5454
ParameterPosition decodeUnknownParameterPosition(AccessPath::AccessPathTokenBase token) {
55-
// needed to support `Argument[x..y]` ranges and `Argument[-1]`
56-
token.getName() = "Argument" and
57-
exists(int pos | pos = AccessPath::parseInt(token.getAnArgument()) |
58-
pos >= 0 and result = TDirectPosition(pos)
59-
or
60-
// `Argument[-1]` is the qualifier object `*this`, not the `this` pointer itself
61-
pos = -1 and result = TIndirectionPosition(pos, 1)
55+
// needed to support `Argument[x..y]` ranges, `Argument[-1]`, and indirections `*Argument[0]`.
56+
exists(int indirection |
57+
token.getName() = indirectionString(indirection) + "Argument" and
58+
exists(int pos | pos = AccessPath::parseInt(token.getAnArgument()) |
59+
pos >= 0 and indirection = 0 and result = TDirectPosition(pos)
60+
or
61+
pos >= 0 and indirection > 0 and result = TIndirectionPosition(pos, indirection)
62+
or
63+
// `Argument[-1]` is the qualifier object `*this`, not the `this` pointer itself
64+
pos = -1 and result = TIndirectionPosition(pos, indirection + 1)
65+
)
6266
)
6367
}
6468

6569
bindingset[token]
6670
ArgumentPosition decodeUnknownArgumentPosition(AccessPath::AccessPathTokenBase token) {
67-
// needed to support `Parameter[x..y]` ranges and `Parameter[-1]`
68-
token.getName() = "Parameter" and
69-
exists(int pos | pos = AccessPath::parseInt(token.getAnArgument()) |
70-
pos >= 0 and result = TDirectPosition(pos)
71-
or
72-
// `Argument[-1]` is the qualifier object `*this`, not the `this` pointer itself
73-
pos = -1 and result = TIndirectionPosition(pos, 1)
71+
// needed to support `Argument[x..y]` ranges, `Argument[-1]`, and indirections `*Argument[0]`.
72+
exists(int indirection |
73+
token.getName() = indirectionString(indirection) + "Parameter" and
74+
exists(int pos | pos = AccessPath::parseInt(token.getAnArgument()) |
75+
pos >= 0 and indirection = 0 and result = TDirectPosition(pos)
76+
or
77+
pos >= 0 and indirection > 0 and result = TIndirectionPosition(pos, indirection)
78+
or
79+
// `Argument[-1]` is the qualifier object `*this`, not the `this` pointer itself
80+
pos = -1 and result = TIndirectionPosition(pos, indirection + 1)
81+
)
7482
)
7583
}
7684
}

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -455,7 +455,7 @@ class IndirectionPosition extends Position, TIndirectionPosition {
455455
}
456456

457457
newtype TPosition =
458-
TDirectPosition(int index) { exists(any(CallInstruction c).getArgument(index)) } or
458+
TDirectPosition(int argumentIndex) { exists(any(CallInstruction c).getArgument(argumentIndex)) } or
459459
TIndirectionPosition(int argumentIndex, int indirectionIndex) {
460460
Ssa::hasIndirectOperand(any(CallInstruction call).getArgumentOperand(argumentIndex),
461461
indirectionIndex)

cpp/ql/test/library-tests/dataflow/models-as-data/FlowSummaryNode.expected

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,16 @@
44
| tests.cpp:127:6:127:28 | [summary] to write: *ReturnValue in madArg0ToReturnIndirect | ReturnNode | madArg0ToReturnIndirect | madArg0ToReturnIndirect |
55
| tests.cpp:129:5:129:28 | [summary param] 0 in madArg0ToReturnValueFlow | ParameterNode | madArg0ToReturnValueFlow | madArg0ToReturnValueFlow |
66
| tests.cpp:129:5:129:28 | [summary] to write: ReturnValue in madArg0ToReturnValueFlow | ReturnNode | madArg0ToReturnValueFlow | madArg0ToReturnValueFlow |
7+
| tests.cpp:130:5:130:27 | [summary param] 0 indirection in madArg0IndirectToReturn | ParameterNode | madArg0IndirectToReturn | madArg0IndirectToReturn |
8+
| tests.cpp:130:5:130:27 | [summary] to write: ReturnValue in madArg0IndirectToReturn | ReturnNode | madArg0IndirectToReturn | madArg0IndirectToReturn |
9+
| tests.cpp:131:5:131:33 | [summary param] 0 indirection in madArg0DoubleIndirectToReturn | ParameterNode | madArg0DoubleIndirectToReturn | madArg0DoubleIndirectToReturn |
10+
| tests.cpp:131:5:131:33 | [summary] to write: ReturnValue in madArg0DoubleIndirectToReturn | ReturnNode | madArg0DoubleIndirectToReturn | madArg0DoubleIndirectToReturn |
11+
| tests.cpp:132:6:132:26 | [summary param] 0 in madArg0ToArg1Indirect | ParameterNode | madArg0ToArg1Indirect | madArg0ToArg1Indirect |
12+
| tests.cpp:132:6:132:26 | [summary param] 1 indirection in madArg0ToArg1Indirect | ParameterNode | madArg0ToArg1Indirect | madArg0ToArg1Indirect |
13+
| tests.cpp:132:6:132:26 | [summary] to write: Argument[1 indirection] in madArg0ToArg1Indirect | PostUpdateNode | madArg0ToArg1Indirect | madArg0ToArg1Indirect |
14+
| tests.cpp:133:6:133:34 | [summary param] 0 indirection in madArg0IndirectToArg1Indirect | ParameterNode | madArg0IndirectToArg1Indirect | madArg0IndirectToArg1Indirect |
15+
| tests.cpp:133:6:133:34 | [summary param] 1 indirection in madArg0IndirectToArg1Indirect | ParameterNode | madArg0IndirectToArg1Indirect | madArg0IndirectToArg1Indirect |
16+
| tests.cpp:133:6:133:34 | [summary] to write: Argument[1 indirection] in madArg0IndirectToArg1Indirect | PostUpdateNode | madArg0IndirectToArg1Indirect | madArg0IndirectToArg1Indirect |
717
| tests.cpp:220:7:220:19 | [summary param] 0 in madArg0ToSelf | ParameterNode | madArg0ToSelf | madArg0ToSelf |
818
| tests.cpp:220:7:220:19 | [summary param] this indirection in madArg0ToSelf | ParameterNode | madArg0ToSelf | madArg0ToSelf |
919
| tests.cpp:220:7:220:19 | [summary] to write: Argument[this indirection] in madArg0ToSelf | PostUpdateNode | madArg0ToSelf | madArg0ToSelf |

cpp/ql/test/library-tests/dataflow/models-as-data/tests.cpp

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -155,15 +155,15 @@ void test_summaries() {
155155

156156
a = source();
157157
a_ptr = &a;
158-
sink(madArg0IndirectToReturn(&a)); // $ MISSING: ir
159-
sink(madArg0IndirectToReturn(a_ptr)); // $ MISSING: ir
160-
sink(madArg0DoubleIndirectToReturn(&a_ptr)); // $ MISSING: ir
158+
sink(madArg0IndirectToReturn(&a)); // $ ir
159+
sink(madArg0IndirectToReturn(a_ptr)); // $ ir
160+
sink(madArg0DoubleIndirectToReturn(&a_ptr)); // $ ir
161161

162162
madArg0ToArg1Indirect(source(), b);
163-
sink(b); // $ MISSING: ir
163+
sink(b); // $ ir
164164

165165
madArg0IndirectToArg1Indirect(&a, &c);
166-
sink(c); // $ MISSING: ir
166+
sink(c); // $ ir
167167

168168
MyContainer mc1, mc2;
169169

0 commit comments

Comments
 (0)