Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 1722614

Browse files
MathiasVPMathiasVP
committed
Merge branch 'replace-ast-with-ir-use-usedataflow' into fix-as-expr
2 parents 20bd300 + b7e42e8 commit 1722614

8 files changed

Lines changed: 2320 additions & 2272 deletions

File tree

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll‎

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -756,11 +756,20 @@ private predicate indirectExprNodeShouldBeIndirectOperand(IndirectOperand node,
756756
)
757757
}
758758

759+
private predicate exprNodeShouldBeIndirectOutNode(IndirectArgumentOutNode node, Expr e) {
760+
exists(CallInstruction call |
761+
call.getStaticCallTarget() instanceof Constructor and
762+
e = call.getConvertedResultExpression() and
763+
call.getThisArgumentOperand() = node.getAddressOperand()
764+
)
765+
}
766+
759767
/** Holds if `node` should be an instruction node that maps `node.asExpr()` to `e`. */
760768
predicate exprNodeShouldBeInstruction(Node node, Expr e) {
761769
e = node.asInstruction().getConvertedResultExpression() and
762770
not exprNodeShouldBeOperand(_, e) and
763-
not exprNodeShouldBeIndirectOperand(_, e, _)
771+
not exprNodeShouldBeIndirectOperand(_, e, _) and
772+
not exprNodeShouldBeIndirectOutNode(_, e)
764773
}
765774

766775
/** Holds if `node` should be an `IndirectInstruction` that maps `node.asIndirectExpr()` to `e`. */
@@ -866,6 +875,16 @@ private class IndirectInstructionIndirectExprNode extends IndirectExprNodeBase,
866875
final override string toStringImpl() { result = super.toStringImpl() }
867876
}
868877

878+
private class IndirectArgumentOutExprNode extends ExprNodeBase, IndirectArgumentOutNode {
879+
IndirectArgumentOutExprNode() { exprNodeShouldBeIndirectOutNode(this, _) }
880+
881+
final override Expr getConvertedExpr() { exprNodeShouldBeIndirectOutNode(this, result) }
882+
883+
final override Expr getExpr() { result = this.getConvertedExpr() }
884+
885+
final override string toStringImpl() { result = this.getConvertedExpr().toString() }
886+
}
887+
869888
/**
870889
* An expression, viewed as a node in a data flow graph.
871890
*/

‎cpp/ql/src/Likely Bugs/Likely Typos/inconsistentLoopDirection.ql‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ predicate illDefinedDecrForStmt(
4646
candidateDecrForStmt(forstmt, v, lesserOperand, terminalCondition) and
4747
// `initialCondition` is a value of `v` in the for loop
4848
v.getAnAssignedValue() = initialCondition and
49-
DataFlow::localFlowStep(DataFlow::exprNode(initialCondition), DataFlow::exprNode(lesserOperand)) and
49+
DataFlow::localFlowStep+(DataFlow::exprNode(initialCondition), DataFlow::exprNode(lesserOperand)) and
5050
// `initialCondition` < `terminalCondition`
5151
(
5252
upperBound(initialCondition) < lowerBound(terminalCondition) and
@@ -82,7 +82,8 @@ predicate illDefinedIncrForStmt(
8282
candidateIncrForStmt(forstmt, v, greaterOperand, terminalCondition) and
8383
// `initialCondition` is a value of `v` in the for loop
8484
v.getAnAssignedValue() = initialCondition and
85-
DataFlow::localFlowStep(DataFlow::exprNode(initialCondition), DataFlow::exprNode(greaterOperand)) and
85+
DataFlow::localFlowStep+(DataFlow::exprNode(initialCondition),
86+
DataFlow::exprNode(greaterOperand)) and
8687
// `terminalCondition` < `initialCondition`
8788
(
8889
upperBound(terminalCondition) < lowerBound(initialCondition)

‎cpp/ql/src/Likely Bugs/Memory Management/ReturnCstrOfLocalStdString.ql‎

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -36,20 +36,20 @@ class StdString extends Class {
3636
* Holds if `e` is a direct or indirect reference to a locally
3737
* allocated `std::string`.
3838
*/
39-
predicate refToStdString(Expr e, ConstructorCall source) {
39+
predicate refToStdString(DataFlow::Node node, ConstructorCall source) {
4040
exists(StdString stdstring |
4141
stdstring.getAMemberFunction() = source.getTarget() and
4242
not exists(LocalVariable v |
4343
source = v.getInitializer().getExpr() and
4444
v.isStatic()
4545
) and
46-
e = source
46+
node.asExpr() = source
4747
)
4848
or
4949
// Indirect use.
50-
exists(Expr prev |
50+
exists(DataFlow::Node prev |
5151
refToStdString(prev, source) and
52-
DataFlow::localFlowStep(DataFlow::exprNode(prev), DataFlow::exprNode(e))
52+
DataFlow::localFlowStep(prev, node)
5353
)
5454
}
5555

@@ -74,29 +74,30 @@ predicate flowFunction(Function fcn, int argIndex) {
7474
* Holds if `e` is a direct or indirect reference to the result of calling
7575
* `c_str` on a locally allocated `std::string`.
7676
*/
77-
predicate refToCStr(Expr e, ConstructorCall source) {
78-
exists(MemberFunction f, FunctionCall call |
77+
predicate refToCStr(DataFlow::Node node, ConstructorCall source) {
78+
exists(MemberFunction f, FunctionCall call, DataFlow::Node qualifier |
7979
f.getName() = "c_str" and
80-
call = e and
80+
call = node.asExpr() and
8181
call.getTarget() = f and
82-
refToStdString(call.getQualifier(), source)
82+
qualifier.asIndirectArgument() = call.getQualifier() and
83+
refToStdString(qualifier, source)
8384
)
8485
or
8586
// Indirect use.
86-
exists(Expr prev |
87+
exists(DataFlow::Node prev |
8788
refToCStr(prev, source) and
88-
DataFlow::localFlowStep(DataFlow::exprNode(prev), DataFlow::exprNode(e))
89+
DataFlow::localFlowStep(prev, node)
8990
)
9091
or
9192
// Some functions, such as `JNIEnv::NewStringUTF()` (from Java's JNI)
9293
// embed return a structure containing a reference to the C-style string.
9394
exists(Function f, int argIndex |
9495
flowFunction(f, argIndex) and
95-
f = e.(Call).getTarget() and
96-
refToCStr(e.(Call).getArgument(argIndex), source)
96+
f = node.asExpr().(Call).getTarget() and
97+
refToCStr(DataFlow::exprNode(node.asExpr().(Call).getArgument(argIndex)), source)
9798
)
9899
}
99100

100101
from ReturnStmt r, ConstructorCall source
101-
where refToCStr(r.getExpr(), source)
102+
where refToCStr(DataFlow::exprNode(r.getExpr()), source)
102103
select r, "Return value may contain a dangling pointer to $@.", source, "this local std::string"

0 commit comments

Comments
 (0)