Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 4043aa9

Browse files
MathiasVPMathiasVP
committed
Merge branch 'main' into skip-safe-conversions-in-range-analysis
2 parents d9b2a72 + 62bc807 commit 4043aa9

216 files changed

Lines changed: 5272 additions & 1486 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/ruby-qltest.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ on:
44
push:
55
paths:
66
- "ruby/**"
7+
- "shared/**"
78
- .github/workflows/ruby-build.yml
89
- .github/actions/fetch-codeql/action.yml
910
- codeql-workspace.yml

‎cpp/ql/lib/change-notes/2023-03-28-dataflow-rm-footgun.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: fix
3+
---
4+
* Fixed some accidental predicate visibility in the backwards-compatible wrapper for data flow configurations. In particular `DataFlow::hasFlowPath`, `DataFlow::hasFlow`, `DataFlow::hasFlowTo`, and `DataFlow::hasFlowToExpr` were accidentally exposed in a single version.

‎cpp/ql/lib/change-notes/2023-03-30-bufferaccess.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: feature
3+
---
4+
* Added overridable predicates `getSizeExpr` and `getSizeMult` to the `BufferAccess` class (`semmle.code.cpp.security.BufferAccess.qll`). This makes it possible to model a larger class of buffer reads and writes using the library.

‎cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/FloatDelta.qll‎

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -16,14 +16,5 @@ module FloatDelta implements DeltaSig {
1616
Delta fromInt(int n) { result = n }
1717

1818
bindingset[f]
19-
Delta fromFloat(float f) {
20-
result =
21-
min(float diff, float res |
22-
diff = (res - f) and res = f.ceil()
23-
or
24-
diff = (f - res) and res = f.floor()
25-
|
26-
res order by diff
27-
)
28-
}
19+
Delta fromFloat(float f) { result = f }
2920
}

‎cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/RangeAnalysisStage.qll‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1062,6 +1062,20 @@ module RangeStage<DeltaSig D, BoundSig<D> Bounds, LangSig<D> LangParam, UtilSig<
10621062
or
10631063
upper = false and delta = D::fromFloat(-D::toFloat(d_max).abs() + 1)
10641064
)
1065+
or
1066+
exists(
1067+
D::Delta dLeft, D::Delta dRight, boolean fbeLeft, boolean fbeRight, D::Delta odLeft,
1068+
D::Delta odRight, SemReason rLeft, SemReason rRight
1069+
|
1070+
boundedMulOperand(e, upper, true, dLeft, fbeLeft, odLeft, rLeft) and
1071+
boundedMulOperand(e, upper, false, dRight, fbeRight, odRight, rRight) and
1072+
delta = D::fromFloat(D::toFloat(dLeft) * D::toFloat(dRight)) and
1073+
fromBackEdge = fbeLeft.booleanOr(fbeRight)
1074+
|
1075+
b instanceof SemZeroBound and origdelta = odLeft and reason = rLeft
1076+
or
1077+
b instanceof SemZeroBound and origdelta = odRight and reason = rRight
1078+
)
10651079
)
10661080
}
10671081

@@ -1095,4 +1109,109 @@ module RangeStage<DeltaSig D, BoundSig<D> Bounds, LangSig<D> LangParam, UtilSig<
10951109
) {
10961110
bounded(rem.getRightOperand(), b, delta, upper, fromBackEdge, origdelta, reason)
10971111
}
1112+
1113+
/**
1114+
* Define `cmp(true) = <=` and `cmp(false) = >=`.
1115+
*
1116+
* Holds if `mul = left * right`, and in order to know if `mul cmp(upper) 0 + k` (for
1117+
* some `k`) we need to know that `left cmp(upperLeft) 0 + k1` and
1118+
* `right cmp(upperRight) 0 + k2` (for some `k1` and `k2`).
1119+
*/
1120+
pragma[nomagic]
1121+
private predicate boundedMulOperandCand(
1122+
SemMulExpr mul, SemExpr left, SemExpr right, boolean upper, boolean upperLeft,
1123+
boolean upperRight
1124+
) {
1125+
not boundFlowStepMul(mul, _, _) and
1126+
mul.getLeftOperand() = left and
1127+
mul.getRightOperand() = right and
1128+
(
1129+
semPositive(left) and
1130+
(
1131+
// left, right >= 0
1132+
semPositive(right) and
1133+
(
1134+
// max(left * right) = max(left) * max(right)
1135+
upper = true and
1136+
upperLeft = true and
1137+
upperRight = true
1138+
or
1139+
// min(left * right) = min(left) * min(right)
1140+
upper = false and
1141+
upperLeft = false and
1142+
upperRight = false
1143+
)
1144+
or
1145+
// left >= 0, right <= 0
1146+
semNegative(right) and
1147+
(
1148+
// max(left * right) = min(left) * max(right)
1149+
upper = true and
1150+
upperLeft = false and
1151+
upperRight = true
1152+
or
1153+
// min(left * right) = max(left) * min(right)
1154+
upper = false and
1155+
upperLeft = true and
1156+
upperRight = false
1157+
)
1158+
)
1159+
or
1160+
semNegative(left) and
1161+
(
1162+
// left <= 0, right >= 0
1163+
semPositive(right) and
1164+
(
1165+
// max(left * right) = max(left) * min(right)
1166+
upper = true and
1167+
upperLeft = true and
1168+
upperRight = false
1169+
or
1170+
// min(left * right) = min(left) * max(right)
1171+
upper = false and
1172+
upperLeft = false and
1173+
upperRight = true
1174+
)
1175+
or
1176+
// left, right <= 0
1177+
semNegative(right) and
1178+
(
1179+
// max(left * right) = min(left) * min(right)
1180+
upper = true and
1181+
upperLeft = false and
1182+
upperRight = false
1183+
or
1184+
// min(left * right) = max(left) * max(right)
1185+
upper = false and
1186+
upperLeft = true and
1187+
upperRight = true
1188+
)
1189+
)
1190+
)
1191+
}
1192+
1193+
/**
1194+
* Holds if `isLeft = true` and `mul`'s left operand is bounded by `delta`,
1195+
* or if `isLeft = false` and `mul`'s right operand is bounded by `delta`.
1196+
*
1197+
* If `upper = true` the computed bound contributes to an upper bound of `mul`,
1198+
* and if `upper = false` it contributes to a lower bound.
1199+
* The `fromBackEdge`, `origdelta`, `reason` triple are defined by the recursive
1200+
* call to `bounded`.
1201+
*/
1202+
pragma[nomagic]
1203+
private predicate boundedMulOperand(
1204+
SemMulExpr mul, boolean upper, boolean isLeft, D::Delta delta, boolean fromBackEdge,
1205+
D::Delta origdelta, SemReason reason
1206+
) {
1207+
exists(boolean upperLeft, boolean upperRight, SemExpr left, SemExpr right |
1208+
boundedMulOperandCand(mul, left, right, upper, upperLeft, upperRight)
1209+
|
1210+
isLeft = true and
1211+
bounded(left, any(SemZeroBound zb), delta, upperLeft, fromBackEdge, origdelta, reason)
1212+
or
1213+
isLeft = false and
1214+
bounded(right, any(SemZeroBound zb), delta, upperRight, fromBackEdge, origdelta, reason)
1215+
)
1216+
}
10981217
}

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ private import DataFlowImplCommon
88
private import DataFlowImplSpecific::Private
99
private import DataFlowImplSpecific::Public
1010
private import DataFlowImplCommonPublic
11+
private import codeql.util.Unit
1112
import DataFlow
1213

1314
/**

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl1.qll‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ import DataFlowImplSpecific::Public
1111
private import DataFlowImpl
1212
import DataFlowImplCommonPublic
1313
import FlowStateString
14+
private import codeql.util.Unit
1415

1516
/**
1617
* A configuration of interprocedural data flow analysis. This defines
@@ -328,7 +329,6 @@ private module Config implements FullStateConfigSig {
328329
}
329330

330331
private import Impl<Config> as I
331-
import I
332332

333333
/**
334334
* A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
@@ -379,6 +379,8 @@ class PathNode instanceof I::PathNode {
379379
final predicate isSinkGroup(string group) { super.isSinkGroup(group) }
380380
}
381381

382+
module PathGraph = I::PathGraph;
383+
382384
private predicate hasFlow(Node source, Node sink, Configuration config) {
383385
exists(PathNode source0, PathNode sink0 |
384386
hasFlowPath(source0, sink0, config) and
@@ -388,7 +390,7 @@ private predicate hasFlow(Node source, Node sink, Configuration config) {
388390
}
389391

390392
private predicate hasFlowPath(PathNode source, PathNode sink, Configuration config) {
391-
flowPath(source, sink) and source.getConfiguration() = config
393+
I::flowPath(source, sink) and source.getConfiguration() = config
392394
}
393395

394396
private predicate hasFlowTo(Node sink, Configuration config) { hasFlow(_, sink, config) }

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ import DataFlowImplSpecific::Public
1111
private import DataFlowImpl
1212
import DataFlowImplCommonPublic
1313
import FlowStateString
14+
private import codeql.util.Unit
1415

1516
/**
1617
* A configuration of interprocedural data flow analysis. This defines
@@ -328,7 +329,6 @@ private module Config implements FullStateConfigSig {
328329
}
329330

330331
private import Impl<Config> as I
331-
import I
332332

333333
/**
334334
* A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
@@ -379,6 +379,8 @@ class PathNode instanceof I::PathNode {
379379
final predicate isSinkGroup(string group) { super.isSinkGroup(group) }
380380
}
381381

382+
module PathGraph = I::PathGraph;
383+
382384
private predicate hasFlow(Node source, Node sink, Configuration config) {
383385
exists(PathNode source0, PathNode sink0 |
384386
hasFlowPath(source0, sink0, config) and
@@ -388,7 +390,7 @@ private predicate hasFlow(Node source, Node sink, Configuration config) {
388390
}
389391

390392
private predicate hasFlowPath(PathNode source, PathNode sink, Configuration config) {
391-
flowPath(source, sink) and source.getConfiguration() = config
393+
I::flowPath(source, sink) and source.getConfiguration() = config
392394
}
393395

394396
private predicate hasFlowTo(Node sink, Configuration config) { hasFlow(_, sink, config) }

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ import DataFlowImplSpecific::Public
1111
private import DataFlowImpl
1212
import DataFlowImplCommonPublic
1313
import FlowStateString
14+
private import codeql.util.Unit
1415

1516
/**
1617
* A configuration of interprocedural data flow analysis. This defines
@@ -328,7 +329,6 @@ private module Config implements FullStateConfigSig {
328329
}
329330

330331
private import Impl<Config> as I
331-
import I
332332

333333
/**
334334
* A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
@@ -379,6 +379,8 @@ class PathNode instanceof I::PathNode {
379379
final predicate isSinkGroup(string group) { super.isSinkGroup(group) }
380380
}
381381

382+
module PathGraph = I::PathGraph;
383+
382384
private predicate hasFlow(Node source, Node sink, Configuration config) {
383385
exists(PathNode source0, PathNode sink0 |
384386
hasFlowPath(source0, sink0, config) and
@@ -388,7 +390,7 @@ private predicate hasFlow(Node source, Node sink, Configuration config) {
388390
}
389391

390392
private predicate hasFlowPath(PathNode source, PathNode sink, Configuration config) {
391-
flowPath(source, sink) and source.getConfiguration() = config
393+
I::flowPath(source, sink) and source.getConfiguration() = config
392394
}
393395

394396
private predicate hasFlowTo(Node sink, Configuration config) { hasFlow(_, sink, config) }

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ import DataFlowImplSpecific::Public
1111
private import DataFlowImpl
1212
import DataFlowImplCommonPublic
1313
import FlowStateString
14+
private import codeql.util.Unit
1415

1516
/**
1617
* A configuration of interprocedural data flow analysis. This defines
@@ -328,7 +329,6 @@ private module Config implements FullStateConfigSig {
328329
}
329330

330331
private import Impl<Config> as I
331-
import I
332332

333333
/**
334334
* A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
@@ -379,6 +379,8 @@ class PathNode instanceof I::PathNode {
379379
final predicate isSinkGroup(string group) { super.isSinkGroup(group) }
380380
}
381381

382+
module PathGraph = I::PathGraph;
383+
382384
private predicate hasFlow(Node source, Node sink, Configuration config) {
383385
exists(PathNode source0, PathNode sink0 |
384386
hasFlowPath(source0, sink0, config) and
@@ -388,7 +390,7 @@ private predicate hasFlow(Node source, Node sink, Configuration config) {
388390
}
389391

390392
private predicate hasFlowPath(PathNode source, PathNode sink, Configuration config) {
391-
flowPath(source, sink) and source.getConfiguration() = config
393+
I::flowPath(source, sink) and source.getConfiguration() = config
392394
}
393395

394396
private predicate hasFlowTo(Node sink, Configuration config) { hasFlow(_, sink, config) }

0 commit comments

Comments
 (0)