Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 5b33255

Browse files
author
Dave Bartolomeo
authored
Merge pull request #1585 from rdmarsh2/rdmarsh/cpp/hasGlobalOrStdName
C++: add Declaration.hasGlobalOrStdName()
2 parents 6c9f926 + 9554513 commit 5b33255

33 files changed

Lines changed: 142 additions & 126 deletions

‎change-notes/1.23/analysis-cpp.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,8 @@ The following changes in version 1.23 affect C/C++ analysis in all applications.
5353
clarity (e.g. `isOutReturnPointer()` to `isReturnValueDeref()`). The existing member predicates
5454
have been deprecated, and will be removed in a future release. Code that uses the old member
5555
predicates should be updated to use the corresponding new member predicate.
56+
* The predicates `Declaration.hasStdName()` and `Declaration.hasGlobalOrStdName`
57+
have been added, simplifying handling of C++ standard library functions.
5658
* The control-flow graph is now computed in QL, not in the extractor. This can
5759
lead to regressions (or improvements) in how queries are optimized because
5860
optimization in QL relies on static size estimates, and the control-flow edge

‎cpp/ql/src/Critical/DescriptorMayNotBeClosed.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ import semmle.code.cpp.pointsto.PointsTo
1313
import Negativity
1414

1515
predicate closeCall(FunctionCall fc, Variable v) {
16-
fc.getTarget().hasGlobalName("close") and v.getAnAccess() = fc.getArgument(0)
16+
fc.getTarget().hasGlobalOrStdName("close") and v.getAnAccess() = fc.getArgument(0)
1717
or
1818
exists(FunctionCall midcall, Function mid, int arg |
1919
fc.getArgument(arg) = v.getAnAccess() and

‎cpp/ql/src/Critical/DescriptorNeverClosed.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ import semmle.code.cpp.pointsto.PointsTo
1313

1414
predicate closed(Expr e) {
1515
exists(FunctionCall fc |
16-
fc.getTarget().hasGlobalName("close") and
16+
fc.getTarget().hasGlobalOrStdName("close") and
1717
fc.getArgument(0) = e
1818
)
1919
}

‎cpp/ql/src/Critical/MemoryMayNotBeFreed.ql‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ predicate allocCallOrIndirect(Expr e) {
5353
* can cause memory leaks.
5454
*/
5555
predicate verifiedRealloc(FunctionCall reallocCall, Variable v, ControlFlowNode verified) {
56-
reallocCall.getTarget().hasGlobalName("realloc") and
56+
reallocCall.getTarget().hasGlobalOrStdName("realloc") and
5757
reallocCall.getArgument(0) = v.getAnAccess() and
5858
(
5959
exists(Variable newV, ControlFlowNode node |
@@ -79,7 +79,7 @@ predicate verifiedRealloc(FunctionCall reallocCall, Variable v, ControlFlowNode
7979
predicate freeCallOrIndirect(ControlFlowNode n, Variable v) {
8080
// direct free call
8181
freeCall(n, v.getAnAccess()) and
82-
not n.(FunctionCall).getTarget().hasGlobalName("realloc")
82+
not n.(FunctionCall).getTarget().hasGlobalOrStdName("realloc")
8383
or
8484
// verified realloc call
8585
verifiedRealloc(_, v, n)

‎cpp/ql/src/Critical/OverflowCalculated.ql‎

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,7 @@
1313
import cpp
1414

1515
class MallocCall extends FunctionCall {
16-
MallocCall() {
17-
this.getTarget().hasGlobalName("malloc") or
18-
this.getTarget().hasQualifiedName("std", "malloc")
19-
}
16+
MallocCall() { this.getTarget().hasGlobalOrStdName("malloc") }
2017

2118
Expr getAllocatedSize() {
2219
if this.getArgument(0) instanceof VariableAccess
@@ -36,12 +33,12 @@ predicate spaceProblem(FunctionCall append, string msg) {
3633
malloc.getAllocatedSize() = add and
3734
buffer.getAnAccess() = strlen.getStringExpr() and
3835
(
39-
insert.getTarget().hasGlobalName("strcpy") or
40-
insert.getTarget().hasGlobalName("strncpy")
36+
insert.getTarget().hasGlobalOrStdName("strcpy") or
37+
insert.getTarget().hasGlobalOrStdName("strncpy")
4138
) and
4239
(
43-
append.getTarget().hasGlobalName("strcat") or
44-
append.getTarget().hasGlobalName("strncat")
40+
append.getTarget().hasGlobalOrStdName("strcat") or
41+
append.getTarget().hasGlobalOrStdName("strncat")
4542
) and
4643
malloc.getASuccessor+() = insert and
4744
insert.getArgument(1) = buffer.getAnAccess() and

‎cpp/ql/src/Critical/OverflowDestination.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ import semmle.code.cpp.security.TaintTracking
2525
predicate sourceSized(FunctionCall fc, Expr src) {
2626
exists(string name |
2727
(name = "strncpy" or name = "strncat" or name = "memcpy" or name = "memmove") and
28-
fc.getTarget().hasGlobalName(name)
28+
fc.getTarget().hasGlobalOrStdName(name)
2929
) and
3030
exists(Expr dest, Expr size, Variable v |
3131
fc.getArgument(0) = dest and

‎cpp/ql/src/Critical/OverflowStatic.ql‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -60,19 +60,19 @@ predicate overflowOffsetInLoop(BufferAccess bufaccess, string msg) {
6060
predicate bufferAndSizeFunction(Function f, int buf, int size) {
6161
f.hasGlobalName("read") and buf = 1 and size = 2
6262
or
63-
f.hasGlobalName("fgets") and buf = 0 and size = 1
63+
f.hasGlobalOrStdName("fgets") and buf = 0 and size = 1
6464
or
65-
f.hasGlobalName("strncpy") and buf = 0 and size = 2
65+
f.hasGlobalOrStdName("strncpy") and buf = 0 and size = 2
6666
or
67-
f.hasGlobalName("strncat") and buf = 0 and size = 2
67+
f.hasGlobalOrStdName("strncat") and buf = 0 and size = 2
6868
or
69-
f.hasGlobalName("memcpy") and buf = 0 and size = 2
69+
f.hasGlobalOrStdName("memcpy") and buf = 0 and size = 2
7070
or
71-
f.hasGlobalName("memmove") and buf = 0 and size = 2
71+
f.hasGlobalOrStdName("memmove") and buf = 0 and size = 2
7272
or
73-
f.hasGlobalName("snprintf") and buf = 0 and size = 1
73+
f.hasGlobalOrStdName("snprintf") and buf = 0 and size = 1
7474
or
75-
f.hasGlobalName("vsnprintf") and buf = 0 and size = 1
75+
f.hasGlobalOrStdName("vsnprintf") and buf = 0 and size = 1
7676
}
7777

7878
class CallWithBufferSize extends FunctionCall {

‎cpp/ql/src/Critical/SizeCheck.ql‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,12 @@ import cpp
1717
class Allocation extends FunctionCall {
1818
Allocation() {
1919
exists(string name |
20-
this.getTarget().hasGlobalName(name) and
20+
this.getTarget().hasGlobalOrStdName(name) and
2121
(name = "malloc" or name = "calloc" or name = "realloc")
2222
)
2323
}
2424

25-
private string getName() { this.getTarget().hasGlobalName(result) }
25+
private string getName() { this.getTarget().hasGlobalOrStdName(result) }
2626

2727
int getSize() {
2828
this.getName() = "malloc" and

‎cpp/ql/src/Critical/SizeCheck2.ql‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,12 @@ import cpp
1717
class Allocation extends FunctionCall {
1818
Allocation() {
1919
exists(string name |
20-
this.getTarget().hasGlobalName(name) and
20+
this.getTarget().hasGlobalOrStdName(name) and
2121
(name = "malloc" or name = "calloc" or name = "realloc")
2222
)
2323
}
2424

25-
private string getName() { this.getTarget().hasGlobalName(result) }
25+
private string getName() { this.getTarget().hasGlobalOrStdName(result) }
2626

2727
int getSize() {
2828
this.getName() = "malloc" and

‎cpp/ql/src/Critical/UseAfterFree.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ import semmle.code.cpp.controlflow.LocalScopeVariableReachability
1616
predicate isFreeExpr(Expr e, LocalScopeVariable v) {
1717
exists(VariableAccess va | va.getTarget() = v |
1818
exists(FunctionCall fc | fc = e |
19-
fc.getTarget().hasGlobalName("free") and
19+
fc.getTarget().hasGlobalOrStdName("free") and
2020
va = fc.getArgument(0)
2121
)
2222
or

0 commit comments

Comments
 (0)