@@ -1775,100 +1775,95 @@ private module Stage4 {
17751775 * argument in a call, and if so, `argAp` records the approximate access path
17761776 * of that argument.
17771777 */
1778- predicate fwdFlow (
1779- Node node , Cc cc , ApOption argAp , AccessPathFront apf , Ap ap , Configuration config
1780- ) {
1781- fwdFlow0 ( node , cc , argAp , apf , ap , config ) and
1782- Stage3:: revFlow ( node , _, _, apf , config )
1778+ predicate fwdFlow ( Node node , Cc cc , ApOption argAp , Ap ap , Configuration config ) {
1779+ fwdFlow0 ( node , cc , argAp , ap , config ) and
1780+ Stage3:: revFlow ( node , _, _, ap .getFront ( ) , config )
17831781 }
17841782
1785- private predicate fwdFlow0 (
1786- Node node , Cc cc , ApOption argAp , AccessPathFront apf , Ap ap , Configuration config
1787- ) {
1783+ private predicate fwdFlow0 ( Node node , Cc cc , ApOption argAp , Ap ap , Configuration config ) {
17881784 Stage3:: revFlow ( node , _, _, _, config ) and
17891785 config .isSource ( node ) and
17901786 cc instanceof CallContextAny and
17911787 argAp = TAccessPathApproxNone ( ) and
1792- ap = TNil ( getNodeType ( node ) ) and
1793- apf = ap .( AccessPathApproxNil ) .getFront ( )
1788+ ap = TNil ( getNodeType ( node ) )
17941789 or
17951790 Stage3:: revFlow ( node , _, _, _, unbind ( config ) ) and
17961791 (
17971792 exists ( Node mid , LocalCallContext localCC |
1798- fwdFlowLocalEntry ( mid , cc , argAp , apf , ap , localCC , config ) and
1793+ fwdFlowLocalEntry ( mid , cc , argAp , ap , localCC , config ) and
17991794 localFlowBigStep ( mid , node , true , _, config , localCC )
18001795 )
18011796 or
1802- exists ( Node mid , AccessPathApproxNil nil , LocalCallContext localCC |
1803- fwdFlowLocalEntry ( mid , cc , argAp , _ , nil , localCC , config ) and
1797+ exists ( Node mid , AccessPathApproxNil nil , LocalCallContext localCC , AccessPathFront apf |
1798+ fwdFlowLocalEntry ( mid , cc , argAp , nil , localCC , config ) and
18041799 localFlowBigStep ( mid , node , false , apf , config , localCC ) and
18051800 apf = ap .( AccessPathApproxNil ) .getFront ( )
18061801 )
18071802 or
18081803 exists ( Node mid |
1809- fwdFlow ( mid , _, _, apf , ap , config ) and
1804+ fwdFlow ( mid , _, _, ap , config ) and
18101805 jumpStep ( mid , node , config ) and
18111806 cc instanceof CallContextAny and
18121807 argAp = TAccessPathApproxNone ( )
18131808 )
18141809 or
18151810 exists ( Node mid , AccessPathApproxNil nil |
1816- fwdFlow ( mid , _, _, _ , nil , config ) and
1811+ fwdFlow ( mid , _, _, nil , config ) and
18171812 additionalJumpStep ( mid , node , config ) and
18181813 cc instanceof CallContextAny and
18191814 argAp = TAccessPathApproxNone ( ) and
1820- ap = TNil ( getNodeType ( node ) ) and
1821- apf = ap .( AccessPathApproxNil ) .getFront ( )
1815+ ap = TNil ( getNodeType ( node ) )
18221816 )
18231817 )
18241818 or
18251819 // store
1826- exists ( TypedContent tc | fwdFlowStore ( node , tc , pop ( tc , ap ) , apf , cc , argAp , config ) )
1820+ exists ( TypedContent tc | fwdFlowStore ( node , tc , pop ( tc , ap ) , cc , argAp , config ) )
18271821 or
18281822 // read
1829- exists ( TypedContent tc |
1830- fwdFlowRead ( node , _ , push ( tc , ap ) , apf , cc , argAp , config ) and
1823+ exists ( TypedContent tc , AccessPathFront apf |
1824+ fwdFlowRead ( node , push ( tc , ap ) , apf , cc , argAp , config ) and
18311825 fwdFlowConsCand ( tc , apf , ap , config )
18321826 )
18331827 or
18341828 // flow into a callable
1835- fwdFlowIn ( _, node , _, cc , _, apf , ap , config ) and
1836- if Stage3:: revFlow ( node , true , _, apf , config )
1837- then argAp = TAccessPathApproxSome ( ap )
1838- else argAp = TAccessPathApproxNone ( )
1829+ exists ( ApApprox apa |
1830+ fwdFlowIn ( _, node , _, cc , _, ap , config ) and
1831+ apa = ap .getFront ( ) and
1832+ if Stage3:: revFlow ( node , true , _, apa , config )
1833+ then argAp = TAccessPathApproxSome ( ap )
1834+ else argAp = TAccessPathApproxNone ( )
1835+ )
18391836 or
18401837 // flow out of a callable
18411838 exists ( DataFlowCall call |
18421839 exists ( DataFlowCallable c |
1843- fwdFlowOut ( call , node , any ( CallContextNoCall innercc ) , c , argAp , apf , ap , config ) and
1840+ fwdFlowOut ( call , node , any ( CallContextNoCall innercc ) , c , argAp , ap , config ) and
18441841 if reducedViableImplInReturn ( c , call ) then cc = TReturn ( c , call ) else cc = TAnyCallContext ( )
18451842 )
18461843 or
18471844 exists ( Ap argAp0 |
1848- fwdFlowOutFromArg ( call , node , argAp0 , apf , ap , config ) and
1845+ fwdFlowOutFromArg ( call , node , argAp0 , ap , config ) and
18491846 fwdFlowIsEntered ( call , cc , argAp , argAp0 , config )
18501847 )
18511848 )
18521849 }
18531850
18541851 pragma [ nomagic]
18551852 private predicate fwdFlowLocalEntry (
1856- Node node , Cc cc , ApOption argAp , AccessPathFront apf , Ap ap , LocalCallContext localCC ,
1857- Configuration config
1853+ Node node , Cc cc , ApOption argAp , Ap ap , LocalCallContext localCC , Configuration config
18581854 ) {
1859- fwdFlow ( node , cc , argAp , apf , ap , config ) and
1855+ fwdFlow ( node , cc , argAp , ap , config ) and
18601856 localFlowEntry ( node , config ) and
18611857 localCC = getLocalCallContext ( cc , node .getEnclosingCallable ( ) )
18621858 }
18631859
18641860 pragma [ nomagic]
18651861 private predicate fwdFlowStore (
1866- Node node , TypedContent tc , Ap ap0 , AccessPathFront apf , Cc cc , ApOption argAp ,
1867- Configuration config
1862+ Node node , TypedContent tc , Ap ap0 , Cc cc , ApOption argAp , Configuration config
18681863 ) {
1869- exists ( Node mid , AccessPathFront apf0 |
1870- fwdFlow ( mid , cc , argAp , apf0 , ap0 , config ) and
1871- fwdFlowStore0 ( mid , tc , node , apf0 , apf , config )
1864+ exists ( Node mid |
1865+ fwdFlow ( mid , cc , argAp , ap0 , config ) and
1866+ fwdFlowStore0 ( mid , tc , node , ap0 . getFront ( ) , config )
18721867 )
18731868 }
18741869
@@ -1884,30 +1879,29 @@ private module Stage4 {
18841879
18851880 pragma [ noinline]
18861881 private predicate fwdFlowStore0 (
1887- Node mid , TypedContent tc , Node node , AccessPathFront apf0 , AccessPathFrontHead apf ,
1888- Configuration config
1882+ Node mid , TypedContent tc , Node node , AccessPathFront apf0 , Configuration config
18891883 ) {
1890- storeCand ( mid , tc , node , apf0 , apf , config ) and
1891- Stage3:: revFlowConsCand ( tc , apf0 , config ) and
1892- Stage3:: revFlow ( node , _, _, apf , unbind ( config ) )
1884+ exists ( AccessPathFront apf |
1885+ storeCand ( mid , tc , node , apf0 , apf , config ) and
1886+ Stage3:: revFlowConsCand ( tc , apf0 , config ) and
1887+ Stage3:: revFlow ( node , _, _, apf , unbind ( config ) )
1888+ )
18931889 }
18941890
18951891 pragma [ nomagic]
18961892 private predicate fwdFlowRead0 (
1897- Node node1 , TypedContent tc , AccessPathFrontHead apf0 , Ap ap0 , Node node2 , Cc cc ,
1898- ApOption argAp , Configuration config
1893+ Node node1 , TypedContent tc , Ap ap0 , Node node2 , Cc cc , ApOption argAp , Configuration config
18991894 ) {
1900- fwdFlow ( node1 , cc , argAp , apf0 , ap0 , config ) and
1901- Stage3:: readCandFwd ( node1 , tc , apf0 , node2 , config )
1895+ fwdFlow ( node1 , cc , argAp , ap0 , config ) and
1896+ Stage3:: readCandFwd ( node1 , tc , ap0 . getFront ( ) , node2 , config )
19021897 }
19031898
19041899 pragma [ nomagic]
19051900 private predicate fwdFlowRead (
1906- Node node , AccessPathFrontHead apf0 , Ap ap0 , AccessPathFront apf , Cc cc , ApOption argAp ,
1907- Configuration config
1901+ Node node , Ap ap0 , AccessPathFront apf , Cc cc , ApOption argAp , Configuration config
19081902 ) {
19091903 exists ( Node mid , TypedContent tc |
1910- fwdFlowRead0 ( mid , tc , apf0 , ap0 , node , cc , argAp , config ) and
1904+ fwdFlowRead0 ( mid , tc , ap0 , node , cc , argAp , config ) and
19111905 Stage3:: revFlow ( node , _, _, apf , unbind ( config ) ) and
19121906 Stage3:: revFlowConsCand ( tc , apf , unbind ( config ) )
19131907 )
@@ -1918,18 +1912,19 @@ private module Stage4 {
19181912 TypedContent tc , AccessPathFront apf , Ap ap , Configuration config
19191913 ) {
19201914 exists ( Node n |
1921- fwdFlow ( n , _, _, apf , ap , config ) and
1922- fwdFlowStore0 ( n , tc , _, apf , _, config )
1915+ fwdFlow ( n , _, _, ap , config ) and
1916+ apf = ap .getFront ( ) and
1917+ fwdFlowStore0 ( n , tc , _, apf , config )
19231918 )
19241919 }
19251920
19261921 pragma [ nomagic]
19271922 private predicate fwdFlowIn (
1928- DataFlowCall call , ParameterNode p , Cc outercc , Cc innercc , ApOption argAp , AccessPathFront apf ,
1929- Ap ap , Configuration config
1923+ DataFlowCall call , ParameterNode p , Cc outercc , Cc innercc , ApOption argAp , Ap ap ,
1924+ Configuration config
19301925 ) {
19311926 exists ( ArgumentNode arg , boolean allowsFieldFlow , DataFlowCallable c |
1932- fwdFlow ( arg , outercc , argAp , apf , ap , config ) and
1927+ fwdFlow ( arg , outercc , argAp , ap , config ) and
19331928 flowIntoCallNodeCand2 ( call , arg , p , allowsFieldFlow , config ) and
19341929 c = p .getEnclosingCallable ( ) and
19351930 c = resolveCall ( call , outercc ) and
@@ -1944,11 +1939,11 @@ private module Stage4 {
19441939
19451940 pragma [ nomagic]
19461941 private predicate fwdFlowOut (
1947- DataFlowCall call , Node node , Cc innercc , DataFlowCallable innerc , ApOption argAp ,
1948- AccessPathFront apf , Ap ap , Configuration config
1942+ DataFlowCall call , Node node , Cc innercc , DataFlowCallable innerc , ApOption argAp , Ap ap ,
1943+ Configuration config
19491944 ) {
19501945 exists ( ReturnNodeExt ret , boolean allowsFieldFlow |
1951- fwdFlow ( ret , innercc , argAp , apf , ap , config ) and
1946+ fwdFlow ( ret , innercc , argAp , ap , config ) and
19521947 flowOutOfCallNodeCand2 ( call , ret , node , allowsFieldFlow , config ) and
19531948 innerc = ret .getEnclosingCallable ( ) and
19541949 Stage3:: revFlow ( node , _, _, _, unbind ( config ) ) and
@@ -1964,10 +1959,9 @@ private module Stage4 {
19641959
19651960 pragma [ nomagic]
19661961 private predicate fwdFlowOutFromArg (
1967- DataFlowCall call , Node node , Ap argAp , AccessPathFront apf , Ap ap , Configuration config
1962+ DataFlowCall call , Node node , Ap argAp , Ap ap , Configuration config
19681963 ) {
1969- fwdFlowOut ( call , node , any ( CallContextCall ccc ) , _, TAccessPathApproxSome ( argAp ) , apf , ap ,
1970- config )
1964+ fwdFlowOut ( call , node , any ( CallContextCall ccc ) , _, TAccessPathApproxSome ( argAp ) , ap , config )
19711965 }
19721966
19731967 /**
@@ -1977,9 +1971,9 @@ private module Stage4 {
19771971 private predicate fwdFlowIsEntered (
19781972 DataFlowCall call , Cc cc , ApOption argAp , Ap ap , Configuration config
19791973 ) {
1980- exists ( ParameterNode p , AccessPathFront apf |
1981- fwdFlowIn ( call , p , cc , _, argAp , apf , ap , config ) and
1982- Stage3:: revFlow ( p , true , TAccessPathFrontSome ( _) , apf , config )
1974+ exists ( ParameterNode p |
1975+ fwdFlowIn ( call , p , cc , _, argAp , ap , config ) and
1976+ Stage3:: revFlow ( p , true , TAccessPathFrontSome ( _) , ap . getFront ( ) , config )
19831977 )
19841978 }
19851979
@@ -1993,13 +1987,13 @@ private module Stage4 {
19931987 */
19941988 predicate revFlow ( Node node , boolean toReturn , ApOption returnAp , Ap ap , Configuration config ) {
19951989 revFlow0 ( node , toReturn , returnAp , ap , config ) and
1996- fwdFlow ( node , _, _, _ , ap , config )
1990+ fwdFlow ( node , _, _, ap , config )
19971991 }
19981992
19991993 private predicate revFlow0 (
20001994 Node node , boolean toReturn , ApOption returnAp , Ap ap , Configuration config
20011995 ) {
2002- fwdFlow ( node , _, _, _ , ap , config ) and
1996+ fwdFlow ( node , _, _, ap , config ) and
20031997 config .isSink ( node ) and
20041998 toReturn = false and
20051999 returnAp = TAccessPathApproxNone ( ) and
@@ -2011,7 +2005,7 @@ private module Stage4 {
20112005 )
20122006 or
20132007 exists ( Node mid , AccessPathApproxNil nil |
2014- fwdFlow ( node , _, _, _ , ap , config ) and
2008+ fwdFlow ( node , _, _, ap , config ) and
20152009 localFlowBigStep ( node , mid , false , _, config , _) and
20162010 revFlow ( mid , toReturn , returnAp , nil , config ) and
20172011 ap instanceof AccessPathApproxNil
@@ -2025,7 +2019,7 @@ private module Stage4 {
20252019 )
20262020 or
20272021 exists ( Node mid , AccessPathApproxNil nil |
2028- fwdFlow ( node , _, _, _ , ap , config ) and
2022+ fwdFlow ( node , _, _, ap , config ) and
20292023 additionalJumpStep ( node , mid , config ) and
20302024 revFlow ( mid , _, _, nil , config ) and
20312025 toReturn = false and
@@ -2059,7 +2053,7 @@ private module Stage4 {
20592053 // flow out of a callable
20602054 revFlowOut ( _, node , _, _, ap , config ) and
20612055 toReturn = true and
2062- if fwdFlow ( node , any ( CallContextCall ccc ) , TAccessPathApproxSome ( _) , _ , ap , config )
2056+ if fwdFlow ( node , any ( CallContextCall ccc ) , TAccessPathApproxSome ( _) , ap , config )
20632057 then returnAp = TAccessPathApproxSome ( ap )
20642058 else returnAp = TAccessPathApproxNone ( )
20652059 }
@@ -2069,7 +2063,7 @@ private module Stage4 {
20692063 Node node1 , TypedContent tc , Node node2 , Ap ap , Ap ap0 , Configuration config
20702064 ) {
20712065 storeCand2 ( node1 , tc , node2 , _, config ) and
2072- fwdFlowStore ( node2 , tc , ap , _, _, _ , config ) and
2066+ fwdFlowStore ( node2 , tc , ap , _, _, config ) and
20732067 ap0 = push ( tc , ap )
20742068 }
20752069
@@ -2089,7 +2083,8 @@ private module Stage4 {
20892083 ) {
20902084 exists ( AccessPathFrontHead apf |
20912085 Stage3:: readCandFwd ( node1 , tc , apf , node2 , config ) and
2092- fwdFlowRead ( node2 , apf , ap , _, _, _, config ) and
2086+ apf = ap .getFront ( ) and
2087+ fwdFlowRead ( node2 , ap , _, _, _, config ) and
20932088 ap0 = pop ( tc , ap ) and
20942089 fwdFlowConsCand ( tc , _, ap0 , unbind ( config ) )
20952090 )
@@ -2145,7 +2140,7 @@ private module Stage4 {
21452140 ) {
21462141 exists ( ReturnNodeExt ret , CallContextCall ccc |
21472142 revFlowOut ( call , ret , toReturn , returnAp , ap , config ) and
2148- fwdFlow ( ret , ccc , TAccessPathApproxSome ( _) , _ , ap , config ) and
2143+ fwdFlow ( ret , ccc , TAccessPathApproxSome ( _) , ap , config ) and
21492144 ccc .matchesCall ( call )
21502145 )
21512146 }
@@ -2171,15 +2166,15 @@ private predicate parameterMayFlowThrough(ParameterNode p, DataFlowCallable c, A
21712166 parameterFlow ( p , apa , apa0 , c , config ) and
21722167 c = ret .getEnclosingCallable ( ) and
21732168 Stage4:: revFlow ( ret , true , TAccessPathApproxSome ( _) , apa0 , config ) and
2174- Stage4:: fwdFlow ( ret , any ( CallContextCall ccc ) , TAccessPathApproxSome ( apa ) , _ , apa0 , config )
2169+ Stage4:: fwdFlow ( ret , any ( CallContextCall ccc ) , TAccessPathApproxSome ( apa ) , apa0 , config )
21752170 )
21762171}
21772172
21782173private predicate nodeMayUseSummary ( Node n , AccessPathApprox apa , Configuration config ) {
21792174 exists ( DataFlowCallable c , AccessPathApprox apa0 |
21802175 parameterMayFlowThrough ( _, c , apa ) and
21812176 Stage4:: revFlow ( n , true , _, apa0 , config ) and
2182- Stage4:: fwdFlow ( n , any ( CallContextCall ccc ) , TAccessPathApproxSome ( apa ) , _ , apa0 , config ) and
2177+ Stage4:: fwdFlow ( n , any ( CallContextCall ccc ) , TAccessPathApproxSome ( apa ) , apa0 , config ) and
21832178 n .getEnclosingCallable ( ) = c
21842179 )
21852180}
0 commit comments