Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 97c11a5

Browse files
author
Robert Marsh
committed
C++: points-to for argument-returning calls
1 parent 878502f commit 97c11a5

3 files changed

Lines changed: 45 additions & 33 deletions

File tree

‎cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll‎

Lines changed: 19 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -161,7 +161,7 @@ private predicate operandEscapesNonReturn(Operand operand) {
161161
exists(CallInstruction ci, Instruction init |
162162
isArgumentForParameter(ci, operand, init) and
163163
(
164-
resultReturned(init) and
164+
resultReturned(init, _) and
165165
resultEscapesNonReturn(ci)
166166
or
167167
resultEscapesNonReturn(init)
@@ -173,21 +173,29 @@ private predicate operandEscapesNonReturn(Operand operand) {
173173
operandEscapesDomain(operand)
174174
}
175175

176-
private predicate operandReturned(Operand operand) {
176+
private predicate operandReturned(Operand operand, IntValue bitOffset) {
177177
// The address is propagated to the result of the instruction, and that result itself is returned
178-
operandIsPropagated(operand, _) and resultReturned(operand.getUseInstruction())
178+
exists(IntValue bitOffset1, IntValue bitOffset2 |
179+
operandIsPropagated(operand, bitOffset1) and
180+
resultReturned(operand.getUseInstruction(), bitOffset2) and
181+
bitOffset = bitOffset1 + bitOffset2
182+
)
179183
or
180184
// The operand is used in a function call which returns it, and the return value is then returned
181-
exists(CallInstruction ci, Instruction init |
185+
exists(CallInstruction ci, Instruction init, IntValue bitOffset1, IntValue bitOffset2 |
182186
isArgumentForParameter(ci, operand, init) and
183-
resultReturned(init) and
184-
resultReturned(ci)
187+
resultReturned(init, bitOffset1) and
188+
resultReturned(ci, bitOffset2) and
189+
bitOffset = bitOffset1 + bitOffset2
190+
185191
)
186192
or
187193
// The address is returned
188-
operand.getUseInstruction() instanceof ReturnValueInstruction
194+
operand.getUseInstruction() instanceof ReturnValueInstruction and
195+
bitOffset = 0
189196
or
190-
isOnlyEscapesViaReturnArgument(operand) and resultReturned(operand.getUseInstruction())
197+
isOnlyEscapesViaReturnArgument(operand) and resultReturned(operand.getUseInstruction(), _) and
198+
bitOffset = Ints::unknown()
191199
}
192200

193201
private predicate isArgumentForParameter(CallInstruction ci, Operand operand, Instruction init) {
@@ -227,8 +235,8 @@ private predicate isNeverEscapesArgument(Operand operand) {
227235
)
228236
}
229237

230-
private predicate resultReturned(Instruction instr) {
231-
operandReturned(instr.getAUse())
238+
private predicate resultReturned(Instruction instr, IntValue bitOffset) {
239+
operandReturned(instr.getAUse(), bitOffset)
232240
}
233241

234242
/**
@@ -284,8 +292,7 @@ predicate resultPointsTo(Instruction instr, IRVariable var, IntValue bitOffset)
284292
or
285293
exists(CallInstruction ci, Instruction init |
286294
isArgumentForParameter(ci, operand, init) and
287-
resultReturned(init) and
288-
propagatedBitOffset = Ints::unknown()
295+
resultReturned(init, propagatedBitOffset)
289296
)
290297
) and
291298
bitOffset = Ints::add(originalBitOffset, propagatedBitOffset)

‎cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll‎

Lines changed: 19 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -161,7 +161,7 @@ private predicate operandEscapesNonReturn(Operand operand) {
161161
exists(CallInstruction ci, Instruction init |
162162
isArgumentForParameter(ci, operand, init) and
163163
(
164-
resultReturned(init) and
164+
resultReturned(init, _) and
165165
resultEscapesNonReturn(ci)
166166
or
167167
resultEscapesNonReturn(init)
@@ -173,21 +173,29 @@ private predicate operandEscapesNonReturn(Operand operand) {
173173
operandEscapesDomain(operand)
174174
}
175175

176-
private predicate operandReturned(Operand operand) {
176+
private predicate operandReturned(Operand operand, IntValue bitOffset) {
177177
// The address is propagated to the result of the instruction, and that result itself is returned
178-
operandIsPropagated(operand, _) and resultReturned(operand.getUseInstruction())
178+
exists(IntValue bitOffset1, IntValue bitOffset2 |
179+
operandIsPropagated(operand, bitOffset1) and
180+
resultReturned(operand.getUseInstruction(), bitOffset2) and
181+
bitOffset = bitOffset1 + bitOffset2
182+
)
179183
or
180184
// The operand is used in a function call which returns it, and the return value is then returned
181-
exists(CallInstruction ci, Instruction init |
185+
exists(CallInstruction ci, Instruction init, IntValue bitOffset1, IntValue bitOffset2 |
182186
isArgumentForParameter(ci, operand, init) and
183-
resultReturned(init) and
184-
resultReturned(ci)
187+
resultReturned(init, bitOffset1) and
188+
resultReturned(ci, bitOffset2) and
189+
bitOffset = bitOffset1 + bitOffset2
190+
185191
)
186192
or
187193
// The address is returned
188-
operand.getUseInstruction() instanceof ReturnValueInstruction
194+
operand.getUseInstruction() instanceof ReturnValueInstruction and
195+
bitOffset = 0
189196
or
190-
isOnlyEscapesViaReturnArgument(operand) and resultReturned(operand.getUseInstruction())
197+
isOnlyEscapesViaReturnArgument(operand) and resultReturned(operand.getUseInstruction(), _) and
198+
bitOffset = Ints::unknown()
191199
}
192200

193201
private predicate isArgumentForParameter(CallInstruction ci, Operand operand, Instruction init) {
@@ -227,8 +235,8 @@ private predicate isNeverEscapesArgument(Operand operand) {
227235
)
228236
}
229237

230-
private predicate resultReturned(Instruction instr) {
231-
operandReturned(instr.getAUse())
238+
private predicate resultReturned(Instruction instr, IntValue bitOffset) {
239+
operandReturned(instr.getAUse(), bitOffset)
232240
}
233241

234242
/**
@@ -284,8 +292,7 @@ predicate resultPointsTo(Instruction instr, IRVariable var, IntValue bitOffset)
284292
or
285293
exists(CallInstruction ci, Instruction init |
286294
isArgumentForParameter(ci, operand, init) and
287-
resultReturned(init) and
288-
propagatedBitOffset = Ints::unknown()
295+
resultReturned(init, propagatedBitOffset)
289296
)
290297
) and
291298
bitOffset = Ints::add(originalBitOffset, propagatedBitOffset)

‎cpp/ql/test/library-tests/ir/escape/points_to.expected‎

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -140,10 +140,10 @@
140140
| escape.cpp:187:9:187:18 | VariableAddress[passByRef2] | passByRef2+0:0 | passByRef2+0:0 |
141141
| escape.cpp:188:32:188:41 | VariableAddress[passByRef2] | passByRef2+0:0 | passByRef2+0:0 |
142142
| escape.cpp:190:9:190:18 | VariableAddress[passByPtr3] | passByPtr3+0:0 | passByPtr3+0:0 |
143-
| escape.cpp:191:30:191:42 | Call | none | passByPtr3+? |
143+
| escape.cpp:191:30:191:42 | Call | none | passByPtr3+0:0 |
144144
| escape.cpp:191:45:191:54 | VariableAddress[passByPtr3] | passByPtr3+0:0 | passByPtr3+0:0 |
145145
| escape.cpp:193:9:193:18 | VariableAddress[passByRef3] | passByRef3+0:0 | passByRef3+0:0 |
146-
| escape.cpp:194:32:194:46 | Call | none | passByRef3+? |
146+
| escape.cpp:194:32:194:46 | Call | none | passByRef3+0:0 |
147147
| escape.cpp:194:48:194:57 | VariableAddress[passByRef3] | passByRef3+0:0 | passByRef3+0:0 |
148148
| escape.cpp:196:9:196:18 | VariableAddress[passByPtr4] | passByPtr4+0:0 | passByPtr4+0:0 |
149149
| escape.cpp:197:9:197:18 | VariableAddress[passByPtr5] | passByPtr5+0:0 | passByPtr5+0:0 |
@@ -152,32 +152,30 @@
152152
| escape.cpp:199:31:199:40 | VariableAddress[passByPtr5] | passByPtr5+0:0 | passByPtr5+0:0 |
153153
| escape.cpp:199:43:199:47 | VariableAddress[no_b2] | no_b2+0:0 | no_b2+0:0 |
154154
| escape.cpp:201:9:201:18 | VariableAddress[passByRef6] | passByRef6+0:0 | passByRef6+0:0 |
155-
| escape.cpp:202:5:202:19 | Call | none | passByRef6+? |
155+
| escape.cpp:202:5:202:19 | Call | none | passByRef6+0:0 |
156156
| escape.cpp:202:21:202:30 | VariableAddress[passByRef6] | passByRef6+0:0 | passByRef6+0:0 |
157157
| escape.cpp:204:9:204:25 | VariableAddress[no_ssa_passByRef7] | no_ssa_passByRef7+0:0 | no_ssa_passByRef7+0:0 |
158-
| escape.cpp:205:5:205:19 | Call | none | no_ssa_passByRef7+? |
158+
| escape.cpp:205:5:205:19 | Call | none | no_ssa_passByRef7+0:0 |
159159
| escape.cpp:205:21:205:37 | VariableAddress[no_ssa_passByRef7] | no_ssa_passByRef7+0:0 | no_ssa_passByRef7+0:0 |
160160
| escape.cpp:207:7:207:14 | VariableAddress[no_ssa_c] | no_ssa_c+0:0 | no_ssa_c+0:0 |
161161
| escape.cpp:209:5:209:12 | VariableAddress[no_ssa_c] | no_ssa_c+0:0 | no_ssa_c+0:0 |
162-
| escape.cpp:209:14:209:25 | Call | none | no_ssa_c+? |
162+
| escape.cpp:209:14:209:25 | Call | none | no_ssa_c+0:0 |
163163
| escape.cpp:211:7:211:7 | VariableAddress[c] | c+0:0 | c+0:0 |
164164
| escape.cpp:213:5:213:5 | VariableAddress[c] | c+0:0 | c+0:0 |
165165
| escape.cpp:215:7:215:8 | VariableAddress[c2] | c2+0:0 | c2+0:0 |
166166
| escape.cpp:217:15:217:16 | VariableAddress[c2] | c2+0:0 | c2+0:0 |
167167
| escape.cpp:219:7:219:8 | VariableAddress[c3] | c3+0:0 | c3+0:0 |
168168
| escape.cpp:221:5:221:6 | VariableAddress[c3] | c3+0:0 | c3+0:0 |
169-
| escape.cpp:221:8:221:19 | Call | none | c3+? |
169+
| escape.cpp:221:8:221:19 | Call | none | c3+0:0 |
170170
| escape.cpp:223:7:223:8 | VariableAddress[c4] | c4+0:0 | c4+0:0 |
171171
| escape.cpp:225:14:225:15 | VariableAddress[c4] | c4+0:0 | c4+0:0 |
172-
| escape.cpp:225:17:225:28 | Call | none | c4+? |
172+
| escape.cpp:225:17:225:28 | Call | none | c4+0:0 |
173173
| escape.cpp:227:7:227:8 | VariableAddress[c5] | c5+0:0 | c5+0:0 |
174174
| escape.cpp:229:5:229:6 | VariableAddress[c5] | c5+0:0 | c5+0:0 |
175175
| escape.cpp:231:21:231:23 | VariableAddress[or1] | or1+0:0 | or1+0:0 |
176176
| escape.cpp:232:5:232:7 | VariableAddress[or1] | or1+0:0 | or1+0:0 |
177-
| escape.cpp:232:9:232:18 | Call | none | or1+? |
178177
| escape.cpp:234:21:234:23 | VariableAddress[or2] | or2+0:0 | or2+0:0 |
179178
| escape.cpp:235:14:235:16 | VariableAddress[or2] | or2+0:0 | or2+0:0 |
180-
| escape.cpp:235:18:235:27 | Call | none | or2+? |
181179
| escape.cpp:237:18:237:20 | VariableAddress[on1] | on1+0:0 | on1+0:0 |
182180
| escape.cpp:238:5:238:7 | VariableAddress[on1] | on1+0:0 | on1+0:0 |
183181
| escape.cpp:240:18:240:20 | VariableAddress[on2] | on2+0:0 | on2+0:0 |

0 commit comments

Comments
 (0)