Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 9f0499c

Browse files
author
Robert Marsh
authored
Merge pull request #2063 from jbj/dataflow-ref-parameter
C++: Data flow through reference parameters
2 parents 325dbfe + 5d7a0b8 commit 9f0499c

14 files changed

Lines changed: 305 additions & 18 deletions

File tree

‎change-notes/1.23/analysis-cpp.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ The following changes in version 1.23 affect C/C++ analysis in all applications.
3232
picture of the partial flow paths from a given source. The feature is
3333
disabled by default and can be enabled for individual configurations by
3434
overriding `int explorationLimit()`.
35+
* The data-flow library now supports flow out of C++ reference parameters.
3536
* The data-flow library now allows flow through the address-of operator (`&`).
3637
* The `DataFlow::DefinitionByReferenceNode` class now considers `f(x)` to be a
3738
definition of `x` when `x` is a variable of pointer type. It no longer

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowPrivate.qll‎

Lines changed: 48 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -51,31 +51,64 @@ class ArgumentNode extends Node {
5151
DataFlowCall getCall() { this.argumentOf(result, _) }
5252
}
5353

54-
private newtype TReturnKind = TNormalReturnKind()
54+
private newtype TReturnKind =
55+
TNormalReturnKind() or
56+
TRefReturnKind(int i) { exists(Parameter parameter | i = parameter.getIndex()) }
5557

5658
/**
5759
* A return kind. A return kind describes how a value can be returned
5860
* from a callable. For C++, this is simply a function return.
5961
*/
6062
class ReturnKind extends TReturnKind {
6163
/** Gets a textual representation of this return kind. */
62-
string toString() { result = "return" }
64+
string toString() {
65+
this instanceof TNormalReturnKind and
66+
result = "return"
67+
or
68+
this instanceof TRefReturnKind and
69+
result = "ref"
70+
}
71+
}
72+
73+
/** A data flow node that represents a returned value in the called function. */
74+
abstract class ReturnNode extends Node {
75+
/** Gets the kind of this returned value. */
76+
abstract ReturnKind getKind();
6377
}
6478

65-
/** A data flow node that occurs as the result of a `ReturnStmt`. */
66-
class ReturnNode extends ExprNode {
67-
ReturnNode() { exists(ReturnStmt ret | this.getExpr() = ret.getExpr()) }
79+
/** A `ReturnNode` that occurs as the result of a `ReturnStmt`. */
80+
private class NormalReturnNode extends ReturnNode, ExprNode {
81+
NormalReturnNode() { exists(ReturnStmt ret | this.getExpr() = ret.getExpr()) }
6882

6983
/** Gets the kind of this returned value. */
70-
ReturnKind getKind() { result = TNormalReturnKind() }
84+
override ReturnKind getKind() { result = TNormalReturnKind() }
85+
}
86+
87+
/**
88+
* A `ReturnNode` that occurs as a result of a definition of a reference
89+
* parameter reaching the end of a function body.
90+
*/
91+
private class RefReturnNode extends ReturnNode, RefParameterFinalValueNode {
92+
/** Gets the kind of this returned value. */
93+
override ReturnKind getKind() { result = TRefReturnKind(this.getParameter().getIndex()) }
7194
}
7295

73-
/** A data flow node that represents the output of a call. */
74-
class OutNode extends ExprNode {
75-
OutNode() { this.getExpr() instanceof Call }
96+
/** A data flow node that represents the output of a call at the call site. */
97+
abstract class OutNode extends Node {
98+
/** Gets the underlying call. */
99+
abstract DataFlowCall getCall();
100+
}
101+
102+
private class ExprOutNode extends OutNode, ExprNode {
103+
ExprOutNode() { this.getExpr() instanceof Call }
76104

77105
/** Gets the underlying call. */
78-
DataFlowCall getCall() { result = this.getExpr() }
106+
override DataFlowCall getCall() { result = this.getExpr() }
107+
}
108+
109+
private class RefOutNode extends OutNode, DefinitionByReferenceNode {
110+
/** Gets the underlying call. */
111+
override DataFlowCall getCall() { result = this.getArgument().getParent() }
79112
}
80113

81114
/**
@@ -85,6 +118,11 @@ class OutNode extends ExprNode {
85118
OutNode getAnOutNode(DataFlowCall call, ReturnKind kind) {
86119
result = call.getNode() and
87120
kind = TNormalReturnKind()
121+
or
122+
exists(int i |
123+
result.asDefiningArgument() = call.getArgument(i) and
124+
kind = TRefReturnKind(i)
125+
)
88126
}
89127

90128
/**

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll‎

Lines changed: 26 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,8 @@ private newtype TNode =
2525
not c.getTarget().getParameter(i).getUnderlyingType().(PointerType).getBaseType().isConst()
2626
)
2727
} or
28-
TUninitializedNode(LocalVariable v) { not v.hasInitializer() }
28+
TUninitializedNode(LocalVariable v) { not v.hasInitializer() } or
29+
TRefParameterFinalValueNode(Parameter p) { exists(FlowVar var | var.reachesRefParameter(p)) }
2930

3031
/**
3132
* A node in a data flow graph.
@@ -248,6 +249,23 @@ class UninitializedNode extends Node, TUninitializedNode {
248249
LocalVariable getLocalVariable() { result = v }
249250
}
250251

252+
/** INTERNAL: do not use. The final value of a non-const ref parameter. */
253+
class RefParameterFinalValueNode extends Node, TRefParameterFinalValueNode {
254+
Parameter p;
255+
256+
RefParameterFinalValueNode() { this = TRefParameterFinalValueNode(p) }
257+
258+
override Function getFunction() { result = p.getFunction() }
259+
260+
override Type getType() { result = p.getType() }
261+
262+
override string toString() { result = p.toString() }
263+
264+
override Location getLocation() { result = p.getLocation() }
265+
266+
Parameter getParameter() { result = p }
267+
}
268+
251269
/**
252270
* A node associated with an object after an operation that might have
253271
* changed its state.
@@ -490,7 +508,7 @@ predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo) {
490508
or
491509
var.definedPartiallyAt(nodeFrom.asPartialDefinition())
492510
) and
493-
varToExprStep(var, nodeTo.asExpr())
511+
varToNodeStep(var, nodeTo)
494512
)
495513
or
496514
// Expr -> DefinitionByReferenceNode
@@ -533,9 +551,13 @@ private predicate exprToVarStep(Expr assignedExpr, FlowVar var) {
533551
}
534552

535553
/**
536-
* Holds if the expression `e` is an access of the variable `var`.
554+
* Holds if the node `n` is an access of the variable `var`.
537555
*/
538-
private predicate varToExprStep(FlowVar var, Expr e) { e = var.getAnAccess() }
556+
private predicate varToNodeStep(FlowVar var, Node n) {
557+
n.asExpr() = var.getAnAccess()
558+
or
559+
var.reachesRefParameter(n.(RefParameterFinalValueNode).getParameter())
560+
}
539561

540562
/**
541563
* Holds if data flows from `fromExpr` to `toExpr` directly, in the case

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/FlowVar.qll‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,9 +62,20 @@ class FlowVar extends TFlowVar {
6262
cached
6363
abstract predicate definedByReference(Expr arg);
6464

65+
/**
66+
* Holds if this `FlowVar` is a `PartialDefinition` whose defined expression
67+
* is `e`.
68+
*/
6569
cached
6670
abstract predicate definedPartiallyAt(Expr e);
6771

72+
/**
73+
* Holds if this `FlowVar` is a definition of a reference parameter `p` that
74+
* persists until the function returns.
75+
*/
76+
cached
77+
abstract predicate reachesRefParameter(Parameter p);
78+
6879
/**
6980
* Holds if this `FlowVar` corresponds to the initial value of `v`. The following
7081
* is an exhaustive list of cases where this may happen.
@@ -338,6 +349,9 @@ module FlowVar_internal {
338349
param = v
339350
}
340351

352+
// `fullySupportedSsaVariable` excludes reference types
353+
override predicate reachesRefParameter(Parameter p) { none() }
354+
341355
/**
342356
* Holds if this `SsaVar` corresponds to a non-phi definition. Users of this
343357
* library will never directly use an `SsaVar` that comes from a phi node,
@@ -387,6 +401,13 @@ module FlowVar_internal {
387401
sbb = v.(Parameter).getFunction().getEntryPoint()
388402
}
389403

404+
override predicate reachesRefParameter(Parameter p) {
405+
parameterIsNonConstReference(p) and
406+
p = v and
407+
// This definition reaches the exit node of the function CFG
408+
getAReachedBlockVarSBB(this).getANode() = p.getFunction()
409+
}
410+
390411
override predicate definedByInitialValue(LocalScopeVariable lsv) {
391412
blockVarDefinedByVariable(sbb, lsv) and
392413
lsv = v
@@ -588,12 +609,23 @@ module FlowVar_internal {
588609
private predicate variableLiveInSBB(SubBasicBlock sbb, Variable v) {
589610
variableAccessInSBB(v, sbb, _)
590611
or
612+
// Non-const reference parameters are live at the end of the function
613+
parameterIsNonConstReference(v) and
614+
sbb.contains(v.(Parameter).getFunction())
615+
or
591616
exists(SubBasicBlock succ | succ = sbb.getASuccessor() |
592617
variableLiveInSBB(succ, v) and
593618
not variableNotLiveBefore(succ, v)
594619
)
595620
}
596621

622+
predicate parameterIsNonConstReference(Parameter p) {
623+
exists(ReferenceType refType |
624+
refType = p.getUnderlyingType() and
625+
not refType.getBaseType().isConst()
626+
)
627+
}
628+
597629
/**
598630
* Holds if liveness of `v` should stop propagating backwards from `sbb`.
599631
*/

‎cpp/ql/test/library-tests/dataflow/dataflow-tests/lambdas.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,5 +43,5 @@ void test_lambdas()
4343
c = source();
4444
};
4545
e(t, u, w);
46-
sink(w); // flow from source() [NOT DETECTED]
46+
sink(w); // flow from source()
4747
}

‎cpp/ql/test/library-tests/dataflow/dataflow-tests/ref.cpp‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
int source();
2+
3+
template<typename T>
4+
void sink(T);
5+
6+
extern int arbitrary;
7+
8+
namespace withoutFields {
9+
template<typename T>
10+
void assign(T &lhs, T rhs) {
11+
lhs = rhs;
12+
}
13+
14+
template<typename T>
15+
void assignWrapper(T &lhs, T rhs) {
16+
assign(lhs, rhs);
17+
}
18+
19+
void notAssign(int &lhs, int rhs) {
20+
lhs = rhs;
21+
if (arbitrary) {
22+
lhs = 1;
23+
} else {
24+
lhs = 2;
25+
}
26+
}
27+
28+
void sourceToParam(int &out) {
29+
out = source();
30+
if (arbitrary) {
31+
out = 1;
32+
}
33+
}
34+
35+
void sourceToParamWrapper(int &out) {
36+
if (arbitrary) {
37+
sourceToParam(out);
38+
} else {
39+
out = 1;
40+
}
41+
}
42+
43+
void notSource(int &out) {
44+
out = source();
45+
if (arbitrary) {
46+
out = 1;
47+
} else {
48+
out = 2;
49+
}
50+
}
51+
52+
void testRefs() {
53+
int x1, x2, x3, x4;
54+
55+
assignWrapper(x1, source());
56+
sink(x1); // flow [FALSE POSITIVE from uninitialized]
57+
58+
notAssign(x2, source());
59+
sink(x2); // no flow [FALSE POSITIVE from uninitialized]
60+
61+
sourceToParamWrapper(x3);
62+
sink(x3); // flow [FALSE POSITIVE from uninitialized]
63+
64+
notSource(x4);
65+
sink(x4); // no flow [FALSE POSITIVE from uninitialized]
66+
}
67+
}
68+
69+
namespace withFields {
70+
struct Int {
71+
int val;
72+
};
73+
74+
void assign(Int &lhs, int rhs) {
75+
lhs.val = rhs;
76+
}
77+
78+
void assignWrapper(Int &lhs, int rhs) {
79+
assign(lhs, rhs);
80+
}
81+
82+
void notAssign(Int &lhs, int rhs) {
83+
lhs.val = rhs;
84+
// Field flow ignores that the field is subsequently overwritten, leading
85+
// to false flow here.
86+
if (arbitrary) {
87+
lhs.val = 1;
88+
} else {
89+
lhs.val = 2;
90+
}
91+
}
92+
93+
void sourceToParam(Int &out) {
94+
out.val = source();
95+
if (arbitrary) {
96+
out.val = 1;
97+
}
98+
}
99+
100+
void sourceToParamWrapper(Int &out) {
101+
if (arbitrary) {
102+
sourceToParam(out);
103+
} else {
104+
out.val = 1;
105+
}
106+
}
107+
108+
void notSource(Int &out) {
109+
out.val = source();
110+
// Field flow ignores that the field is subsequently overwritten, leading
111+
// to false flow here.
112+
if (arbitrary) {
113+
out.val = 1;
114+
} else {
115+
out.val = 2;
116+
}
117+
}
118+
119+
void testRefs() {
120+
Int x1, x2, x3, x4;
121+
122+
assignWrapper(x1, source());
123+
sink(x1.val); // flow
124+
125+
notAssign(x2, source());
126+
sink(x2.val); // no flow [FALSE POSITIVE]
127+
128+
sourceToParamWrapper(x3);
129+
sink(x3.val); // flow
130+
131+
notSource(x4);
132+
sink(x4.val); // no flow [FALSE POSITIVE]
133+
}
134+
}

‎cpp/ql/test/library-tests/dataflow/dataflow-tests/test.expected‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,17 @@
1111
| lambdas.cpp:29:3:29:6 | t | lambdas.cpp:8:10:8:15 | call to source |
1212
| lambdas.cpp:35:8:35:8 | a | lambdas.cpp:8:10:8:15 | call to source |
1313
| lambdas.cpp:41:8:41:8 | a | lambdas.cpp:8:10:8:15 | call to source |
14+
| lambdas.cpp:46:7:46:7 | w | lambdas.cpp:43:7:43:12 | call to source |
15+
| ref.cpp:56:10:56:11 | x1 | ref.cpp:53:9:53:10 | x1 |
16+
| ref.cpp:56:10:56:11 | x1 | ref.cpp:55:23:55:28 | call to source |
17+
| ref.cpp:59:10:59:11 | x2 | ref.cpp:53:13:53:14 | x2 |
18+
| ref.cpp:62:10:62:11 | x3 | ref.cpp:29:11:29:16 | call to source |
19+
| ref.cpp:62:10:62:11 | x3 | ref.cpp:53:17:53:18 | x3 |
20+
| ref.cpp:65:10:65:11 | x4 | ref.cpp:53:21:53:22 | x4 |
21+
| ref.cpp:123:13:123:15 | val | ref.cpp:122:23:122:28 | call to source |
22+
| ref.cpp:126:13:126:15 | val | ref.cpp:125:19:125:24 | call to source |
23+
| ref.cpp:129:13:129:15 | val | ref.cpp:94:15:94:20 | call to source |
24+
| ref.cpp:132:13:132:15 | val | ref.cpp:109:15:109:20 | call to source |
1425
| test.cpp:7:8:7:9 | t1 | test.cpp:6:12:6:17 | call to source |
1526
| test.cpp:9:8:9:9 | t1 | test.cpp:6:12:6:17 | call to source |
1627
| test.cpp:10:8:10:9 | t2 | test.cpp:6:12:6:17 | call to source |

0 commit comments

Comments
 (0)