Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit a23d5af

Browse files
author
Dave Bartolomeo
committed
C++: Add test case to demonstrate string literl aliasing change
Also fixed a minor bug where we should have been treating `AllNonLocalMemory` as _totally_ overlapping an access to a non-local variable, rather than _partially_ overlapping it. This fix is exhibited both in the new test case and in a couple existing test functions in `ssa.cpp`.
1 parent fd2cafa commit a23d5af

6 files changed

Lines changed: 211 additions & 11 deletions

File tree

‎cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasedSSA.qll‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -403,11 +403,15 @@ private Overlap getExtentOverlap(MemoryLocation def, MemoryLocation use) {
403403
use instanceof AllNonLocalMemory and
404404
result instanceof MustExactlyOverlap
405405
or
406-
// AllNonLocalMemory may partially overlap any other location within the same virtual
407-
// variable, except a stack variable.
408406
not use instanceof AllNonLocalMemory and
409407
not use.isAlwaysAllocatedOnStack() and
410-
result instanceof MayPartiallyOverlap
408+
if use instanceof VariableMemoryLocation then
409+
// AllNonLocalMemory totally overlaps any non-local variable.
410+
result instanceof MustTotallyOverlap
411+
else
412+
// AllNonLocalMemory may partially overlap any other location within the same virtual
413+
// variable, except a stack variable.
414+
result instanceof MayPartiallyOverlap
411415
)
412416
or
413417
def.getVirtualVariable() = use.getVirtualVariable() and

‎cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected‎

Lines changed: 52 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -963,15 +963,15 @@ ssa.cpp:
963963
# 213| mu213_5(unknown) = UnmodeledDefinition :
964964
# 214| r214_1(glval<char[32]>) = VariableAddress[a_pad] :
965965
# 214| r214_2(glval<char[32]>) = StringConstant[""] :
966-
# 214| r214_3(char[32]) = Load : &:r214_2, ~m213_4
966+
# 214| r214_3(char[32]) = Load : &:r214_2, ~m213_3
967967
# 214| m214_4(char[32]) = Store : &:r214_1, r214_3
968968
# 215| r215_1(glval<char[4]>) = VariableAddress[a_nopad] :
969969
# 215| r215_2(glval<char[4]>) = StringConstant["foo"] :
970-
# 215| r215_3(char[4]) = Load : &:r215_2, ~m213_4
970+
# 215| r215_3(char[4]) = Load : &:r215_2, ~m213_3
971971
# 215| m215_4(char[4]) = Store : &:r215_1, r215_3
972972
# 216| r216_1(glval<char[5]>) = VariableAddress[a_infer] :
973973
# 216| r216_2(glval<char[5]>) = StringConstant["blah"] :
974-
# 216| r216_3(char[5]) = Load : &:r216_2, ~m213_4
974+
# 216| r216_3(char[5]) = Load : &:r216_2, ~m213_3
975975
# 216| m216_4(char[5]) = Store : &:r216_1, r216_3
976976
# 217| r217_1(glval<char[2]>) = VariableAddress[b] :
977977
# 217| m217_2(char[2]) = Uninitialized[b] : &:r217_1
@@ -1043,7 +1043,7 @@ ssa.cpp:
10431043
# 230| r230_3(char *) = Load : &:r230_2, m229_4
10441044
# 230| r230_4(int) = Constant[2] :
10451045
# 230| r230_5(glval<char>) = PointerAdd[1] : r230_3, r230_4
1046-
# 230| r230_6(char) = Load : &:r230_5, ~m226_4
1046+
# 230| r230_6(char) = Load : &:r230_5, ~m226_3
10471047
# 230| m230_7(char) = Store : &:r230_1, r230_6
10481048
# 226| r226_6(glval<char>) = VariableAddress[#return] :
10491049
# 226| v226_7(void) = ReturnValue : &:r226_6, m230_7
@@ -1135,3 +1135,51 @@ ssa.cpp:
11351135
# 239| v239_7(void) = UnmodeledUse : mu*
11361136
# 239| v239_8(void) = AliasedUse : ~m244_5
11371137
# 239| v239_9(void) = ExitFunction :
1138+
1139+
# 247| char StringLiteralAliasing2(bool)
1140+
# 247| Block 0
1141+
# 247| v247_1(void) = EnterFunction :
1142+
# 247| m247_2(unknown) = AliasedDefinition :
1143+
# 247| m247_3(unknown) = InitializeNonLocal :
1144+
# 247| m247_4(unknown) = Chi : total:m247_2, partial:m247_3
1145+
# 247| mu247_5(unknown) = UnmodeledDefinition :
1146+
# 247| r247_6(glval<bool>) = VariableAddress[b] :
1147+
# 247| m247_7(bool) = InitializeParameter[b] : &:r247_6
1148+
# 248| r248_1(glval<bool>) = VariableAddress[b] :
1149+
# 248| r248_2(bool) = Load : &:r248_1, m247_7
1150+
# 248| v248_3(void) = ConditionalBranch : r248_2
1151+
#-----| False -> Block 2
1152+
#-----| True -> Block 1
1153+
1154+
# 249| Block 1
1155+
# 249| r249_1(glval<unknown>) = FunctionAddress[ExternalFunc] :
1156+
# 249| v249_2(void) = Call : func:r249_1
1157+
# 249| m249_3(unknown) = ^CallSideEffect : ~m247_4
1158+
# 249| m249_4(unknown) = Chi : total:m247_4, partial:m249_3
1159+
#-----| Goto -> Block 3
1160+
1161+
# 252| Block 2
1162+
# 252| r252_1(glval<unknown>) = FunctionAddress[ExternalFunc] :
1163+
# 252| v252_2(void) = Call : func:r252_1
1164+
# 252| m252_3(unknown) = ^CallSideEffect : ~m247_4
1165+
# 252| m252_4(unknown) = Chi : total:m247_4, partial:m252_3
1166+
#-----| Goto -> Block 3
1167+
1168+
# 255| Block 3
1169+
# 255| m255_1(unknown) = Phi : from 1:~m249_4, from 2:~m252_4
1170+
# 255| r255_2(glval<char *>) = VariableAddress[s] :
1171+
# 255| r255_3(glval<char[8]>) = StringConstant["Literal"] :
1172+
# 255| r255_4(char *) = Convert : r255_3
1173+
# 255| m255_5(char *) = Store : &:r255_2, r255_4
1174+
# 256| r256_1(glval<char>) = VariableAddress[#return] :
1175+
# 256| r256_2(glval<char *>) = VariableAddress[s] :
1176+
# 256| r256_3(char *) = Load : &:r256_2, m255_5
1177+
# 256| r256_4(int) = Constant[2] :
1178+
# 256| r256_5(glval<char>) = PointerAdd[1] : r256_3, r256_4
1179+
# 256| r256_6(char) = Load : &:r256_5, ~m247_3
1180+
# 256| m256_7(char) = Store : &:r256_1, r256_6
1181+
# 247| r247_8(glval<char>) = VariableAddress[#return] :
1182+
# 247| v247_9(void) = ReturnValue : &:r247_8, m256_7
1183+
# 247| v247_10(void) = UnmodeledUse : mu*
1184+
# 247| v247_11(void) = AliasedUse : ~m255_1
1185+
# 247| v247_12(void) = ExitFunction :

‎cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir_unsound.expected‎

Lines changed: 52 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -958,15 +958,15 @@ ssa.cpp:
958958
# 213| mu213_5(unknown) = UnmodeledDefinition :
959959
# 214| r214_1(glval<char[32]>) = VariableAddress[a_pad] :
960960
# 214| r214_2(glval<char[32]>) = StringConstant[""] :
961-
# 214| r214_3(char[32]) = Load : &:r214_2, ~m213_4
961+
# 214| r214_3(char[32]) = Load : &:r214_2, ~m213_3
962962
# 214| m214_4(char[32]) = Store : &:r214_1, r214_3
963963
# 215| r215_1(glval<char[4]>) = VariableAddress[a_nopad] :
964964
# 215| r215_2(glval<char[4]>) = StringConstant["foo"] :
965-
# 215| r215_3(char[4]) = Load : &:r215_2, ~m213_4
965+
# 215| r215_3(char[4]) = Load : &:r215_2, ~m213_3
966966
# 215| m215_4(char[4]) = Store : &:r215_1, r215_3
967967
# 216| r216_1(glval<char[5]>) = VariableAddress[a_infer] :
968968
# 216| r216_2(glval<char[5]>) = StringConstant["blah"] :
969-
# 216| r216_3(char[5]) = Load : &:r216_2, ~m213_4
969+
# 216| r216_3(char[5]) = Load : &:r216_2, ~m213_3
970970
# 216| m216_4(char[5]) = Store : &:r216_1, r216_3
971971
# 217| r217_1(glval<char[2]>) = VariableAddress[b] :
972972
# 217| m217_2(char[2]) = Uninitialized[b] : &:r217_1
@@ -1038,7 +1038,7 @@ ssa.cpp:
10381038
# 230| r230_3(char *) = Load : &:r230_2, m229_4
10391039
# 230| r230_4(int) = Constant[2] :
10401040
# 230| r230_5(glval<char>) = PointerAdd[1] : r230_3, r230_4
1041-
# 230| r230_6(char) = Load : &:r230_5, ~m226_4
1041+
# 230| r230_6(char) = Load : &:r230_5, ~m226_3
10421042
# 230| m230_7(char) = Store : &:r230_1, r230_6
10431043
# 226| r226_6(glval<char>) = VariableAddress[#return] :
10441044
# 226| v226_7(void) = ReturnValue : &:r226_6, m230_7
@@ -1130,3 +1130,51 @@ ssa.cpp:
11301130
# 239| v239_7(void) = UnmodeledUse : mu*
11311131
# 239| v239_8(void) = AliasedUse : ~m244_5
11321132
# 239| v239_9(void) = ExitFunction :
1133+
1134+
# 247| char StringLiteralAliasing2(bool)
1135+
# 247| Block 0
1136+
# 247| v247_1(void) = EnterFunction :
1137+
# 247| m247_2(unknown) = AliasedDefinition :
1138+
# 247| m247_3(unknown) = InitializeNonLocal :
1139+
# 247| m247_4(unknown) = Chi : total:m247_2, partial:m247_3
1140+
# 247| mu247_5(unknown) = UnmodeledDefinition :
1141+
# 247| r247_6(glval<bool>) = VariableAddress[b] :
1142+
# 247| m247_7(bool) = InitializeParameter[b] : &:r247_6
1143+
# 248| r248_1(glval<bool>) = VariableAddress[b] :
1144+
# 248| r248_2(bool) = Load : &:r248_1, m247_7
1145+
# 248| v248_3(void) = ConditionalBranch : r248_2
1146+
#-----| False -> Block 2
1147+
#-----| True -> Block 1
1148+
1149+
# 249| Block 1
1150+
# 249| r249_1(glval<unknown>) = FunctionAddress[ExternalFunc] :
1151+
# 249| v249_2(void) = Call : func:r249_1
1152+
# 249| m249_3(unknown) = ^CallSideEffect : ~m247_4
1153+
# 249| m249_4(unknown) = Chi : total:m247_4, partial:m249_3
1154+
#-----| Goto -> Block 3
1155+
1156+
# 252| Block 2
1157+
# 252| r252_1(glval<unknown>) = FunctionAddress[ExternalFunc] :
1158+
# 252| v252_2(void) = Call : func:r252_1
1159+
# 252| m252_3(unknown) = ^CallSideEffect : ~m247_4
1160+
# 252| m252_4(unknown) = Chi : total:m247_4, partial:m252_3
1161+
#-----| Goto -> Block 3
1162+
1163+
# 255| Block 3
1164+
# 255| m255_1(unknown) = Phi : from 1:~m249_4, from 2:~m252_4
1165+
# 255| r255_2(glval<char *>) = VariableAddress[s] :
1166+
# 255| r255_3(glval<char[8]>) = StringConstant["Literal"] :
1167+
# 255| r255_4(char *) = Convert : r255_3
1168+
# 255| m255_5(char *) = Store : &:r255_2, r255_4
1169+
# 256| r256_1(glval<char>) = VariableAddress[#return] :
1170+
# 256| r256_2(glval<char *>) = VariableAddress[s] :
1171+
# 256| r256_3(char *) = Load : &:r256_2, m255_5
1172+
# 256| r256_4(int) = Constant[2] :
1173+
# 256| r256_5(glval<char>) = PointerAdd[1] : r256_3, r256_4
1174+
# 256| r256_6(char) = Load : &:r256_5, ~m247_3
1175+
# 256| m256_7(char) = Store : &:r256_1, r256_6
1176+
# 247| r247_8(glval<char>) = VariableAddress[#return] :
1177+
# 247| v247_9(void) = ReturnValue : &:r247_8, m256_7
1178+
# 247| v247_10(void) = UnmodeledUse : mu*
1179+
# 247| v247_11(void) = AliasedUse : ~m255_1
1180+
# 247| v247_12(void) = ExitFunction :

‎cpp/ql/test/library-tests/ir/ssa/ssa.cpp‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -243,3 +243,15 @@ void ExplicitConstructorCalls() {
243243
Constructible c2 = Constructible(2);
244244
c2.g();
245245
}
246+
247+
char StringLiteralAliasing2(bool b) {
248+
if (b) {
249+
ExternalFunc();
250+
}
251+
else {
252+
ExternalFunc();
253+
}
254+
255+
const char* s = "Literal";
256+
return s[2];
257+
}

‎cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1052,3 +1052,47 @@ ssa.cpp:
10521052
# 239| v239_6(void) = UnmodeledUse : mu*
10531053
# 239| v239_7(void) = AliasedUse : ~mu239_4
10541054
# 239| v239_8(void) = ExitFunction :
1055+
1056+
# 247| char StringLiteralAliasing2(bool)
1057+
# 247| Block 0
1058+
# 247| v247_1(void) = EnterFunction :
1059+
# 247| mu247_2(unknown) = AliasedDefinition :
1060+
# 247| mu247_3(unknown) = InitializeNonLocal :
1061+
# 247| mu247_4(unknown) = UnmodeledDefinition :
1062+
# 247| r247_5(glval<bool>) = VariableAddress[b] :
1063+
# 247| m247_6(bool) = InitializeParameter[b] : &:r247_5
1064+
# 248| r248_1(glval<bool>) = VariableAddress[b] :
1065+
# 248| r248_2(bool) = Load : &:r248_1, m247_6
1066+
# 248| v248_3(void) = ConditionalBranch : r248_2
1067+
#-----| False -> Block 2
1068+
#-----| True -> Block 1
1069+
1070+
# 249| Block 1
1071+
# 249| r249_1(glval<unknown>) = FunctionAddress[ExternalFunc] :
1072+
# 249| v249_2(void) = Call : func:r249_1
1073+
# 249| mu249_3(unknown) = ^CallSideEffect : ~mu247_4
1074+
#-----| Goto -> Block 3
1075+
1076+
# 252| Block 2
1077+
# 252| r252_1(glval<unknown>) = FunctionAddress[ExternalFunc] :
1078+
# 252| v252_2(void) = Call : func:r252_1
1079+
# 252| mu252_3(unknown) = ^CallSideEffect : ~mu247_4
1080+
#-----| Goto -> Block 3
1081+
1082+
# 255| Block 3
1083+
# 255| r255_1(glval<char *>) = VariableAddress[s] :
1084+
# 255| r255_2(glval<char[8]>) = StringConstant["Literal"] :
1085+
# 255| r255_3(char *) = Convert : r255_2
1086+
# 255| m255_4(char *) = Store : &:r255_1, r255_3
1087+
# 256| r256_1(glval<char>) = VariableAddress[#return] :
1088+
# 256| r256_2(glval<char *>) = VariableAddress[s] :
1089+
# 256| r256_3(char *) = Load : &:r256_2, m255_4
1090+
# 256| r256_4(int) = Constant[2] :
1091+
# 256| r256_5(glval<char>) = PointerAdd[1] : r256_3, r256_4
1092+
# 256| r256_6(char) = Load : &:r256_5, ~mu247_4
1093+
# 256| m256_7(char) = Store : &:r256_1, r256_6
1094+
# 247| r247_7(glval<char>) = VariableAddress[#return] :
1095+
# 247| v247_8(void) = ReturnValue : &:r247_7, m256_7
1096+
# 247| v247_9(void) = UnmodeledUse : mu*
1097+
# 247| v247_10(void) = AliasedUse : ~mu247_4
1098+
# 247| v247_11(void) = ExitFunction :

‎cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir_unsound.expected‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1052,3 +1052,47 @@ ssa.cpp:
10521052
# 239| v239_6(void) = UnmodeledUse : mu*
10531053
# 239| v239_7(void) = AliasedUse : ~mu239_4
10541054
# 239| v239_8(void) = ExitFunction :
1055+
1056+
# 247| char StringLiteralAliasing2(bool)
1057+
# 247| Block 0
1058+
# 247| v247_1(void) = EnterFunction :
1059+
# 247| mu247_2(unknown) = AliasedDefinition :
1060+
# 247| mu247_3(unknown) = InitializeNonLocal :
1061+
# 247| mu247_4(unknown) = UnmodeledDefinition :
1062+
# 247| r247_5(glval<bool>) = VariableAddress[b] :
1063+
# 247| m247_6(bool) = InitializeParameter[b] : &:r247_5
1064+
# 248| r248_1(glval<bool>) = VariableAddress[b] :
1065+
# 248| r248_2(bool) = Load : &:r248_1, m247_6
1066+
# 248| v248_3(void) = ConditionalBranch : r248_2
1067+
#-----| False -> Block 2
1068+
#-----| True -> Block 1
1069+
1070+
# 249| Block 1
1071+
# 249| r249_1(glval<unknown>) = FunctionAddress[ExternalFunc] :
1072+
# 249| v249_2(void) = Call : func:r249_1
1073+
# 249| mu249_3(unknown) = ^CallSideEffect : ~mu247_4
1074+
#-----| Goto -> Block 3
1075+
1076+
# 252| Block 2
1077+
# 252| r252_1(glval<unknown>) = FunctionAddress[ExternalFunc] :
1078+
# 252| v252_2(void) = Call : func:r252_1
1079+
# 252| mu252_3(unknown) = ^CallSideEffect : ~mu247_4
1080+
#-----| Goto -> Block 3
1081+
1082+
# 255| Block 3
1083+
# 255| r255_1(glval<char *>) = VariableAddress[s] :
1084+
# 255| r255_2(glval<char[8]>) = StringConstant["Literal"] :
1085+
# 255| r255_3(char *) = Convert : r255_2
1086+
# 255| m255_4(char *) = Store : &:r255_1, r255_3
1087+
# 256| r256_1(glval<char>) = VariableAddress[#return] :
1088+
# 256| r256_2(glval<char *>) = VariableAddress[s] :
1089+
# 256| r256_3(char *) = Load : &:r256_2, m255_4
1090+
# 256| r256_4(int) = Constant[2] :
1091+
# 256| r256_5(glval<char>) = PointerAdd[1] : r256_3, r256_4
1092+
# 256| r256_6(char) = Load : &:r256_5, ~mu247_4
1093+
# 256| m256_7(char) = Store : &:r256_1, r256_6
1094+
# 247| r247_7(glval<char>) = VariableAddress[#return] :
1095+
# 247| v247_8(void) = ReturnValue : &:r247_7, m256_7
1096+
# 247| v247_9(void) = UnmodeledUse : mu*
1097+
# 247| v247_10(void) = AliasedUse : ~mu247_4
1098+
# 247| v247_11(void) = ExitFunction :

0 commit comments

Comments
 (0)