Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit a51da53

Browse files
geoffw0geoffw0
committed
CPP: Libraries: Split into interface and implementation.
1 parent 356356f commit a51da53

3 files changed

Lines changed: 336 additions & 329 deletions

File tree

‎cpp/ql/src/semmle/code/cpp/models/Models.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
private import implementations.Allocation
12
private import implementations.IdentityFunction
23
private import implementations.Inet
34
private import implementations.Memcpy

‎cpp/ql/src/semmle/code/cpp/models/implementations/Allocation.qll‎

Lines changed: 327 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,327 @@
1+
import semmle.code.cpp.models.interfaces.Allocation
2+
3+
/**
4+
* An allocation function (such as `malloc`) that has an argument for the size
5+
* in bytes.
6+
*/
7+
class MallocAllocationFunction extends AllocationFunction {
8+
int sizeArg;
9+
10+
MallocAllocationFunction() {
11+
exists(string name |
12+
hasGlobalOrStdName(name) and
13+
(
14+
(name = "malloc" and sizeArg = 0) // malloc(size)
15+
)
16+
or
17+
hasGlobalName(name) and
18+
(
19+
(name = "ExAllocatePool" and sizeArg = 1) or // ExAllocatePool(type, size)
20+
(name = "ExAllocatePoolWithTag" and sizeArg = 1) or // ExAllocatePool(type, size, tag)
21+
(name = "ExAllocatePoolWithTagPriority" and sizeArg = 1) or // ExAllocatePoolWithTagPriority(type, size, tag, priority)
22+
(name = "ExAllocatePoolWithQuota" and sizeArg = 1) or // ExAllocatePoolWithQuota(type, size)
23+
(name = "ExAllocatePoolWithQuotaTag" and sizeArg = 1) or // ExAllocatePoolWithQuotaTag(type, size, tag)
24+
(name = "IoAllocateMdl" and sizeArg = 1) or // IoAllocateMdl(address, size, flag, flag, irp)
25+
(name = "IoAllocateErrorLogEntry" and sizeArg = 1) or // IoAllocateErrorLogEntry(object, size)
26+
(name = "MmAllocateContiguousMemory" and sizeArg = 0) or // MmAllocateContiguousMemory(size, maxaddress)
27+
(name = "MmAllocateContiguousNodeMemory" and sizeArg = 0) or // MmAllocateContiguousNodeMemory(size, minaddress, maxaddress, bound, flag, prefer)
28+
(name = "MmAllocateContiguousMemorySpecifyCache" and sizeArg = 0) or // MmAllocateContiguousMemorySpecifyCache(size, minaddress, maxaddress, bound, type)
29+
(name = "MmAllocateContiguousMemorySpecifyCacheNode" and sizeArg = 0) or // MmAllocateContiguousMemorySpecifyCacheNode(size, minaddress, maxaddress, bound, type, prefer)
30+
(name = "MmAllocateNonCachedMemory" and sizeArg = 0) or // MmAllocateNonCachedMemory(size)
31+
(name = "MmAllocateMappingAddress" and sizeArg = 0) or // MmAllocateMappingAddress(size, tag)
32+
(name = "MmAllocatePagesForMdl" and sizeArg = 3) or // MmAllocatePagesForMdl(minaddress, maxaddress, skip, size)
33+
(name = "MmAllocatePagesForMdlEx" and sizeArg = 3) or // MmAllocatePagesForMdlEx(minaddress, maxaddress, skip, size, type, flags)
34+
(name = "MmAllocateNodePagesForMdlEx" and sizeArg = 3) or // MmAllocateNodePagesForMdlEx(minaddress, maxaddress, skip, size, type, prefer, flags)
35+
(name = "LocalAlloc" and sizeArg = 1) or // LocalAlloc(flags, size)
36+
(name = "GlobalAlloc" and sizeArg = 1) or // GlobalAlloc(flags, size)
37+
(name = "HeapAlloc" and sizeArg = 2) or // HeapAlloc(heap, flags, size)
38+
(name = "VirtualAlloc" and sizeArg = 1) or // VirtualAlloc(address, size, type, flag)
39+
(name = "CoTaskMemAlloc" and sizeArg = 0) // CoTaskMemAlloc(size)
40+
)
41+
)
42+
}
43+
44+
override int getSizeArg() {
45+
result = sizeArg
46+
}
47+
}
48+
49+
/**
50+
* An allocation function (such as `calloc`) that has an argument for the size
51+
* and another argument for the size of those units (in bytes).
52+
*/
53+
class CallocAllocationFunction extends AllocationFunction {
54+
int sizeArg;
55+
int multArg;
56+
57+
CallocAllocationFunction() {
58+
exists(string name |
59+
hasGlobalOrStdName(name) and
60+
(name = "calloc" and sizeArg = 1 and multArg = 0) // calloc(num, size)
61+
)
62+
}
63+
64+
override int getSizeArg() {
65+
result = sizeArg
66+
}
67+
68+
override int getSizeMult() {
69+
result = multArg
70+
}
71+
}
72+
73+
/**
74+
* An allocation function (such as `realloc`) that has an argument for the size
75+
* in bytes, and an argument for an existing pointer that is to be reallocated.
76+
*/
77+
class ReallocAllocationFunction extends AllocationFunction {
78+
int sizeArg;
79+
int reallocArg;
80+
81+
ReallocAllocationFunction() { exists(string name |
82+
hasGlobalOrStdName(name) and
83+
(
84+
(name = "realloc" and sizeArg = 1 and reallocArg = 0) // realloc(ptr, size)
85+
)
86+
or
87+
hasGlobalName(name) and
88+
(
89+
(name = "LocalReAlloc" and sizeArg = 1 and reallocArg = 0) or // LocalReAlloc(ptr, size, flags)
90+
(name = "GlobalReAlloc" and sizeArg = 1 and reallocArg = 0) or // GlobalReAlloc(ptr, size, flags)
91+
(name = "HeapReAlloc" and sizeArg = 3 and reallocArg = 2) or // HeapReAlloc(heap, flags, ptr, size)
92+
(name = "CoTaskMemRealloc" and sizeArg = 1 and reallocArg = 0) // CoTaskMemRealloc(ptr, size)
93+
)
94+
)
95+
}
96+
97+
override int getSizeArg() {
98+
result = sizeArg
99+
}
100+
101+
override int getReallocPtrArg() {
102+
result = reallocArg
103+
}
104+
}
105+
106+
/**
107+
* An allocation function (such as `strdup`) that has no explicit argument for
108+
* the size of the allocation.
109+
*/
110+
class StrdupAllocationFunction extends AllocationFunction {
111+
StrdupAllocationFunction() {
112+
exists(string name |
113+
hasGlobalOrStdName(name) and
114+
(
115+
name = "strdup" or // strdup(str)
116+
name = "wcsdup" // wcsdup(str)
117+
)
118+
or
119+
hasGlobalName(name) and
120+
(
121+
name = "_strdup" or // _strdup(str)
122+
name = "_wcsdup" or // _wcsdup(str)
123+
name = "_mbsdup" or // _mbsdup(str)
124+
name = "ExAllocateFromLookasideListEx" or // ExAllocateFromLookasideListEx(list)
125+
name = "ExAllocateFromPagedLookasideList" or // ExAllocateFromPagedLookasideList(list)
126+
name = "ExAllocateFromNPagedLookasideList" or // ExAllocateFromNPagedLookasideList(list)
127+
name = "ExAllocateTimer" or // ExAllocateTimer(callback, context, attributes)
128+
name = "IoAllocateWorkItem" or // IoAllocateWorkItem(object)
129+
name = "MmMapLockedPagesWithReservedMapping" or // MmMapLockedPagesWithReservedMapping(address, tag, list, type)
130+
name = "MmMapLockedPages" or // MmMapLockedPages(list, mode)
131+
name = "MmMapLockedPagesSpecifyCache" // MmMapLockedPagesSpecifyCache(list, mode, type, address, flag, flag)
132+
)
133+
)
134+
}
135+
}
136+
137+
/**
138+
* An allocation expression that is a function call, such as call to `malloc`.
139+
*/
140+
class CallAllocationExpr extends AllocationExpr, FunctionCall {
141+
AllocationFunction target;
142+
143+
CallAllocationExpr() {
144+
target = getTarget() and
145+
// realloc(ptr, 0) only frees the pointer
146+
not (
147+
exists(target.getReallocPtrArg()) and
148+
getArgument(target.getSizeArg()).getValue().toInt() = 0
149+
)
150+
}
151+
152+
override Expr getSizeExpr() {
153+
result = getArgument(target.getSizeArg())
154+
}
155+
156+
override int getSizeMult() {
157+
// malloc with multiplier argument that is a constant
158+
result = getArgument(target.getSizeMult()).getValue().toInt()
159+
or
160+
// malloc with no multiplier argument
161+
(
162+
not exists(target.getSizeMult()) and
163+
result = 1
164+
)
165+
}
166+
167+
override int getSizeBytes() {
168+
result = getSizeExpr().getValue().toInt() * getSizeMult()
169+
}
170+
171+
override Expr getReallocPtr() {
172+
result = getArgument(target.getReallocPtrArg())
173+
}
174+
}
175+
176+
/**
177+
* An allocation expression that is a `new` expression.
178+
*/
179+
class NewAllocationExpr extends AllocationExpr, NewExpr {
180+
NewAllocationExpr() {
181+
this instanceof NewExpr
182+
}
183+
184+
override int getSizeBytes() {
185+
result = getAllocatedType().getSize()
186+
}
187+
}
188+
189+
/**
190+
* An allocation expression that is a `new []` expression.
191+
*/
192+
class NewArrayAllocationExpr extends AllocationExpr, NewArrayExpr {
193+
NewArrayAllocationExpr() {
194+
this instanceof NewArrayExpr
195+
}
196+
197+
override Expr getSizeExpr() {
198+
// new array expr with variable size
199+
result = getExtent()
200+
}
201+
202+
override int getSizeMult() {
203+
// new array expr with variable size
204+
exists(getExtent()) and
205+
result = getAllocatedElementType().getSize()
206+
}
207+
208+
override int getSizeBytes() {
209+
result = getAllocatedType().getSize()
210+
}
211+
}
212+
213+
/**
214+
* A deallocation function such as `free`.
215+
*/
216+
class StandardDeallocationFunction extends DeallocationFunction {
217+
int freedArg;
218+
219+
StandardDeallocationFunction() {
220+
exists(string name |
221+
hasGlobalName(name) and
222+
(
223+
name = "free" and freedArg = 0
224+
or
225+
name = "realloc" and freedArg = 0
226+
)
227+
or
228+
hasGlobalOrStdName(name) and
229+
(
230+
name = "ExFreePoolWithTag" and freedArg = 0
231+
or
232+
name = "ExFreeToLookasideListEx" and freedArg = 1
233+
or
234+
name = "ExFreeToPagedLookasideList" and freedArg = 1
235+
or
236+
name = "ExFreeToNPagedLookasideList" and freedArg = 1
237+
or
238+
name = "ExDeleteTimer" and freedArg = 0
239+
or
240+
name = "IoFreeMdl" and freedArg = 0
241+
or
242+
name = "IoFreeWorkItem" and freedArg = 0
243+
or
244+
name = "IoFreeErrorLogEntry" and freedArg = 0
245+
or
246+
name = "MmFreeContiguousMemory" and freedArg = 0
247+
or
248+
name = "MmFreeContiguousMemorySpecifyCache" and freedArg = 0
249+
or
250+
name = "MmFreeNonCachedMemory" and freedArg = 0
251+
or
252+
name = "MmFreeMappingAddress" and freedArg = 0
253+
or
254+
name = "MmFreePagesFromMdl" and freedArg = 0
255+
or
256+
name = "MmUnmapReservedMapping" and freedArg = 0
257+
or
258+
name = "MmUnmapLockedPages" and freedArg = 0
259+
or
260+
name = "LocalFree" and freedArg = 0
261+
or
262+
name = "GlobalFree" and freedArg = 0
263+
or
264+
name = "HeapFree" and freedArg = 2
265+
or
266+
name = "VirtualFree" and freedArg = 0
267+
or
268+
name = "CoTaskMemFree" and freedArg = 0
269+
or
270+
name = "SysFreeString" and freedArg = 0
271+
or
272+
name = "LocalReAlloc" and freedArg = 0
273+
or
274+
name = "GlobalReAlloc" and freedArg = 0
275+
or
276+
name = "HeapReAlloc" and freedArg = 2
277+
or
278+
name = "CoTaskMemRealloc" and freedArg = 0
279+
)
280+
)
281+
}
282+
283+
override int getFreedArg() {
284+
result = freedArg
285+
}
286+
}
287+
288+
/**
289+
* An deallocation expression that is a function call, such as call to `free`.
290+
*/
291+
class CallDeallocationExpr extends DeallocationExpr, FunctionCall {
292+
DeallocationFunction target;
293+
294+
CallDeallocationExpr() {
295+
target = getTarget()
296+
}
297+
298+
override Expr getFreedExpr() {
299+
result = getArgument(target.getFreedArg())
300+
}
301+
}
302+
303+
/**
304+
* An deallocation expression that is a `delete` expression.
305+
*/
306+
class DeleteDeallocationExpr extends DeallocationExpr, DeleteExpr {
307+
DeleteDeallocationExpr() {
308+
this instanceof DeleteExpr
309+
}
310+
311+
override Expr getFreedExpr() {
312+
result = getExpr()
313+
}
314+
}
315+
316+
/**
317+
* An deallocation expression that is a `delete []` expression.
318+
*/
319+
class DeleteArrayDeallocationExpr extends DeallocationExpr, DeleteArrayExpr {
320+
DeleteArrayDeallocationExpr() {
321+
this instanceof DeleteArrayExpr
322+
}
323+
324+
override Expr getFreedExpr() {
325+
result = getExpr()
326+
}
327+
}

0 commit comments

Comments
 (0)