Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit ba98c0c

Browse files
andersfugmannandersfugmann
committed
Merge remote-tracking branch 'upstream/main' into relax_memberMayBeVarSize
2 parents a358ea8 + fc8b439 commit ba98c0c

118 files changed

Lines changed: 1515 additions & 1085 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎cpp/ql/lib/semmle/code/cpp/commons/NullTermination.qll‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,15 @@ predicate variableMustBeNullTerminated(VariableAccess va) {
9393
fc.getArgument(i) = va
9494
)
9595
or
96+
// String argument to a formatting function (such as `printf`)
97+
exists(int n, FormatLiteral fl |
98+
fc.(FormattingFunctionCall).getConversionArgument(n) = va and
99+
fl = fc.(FormattingFunctionCall).getFormat() and
100+
fl.getConversionType(n) instanceof PointerType and // `%s`, `%ws` etc
101+
not fl.getConversionType(n) instanceof VoidPointerType and // exclude: `%p`
102+
not fl.hasPrecision(n) // exclude: `%.*s`
103+
)
104+
or
96105
// Call to a wrapper function that requires null termination
97106
// (not itself adding a null terminator)
98107
exists(Function wrapper, int i, Parameter p, VariableAccess use |

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -550,6 +550,39 @@ module TaintedWithPath {
550550
)
551551
}
552552

553+
/**
554+
* Holds if there is flow from `arg` to `out` across a call that can by summarized by the flow
555+
* from `par` to `ret` within it, in the graph of data flow path explanations.
556+
*/
557+
query predicate subpaths(PathNode arg, PathNode par, PathNode ret, PathNode out) {
558+
DataFlow3::PathGraph::subpaths(arg.(WrapPathNode).inner(), par.(WrapPathNode).inner(),
559+
ret.(WrapPathNode).inner(), out.(WrapPathNode).inner())
560+
or
561+
// To avoid showing trivial-looking steps, we _replace_ the last node instead
562+
// of adding an edge out of it.
563+
exists(WrapPathNode sinkNode |
564+
DataFlow3::PathGraph::subpaths(arg.(WrapPathNode).inner(), par.(WrapPathNode).inner(),
565+
ret.(WrapPathNode).inner(), sinkNode.inner()) and
566+
out.(FinalPathNode).inner() = adjustedSink(sinkNode.inner().getNode())
567+
)
568+
or
569+
// Same for the first node
570+
exists(WrapPathNode sourceNode |
571+
DataFlow3::PathGraph::subpaths(sourceNode.inner(), par.(WrapPathNode).inner(),
572+
ret.(WrapPathNode).inner(), out.(WrapPathNode).inner()) and
573+
sourceNode.inner().getNode() = getNodeForExpr(arg.(InitialPathNode).inner())
574+
)
575+
or
576+
// Finally, handle the case where the path goes directly from a source to a
577+
// sink, meaning that they both need to be translated.
578+
exists(WrapPathNode sinkNode, WrapPathNode sourceNode |
579+
DataFlow3::PathGraph::subpaths(sourceNode.inner(), par.(WrapPathNode).inner(),
580+
ret.(WrapPathNode).inner(), sinkNode.inner()) and
581+
sourceNode.inner().getNode() = getNodeForExpr(arg.(InitialPathNode).inner()) and
582+
out.(FinalPathNode).inner() = adjustedSink(sinkNode.inner().getNode())
583+
)
584+
}
585+
553586
/** Holds if `n` is a node in the graph of data flow path explanations. */
554587
query predicate nodes(PathNode n, string key, string val) {
555588
key = "semmle.label" and val = n.toString()

‎cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1856,12 +1856,12 @@ class InitializeDynamicAllocationInstruction extends SideEffectInstruction {
18561856
}
18571857

18581858
/**
1859-
* Gets the address of the allocation this instruction is initializing.
1859+
* Gets the operand that represents the address of the allocation this instruction is initializing.
18601860
*/
18611861
final AddressOperand getAllocationAddressOperand() { result = getAnOperand() }
18621862

18631863
/**
1864-
* Gets the operand for the allocation this instruction is initializing.
1864+
* Gets the address for the allocation this instruction is initializing.
18651865
*/
18661866
final Instruction getAllocationAddress() { result = getAllocationAddressOperand().getDef() }
18671867
}

‎cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/Instruction.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1856,12 +1856,12 @@ class InitializeDynamicAllocationInstruction extends SideEffectInstruction {
18561856
}
18571857

18581858
/**
1859-
* Gets the address of the allocation this instruction is initializing.
1859+
* Gets the operand that represents the address of the allocation this instruction is initializing.
18601860
*/
18611861
final AddressOperand getAllocationAddressOperand() { result = getAnOperand() }
18621862

18631863
/**
1864-
* Gets the operand for the allocation this instruction is initializing.
1864+
* Gets the address for the allocation this instruction is initializing.
18651865
*/
18661866
final Instruction getAllocationAddress() { result = getAllocationAddressOperand().getDef() }
18671867
}

‎cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1856,12 +1856,12 @@ class InitializeDynamicAllocationInstruction extends SideEffectInstruction {
18561856
}
18571857

18581858
/**
1859-
* Gets the address of the allocation this instruction is initializing.
1859+
* Gets the operand that represents the address of the allocation this instruction is initializing.
18601860
*/
18611861
final AddressOperand getAllocationAddressOperand() { result = getAnOperand() }
18621862

18631863
/**
1864-
* Gets the operand for the allocation this instruction is initializing.
1864+
* Gets the address for the allocation this instruction is initializing.
18651865
*/
18661866
final Instruction getAllocationAddress() { result = getAllocationAddressOperand().getDef() }
18671867
}

‎cpp/ql/lib/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1549,7 +1549,8 @@ private float getGuardedUpperBound(VariableAccess guardedAccess) {
15491549
// that there is one predecessor, albeit somewhat conservative.
15501550
exists(unique(BasicBlock b | b = def.(BasicBlock).getAPredecessor())) and
15511551
guardedAccess = def.getAUse(v) and
1552-
result = max(float ub | upperBoundFromGuard(guard, guardVa, ub, branch))
1552+
result = max(float ub | upperBoundFromGuard(guard, guardVa, ub, branch)) and
1553+
not convertedExprMightOverflow(guard.getAChild+())
15531554
)
15541555
}
15551556

‎cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/lowerBound.expected‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -599,6 +599,10 @@
599599
| test.c:675:7:675:7 | y | -2147483648 |
600600
| test.c:684:7:684:7 | x | -2147483648 |
601601
| test.c:689:7:689:7 | x | -2147483648 |
602+
| test.c:696:8:696:8 | x | 2147483647 |
603+
| test.c:696:12:696:12 | y | 256 |
604+
| test.c:697:9:697:9 | x | 2147483647 |
605+
| test.c:698:9:698:9 | y | 256 |
602606
| test.cpp:10:7:10:7 | b | -2147483648 |
603607
| test.cpp:11:5:11:5 | x | -2147483648 |
604608
| test.cpp:13:10:13:10 | x | -2147483648 |

‎cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/test.c‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -689,3 +689,12 @@ void test(int x) {
689689
out(x);
690690
goto label;
691691
}
692+
693+
void test_overflow() {
694+
const int x = 2147483647; // 2^31-1
695+
const int y = 256;
696+
if ((x + y) <= 512) {
697+
out(x);
698+
out(y);
699+
}
700+
}

‎cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/upperBound.expected‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -599,6 +599,10 @@
599599
| test.c:675:7:675:7 | y | 2147483647 |
600600
| test.c:684:7:684:7 | x | 2147483647 |
601601
| test.c:689:7:689:7 | x | 15 |
602+
| test.c:696:8:696:8 | x | 2147483647 |
603+
| test.c:696:12:696:12 | y | 256 |
604+
| test.c:697:9:697:9 | x | 2147483647 |
605+
| test.c:698:9:698:9 | y | 256 |
602606
| test.cpp:10:7:10:7 | b | 2147483647 |
603607
| test.cpp:11:5:11:5 | x | 2147483647 |
604608
| test.cpp:13:10:13:10 | x | 2147483647 |

‎cpp/ql/test/query-tests/Likely Bugs/Memory Management/ImproperNullTermination/ImproperNullTermination.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,3 +23,5 @@
2323
| test.cpp:365:19:365:25 | buffer2 | Variable $@ may not be null terminated. | test.cpp:363:8:363:14 | buffer2 | buffer2 |
2424
| test.cpp:392:17:392:22 | buffer | Variable $@ may not be null terminated. | test.cpp:390:8:390:13 | buffer | buffer |
2525
| test.cpp:398:18:398:23 | buffer | Variable $@ may not be null terminated. | test.cpp:396:8:396:13 | buffer | buffer |
26+
| test.cpp:444:10:444:15 | buffer | Variable $@ may not be null terminated. | test.cpp:442:8:442:13 | buffer | buffer |
27+
| test.cpp:450:16:450:21 | buffer | Variable $@ may not be null terminated. | test.cpp:448:8:448:13 | buffer | buffer |

0 commit comments

Comments
 (0)