Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit d56284f

Browse files
MathiasVPMathiasVP
committed
C++: Move added flow from simpleLocalFlowStep to simpleInstructionLocalFlowStep and remove flow that could cause field conflation
1 parent 5719967 commit d56284f

6 files changed

Lines changed: 13 additions & 28 deletions

File tree

‎cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll‎

Lines changed: 5 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -385,13 +385,6 @@ predicate localFlowStep(Node nodeFrom, Node nodeTo) { simpleLocalFlowStep(nodeFr
385385
*/
386386
predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo) {
387387
simpleInstructionLocalFlowStep(nodeFrom.asInstruction(), nodeTo.asInstruction())
388-
or
389-
exists(LoadInstruction load, ChiInstruction chi |
390-
not chi.isResultConflated() and
391-
nodeTo.asInstruction() = load and
392-
nodeFrom.asInstruction() = chi and
393-
load.getSourceValueOperand().getAnyDef() = chi
394-
)
395388
}
396389

397390
private predicate simpleInstructionLocalFlowStep(Instruction iFrom, Instruction iTo) {
@@ -417,13 +410,13 @@ private predicate simpleInstructionLocalFlowStep(Instruction iFrom, Instruction
417410
//
418411
// Flow through the partial operand belongs in the taint-tracking libraries
419412
// for now.
420-
// TODO: To capture flow from a partial definition of an object (i.e., a field write) to the object
421-
// we add dataflow through partial chi operands, but only if the chi node is not the chi node for all
422-
// aliased memory.
423-
iTo.getAnOperand().(ChiPartialOperand).getDef() = iFrom and not iTo.isResultConflated()
424-
or
425413
iTo.getAnOperand().(ChiTotalOperand).getDef() = iFrom
426414
or
415+
exists(ChiInstruction chi | iFrom = chi |
416+
not chi.isResultConflated() and
417+
iTo.(LoadInstruction).getSourceValueOperand().getAnyDef() = chi
418+
)
419+
or
427420
// Flow through modeled functions
428421
modelFlow(iFrom, iTo)
429422
}

‎cpp/ql/test/library-tests/dataflow/dataflow-tests/test_diff.expected‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22
| BarrierGuard.cpp:60:11:60:16 | BarrierGuard.cpp:62:14:62:14 | AST only |
33
| clang.cpp:12:9:12:20 | clang.cpp:22:8:22:20 | AST only |
44
| clang.cpp:28:27:28:32 | clang.cpp:30:27:30:34 | AST only |
5-
| clang.cpp:28:27:28:32 | clang.cpp:31:27:31:28 | IR only |
65
| clang.cpp:39:42:39:47 | clang.cpp:41:18:41:19 | IR only |
76
| dispatch.cpp:16:37:16:42 | dispatch.cpp:32:16:32:24 | IR only |
87
| dispatch.cpp:16:37:16:42 | dispatch.cpp:40:15:40:23 | IR only |
@@ -46,6 +45,9 @@
4645
| test.cpp:359:13:359:18 | test.cpp:365:10:365:14 | AST only |
4746
| test.cpp:373:13:373:18 | test.cpp:369:10:369:14 | AST only |
4847
| test.cpp:373:13:373:18 | test.cpp:375:10:375:14 | AST only |
48+
| test.cpp:382:48:382:54 | test.cpp:385:8:385:10 | AST only |
49+
| test.cpp:388:53:388:59 | test.cpp:392:8:392:10 | AST only |
50+
| test.cpp:388:53:388:59 | test.cpp:394:10:394:12 | AST only |
4951
| test.cpp:399:7:399:9 | test.cpp:401:8:401:10 | AST only |
5052
| test.cpp:405:7:405:9 | test.cpp:408:8:408:10 | AST only |
5153
| test.cpp:416:7:416:11 | test.cpp:418:8:418:12 | AST only |

‎cpp/ql/test/library-tests/dataflow/dataflow-tests/test_ir.expected‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@
1212
| clang.cpp:18:8:18:19 | (const int *)... | clang.cpp:12:9:12:20 | sourceArray1 |
1313
| clang.cpp:18:8:18:19 | sourceArray1 | clang.cpp:12:9:12:20 | sourceArray1 |
1414
| clang.cpp:29:27:29:28 | m1 | clang.cpp:28:27:28:32 | call to source |
15-
| clang.cpp:31:27:31:28 | m2 | clang.cpp:28:27:28:32 | call to source |
1615
| clang.cpp:37:10:37:11 | m2 | clang.cpp:34:32:34:37 | call to source |
1716
| clang.cpp:41:18:41:19 | m2 | clang.cpp:39:42:39:47 | call to source |
1817
| clang.cpp:45:17:45:18 | m2 | clang.cpp:43:35:43:40 | call to source |
@@ -62,9 +61,6 @@
6261
| test.cpp:266:12:266:12 | x | test.cpp:265:22:265:27 | call to source |
6362
| test.cpp:289:14:289:14 | x | test.cpp:305:17:305:22 | call to source |
6463
| test.cpp:318:7:318:7 | x | test.cpp:314:4:314:9 | call to source |
65-
| test.cpp:385:8:385:10 | tmp | test.cpp:382:48:382:54 | source1 |
66-
| test.cpp:392:8:392:10 | tmp | test.cpp:388:53:388:59 | source1 |
67-
| test.cpp:394:10:394:12 | tmp | test.cpp:388:53:388:59 | source1 |
6864
| test.cpp:450:9:450:22 | (statement expression) | test.cpp:449:26:449:32 | source1 |
6965
| test.cpp:461:8:461:12 | local | test.cpp:449:26:449:32 | source1 |
7066
| true_upon_entry.cpp:13:8:13:8 | x | true_upon_entry.cpp:9:11:9:16 | call to source |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,15 +17,13 @@
1717
| taint.cpp:93:11:93:11 | taint.cpp:71:22:71:27 | AST only |
1818
| taint.cpp:94:11:94:11 | taint.cpp:72:7:72:12 | AST only |
1919
| taint.cpp:109:7:109:13 | taint.cpp:105:12:105:17 | IR only |
20-
| taint.cpp:110:7:110:13 | taint.cpp:105:12:105:17 | IR only |
21-
| taint.cpp:111:7:111:13 | taint.cpp:106:12:106:17 | IR only |
22-
| taint.cpp:112:7:112:13 | taint.cpp:106:12:106:17 | IR only |
2320
| taint.cpp:130:7:130:9 | taint.cpp:127:8:127:13 | IR only |
2421
| taint.cpp:137:7:137:9 | taint.cpp:120:11:120:16 | AST only |
2522
| taint.cpp:173:8:173:13 | taint.cpp:164:19:164:24 | AST only |
2623
| taint.cpp:181:8:181:9 | taint.cpp:185:11:185:16 | AST only |
2724
| taint.cpp:195:7:195:7 | taint.cpp:192:23:192:28 | AST only |
2825
| taint.cpp:195:7:195:7 | taint.cpp:193:6:193:6 | AST only |
26+
| taint.cpp:216:7:216:7 | taint.cpp:207:6:207:11 | AST only |
2927
| taint.cpp:229:3:229:6 | taint.cpp:223:10:223:15 | AST only |
3028
| taint.cpp:233:8:233:8 | taint.cpp:223:10:223:15 | AST only |
3129
| taint.cpp:236:3:236:6 | taint.cpp:223:10:223:15 | AST only |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_ir.expected‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,6 @@
22
| taint.cpp:16:8:16:14 | source1 | taint.cpp:12:22:12:27 | call to source |
33
| taint.cpp:17:8:17:16 | ++ ... | taint.cpp:12:22:12:27 | call to source |
44
| taint.cpp:109:7:109:13 | access to array | taint.cpp:105:12:105:17 | call to source |
5-
| taint.cpp:110:7:110:13 | access to array | taint.cpp:105:12:105:17 | call to source |
6-
| taint.cpp:111:7:111:13 | access to array | taint.cpp:106:12:106:17 | call to source |
7-
| taint.cpp:112:7:112:13 | access to array | taint.cpp:106:12:106:17 | call to source |
85
| taint.cpp:129:7:129:9 | * ... | taint.cpp:120:11:120:16 | call to source |
96
| taint.cpp:130:7:130:9 | * ... | taint.cpp:127:8:127:13 | call to source |
107
| taint.cpp:134:7:134:9 | * ... | taint.cpp:120:11:120:16 | call to source |
@@ -13,7 +10,6 @@
1310
| taint.cpp:168:8:168:14 | tainted | taint.cpp:164:19:164:24 | call to source |
1411
| taint.cpp:210:7:210:7 | x | taint.cpp:207:6:207:11 | call to source |
1512
| taint.cpp:215:7:215:7 | x | taint.cpp:207:6:207:11 | call to source |
16-
| taint.cpp:216:7:216:7 | y | taint.cpp:207:6:207:11 | call to source |
1713
| taint.cpp:250:8:250:8 | a | taint.cpp:223:10:223:15 | call to source |
1814
| taint.cpp:280:7:280:7 | t | taint.cpp:275:6:275:11 | call to source |
1915
| taint.cpp:289:7:289:7 | t | taint.cpp:275:6:275:11 | call to source |

‎cpp/ql/test/library-tests/literals/literals/literals.expected‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@
22
| literals.c:3:13:3:16 | 1.0 |
33
| literals.c:4:13:4:16 | 1.0 |
44
| literals.c:5:13:5:16 | 1.0 |
5-
| literals.c:6:13:6:16 | (0.0,1.0i) |
6-
| literals.c:7:13:7:16 | (0.0,1.0i) |
7-
| literals.c:8:13:8:16 | (0.0,1.0i) |
8-
| literals.c:9:13:9:16 | (0.0,1.0i) |
5+
| literals.c:6:13:6:16 | (1.0,1.0i) |
6+
| literals.c:7:13:7:16 | (1.0,1.0i) |
7+
| literals.c:8:13:8:16 | (1.0,1.0i) |
8+
| literals.c:9:13:9:16 | (1.0,1.0i) |
99
| literals.c:10:13:10:16 | 1.0 |
1010
| literals.c:11:13:11:16 | 1.0 |
1111
| literals.c:12:13:12:16 | 1.0 |

0 commit comments

Comments
 (0)