C++: Use EscapesTree to find pointers to stack

jbj · jbj · commit dcf910f20c45 · 2019-02-21T11:20:25.000+01:00
This simplifies the query and is a strict improvement on the tests. I
also found it to be an overall improvement on real projects.
diff --git a/cpp/ql/src/Likely Bugs/Memory Management/ReturnStackAllocatedMemory.ql b/cpp/ql/src/Likely Bugs/Memory Management/ReturnStackAllocatedMemory.ql
@@ -10,49 +10,40 @@
  */
 
 import cpp
+import semmle.code.cpp.dataflow.EscapesTree
+import semmle.code.cpp.dataflow.DataFlow
 
-// an expression is possibly stack allocated if it is an aggregate literal
-// or accesses a possibly stack allocated local variables
-predicate exprMaybeStackAllocated(Expr e) {
-  e instanceof AggregateLiteral or
-  varMaybeStackAllocated(e.(VariableAccess).getTarget()) or
-  exprMayPointToStack(e.(ArrayExpr).getArrayBase())
-}
-
-// a local variable is possibly stack allocated if it is not static and
-// is initialized to/assigned a possibly stack allocated expression
-predicate varMaybeStackAllocated(LocalVariable lv) {
-  not lv.isStatic() and
-  not lv.getType() instanceof ReferenceType
+/**
+ * Holds if `n1` may flow to `n2`, ignoring flow through fields because these
+ * are currently modeled as an overapproximation that assumes all objects may
+ * alias.
+ */
+predicate conservativeDataFlowStep(DataFlow::Node n1, DataFlow::Node n2) {
+  DataFlow::localFlowStep(n1, n2) and
+  not n2.asExpr() instanceof FieldAccess
 }
 
-// an expression possibly points to the stack if it takes the address of
-// a possibly stack allocated expression, if it is a reference to a local variable
-// that possibly points to the stack, or if it is a possibly stack allocated array
-// that is converted (implicitly or explicitly) to a pointer
-predicate exprMayPointToStack(Expr e) {
-  exprMaybeStackAllocated(e.(AddressOfExpr).getAnOperand())
-  or
-  varMayPointToStack(e.(VariableAccess).getTarget())
-  or
+from LocalScopeVariable var, VariableAccess va, ReturnStmt r
+where
+  not var.isStatic() and
+  not var.getType().getUnspecifiedType() instanceof ReferenceType and
+  not r.isFromUninstantiatedTemplate(_) and
+  va = var.getAnAccess() and
   (
-    exprMaybeStackAllocated(e) and
-    e.getType() instanceof ArrayType and
-    e.getFullyConverted().getType() instanceof PointerType
+    // To check if the address escapes directly from `e` in `return e`, we need
+    // to check the fully-converted `e` in case there are implicit
+    // array-to-pointer conversions or reference conversions.
+    variableAddressEscapesTree(va, r.getExpr().getFullyConverted())
+    or
+    // The data flow library doesn't support conversions, so here we check that
+    // the address escapes into some expression `pointerToLocal`, which flows
+    // in a non-trivial way (one or more steps) to a returned expression.
+    exists(Expr pointerToLocal |
+      variableAddressEscapesTree(va, pointerToLocal.getFullyConverted()) and
+      conservativeDataFlowStep+(
+        DataFlow::exprNode(pointerToLocal),
+        DataFlow::exprNode(r.getExpr())
+      )
+    )
   )
-}
-
-// a local variable possibly points to the stack if it is initialized to/assigned to
-// an expression that possibly points to the stack
-predicate varMayPointToStack(LocalVariable lv) {
-  exprMayPointToStack(lv.getInitializer().getExpr())
-  or
-  exists(AssignExpr a |
-    a.getLValue().(VariableAccess).getTarget() = lv and
-    exprMayPointToStack(a.getRValue())
-  )
-}
-
-from ReturnStmt r
-where exprMayPointToStack(r.getExpr())
 select r, "May return stack-allocated memory."
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/ReturnStackAllocatedMemory.expected b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/ReturnStackAllocatedMemory.expected
@@ -1,6 +1,7 @@
 | test.cpp:17:2:17:12 | return ... | May return stack-allocated memory. |
 | test.cpp:25:2:25:12 | return ... | May return stack-allocated memory. |
-| test.cpp:33:2:33:12 | return ... | May return stack-allocated memory. |
+| test.cpp:47:2:47:11 | return ... | May return stack-allocated memory. |
+| test.cpp:54:2:54:16 | return ... | May return stack-allocated memory. |
 | test.cpp:92:2:92:12 | return ... | May return stack-allocated memory. |
 | test.cpp:112:2:112:12 | return ... | May return stack-allocated memory. |
 | test.cpp:119:2:119:19 | return ... | May return stack-allocated memory. |
diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/test.cpp b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ReturnStackAllocatedMemory/test.cpp
@@ -30,7 +30,7 @@ MyClass *test3()
 	MyClass mc;
 	MyClass *ptr = &mc;
 	ptr = nullptr;
-	return ptr; // GOOD [FALSE POSITIVE]
+	return ptr; // GOOD
 }
 
 MyClass *test4()
@@ -44,14 +44,14 @@ MyClass *test4()
 MyClass &test5()
 {
 	MyClass mc;
-	return mc; // BAD [NOT DETECTED]
+	return mc; // BAD
 }
 
 int *test6()
 {
 	MyClass mc;
 
-	return &(mc.a); // BAD [NOT DETECTED]
+	return &(mc.a); // BAD
 }
 
 MyClass test7()

Original file line number	Diff line number	Diff line change
`@@ -30,7 +30,7 @@ MyClass *test3()`
`30`	`30`	`MyClass mc;`
`31`	`31`	`MyClass *ptr = &mc;`
`32`	`32`	`ptr = nullptr;`
`33`		`- return ptr; // GOOD [FALSE POSITIVE]`
	`33`	`+ return ptr; // GOOD`
`34`	`34`	`}`
`35`	`35`
`36`	`36`	`MyClass *test4()`
`@@ -44,14 +44,14 @@ MyClass *test4()`
`44`	`44`	`MyClass &test5()`
`45`	`45`	`{`
`46`	`46`	`MyClass mc;`
`47`		`- return mc; // BAD [NOT DETECTED]`
	`47`	`+ return mc; // BAD`
`48`	`48`	`}`
`49`	`49`
`50`	`50`	`int *test6()`
`51`	`51`	`{`
`52`	`52`	`MyClass mc;`
`53`	`53`
`54`		`- return &(mc.a); // BAD [NOT DETECTED]`
	`54`	`+ return &(mc.a); // BAD`
`55`	`55`	`}`
`56`	`56`
`57`	`57`	`MyClass test7()`