Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit e2244d4

Browse files
MathiasVPMathiasVP
committed
C++: Factored the body of MistypedFunctionArguments.ql out into a library file
1 parent c9439df commit e2244d4

2 files changed

Lines changed: 98 additions & 87 deletions

File tree

‎cpp/ql/src/Likely Bugs/Underspecified Functions/MistypedFunctionArguments.ql‎

Lines changed: 2 additions & 87 deletions
Original file line numberDiff line numberDiff line change
@@ -12,95 +12,10 @@
1212
*/
1313

1414
import cpp
15-
16-
predicate arithTypesMatch(Type arg, Type parm) {
17-
arg = parm
18-
or
19-
arg.getSize() = parm.getSize() and
20-
(
21-
arg instanceof IntegralOrEnumType and
22-
parm instanceof IntegralOrEnumType
23-
or
24-
arg instanceof FloatingPointType and
25-
parm instanceof FloatingPointType
26-
)
27-
}
28-
29-
pragma[inline]
30-
predicate nestedPointerArgTypeMayBeUsed(Type arg, Type parm) {
31-
// arithmetic types
32-
arithTypesMatch(arg, parm)
33-
or
34-
// conversion to/from pointers to void is allowed
35-
arg instanceof VoidType
36-
or
37-
parm instanceof VoidType
38-
}
39-
40-
pragma[inline]
41-
predicate pointerArgTypeMayBeUsed(Type arg, Type parm) {
42-
nestedPointerArgTypeMayBeUsed(arg, parm)
43-
or
44-
// nested pointers
45-
nestedPointerArgTypeMayBeUsed(arg.(PointerType).getBaseType().getUnspecifiedType(),
46-
parm.(PointerType).getBaseType().getUnspecifiedType())
47-
or
48-
nestedPointerArgTypeMayBeUsed(arg.(ArrayType).getBaseType().getUnspecifiedType(),
49-
parm.(PointerType).getBaseType().getUnspecifiedType())
50-
}
51-
52-
pragma[inline]
53-
predicate argTypeMayBeUsed(Type arg, Type parm) {
54-
// arithmetic types
55-
arithTypesMatch(arg, parm)
56-
or
57-
// pointers to compatible types
58-
pointerArgTypeMayBeUsed(arg.(PointerType).getBaseType().getUnspecifiedType(),
59-
parm.(PointerType).getBaseType().getUnspecifiedType())
60-
or
61-
pointerArgTypeMayBeUsed(arg.(ArrayType).getBaseType().getUnspecifiedType(),
62-
parm.(PointerType).getBaseType().getUnspecifiedType())
63-
or
64-
// C11 arrays
65-
pointerArgTypeMayBeUsed(arg.(PointerType).getBaseType().getUnspecifiedType(),
66-
parm.(ArrayType).getBaseType().getUnspecifiedType())
67-
or
68-
pointerArgTypeMayBeUsed(arg.(ArrayType).getBaseType().getUnspecifiedType(),
69-
parm.(ArrayType).getBaseType().getUnspecifiedType())
70-
}
71-
72-
// This predicate holds whenever expression `arg` may be used to initialize
73-
// function parameter `parm` without need for run-time conversion.
74-
pragma[inline]
75-
predicate argMayBeUsed(Expr arg, Parameter parm) {
76-
argTypeMayBeUsed(arg.getFullyConverted().getUnspecifiedType(), parm.getUnspecifiedType())
77-
}
78-
79-
// True if function was ()-declared, but not (void)-declared or K&R-defined
80-
predicate hasZeroParamDecl(Function f) {
81-
exists(FunctionDeclarationEntry fde | fde = f.getADeclarationEntry() |
82-
not fde.hasVoidParamList() and fde.getNumberOfParameters() = 0 and not fde.isDefinition()
83-
)
84-
}
85-
86-
// True if this file (or header) was compiled as a C file
87-
predicate isCompiledAsC(File f) {
88-
f.compiledAsC()
89-
or
90-
exists(File src | isCompiledAsC(src) | src.getAnIncludedFile() = f)
91-
}
15+
import MistypedFunctionArguments
9216

9317
from FunctionCall fc, Function f, Parameter p
94-
where
95-
f = fc.getTarget() and
96-
p = f.getAParameter() and
97-
hasZeroParamDecl(f) and
98-
isCompiledAsC(f.getFile()) and
99-
not f.isVarargs() and
100-
not f instanceof BuiltInFunction and
101-
p.getIndex() < fc.getNumberOfArguments() and
102-
// Parameter p and its corresponding call argument must have mismatched types
103-
not argMayBeUsed(fc.getArgument(p.getIndex()), p)
18+
where mistypedFunctionArguments(fc, f, p)
10419
select fc, "Calling $@: argument $@ of type $@ is incompatible with parameter $@.", f, f.toString(),
10520
fc.getArgument(p.getIndex()) as arg, arg.toString(),
10621
arg.getExplicitlyConverted().getUnspecifiedType() as atype, atype.toString(), p, p.getTypedName()

‎cpp/ql/src/Likely Bugs/Underspecified Functions/MistypedFunctionArguments.qll‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
/**
2+
* Provides the implementation of the MistypedFunctionArguments query. The
3+
* query is implemented as a library, so that we can avoid producing
4+
* duplicate results in other similar queries.
5+
*/
6+
7+
import cpp
8+
9+
private predicate arithTypesMatch(Type arg, Type parm) {
10+
arg = parm
11+
or
12+
arg.getSize() = parm.getSize() and
13+
(
14+
arg instanceof IntegralOrEnumType and
15+
parm instanceof IntegralOrEnumType
16+
or
17+
arg instanceof FloatingPointType and
18+
parm instanceof FloatingPointType
19+
)
20+
}
21+
22+
pragma[inline]
23+
private predicate nestedPointerArgTypeMayBeUsed(Type arg, Type parm) {
24+
// arithmetic types
25+
arithTypesMatch(arg, parm)
26+
or
27+
// conversion to/from pointers to void is allowed
28+
arg instanceof VoidType
29+
or
30+
parm instanceof VoidType
31+
}
32+
33+
pragma[inline]
34+
private predicate pointerArgTypeMayBeUsed(Type arg, Type parm) {
35+
nestedPointerArgTypeMayBeUsed(arg, parm)
36+
or
37+
// nested pointers
38+
nestedPointerArgTypeMayBeUsed(arg.(PointerType).getBaseType().getUnspecifiedType(),
39+
parm.(PointerType).getBaseType().getUnspecifiedType())
40+
or
41+
nestedPointerArgTypeMayBeUsed(arg.(ArrayType).getBaseType().getUnspecifiedType(),
42+
parm.(PointerType).getBaseType().getUnspecifiedType())
43+
}
44+
45+
pragma[inline]
46+
private predicate argTypeMayBeUsed(Type arg, Type parm) {
47+
// arithmetic types
48+
arithTypesMatch(arg, parm)
49+
or
50+
// pointers to compatible types
51+
pointerArgTypeMayBeUsed(arg.(PointerType).getBaseType().getUnspecifiedType(),
52+
parm.(PointerType).getBaseType().getUnspecifiedType())
53+
or
54+
pointerArgTypeMayBeUsed(arg.(ArrayType).getBaseType().getUnspecifiedType(),
55+
parm.(PointerType).getBaseType().getUnspecifiedType())
56+
or
57+
// C11 arrays
58+
pointerArgTypeMayBeUsed(arg.(PointerType).getBaseType().getUnspecifiedType(),
59+
parm.(ArrayType).getBaseType().getUnspecifiedType())
60+
or
61+
pointerArgTypeMayBeUsed(arg.(ArrayType).getBaseType().getUnspecifiedType(),
62+
parm.(ArrayType).getBaseType().getUnspecifiedType())
63+
}
64+
65+
// This predicate holds whenever expression `arg` may be used to initialize
66+
// function parameter `parm` without need for run-time conversion.
67+
pragma[inline]
68+
private predicate argMayBeUsed(Expr arg, Parameter parm) {
69+
argTypeMayBeUsed(arg.getFullyConverted().getUnspecifiedType(), parm.getUnspecifiedType())
70+
}
71+
72+
// True if function was ()-declared, but not (void)-declared or K&R-defined
73+
private predicate hasZeroParamDecl(Function f) {
74+
exists(FunctionDeclarationEntry fde | fde = f.getADeclarationEntry() |
75+
not fde.hasVoidParamList() and fde.getNumberOfParameters() = 0 and not fde.isDefinition()
76+
)
77+
}
78+
79+
// True if this file (or header) was compiled as a C file
80+
private predicate isCompiledAsC(File f) {
81+
f.compiledAsC()
82+
or
83+
exists(File src | isCompiledAsC(src) | src.getAnIncludedFile() = f)
84+
}
85+
86+
predicate mistypedFunctionArguments(FunctionCall fc, Function f, Parameter p) {
87+
f = fc.getTarget() and
88+
p = f.getAParameter() and
89+
hasZeroParamDecl(f) and
90+
isCompiledAsC(f.getFile()) and
91+
not f.isVarargs() and
92+
not f instanceof BuiltInFunction and
93+
p.getIndex() < fc.getNumberOfArguments() and
94+
// Parameter p and its corresponding call argument must have mismatched types
95+
not argMayBeUsed(fc.getArgument(p.getIndex()), p)
96+
}

0 commit comments

Comments
 (0)