Skip to content

Dataflow: Record content types #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hvitved merged 5 commits into from
Jun 17, 2020
Merged

Dataflow: Record content types #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
10b64fc
Dataflow: Record content type for stores.
aschackmull Jun 17, 2020
d28b5ac
Dataflow: Sync.
aschackmull Jun 17, 2020
543ab71
Dataflow: minor review fixes.
aschackmull Jun 17, 2020
cedfaf6
Dataflow: autoformat
aschackmull Jun 17, 2020
74eab3c
Dataflow: Fix qltest.
aschackmull Jun 17, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
58 changes: 30 additions & 28 deletions cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -289,7 +289,7 @@ private predicate nodeCandFwd1(Node node, boolean fromArg, Configuration config)
exists(Node mid |
useFieldFlow(config) and
nodeCandFwd1(mid, fromArg, config) and
store(mid, _, node) and
store(mid, _, node, _) and
not outBarrier(mid, config)
)
or
Expand Down Expand Up @@ -337,7 +337,7 @@ private predicate nodeCandFwd1IsStored(Content c, Configuration config) {
not fullBarrier(node, config) and
useFieldFlow(config) and
nodeCandFwd1(mid, config) and
store(mid, tc, node) and
store(mid, tc, node, _) and
c = tc.getContent()
)
}
Expand Down Expand Up @@ -469,7 +469,7 @@ private predicate nodeCand1Store(Content c, Node node, boolean toReturn, Configu
exists(Node mid, TypedContent tc |
nodeCand1(mid, toReturn, config) and
nodeCandFwd1IsStored(c, unbind(config)) and
store(node, tc, mid) and
store(node, tc, mid, _) and
c = tc.getContent()
)
}
Expand Down Expand Up @@ -571,11 +571,11 @@ private predicate parameterThroughFlowNodeCand1(ParameterNode p, Configuration c
}

pragma[nomagic]
private predicate store(Node n1, Content c, Node n2, Configuration config) {
private predicate storeCand1(Node n1, Content c, Node n2, Configuration config) {
exists(TypedContent tc |
nodeCand1IsReadAndStored(c, config) and
nodeCand1(n2, unbind(config)) and
store(n1, tc, n2) and
store(n1, tc, n2, _) and
c = tc.getContent()
)
}
Expand Down Expand Up @@ -758,7 +758,7 @@ private predicate nodeCandFwd2(
// store
exists(Node mid |
nodeCandFwd2(mid, fromArg, argStored, _, config) and
store(mid, _, node, config) and
storeCand1(mid, _, node, config) and
stored = true
)
or
Expand Down Expand Up @@ -797,7 +797,7 @@ private predicate nodeCandFwd2IsStored(Content c, boolean stored, Configuration
useFieldFlow(config) and
nodeCand1(node, unbind(config)) and
nodeCandFwd2(mid, _, _, stored, config) and
store(mid, c, node, config)
storeCand1(mid, c, node, config)
)
}

Expand Down Expand Up @@ -957,7 +957,7 @@ private predicate nodeCand2Store(
Configuration config
) {
exists(Node mid |
store(node, c, mid, config) and
storeCand1(node, c, mid, config) and
nodeCand2(mid, toReturn, returnRead, true, config) and
nodeCandFwd2(node, _, _, stored, unbind(config))
)
Expand Down Expand Up @@ -1066,7 +1066,7 @@ private module LocalFlowBigStep {
additionalJumpStep(_, node, config) or
node instanceof ParameterNode or
node instanceof OutNodeExt or
store(_, _, node) or
store(_, _, node, _) or
read(_, _, node) or
node instanceof CastNode
)
Expand All @@ -1082,7 +1082,7 @@ private module LocalFlowBigStep {
additionalJumpStep(node, next, config) or
flowIntoCallNodeCand1(_, node, next, config) or
flowOutOfCallNodeCand1(_, node, next, config) or
store(node, _, next) or
store(node, _, next, _) or
read(node, _, next)
)
or
Expand Down Expand Up @@ -1170,8 +1170,10 @@ private predicate readCand2(Node node1, Content c, Node node2, Configuration con
}

pragma[nomagic]
private predicate storeCand2(Node node1, TypedContent tc, Node node2, Configuration config) {
store(node1, tc, node2) and
private predicate storeCand2(
Node node1, TypedContent tc, Node node2, DataFlowType contentType, Configuration config
) {
store(node1, tc, node2, contentType) and
nodeCand2(node1, config) and
nodeCand2(node2, _, _, true, unbind(config)) and
nodeCand2IsReadAndStored(tc.getContent(), unbind(config))
Expand Down Expand Up @@ -1235,11 +1237,12 @@ private predicate flowCandFwd0(
)
or
// store
exists(Node mid, TypedContent tc |
flowCandFwd(mid, fromArg, argApf, _, config) and
storeCand2(mid, tc, node, config) and
exists(Node mid, TypedContent tc, AccessPathFront apf0, DataFlowType contentType |
flowCandFwd(mid, fromArg, argApf, apf0, config) and
storeCand2(mid, tc, node, contentType, config) and
nodeCand2(node, _, _, true, unbind(config)) and
apf.headUsesContent(tc)
apf.headUsesContent(tc) and
compatibleTypes(apf0.getType(), contentType)
)
or
// read
Expand Down Expand Up @@ -1270,11 +1273,11 @@ private predicate flowCandFwd0(

pragma[nomagic]
private predicate flowCandFwdConsCand(TypedContent tc, AccessPathFront apf, Configuration config) {
exists(Node mid, Node n |
exists(Node mid, Node n, DataFlowType contentType |
flowCandFwd(mid, _, _, apf, config) and
storeCand2(mid, tc, n, config) and
storeCand2(mid, tc, n, contentType, config) and
nodeCand2(n, _, _, true, unbind(config)) and
compatibleTypes(apf.getType(), mid.getTypeBound())
compatibleTypes(apf.getType(), contentType)
)
}

Expand Down Expand Up @@ -1454,7 +1457,7 @@ private predicate flowCandStore(
) {
exists(Node mid |
flowCandFwd(node, _, _, apf, config) and
storeCand2(node, tc, mid, unbind(config)) and
storeCand2(node, tc, mid, _, unbind(config)) and
flowCand(mid, toReturn, returnApf, TFrontHead(tc), unbind(config))
)
}
Expand Down Expand Up @@ -1737,7 +1740,7 @@ private predicate storeCand(
Node mid, TypedContent tc, Node node, AccessPathFront apf0, AccessPathFront apf,
Configuration config
) {
storeCand2(mid, tc, node, config) and
storeCand2(mid, tc, node, _, config) and
flowCand(mid, _, _, apf0, config) and
apf.headUsesContent(tc)
}
Expand Down Expand Up @@ -1919,7 +1922,7 @@ pragma[nomagic]
private predicate storeFlowFwd(
Node node1, TypedContent tc, Node node2, AccessPath ap, AccessPath ap0, Configuration config
) {
storeCand2(node1, tc, node2, config) and
storeCand2(node1, tc, node2, _, config) and
flowFwdStore(node2, tc, ap, _, _, _, config) and
ap0 = push(tc, ap)
}
Expand Down Expand Up @@ -2307,7 +2310,7 @@ private predicate pathReadStep(

pragma[nomagic]
private predicate storeCand(Node node1, TypedContent tc, Node node2, Configuration config) {
storeCand2(node1, tc, node2, config) and
storeCand2(node1, tc, node2, _, config) and
flow(node2, config)
}

Expand Down Expand Up @@ -2799,13 +2802,13 @@ private module FlowExploration {
PartialPathNodePriv mid, PartialAccessPath ap1, TypedContent tc, Node node,
PartialAccessPath ap2
) {
exists(Node midNode |
exists(Node midNode, DataFlowType contentType |
midNode = mid.getNode() and
ap1 = mid.getAp() and
store(midNode, tc, node) and
store(midNode, tc, node, contentType) and
ap2.getHead() = tc and
ap2.len() = unbindInt(ap1.len() + 1) and
compatibleTypes(ap1.getType(), getErasedNodeTypeBound(midNode))
compatibleTypes(ap1.getType(), contentType)
)
}

Expand All @@ -2830,8 +2833,7 @@ private module FlowExploration {
read(midNode, tc.getContent(), node) and
ap.getHead() = tc and
config = mid.getConfiguration() and
cc = mid.getCallContext() and
compatibleTypes(tc.getContainerType(), getErasedNodeTypeBound(midNode))
cc = mid.getCallContext()
)
}

Expand Down
58 changes: 30 additions & 28 deletions cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -289,7 +289,7 @@ private predicate nodeCandFwd1(Node node, boolean fromArg, Configuration config)
exists(Node mid |
useFieldFlow(config) and
nodeCandFwd1(mid, fromArg, config) and
store(mid, _, node) and
store(mid, _, node, _) and
not outBarrier(mid, config)
)
or
Expand Down Expand Up @@ -337,7 +337,7 @@ private predicate nodeCandFwd1IsStored(Content c, Configuration config) {
not fullBarrier(node, config) and
useFieldFlow(config) and
nodeCandFwd1(mid, config) and
store(mid, tc, node) and
store(mid, tc, node, _) and
c = tc.getContent()
)
}
Expand Down Expand Up @@ -469,7 +469,7 @@ private predicate nodeCand1Store(Content c, Node node, boolean toReturn, Configu
exists(Node mid, TypedContent tc |
nodeCand1(mid, toReturn, config) and
nodeCandFwd1IsStored(c, unbind(config)) and
store(node, tc, mid) and
store(node, tc, mid, _) and
c = tc.getContent()
)
}
Expand Down Expand Up @@ -571,11 +571,11 @@ private predicate parameterThroughFlowNodeCand1(ParameterNode p, Configuration c
}

pragma[nomagic]
private predicate store(Node n1, Content c, Node n2, Configuration config) {
private predicate storeCand1(Node n1, Content c, Node n2, Configuration config) {
exists(TypedContent tc |
nodeCand1IsReadAndStored(c, config) and
nodeCand1(n2, unbind(config)) and
store(n1, tc, n2) and
store(n1, tc, n2, _) and
c = tc.getContent()
)
}
Expand Down Expand Up @@ -758,7 +758,7 @@ private predicate nodeCandFwd2(
// store
exists(Node mid |
nodeCandFwd2(mid, fromArg, argStored, _, config) and
store(mid, _, node, config) and
storeCand1(mid, _, node, config) and
stored = true
)
or
Expand Down Expand Up @@ -797,7 +797,7 @@ private predicate nodeCandFwd2IsStored(Content c, boolean stored, Configuration
useFieldFlow(config) and
nodeCand1(node, unbind(config)) and
nodeCandFwd2(mid, _, _, stored, config) and
store(mid, c, node, config)
storeCand1(mid, c, node, config)
)
}

Expand Down Expand Up @@ -957,7 +957,7 @@ private predicate nodeCand2Store(
Configuration config
) {
exists(Node mid |
store(node, c, mid, config) and
storeCand1(node, c, mid, config) and
nodeCand2(mid, toReturn, returnRead, true, config) and
nodeCandFwd2(node, _, _, stored, unbind(config))
)
Expand Down Expand Up @@ -1066,7 +1066,7 @@ private module LocalFlowBigStep {
additionalJumpStep(_, node, config) or
node instanceof ParameterNode or
node instanceof OutNodeExt or
store(_, _, node) or
store(_, _, node, _) or
read(_, _, node) or
node instanceof CastNode
)
Expand All @@ -1082,7 +1082,7 @@ private module LocalFlowBigStep {
additionalJumpStep(node, next, config) or
flowIntoCallNodeCand1(_, node, next, config) or
flowOutOfCallNodeCand1(_, node, next, config) or
store(node, _, next) or
store(node, _, next, _) or
read(node, _, next)
)
or
Expand Down Expand Up @@ -1170,8 +1170,10 @@ private predicate readCand2(Node node1, Content c, Node node2, Configuration con
}

pragma[nomagic]
private predicate storeCand2(Node node1, TypedContent tc, Node node2, Configuration config) {
store(node1, tc, node2) and
private predicate storeCand2(
Node node1, TypedContent tc, Node node2, DataFlowType contentType, Configuration config
) {
store(node1, tc, node2, contentType) and
nodeCand2(node1, config) and
nodeCand2(node2, _, _, true, unbind(config)) and
nodeCand2IsReadAndStored(tc.getContent(), unbind(config))
Expand Down Expand Up @@ -1235,11 +1237,12 @@ private predicate flowCandFwd0(
)
or
// store
exists(Node mid, TypedContent tc |
flowCandFwd(mid, fromArg, argApf, _, config) and
storeCand2(mid, tc, node, config) and
exists(Node mid, TypedContent tc, AccessPathFront apf0, DataFlowType contentType |
flowCandFwd(mid, fromArg, argApf, apf0, config) and
storeCand2(mid, tc, node, contentType, config) and
nodeCand2(node, _, _, true, unbind(config)) and
apf.headUsesContent(tc)
apf.headUsesContent(tc) and
compatibleTypes(apf0.getType(), contentType)
)
or
// read
Expand Down Expand Up @@ -1270,11 +1273,11 @@ private predicate flowCandFwd0(

pragma[nomagic]
private predicate flowCandFwdConsCand(TypedContent tc, AccessPathFront apf, Configuration config) {
exists(Node mid, Node n |
exists(Node mid, Node n, DataFlowType contentType |
flowCandFwd(mid, _, _, apf, config) and
storeCand2(mid, tc, n, config) and
storeCand2(mid, tc, n, contentType, config) and
nodeCand2(n, _, _, true, unbind(config)) and
compatibleTypes(apf.getType(), mid.getTypeBound())
compatibleTypes(apf.getType(), contentType)
)
}

Expand Down Expand Up @@ -1454,7 +1457,7 @@ private predicate flowCandStore(
) {
exists(Node mid |
flowCandFwd(node, _, _, apf, config) and
storeCand2(node, tc, mid, unbind(config)) and
storeCand2(node, tc, mid, _, unbind(config)) and
flowCand(mid, toReturn, returnApf, TFrontHead(tc), unbind(config))
)
}
Expand Down Expand Up @@ -1737,7 +1740,7 @@ private predicate storeCand(
Node mid, TypedContent tc, Node node, AccessPathFront apf0, AccessPathFront apf,
Configuration config
) {
storeCand2(mid, tc, node, config) and
storeCand2(mid, tc, node, _, config) and
flowCand(mid, _, _, apf0, config) and
apf.headUsesContent(tc)
}
Expand Down Expand Up @@ -1919,7 +1922,7 @@ pragma[nomagic]
private predicate storeFlowFwd(
Node node1, TypedContent tc, Node node2, AccessPath ap, AccessPath ap0, Configuration config
) {
storeCand2(node1, tc, node2, config) and
storeCand2(node1, tc, node2, _, config) and
flowFwdStore(node2, tc, ap, _, _, _, config) and
ap0 = push(tc, ap)
}
Expand Down Expand Up @@ -2307,7 +2310,7 @@ private predicate pathReadStep(

pragma[nomagic]
private predicate storeCand(Node node1, TypedContent tc, Node node2, Configuration config) {
storeCand2(node1, tc, node2, config) and
storeCand2(node1, tc, node2, _, config) and
flow(node2, config)
}

Expand Down Expand Up @@ -2799,13 +2802,13 @@ private module FlowExploration {
PartialPathNodePriv mid, PartialAccessPath ap1, TypedContent tc, Node node,
PartialAccessPath ap2
) {
exists(Node midNode |
exists(Node midNode, DataFlowType contentType |
midNode = mid.getNode() and
ap1 = mid.getAp() and
store(midNode, tc, node) and
store(midNode, tc, node, contentType) and
ap2.getHead() = tc and
ap2.len() = unbindInt(ap1.len() + 1) and
compatibleTypes(ap1.getType(), getErasedNodeTypeBound(midNode))
compatibleTypes(ap1.getType(), contentType)
)
}

Expand All @@ -2830,8 +2833,7 @@ private module FlowExploration {
read(midNode, tc.getContent(), node) and
ap.getHead() = tc and
config = mid.getConfiguration() and
cc = mid.getCallContext() and
compatibleTypes(tc.getContainerType(), getErasedNodeTypeBound(midNode))
cc = mid.getCallContext()
)
}

Expand Down
Loading