codeql-workshop-dataflow-c/readme-low-level.org

• CodeQL AST in dot and pdf
• CodeQL CFG in dot and pdf
• AST
• CFG
• GPTs
• Render via dot
• AST-CFG HYBRID
• Hybrid portion of source code

CodeQL AST in dot and pdf

The control flow graph is narrowed to the function of interest,

  int copy_mem(unsigned int unused, dyn_input_t *input,
               unsigned int input_types) {...}

from ./tests-common/test_part1.c, so we do the same for the AST.

  # Produce ast in dot format
  codeql database analyze                             \
         --format=dot --output=ast.dot                \
         -j8 -v --ram=16000                           \
         --rerun                                      \
         --                                           \
         cpp-dataflow-part1-database                  \
         graphs/ast.ql                            

  # Convert dot to pdf
  dot -Tpdf < ast.dot/cpp/print-ast.dot > ast.dot/cpp/print-ast.pdf
  dot -Tsvg < ast.dot/cpp/print-ast.dot > ast.dot/cpp/print-ast.svg

  # View the graph
  open ast.dot/cpp/print-ast.pdf

  # This comes from
  tests-common/test_part1.c

CodeQL CFG in dot and pdf

The whole control flow graph is very large, so the query narrows it to the function of interest,

  int copy_mem(unsigned int unused, dyn_input_t *input,
               unsigned int input_types) {...}

from ./tests-common/test_part1.c

  # Produce CFG in dot format
  codeql database analyze                             \
         --format=dot --output=cfg.dot                \
         -j8 -v --ram=16000                           \
         --rerun                                      \
         --                                           \
         cpp-dataflow-part1-database                  \
         graphs/cfg.ql                            


  # Convert dot to pdf
  dot -Tpdf < cfg.dot/cpp/print-cfg.dot > cfg.dot/cpp/print-cfg.pdf
  dot -Tsvg < cfg.dot/cpp/print-cfg.dot > cfg.dot/cpp/print-cfg.svg

  # View the graph
  open cfg.dot/cpp/print-cfg.pdf

AST

The ast is inlined here. For better viewing, open the pdf (./ast.dot/cpp/print-ast.pdf) separately.

CFG

The cfg is inlined here. For better viewing, open the pdf (./cfg.dot/cpp/print-cfg.pdf) separately.

GPTs

A gpt was used to add 17 of the CFG edges to the AST tree; more resulted in a very confusing graph. The hybrid is in cfg.dot/cpp/ast-cfg-hybrid.dot

Render via dot

The hybrid is rendered via dot. The other renderers produced very spread layouts.

  # Convert dot to pdf
  twopi -Tpdf < cfg.dot/cpp/ast-cfg-hybrid.dot > cfg.dot/cpp/ast-cfg-hybrid.pdf
  circo -Tpdf < cfg.dot/cpp/ast-cfg-hybrid.dot > cfg.dot/cpp/ast-cfg-hybrid.pdf
  dot -Tpdf < cfg.dot/cpp/ast-cfg-hybrid.dot > cfg.dot/cpp/ast-cfg-hybrid.pdf
  dot -Tsvg < cfg.dot/cpp/ast-cfg-hybrid.dot > cfg.dot/cpp/ast-cfg-hybrid.svg

  # View the graph
  open -a skim cfg.dot/cpp/ast-cfg-hybrid.pdf

AST-CFG HYBRID

The ast-cfg hybrid is inlined here. For better viewing, open the pdf (./cfg.dot/cpp/ast-cfg-hybrid.pdf) separately.

Hybrid portion of source code

The part of the source code corresponding to the hybrid portion, with space for adding edges:

  int    copy_mem(unsigned    int    unused,    dyn_input_t    *input,


               unsigned    int    input_types)    {


      memcpy(input[0].ptr.buf,    input[1].ptr.buf,


             input[1].ptr.size);  


      copy_mem_nested(input);   

      ...;
  }