hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-23 15:55:18 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: Improve indirectionForModelledFunction.

Browse Source
This commit is contained in:
Geoffrey White
2024-04-09 11:51:42 +01:00
parent 70bb29581d
commit 13734d4e62
4 changed files with 18 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll
View File

@@ -264,20 +264,23 @@ module Private {
module Public = Impl::Public;
/**
* Gets the number of indirections that can be returned by the function
* modelled using the given MaD row.
* Gets a number of indirections that can be returned by a function
* modelled using models-as-data.
*/
int indirectionForModelledFunction(
string namespace, string type, boolean subtypes, string name, string signature, string ext,
string input, string output, string kind, string provenance
) {
summaryModel(namespace, type, subtypes, name, signature, ext, input, output, kind, provenance) and
(
// Return the number of stars in `ReturnValue[...]`
result = output.regexpCapture("ReturnValue\\[(\\*+)\\]", 1).length()
or
// There are no brackets the result is 0
output = "ReturnValue" and
result = 0
int returnIndirectionForModelledFunction() {
exists(string inputOutput |
(
sourceModel(_, _, _, _, _, _, inputOutput, _, _) or
sinkModel(_, _, _, _, _, _, inputOutput, _, _) or
summaryModel(_, _, _, _, _, _, inputOutput, _, _, _) or
summaryModel(_, _, _, _, _, _, _, inputOutput, _, _)
) and (
// Return the number of stars in `ReturnValue[...]`
result = inputOutput.regexpCapture("ReturnValue\\[(\\*+)\\]", 1).length()
or
// There are no brackets the result is 0
inputOutput = "ReturnValue" and
result = 0
)
)
}

2
cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
View File

@@ -460,7 +460,7 @@ private newtype TReturnKind =
Ssa::hasIndirectOperand(any(ReturnValueInstruction ret).getReturnAddressOperand(),
indirectionIndex + 1) // We subtract one because the return loads the value.
or
indirectionIndex = FlowSummaryImpl::indirectionForModelledFunction(_, _, _, _, _, _, _, _, _, _)
indirectionIndex = FlowSummaryImpl::returnIndirectionForModelledFunction()
} or
TIndirectReturnKind(int argumentIndex, int indirectionIndex) {
exists(Ssa::FinalParameterUse use |

9
cpp/ql/test/library-tests/dataflow/source-sink-tests/local-flow.expected
View File

@@ -1,11 +1,2 @@
testFailures
| sources-and-sinks.cpp:78:20:78:36 | // $ local_source | Missing result:local_source= |
| sources-and-sinks.cpp:79:21:79:37 | // $ local_source | Missing result:local_source= |
| sources-and-sinks.cpp:80:25:80:41 | // $ local_source | Missing result:local_source= |
| sources-and-sinks.cpp:81:28:81:44 | // $ local_source | Missing result:local_source= |
| sources-and-sinks.cpp:82:32:82:48 | // $ local_source | Missing result:local_source= |
| sources-and-sinks.cpp:83:22:83:38 | // $ local_source | Missing result:local_source= |
| sources-and-sinks.cpp:84:26:84:42 | // $ local_source | Missing result:local_source= |
| sources-and-sinks.cpp:85:30:85:46 | // $ local_source | Missing result:local_source= |
| sources-and-sinks.cpp:86:34:86:50 | // $ local_source | Missing result:local_source= |
failures

4
cpp/ql/test/library-tests/dataflow/source-sink-tests/remote-flow.expected
View File

@@ -1,6 +1,2 @@
testFailures
| sources-and-sinks.cpp:73:25:73:42 | // $ remote_source | Missing result:remote_source= |
| sources-and-sinks.cpp:74:29:74:46 | // $ remote_source | Missing result:remote_source= |
| sources-and-sinks.cpp:75:33:75:50 | // $ remote_source | Missing result:remote_source= |
| sources-and-sinks.cpp:76:37:76:54 | // $ remote_source | Missing result:remote_source= |
failures