Merge pull request #20950 from paldepind/rust/ti-raw-pointer

Rust: Type inference for raw pointers

rust/ql/test/library-tests/elements/builtintypes/BuiltinTypes.expected

@@ -1,5 +1,5 @@
 | struct Array |  |
-| struct Ptr |  |
+| struct PtrConst |  |
 | struct PtrMut |  |
 | struct Ref |  |
 | struct RefMut |  |

rust/ql/test/library-tests/type-inference/raw_pointer.rs

@@ -0,0 +1,60 @@
+use std::ptr::null_mut;
+
+fn raw_pointer_const_deref(x: *const i32) -> i32 {
+    let _y = unsafe { *x }; // $ type=_y:i32
+    0
+}
+
+fn raw_pointer_mut_deref(x: *mut bool) -> i32 {
+    let _y = unsafe { *x }; // $ type=_y:bool
+    0
+}
+
+fn raw_const_borrow() {
+    let a: i64 = 10;
+    let x = &raw const a; // $ type=x:TPtrConst.i64
+    unsafe {
+        let _y = *x; // $ type=_y:i64
+    }
+}
+
+fn raw_mut_borrow() {
+    let mut a = 10i32;
+    let x = &raw mut a; // $ type=x:TPtrMut.i32
+    unsafe {
+        let _y = *x; // $ type=_y:i32
+    }
+}
+
+fn raw_mut_write(cond: bool) {
+    let a = 10i32;
+    // The type of `ptr_written` must be inferred from the write below.
+    let ptr_written = null_mut(); // $ target=null_mut type=ptr_written:TPtrMut.i32
+    if cond {
+        unsafe {
+            // NOTE: This write is undefined behavior because `ptr_written` is a null pointer.
+            *ptr_written = a;
+            let _y = *ptr_written; // $ type=_y:i32
+        }
+    }
+}
+
+fn raw_type_from_deref(cond: bool) {
+    // The type of `ptr_read` must be inferred from the read below.
+    let ptr_read = null_mut(); // $ target=null_mut type=ptr_read:TPtrMut.i64
+    if cond {
+        unsafe {
+            // NOTE: This read is undefined behavior because `ptr_read` is a null pointer.
+            let _y: i64 = *ptr_read;
+        }
+    }
+}
+
+pub fn test() {
+    raw_pointer_const_deref(&10); // $ target=raw_pointer_const_deref
+    raw_pointer_mut_deref(&mut true); // $ target=raw_pointer_mut_deref
+    raw_const_borrow(); // $ target=raw_const_borrow
+    raw_mut_borrow(); // $ target=raw_mut_borrow
+    raw_mut_write(false); // $ target=raw_mut_write
+    raw_type_from_deref(false); // $ target=raw_type_from_deref
+}

rust/ql/test/library-tests/type-inference/type-inference.ql

@@ -4,15 +4,25 @@ import codeql.rust.internal.Type
 import codeql.rust.internal.TypeInference as TypeInference
 import TypeInference
 
-query predicate inferType(AstNode n, TypePath path, Type t) {
-  t = TypeInference::inferType(n, path) and
-  t != TUnknownType() and
+private predicate relevantNode(AstNode n) {
   n.fromSource() and
   not n.isFromMacroExpansion() and
   not n instanceof IdentPat and // avoid overlap in the output with the underlying `Name` node
   not n instanceof LiteralPat // avoid overlap in the output with the underlying `Literal` node
 }
 
+query predicate inferCertainType(AstNode n, TypePath path, Type t) {
+  t = TypeInference::CertainTypeInference::inferCertainType(n, path) and
+  t != TUnknownType() and
+  relevantNode(n)
+}
+
+query predicate inferType(AstNode n, TypePath path, Type t) {
+  t = TypeInference::inferType(n, path) and
+  t != TUnknownType() and
+  relevantNode(n)
+}
+
 module ResolveTest implements TestSig {
   string getARelevantTag() { result = ["target", "fieldof"] }
 

rust/ql/test/query-tests/security/CWE-696/CONSISTENCY/PathResolutionConsistency.expected

@@ -1,2 +0,0 @@
-multipleCallTargets
-| test.rs:117:9:117:21 | ptr.is_null() |

rust/ql/test/query-tests/security/CWE-770/CONSISTENCY/PathResolutionConsistency.expected

@@ -1,7 +0,0 @@
-multipleCallTargets
-| main.rs:242:44:242:78 | ... .cast() |
-| main.rs:245:44:245:78 | ... .cast() |
-| main.rs:248:44:248:78 | ... .cast() |
-| main.rs:251:14:251:48 | ... .cast() |
-| main.rs:254:14:254:48 | ... .cast() |
-| main.rs:257:14:257:48 | ... .cast() |

rust/ql/test/query-tests/security/CWE-825/CONSISTENCY/PathResolutionConsistency.expected

@@ -1,12 +1,4 @@
 multipleCallTargets
-| deallocation.rs:162:5:162:17 | ptr.is_null() |
-| deallocation.rs:174:7:174:19 | ptr.is_null() |
-| deallocation.rs:186:5:186:17 | ptr.is_null() |
-| deallocation.rs:190:5:190:17 | ptr.is_null() |
-| deallocation.rs:194:6:194:18 | ptr.is_null() |
-| deallocation.rs:202:5:202:17 | ptr.is_null() |
-| deallocation.rs:210:25:210:37 | ptr.is_null() |
-| deallocation.rs:225:5:225:23 | const_ptr.is_null() |
 | deallocation.rs:354:11:354:29 | ...::from(...) |
 | deallocation.rs:355:11:355:29 | ...::from(...) |
 | lifetime.rs:610:13:610:31 | ...::from(...) |