hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 10:15:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' into sideeffect

Browse Source
This commit is contained in:
Geoffrey White
2020-03-18 16:59:32 +00:00
parent 6cc1c2341c b0303158a5
commit 2e4e491ce8
98 changed files with 2297 additions and 778 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
cpp/ql/test/library-tests/dataflow/security-taint/tainted.expected
View File

@@ -67,3 +67,9 @@
| test.cpp:83:28:83:33 | call to getenv | test.cpp:88:7:88:27 | (bool)... | |
| test.cpp:83:28:83:33 | call to getenv | test.cpp:88:14:88:17 | (const char *)... | |
| test.cpp:83:28:83:33 | call to getenv | test.cpp:88:14:88:17 | copy | |
| test.cpp:100:12:100:15 | call to gets | test.cpp:98:8:98:14 | pointer | |
| test.cpp:100:12:100:15 | call to gets | test.cpp:100:2:100:8 | pointer | |
| test.cpp:100:12:100:15 | call to gets | test.cpp:100:12:100:15 | call to gets | |
| test.cpp:100:17:100:22 | buffer | test.cpp:93:18:93:18 | s | |
| test.cpp:100:17:100:22 | buffer | test.cpp:97:7:97:12 | buffer | |
| test.cpp:100:17:100:22 | buffer | test.cpp:100:17:100:22 | buffer | |

3
cpp/ql/test/library-tests/dataflow/security-taint/tainted_diff.expected
View File

@@ -11,3 +11,6 @@
| test.cpp:83:28:83:33 | call to getenv | test.cpp:11:20:11:21 | s1 | AST only |
| test.cpp:83:28:83:33 | call to getenv | test.cpp:85:8:85:11 | copy | AST only |
| test.cpp:83:28:83:33 | call to getenv | test.cpp:86:9:86:12 | copy | AST only |
| test.cpp:100:12:100:15 | call to gets | test.cpp:100:2:100:8 | pointer | AST only |
| test.cpp:100:17:100:22 | buffer | test.cpp:97:7:97:12 | buffer | AST only |
| test.cpp:100:17:100:22 | buffer | test.cpp:100:17:100:22 | array to pointer conversion | IR only |

5
cpp/ql/test/library-tests/dataflow/security-taint/tainted_ir.expected
View File

@@ -52,3 +52,8 @@
| test.cpp:83:28:83:33 | call to getenv | test.cpp:88:7:88:27 | (bool)... | |
| test.cpp:83:28:83:33 | call to getenv | test.cpp:88:14:88:17 | (const char *)... | |
| test.cpp:83:28:83:33 | call to getenv | test.cpp:88:14:88:17 | copy | |
| test.cpp:100:12:100:15 | call to gets | test.cpp:98:8:98:14 | pointer | |
| test.cpp:100:12:100:15 | call to gets | test.cpp:100:12:100:15 | call to gets | |
| test.cpp:100:17:100:22 | buffer | test.cpp:93:18:93:18 | s | |
| test.cpp:100:17:100:22 | buffer | test.cpp:100:17:100:22 | array to pointer conversion | |
| test.cpp:100:17:100:22 | buffer | test.cpp:100:17:100:22 | buffer | |

12
cpp/ql/test/library-tests/dataflow/security-taint/test.cpp
View File

@@ -88,4 +88,14 @@ void mallocBuffer() {
if (!strcmp(copy, "admin")) { // copy should be tainted
isAdmin = true;
}
}
}
char *gets(char *s);
void test_gets()
{
char buffer[1024];
char *pointer;
pointer = gets(buffer);
}

239
cpp/ql/test/library-tests/ir/ir/PrintAST.expected
View File

@@ -8303,76 +8303,177 @@ ir.cpp:
# 1219| Type = [IntType] int
# 1219| ValueCategory = prvalue(load)
# 1220| 4: [ReturnStmt] return ...
# 1224| [TopLevelFunction] char* strcpy(char*, char const*)
# 1224| params:
# 1224| 0: [Parameter] destination
# 1224| Type = [CharPointerType] char *
# 1224| 1: [Parameter] source
# 1224| Type = [PointerType] const char *
# 1225| [TopLevelFunction] char* strcat(char*, char const*)
# 1225| params:
# 1225| 0: [Parameter] destination
# 1225| Type = [CharPointerType] char *
# 1225| 1: [Parameter] source
# 1225| Type = [PointerType] const char *
# 1227| [TopLevelFunction] void test_strings(char*, char*)
# 1227| params:
# 1227| 0: [Parameter] s1
# 1227| Type = [CharPointerType] char *
# 1227| 1: [Parameter] s2
# 1227| Type = [CharPointerType] char *
# 1227| body: [Block] { ... }
# 1228| 0: [DeclStmt] declaration
# 1228| 0: [VariableDeclarationEntry] definition of buffer
# 1228| Type = [ArrayType] char[1024]
# 1228| init: [Initializer] initializer for buffer
# 1228| expr: [ArrayAggregateLiteral] {...}
# 1228| Type = [ArrayType] char[1024]
# 1222| [TopLevelFunction] int staticLocalInit(int)
# 1222| params:
# 1222| 0: [Parameter] x
# 1222| Type = [IntType] int
# 1222| body: [Block] { ... }
# 1223| 0: [DeclStmt] declaration
# 1223| 0: [VariableDeclarationEntry] definition of a
# 1223| Type = [IntType] int
# 1223| init: [Initializer] initializer for a
# 1223| expr: [Literal] 0
# 1223| Type = [IntType] int
# 1223| Value = [Literal] 0
# 1223| ValueCategory = prvalue
# 1224| 1: [DeclStmt] declaration
# 1224| 0: [VariableDeclarationEntry] definition of b
# 1224| Type = [IntType] int
# 1224| init: [Initializer] initializer for b
# 1224| expr: [CStyleCast] (int)...
# 1224| Conversion = [IntegralConversion] integral conversion
# 1224| Type = [IntType] int
# 1224| Value = [CStyleCast] 4
# 1224| ValueCategory = prvalue
# 1224| expr: [SizeofExprOperator] sizeof(<expr>)
# 1224| Type = [LongType] unsigned long
# 1224| Value = [SizeofExprOperator] 4
# 1224| ValueCategory = prvalue
# 1224| 0: [ParenthesisExpr] (...)
# 1224| Type = [IntType] int
# 1224| ValueCategory = lvalue
# 1224| expr: [VariableAccess] x
# 1224| Type = [IntType] int
# 1224| ValueCategory = lvalue
# 1225| 2: [DeclStmt] declaration
# 1225| 0: [VariableDeclarationEntry] definition of c
# 1225| Type = [IntType] int
# 1225| init: [Initializer] initializer for c
# 1225| expr: [VariableAccess] x
# 1225| Type = [IntType] int
# 1225| ValueCategory = prvalue(load)
# 1226| 3: [DeclStmt] declaration
# 1226| 0: [VariableDeclarationEntry] definition of d
# 1226| Type = [IntType] int
# 1228| 4: [ReturnStmt] return ...
# 1228| 0: [AddExpr] ... + ...
# 1228| Type = [IntType] int
# 1228| ValueCategory = prvalue
# 1228| 0: [AddExpr] ... + ...
# 1228| Type = [IntType] int
# 1228| ValueCategory = prvalue
# 1228| 0: [AddExpr] ... + ...
# 1228| Type = [IntType] int
# 1228| ValueCategory = prvalue
# 1228| [0]: [CStyleCast] (char)...
# 1228| Conversion = [IntegralConversion] integral conversion
# 1228| Type = [PlainCharType] char
# 1228| Value = [CStyleCast] 0
# 1228| ValueCategory = prvalue
# 1228| expr: [Literal] 0
# 1228| Type = [IntType] int
# 1228| Value = [Literal] 0
# 1228| ValueCategory = prvalue
# 1230| 1: [ExprStmt] ExprStmt
# 1230| 0: [FunctionCall] call to strcpy
# 1230| Type = [CharPointerType] char *
# 1230| ValueCategory = prvalue
# 1230| 0: [ArrayToPointerConversion] array to pointer conversion
# 1230| Type = [CharPointerType] char *
# 1230| ValueCategory = prvalue
# 1230| expr: [VariableAccess] buffer
# 1230| Type = [ArrayType] char[1024]
# 1230| ValueCategory = lvalue
# 1230| 1: [CStyleCast] (const char *)...
# 1230| Conversion = [PointerConversion] pointer conversion
# 1230| Type = [PointerType] const char *
# 1230| ValueCategory = prvalue
# 1230| expr: [VariableAccess] s1
# 1230| Type = [CharPointerType] char *
# 1230| ValueCategory = prvalue(load)
# 1231| 2: [ExprStmt] ExprStmt
# 1231| 0: [FunctionCall] call to strcat
# 1231| Type = [CharPointerType] char *
# 1231| ValueCategory = prvalue
# 1231| 0: [ArrayToPointerConversion] array to pointer conversion
# 1231| Type = [CharPointerType] char *
# 1231| ValueCategory = prvalue
# 1231| expr: [VariableAccess] buffer
# 1231| Type = [ArrayType] char[1024]
# 1231| ValueCategory = lvalue
# 1231| 1: [CStyleCast] (const char *)...
# 1231| Conversion = [PointerConversion] pointer conversion
# 1231| Type = [PointerType] const char *
# 1231| ValueCategory = prvalue
# 1231| expr: [VariableAccess] s2
# 1231| Type = [CharPointerType] char *
# 1231| ValueCategory = prvalue(load)
# 1232| 3: [ReturnStmt] return ...
# 1228| 0: [VariableAccess] a
# 1228| Type = [IntType] int
# 1228| ValueCategory = prvalue(load)
# 1228| 1: [VariableAccess] b
# 1228| Type = [IntType] int
# 1228| ValueCategory = prvalue(load)
# 1228| 1: [VariableAccess] c
# 1228| Type = [IntType] int
# 1228| ValueCategory = prvalue(load)
# 1228| 1: [VariableAccess] d
# 1228| Type = [IntType] int
# 1228| ValueCategory = prvalue(load)
# 1231| [TopLevelFunction] void staticLocalWithConstructor(char const*)
# 1231| params:
# 1231| 0: [Parameter] dynamic
# 1231| Type = [PointerType] const char *
# 1231| body: [Block] { ... }
# 1232| 0: [DeclStmt] declaration
# 1232| 0: [VariableDeclarationEntry] definition of a
# 1232| Type = [Struct] String
#-----| init: [Initializer] initializer for a
#-----| expr: [ConstructorCall] call to String
#-----| Type = [VoidType] void
#-----| ValueCategory = prvalue
# 1233| 1: [DeclStmt] declaration
# 1233| 0: [VariableDeclarationEntry] definition of b
# 1233| Type = [Struct] String
# 1233| init: [Initializer] initializer for b
# 1233| expr: [ConstructorCall] call to String
# 1233| Type = [VoidType] void
# 1233| ValueCategory = prvalue
# 1233| 0: [ArrayToPointerConversion] array to pointer conversion
# 1233| Type = [PointerType] const char *
# 1233| ValueCategory = prvalue
# 1233| expr: static
# 1233| Type = [ArrayType] const char[7]
# 1233| Value = [StringLiteral] "static"
# 1233| ValueCategory = lvalue
# 1234| 2: [DeclStmt] declaration
# 1234| 0: [VariableDeclarationEntry] definition of c
# 1234| Type = [Struct] String
# 1234| init: [Initializer] initializer for c
# 1234| expr: [ConstructorCall] call to String
# 1234| Type = [VoidType] void
# 1234| ValueCategory = prvalue
# 1234| 0: [VariableAccess] dynamic
# 1234| Type = [PointerType] const char *
# 1234| ValueCategory = prvalue(load)
# 1235| 3: [ReturnStmt] return ...
# 1239| [TopLevelFunction] char* strcpy(char*, char const*)
# 1239| params:
# 1239| 0: [Parameter] destination
# 1239| Type = [CharPointerType] char *
# 1239| 1: [Parameter] source
# 1239| Type = [PointerType] const char *
# 1240| [TopLevelFunction] char* strcat(char*, char const*)
# 1240| params:
# 1240| 0: [Parameter] destination
# 1240| Type = [CharPointerType] char *
# 1240| 1: [Parameter] source
# 1240| Type = [PointerType] const char *
# 1242| [TopLevelFunction] void test_strings(char*, char*)
# 1242| params:
# 1242| 0: [Parameter] s1
# 1242| Type = [CharPointerType] char *
# 1242| 1: [Parameter] s2
# 1242| Type = [CharPointerType] char *
# 1242| body: [Block] { ... }
# 1243| 0: [DeclStmt] declaration
# 1243| 0: [VariableDeclarationEntry] definition of buffer
# 1243| Type = [ArrayType] char[1024]
# 1243| init: [Initializer] initializer for buffer
# 1243| expr: [ArrayAggregateLiteral] {...}
# 1243| Type = [ArrayType] char[1024]
# 1243| ValueCategory = prvalue
# 1243| [0]: [CStyleCast] (char)...
# 1243| Conversion = [IntegralConversion] integral conversion
# 1243| Type = [PlainCharType] char
# 1243| Value = [CStyleCast] 0
# 1243| ValueCategory = prvalue
# 1243| expr: [Literal] 0
# 1243| Type = [IntType] int
# 1243| Value = [Literal] 0
# 1243| ValueCategory = prvalue
# 1245| 1: [ExprStmt] ExprStmt
# 1245| 0: [FunctionCall] call to strcpy
# 1245| Type = [CharPointerType] char *
# 1245| ValueCategory = prvalue
# 1245| 0: [ArrayToPointerConversion] array to pointer conversion
# 1245| Type = [CharPointerType] char *
# 1245| ValueCategory = prvalue
# 1245| expr: [VariableAccess] buffer
# 1245| Type = [ArrayType] char[1024]
# 1245| ValueCategory = lvalue
# 1245| 1: [CStyleCast] (const char *)...
# 1245| Conversion = [PointerConversion] pointer conversion
# 1245| Type = [PointerType] const char *
# 1245| ValueCategory = prvalue
# 1245| expr: [VariableAccess] s1
# 1245| Type = [CharPointerType] char *
# 1245| ValueCategory = prvalue(load)
# 1246| 2: [ExprStmt] ExprStmt
# 1246| 0: [FunctionCall] call to strcat
# 1246| Type = [CharPointerType] char *
# 1246| ValueCategory = prvalue
# 1246| 0: [ArrayToPointerConversion] array to pointer conversion
# 1246| Type = [CharPointerType] char *
# 1246| ValueCategory = prvalue
# 1246| expr: [VariableAccess] buffer
# 1246| Type = [ArrayType] char[1024]
# 1246| ValueCategory = lvalue
# 1246| 1: [CStyleCast] (const char *)...
# 1246| Conversion = [PointerConversion] pointer conversion
# 1246| Type = [PointerType] const char *
# 1246| ValueCategory = prvalue
# 1246| expr: [VariableAccess] s2
# 1246| Type = [CharPointerType] char *
# 1246| ValueCategory = prvalue(load)
# 1247| 3: [ReturnStmt] return ...
perf-regression.cpp:
# 4| [CopyAssignmentOperator] Big& Big::operator=(Big const&)
# 4| params:

15
cpp/ql/test/library-tests/ir/ir/ir.cpp
View File

@@ -1219,6 +1219,21 @@ void switch2Case_default(int x) {
int z = y;
}
int staticLocalInit(int x) {
static int a = 0; // Constant initialization
static int b = sizeof(x); // Constant initialization
static int c = x; // Dynamic initialization
static int d; // Zero initialization
return a + b + c + d;
}
void staticLocalWithConstructor(const char* dynamic) {
static String a;
static String b("static");
static String c(dynamic);
}
// --- strings ---
char *strcpy(char *destination, const char *source);

316
cpp/ql/test/library-tests/ir/ir/raw_ir.expected
View File

@@ -6228,56 +6228,175 @@ ir.cpp:
# 1205| v1205_9(void) = AliasedUse : ~mu1205_4
# 1205| v1205_10(void) = ExitFunction :
# 1227| void test_strings(char*, char*)
# 1227| Block 0
# 1227| v1227_1(void) = EnterFunction :
# 1227| mu1227_2(unknown) = AliasedDefinition :
# 1227| mu1227_3(unknown) = InitializeNonLocal :
# 1227| mu1227_4(unknown) = UnmodeledDefinition :
# 1227| r1227_5(glval<char *>) = VariableAddress[s1] :
# 1227| mu1227_6(char *) = InitializeParameter[s1] : &:r1227_5
# 1227| r1227_7(char *) = Load : &:r1227_5, ~mu1227_6
# 1227| mu1227_8(unknown) = InitializeIndirection[s1] : &:r1227_7
# 1227| r1227_9(glval<char *>) = VariableAddress[s2] :
# 1227| mu1227_10(char *) = InitializeParameter[s2] : &:r1227_9
# 1227| r1227_11(char *) = Load : &:r1227_9, ~mu1227_10
# 1227| mu1227_12(unknown) = InitializeIndirection[s2] : &:r1227_11
# 1228| r1228_1(glval<char[1024]>) = VariableAddress[buffer] :
# 1228| mu1228_2(char[1024]) = Uninitialized[buffer] : &:r1228_1
# 1228| r1228_3(int) = Constant[0] :
# 1228| r1228_4(glval<char>) = PointerAdd[1] : r1228_1, r1228_3
# 1228| r1228_5(char) = Constant[0] :
# 1228| mu1228_6(char) = Store : &:r1228_4, r1228_5
# 1228| r1228_7(int) = Constant[1] :
# 1228| r1228_8(glval<char>) = PointerAdd[1] : r1228_1, r1228_7
# 1228| r1228_9(unknown[1023]) = Constant[0] :
# 1228| mu1228_10(unknown[1023]) = Store : &:r1228_8, r1228_9
# 1230| r1230_1(glval<unknown>) = FunctionAddress[strcpy] :
# 1230| r1230_2(glval<char[1024]>) = VariableAddress[buffer] :
# 1230| r1230_3(char *) = Convert : r1230_2
# 1230| r1230_4(glval<char *>) = VariableAddress[s1] :
# 1230| r1230_5(char *) = Load : &:r1230_4, ~mu1227_4
# 1230| r1230_6(char *) = Convert : r1230_5
# 1230| r1230_7(char *) = Call : func:r1230_1, 0:r1230_3, 1:r1230_6
# 1230| v1230_8(void) = ^BufferReadSideEffect[1] : &:r1230_6, ~mu1227_4
# 1230| mu1230_9(unknown) = ^BufferMustWriteSideEffect[0] : &:r1230_3
# 1231| r1231_1(glval<unknown>) = FunctionAddress[strcat] :
# 1231| r1231_2(glval<char[1024]>) = VariableAddress[buffer] :
# 1231| r1231_3(char *) = Convert : r1231_2
# 1231| r1231_4(glval<char *>) = VariableAddress[s2] :
# 1231| r1231_5(char *) = Load : &:r1231_4, ~mu1227_4
# 1231| r1231_6(char *) = Convert : r1231_5
# 1231| r1231_7(char *) = Call : func:r1231_1, 0:r1231_3, 1:r1231_6
# 1231| v1231_8(void) = ^BufferReadSideEffect[0] : &:r1231_3, ~mu1227_4
# 1231| v1231_9(void) = ^BufferReadSideEffect[1] : &:r1231_6, ~mu1227_4
# 1231| mu1231_10(unknown) = ^BufferMayWriteSideEffect[0] : &:r1231_3
# 1232| v1232_1(void) = NoOp :
# 1227| v1227_13(void) = ReturnIndirection : &:r1227_7, ~mu1227_4
# 1227| v1227_14(void) = ReturnIndirection : &:r1227_11, ~mu1227_4
# 1227| v1227_15(void) = ReturnVoid :
# 1227| v1227_16(void) = UnmodeledUse : mu*
# 1227| v1227_17(void) = AliasedUse : ~mu1227_4
# 1227| v1227_18(void) = ExitFunction :
# 1222| int staticLocalInit(int)
# 1222| Block 0
# 1222| v1222_1(void) = EnterFunction :
# 1222| mu1222_2(unknown) = AliasedDefinition :
# 1222| mu1222_3(unknown) = InitializeNonLocal :
# 1222| mu1222_4(unknown) = UnmodeledDefinition :
# 1222| r1222_5(glval<int>) = VariableAddress[x] :
# 1222| mu1222_6(int) = InitializeParameter[x] : &:r1222_5
# 1225| r1225_1(glval<bool>) = VariableAddress[c#init] :
# 1225| r1225_2(bool) = Load : &:r1225_1, ~mu1222_4
# 1225| v1225_3(void) = ConditionalBranch : r1225_2
#-----| False -> Block 2
#-----| True -> Block 1
# 1228| Block 1
# 1228| r1228_1(glval<int>) = VariableAddress[#return] :
# 1228| r1228_2(glval<int>) = VariableAddress[a] :
# 1228| r1228_3(int) = Load : &:r1228_2, ~mu1222_4
# 1228| r1228_4(glval<int>) = VariableAddress[b] :
# 1228| r1228_5(int) = Load : &:r1228_4, ~mu1222_4
# 1228| r1228_6(int) = Add : r1228_3, r1228_5
# 1228| r1228_7(glval<int>) = VariableAddress[c] :
# 1228| r1228_8(int) = Load : &:r1228_7, ~mu1222_4
# 1228| r1228_9(int) = Add : r1228_6, r1228_8
# 1228| r1228_10(glval<int>) = VariableAddress[d] :
# 1228| r1228_11(int) = Load : &:r1228_10, ~mu1222_4
# 1228| r1228_12(int) = Add : r1228_9, r1228_11
# 1228| mu1228_13(int) = Store : &:r1228_1, r1228_12
# 1222| r1222_7(glval<int>) = VariableAddress[#return] :
# 1222| v1222_8(void) = ReturnValue : &:r1222_7, ~mu1222_4
# 1222| v1222_9(void) = UnmodeledUse : mu*
# 1222| v1222_10(void) = AliasedUse : ~mu1222_4
# 1222| v1222_11(void) = ExitFunction :
# 1225| Block 2
# 1225| r1225_4(glval<int>) = VariableAddress[c] :
# 1225| r1225_5(glval<int>) = VariableAddress[x] :
# 1225| r1225_6(int) = Load : &:r1225_5, ~mu1222_4
# 1225| mu1225_7(int) = Store : &:r1225_4, r1225_6
# 1225| r1225_8(bool) = Constant[1] :
# 1225| mu1225_9(bool) = Store : &:r1225_1, r1225_8
#-----| Goto -> Block 1
# 1231| void staticLocalWithConstructor(char const*)
# 1231| Block 0
# 1231| v1231_1(void) = EnterFunction :
# 1231| mu1231_2(unknown) = AliasedDefinition :
# 1231| mu1231_3(unknown) = InitializeNonLocal :
# 1231| mu1231_4(unknown) = UnmodeledDefinition :
# 1231| r1231_5(glval<char *>) = VariableAddress[dynamic] :
# 1231| mu1231_6(char *) = InitializeParameter[dynamic] : &:r1231_5
# 1231| r1231_7(char *) = Load : &:r1231_5, ~mu1231_6
# 1231| mu1231_8(unknown) = InitializeIndirection[dynamic] : &:r1231_7
# 1232| r1232_1(glval<bool>) = VariableAddress[a#init] :
# 1232| r1232_2(bool) = Load : &:r1232_1, ~mu1231_4
# 1232| v1232_3(void) = ConditionalBranch : r1232_2
#-----| False -> Block 6
#-----| True -> Block 1
# 1233| Block 1
# 1233| r1233_1(glval<bool>) = VariableAddress[b#init] :
# 1233| r1233_2(bool) = Load : &:r1233_1, ~mu1231_4
# 1233| v1233_3(void) = ConditionalBranch : r1233_2
#-----| False -> Block 2
#-----| True -> Block 3
# 1233| Block 2
# 1233| r1233_4(glval<String>) = VariableAddress[b] :
# 1233| r1233_5(glval<unknown>) = FunctionAddress[String] :
# 1233| r1233_6(glval<char[7]>) = StringConstant["static"] :
# 1233| r1233_7(char *) = Convert : r1233_6
# 1233| v1233_8(void) = Call : func:r1233_5, this:r1233_4, 0:r1233_7
# 1233| mu1233_9(unknown) = ^CallSideEffect : ~mu1231_4
# 1233| mu1233_10(String) = ^IndirectMayWriteSideEffect[-1] : &:r1233_4
# 1233| v1233_11(void) = ^BufferReadSideEffect[0] : &:r1233_7, ~mu1231_4
# 1233| mu1233_12(unknown) = ^BufferMayWriteSideEffect[0] : &:r1233_7
# 1233| r1233_13(bool) = Constant[1] :
# 1233| mu1233_14(bool) = Store : &:r1233_1, r1233_13
#-----| Goto -> Block 3
# 1234| Block 3
# 1234| r1234_1(glval<bool>) = VariableAddress[c#init] :
# 1234| r1234_2(bool) = Load : &:r1234_1, ~mu1231_4
# 1234| v1234_3(void) = ConditionalBranch : r1234_2
#-----| False -> Block 4
#-----| True -> Block 5
# 1234| Block 4
# 1234| r1234_4(glval<String>) = VariableAddress[c] :
# 1234| r1234_5(glval<unknown>) = FunctionAddress[String] :
# 1234| r1234_6(glval<char *>) = VariableAddress[dynamic] :
# 1234| r1234_7(char *) = Load : &:r1234_6, ~mu1231_4
# 1234| v1234_8(void) = Call : func:r1234_5, this:r1234_4, 0:r1234_7
# 1234| mu1234_9(unknown) = ^CallSideEffect : ~mu1231_4
# 1234| mu1234_10(String) = ^IndirectMayWriteSideEffect[-1] : &:r1234_4
# 1234| v1234_11(void) = ^BufferReadSideEffect[0] : &:r1234_7, ~mu1231_4
# 1234| mu1234_12(unknown) = ^BufferMayWriteSideEffect[0] : &:r1234_7
# 1234| r1234_13(bool) = Constant[1] :
# 1234| mu1234_14(bool) = Store : &:r1234_1, r1234_13
#-----| Goto -> Block 5
# 1235| Block 5
# 1235| v1235_1(void) = NoOp :
# 1231| v1231_9(void) = ReturnIndirection : &:r1231_7, ~mu1231_4
# 1231| v1231_10(void) = ReturnVoid :
# 1231| v1231_11(void) = UnmodeledUse : mu*
# 1231| v1231_12(void) = AliasedUse : ~mu1231_4
# 1231| v1231_13(void) = ExitFunction :
# 1232| Block 6
# 1232| r1232_4(glval<String>) = VariableAddress[a] :
#-----| r0_1(glval<unknown>) = FunctionAddress[String] :
#-----| v0_2(void) = Call : func:r0_1, this:r1232_4
#-----| mu0_3(unknown) = ^CallSideEffect : ~mu1231_4
#-----| mu0_4(String) = ^IndirectMayWriteSideEffect[-1] : &:r1232_4
# 1232| r1232_5(bool) = Constant[1] :
# 1232| mu1232_6(bool) = Store : &:r1232_1, r1232_5
#-----| Goto -> Block 1
# 1242| void test_strings(char*, char*)
# 1242| Block 0
# 1242| v1242_1(void) = EnterFunction :
# 1242| mu1242_2(unknown) = AliasedDefinition :
# 1242| mu1242_3(unknown) = InitializeNonLocal :
# 1242| mu1242_4(unknown) = UnmodeledDefinition :
# 1242| r1242_5(glval<char *>) = VariableAddress[s1] :
# 1242| mu1242_6(char *) = InitializeParameter[s1] : &:r1242_5
# 1242| r1242_7(char *) = Load : &:r1242_5, ~mu1242_6
# 1242| mu1242_8(unknown) = InitializeIndirection[s1] : &:r1242_7
# 1242| r1242_9(glval<char *>) = VariableAddress[s2] :
# 1242| mu1242_10(char *) = InitializeParameter[s2] : &:r1242_9
# 1242| r1242_11(char *) = Load : &:r1242_9, ~mu1242_10
# 1242| mu1242_12(unknown) = InitializeIndirection[s2] : &:r1242_11
# 1243| r1243_1(glval<char[1024]>) = VariableAddress[buffer] :
# 1243| mu1243_2(char[1024]) = Uninitialized[buffer] : &:r1243_1
# 1243| r1243_3(int) = Constant[0] :
# 1243| r1243_4(glval<char>) = PointerAdd[1] : r1243_1, r1243_3
# 1243| r1243_5(char) = Constant[0] :
# 1243| mu1243_6(char) = Store : &:r1243_4, r1243_5
# 1243| r1243_7(int) = Constant[1] :
# 1243| r1243_8(glval<char>) = PointerAdd[1] : r1243_1, r1243_7
# 1243| r1243_9(unknown[1023]) = Constant[0] :
# 1243| mu1243_10(unknown[1023]) = Store : &:r1243_8, r1243_9
# 1245| r1245_1(glval<unknown>) = FunctionAddress[strcpy] :
# 1245| r1245_2(glval<char[1024]>) = VariableAddress[buffer] :
# 1245| r1245_3(char *) = Convert : r1245_2
# 1245| r1245_4(glval<char *>) = VariableAddress[s1] :
# 1245| r1245_5(char *) = Load : &:r1245_4, ~mu1242_4
# 1245| r1245_6(char *) = Convert : r1245_5
# 1245| r1245_7(char *) = Call : func:r1245_1, 0:r1245_3, 1:r1245_6
# 1245| v1245_8(void) = ^BufferReadSideEffect[1] : &:r1245_6, ~mu1242_4
# 1245| mu1245_9(unknown) = ^BufferMustWriteSideEffect[0] : &:r1245_3
# 1246| r1246_1(glval<unknown>) = FunctionAddress[strcat] :
# 1246| r1246_2(glval<char[1024]>) = VariableAddress[buffer] :
# 1246| r1246_3(char *) = Convert : r1246_2
# 1246| r1246_4(glval<char *>) = VariableAddress[s2] :
# 1246| r1246_5(char *) = Load : &:r1246_4, ~mu1242_4
# 1246| r1246_6(char *) = Convert : r1246_5
# 1246| r1246_7(char *) = Call : func:r1246_1, 0:r1246_3, 1:r1246_6
# 1246| v1246_8(void) = ^BufferReadSideEffect[0] : &:r1246_3, ~mu1242_4
# 1246| v1246_9(void) = ^BufferReadSideEffect[1] : &:r1246_6, ~mu1242_4
# 1246| mu1246_10(unknown) = ^BufferMayWriteSideEffect[0] : &:r1246_3
# 1247| v1247_1(void) = NoOp :
# 1242| v1242_13(void) = ReturnIndirection : &:r1242_7, ~mu1242_4
# 1242| v1242_14(void) = ReturnIndirection : &:r1242_11, ~mu1242_4
# 1242| v1242_15(void) = ReturnVoid :
# 1242| v1242_16(void) = UnmodeledUse : mu*
# 1242| v1242_17(void) = AliasedUse : ~mu1242_4
# 1242| v1242_18(void) = ExitFunction :
perf-regression.cpp:
# 6| void Big::Big()
@@ -6352,8 +6471,6 @@ struct_init.cpp:
# 20| mu20_2(unknown) = AliasedDefinition :
# 20| mu20_3(unknown) = InitializeNonLocal :
# 20| mu20_4(unknown) = UnmodeledDefinition :
# 21| r21_1(glval<Info[2]>) = VariableAddress[static_infos] :
# 21| mu21_2(Info[2]) = Uninitialized[static_infos] : &:r21_1
# 25| r25_1(glval<unknown>) = FunctionAddress[let_info_escape] :
# 25| r25_2(glval<Info[2]>) = VariableAddress[static_infos] :
# 25| r25_3(Info *) = Convert : r25_2
@@ -6409,45 +6526,56 @@ struct_init.cpp:
# 36| void declare_static_runtime_infos(char const*)
# 36| Block 0
# 36| v36_1(void) = EnterFunction :
# 36| mu36_2(unknown) = AliasedDefinition :
# 36| mu36_3(unknown) = InitializeNonLocal :
# 36| mu36_4(unknown) = UnmodeledDefinition :
# 36| r36_5(glval<char *>) = VariableAddress[name1] :
# 36| mu36_6(char *) = InitializeParameter[name1] : &:r36_5
# 36| r36_7(char *) = Load : &:r36_5, ~mu36_6
# 36| mu36_8(unknown) = InitializeIndirection[name1] : &:r36_7
# 37| r37_1(glval<Info[2]>) = VariableAddress[static_infos] :
# 37| mu37_2(Info[2]) = Uninitialized[static_infos] : &:r37_1
# 37| r37_3(int) = Constant[0] :
# 37| r37_4(glval<Info>) = PointerAdd[16] : r37_1, r37_3
# 38| r38_1(glval<char *>) = FieldAddress[name] : r37_4
# 38| r38_2(glval<char *>) = VariableAddress[name1] :
# 38| r38_3(char *) = Load : &:r38_2, ~mu36_4
# 38| mu38_4(char *) = Store : &:r38_1, r38_3
# 38| r38_5(glval<..(*)(..)>) = FieldAddress[handler] : r37_4
# 38| r38_6(..(*)(..)) = FunctionAddress[handler1] :
# 38| mu38_7(..(*)(..)) = Store : &:r38_5, r38_6
# 37| r37_5(int) = Constant[1] :
# 37| r37_6(glval<Info>) = PointerAdd[16] : r37_1, r37_5
# 39| r39_1(glval<char *>) = FieldAddress[name] : r37_6
# 39| r39_2(glval<char[2]>) = StringConstant["2"] :
# 39| r39_3(char *) = Convert : r39_2
# 39| mu39_4(char *) = Store : &:r39_1, r39_3
# 39| r39_5(glval<..(*)(..)>) = FieldAddress[handler] : r37_6
# 39| r39_6(glval<..()(..)>) = FunctionAddress[handler2] :
# 39| r39_7(..(*)(..)) = CopyValue : r39_6
# 39| mu39_8(..(*)(..)) = Store : &:r39_5, r39_7
# 41| r41_1(glval<unknown>) = FunctionAddress[let_info_escape] :
# 41| r41_2(glval<Info[2]>) = VariableAddress[static_infos] :
# 41| r41_3(Info *) = Convert : r41_2
# 41| v41_4(void) = Call : func:r41_1, 0:r41_3
# 41| mu41_5(unknown) = ^CallSideEffect : ~mu36_4
# 41| v41_6(void) = ^BufferReadSideEffect[0] : &:r41_3, ~mu36_4
# 41| mu41_7(unknown) = ^BufferMayWriteSideEffect[0] : &:r41_3
# 42| v42_1(void) = NoOp :
# 36| v36_9(void) = ReturnIndirection : &:r36_7, ~mu36_4
# 36| v36_10(void) = ReturnVoid :
# 36| v36_11(void) = UnmodeledUse : mu*
# 36| v36_12(void) = AliasedUse : ~mu36_4
# 36| v36_13(void) = ExitFunction :
# 36| v36_1(void) = EnterFunction :
# 36| mu36_2(unknown) = AliasedDefinition :
# 36| mu36_3(unknown) = InitializeNonLocal :
# 36| mu36_4(unknown) = UnmodeledDefinition :
# 36| r36_5(glval<char *>) = VariableAddress[name1] :
# 36| mu36_6(char *) = InitializeParameter[name1] : &:r36_5
# 36| r36_7(char *) = Load : &:r36_5, ~mu36_6
# 36| mu36_8(unknown) = InitializeIndirection[name1] : &:r36_7
# 37| r37_1(glval<bool>) = VariableAddress[static_infos#init] :
# 37| r37_2(bool) = Load : &:r37_1, ~mu36_4
# 37| v37_3(void) = ConditionalBranch : r37_2
#-----| False -> Block 2
#-----| True -> Block 1
# 41| Block 1
# 41| r41_1(glval<unknown>) = FunctionAddress[let_info_escape] :
# 41| r41_2(glval<Info[2]>) = VariableAddress[static_infos] :
# 41| r41_3(Info *) = Convert : r41_2
# 41| v41_4(void) = Call : func:r41_1, 0:r41_3
# 41| mu41_5(unknown) = ^CallSideEffect : ~mu36_4
# 41| v41_6(void) = ^BufferReadSideEffect[0] : &:r41_3, ~mu36_4
# 41| mu41_7(unknown) = ^BufferMayWriteSideEffect[0] : &:r41_3
# 42| v42_1(void) = NoOp :
# 36| v36_9(void) = ReturnIndirection : &:r36_7, ~mu36_4
# 36| v36_10(void) = ReturnVoid :
# 36| v36_11(void) = UnmodeledUse : mu*
# 36| v36_12(void) = AliasedUse : ~mu36_4
# 36| v36_13(void) = ExitFunction :
# 37| Block 2
# 37| r37_4(glval<Info[2]>) = VariableAddress[static_infos] :
# 37| r37_5(int) = Constant[0] :
# 37| r37_6(glval<Info>) = PointerAdd[16] : r37_4, r37_5
# 38| r38_1(glval<char *>) = FieldAddress[name] : r37_6
# 38| r38_2(glval<char *>) = VariableAddress[name1] :
# 38| r38_3(char *) = Load : &:r38_2, ~mu36_4
# 38| mu38_4(char *) = Store : &:r38_1, r38_3
# 38| r38_5(glval<..(*)(..)>) = FieldAddress[handler] : r37_6
# 38| r38_6(..(*)(..)) = FunctionAddress[handler1] :
# 38| mu38_7(..(*)(..)) = Store : &:r38_5, r38_6
# 37| r37_7(int) = Constant[1] :
# 37| r37_8(glval<Info>) = PointerAdd[16] : r37_4, r37_7
# 39| r39_1(glval<char *>) = FieldAddress[name] : r37_8
# 39| r39_2(glval<char[2]>) = StringConstant["2"] :
# 39| r39_3(char *) = Convert : r39_2
# 39| mu39_4(char *) = Store : &:r39_1, r39_3
# 39| r39_5(glval<..(*)(..)>) = FieldAddress[handler] : r37_8
# 39| r39_6(glval<..()(..)>) = FunctionAddress[handler2] :
# 39| r39_7(..(*)(..)) = CopyValue : r39_6
# 39| mu39_8(..(*)(..)) = Store : &:r39_5, r39_7
# 37| r37_9(bool) = Constant[1] :
# 37| mu37_10(bool) = Store : &:r37_1, r37_9
#-----| Goto -> Block 1

1
cpp/ql/test/library-tests/rangeanalysis/signanalysis/SignAnalysis.expected
View File

@@ -137,7 +137,6 @@
| test.c:109:14:109:16 | Constant: 44 | positive strictlyPositive |
| test.c:110:14:110:14 | Constant: 1 | positive strictlyPositive |
| test.c:110:14:110:14 | Store: 1 | positive strictlyPositive |
| test.c:118:20:118:20 | Uninitialized: definition of n | positive |
| test.c:119:10:119:10 | Load: n | positive |
| test.c:119:10:119:12 | Add: ... ++ | positive strictlyPositive |
| test.c:119:10:119:12 | Constant: ... ++ | positive strictlyPositive |

8
cpp/ql/test/library-tests/syntax-zoo/aliased_ssa_sanity.expected
View File

@@ -52,7 +52,7 @@ instructionWithoutSuccessor
| vla.c:11:6:11:16 | UnmodeledDefinition: vla_typedef |
ambiguousSuccessors
| allocators.cpp:14:5:14:8 | UnmodeledDefinition: main | Goto | 4 | allocators.cpp:16:8:16:10 | VariableAddress: definition of foo |
| allocators.cpp:14:5:14:8 | UnmodeledDefinition: main | Goto | 4 | no_dynamic_init.cpp:10:16:10:16 | VariableAddress: definition of m |
| allocators.cpp:14:5:14:8 | UnmodeledDefinition: main | Goto | 4 | no_dynamic_init.cpp:11:3:11:11 | VariableAddress: return ... |
| allocators.cpp:14:5:14:8 | UnmodeledDefinition: main | Goto | 4 | parameterinitializer.cpp:19:5:19:5 | FunctionAddress: call to f |
| allocators.cpp:14:5:14:8 | UnmodeledDefinition: main | Goto | 4 | stream_it.cpp:18:15:18:16 | VariableAddress: definition of xs |
| array_delete.cpp:5:6:5:6 | UnmodeledDefinition: f | Goto | 14 | array_delete.cpp:6:12:6:24 | Constant: (Foo *)... |
@@ -358,7 +358,7 @@ ambiguousSuccessors
| newexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
| newexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
| no_dynamic_init.cpp:9:5:9:8 | UnmodeledDefinition: main | Goto | 4 | allocators.cpp:16:8:16:10 | VariableAddress: definition of foo |
| no_dynamic_init.cpp:9:5:9:8 | UnmodeledDefinition: main | Goto | 4 | no_dynamic_init.cpp:10:16:10:16 | VariableAddress: definition of m |
| no_dynamic_init.cpp:9:5:9:8 | UnmodeledDefinition: main | Goto | 4 | no_dynamic_init.cpp:11:3:11:11 | VariableAddress: return ... |
| no_dynamic_init.cpp:9:5:9:8 | UnmodeledDefinition: main | Goto | 4 | parameterinitializer.cpp:19:5:19:5 | FunctionAddress: call to f |
| no_dynamic_init.cpp:9:5:9:8 | UnmodeledDefinition: main | Goto | 4 | stream_it.cpp:18:15:18:16 | VariableAddress: definition of xs |
| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | aggregateinitializer.c:2:6:2:6 | VariableAddress: definition of a |
@@ -408,7 +408,7 @@ ambiguousSuccessors
| nonmembercallexpr.c:1:6:1:6 | UnmodeledDefinition: g | Goto | 2 | nonmembercallexpr.c:1:12:1:12 | NoOp: return ... |
| nonmembercallexpr.c:1:6:1:6 | UnmodeledDefinition: g | Goto | 2 | revsubscriptexpr.c:2:9:2:9 | VariableAddress: definition of x |
| parameterinitializer.cpp:18:5:18:8 | UnmodeledDefinition: main | Goto | 4 | allocators.cpp:16:8:16:10 | VariableAddress: definition of foo |
| parameterinitializer.cpp:18:5:18:8 | UnmodeledDefinition: main | Goto | 4 | no_dynamic_init.cpp:10:16:10:16 | VariableAddress: definition of m |
| parameterinitializer.cpp:18:5:18:8 | UnmodeledDefinition: main | Goto | 4 | no_dynamic_init.cpp:11:3:11:11 | VariableAddress: return ... |
| parameterinitializer.cpp:18:5:18:8 | UnmodeledDefinition: main | Goto | 4 | parameterinitializer.cpp:19:5:19:5 | FunctionAddress: call to f |
| parameterinitializer.cpp:18:5:18:8 | UnmodeledDefinition: main | Goto | 4 | stream_it.cpp:18:15:18:16 | VariableAddress: definition of xs |
| pmcallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | array_delete.cpp:6:12:6:24 | Constant: (Foo *)... |
@@ -460,7 +460,7 @@ ambiguousSuccessors
| staticmembercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
| staticmembercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
| stream_it.cpp:16:5:16:8 | UnmodeledDefinition: main | Goto | 4 | allocators.cpp:16:8:16:10 | VariableAddress: definition of foo |
| stream_it.cpp:16:5:16:8 | UnmodeledDefinition: main | Goto | 4 | no_dynamic_init.cpp:10:16:10:16 | VariableAddress: definition of m |
| stream_it.cpp:16:5:16:8 | UnmodeledDefinition: main | Goto | 4 | no_dynamic_init.cpp:11:3:11:11 | VariableAddress: return ... |
| stream_it.cpp:16:5:16:8 | UnmodeledDefinition: main | Goto | 4 | parameterinitializer.cpp:19:5:19:5 | FunctionAddress: call to f |
| stream_it.cpp:16:5:16:8 | UnmodeledDefinition: main | Goto | 4 | stream_it.cpp:18:15:18:16 | VariableAddress: definition of xs |
| switchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | aggregateinitializer.c:2:6:2:6 | VariableAddress: definition of a |

8
cpp/ql/test/library-tests/syntax-zoo/raw_sanity.expected
View File

@@ -107,7 +107,7 @@ instructionWithoutSuccessor
| vla.c:14:92:14:94 | Store: (char *)... |
ambiguousSuccessors
| allocators.cpp:14:5:14:8 | UnmodeledDefinition: main | Goto | 4 | allocators.cpp:16:8:16:10 | VariableAddress: definition of foo |
| allocators.cpp:14:5:14:8 | UnmodeledDefinition: main | Goto | 4 | no_dynamic_init.cpp:10:16:10:16 | VariableAddress: definition of m |
| allocators.cpp:14:5:14:8 | UnmodeledDefinition: main | Goto | 4 | no_dynamic_init.cpp:11:3:11:11 | VariableAddress: return ... |
| allocators.cpp:14:5:14:8 | UnmodeledDefinition: main | Goto | 4 | parameterinitializer.cpp:19:5:19:5 | FunctionAddress: call to f |
| allocators.cpp:14:5:14:8 | UnmodeledDefinition: main | Goto | 4 | stream_it.cpp:18:15:18:16 | VariableAddress: definition of xs |
| array_delete.cpp:5:6:5:6 | UnmodeledDefinition: f | Goto | 14 | array_delete.cpp:6:12:6:24 | Constant: (Foo *)... |
@@ -413,7 +413,7 @@ ambiguousSuccessors
| newexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
| newexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
| no_dynamic_init.cpp:9:5:9:8 | UnmodeledDefinition: main | Goto | 4 | allocators.cpp:16:8:16:10 | VariableAddress: definition of foo |
| no_dynamic_init.cpp:9:5:9:8 | UnmodeledDefinition: main | Goto | 4 | no_dynamic_init.cpp:10:16:10:16 | VariableAddress: definition of m |
| no_dynamic_init.cpp:9:5:9:8 | UnmodeledDefinition: main | Goto | 4 | no_dynamic_init.cpp:11:3:11:11 | VariableAddress: return ... |
| no_dynamic_init.cpp:9:5:9:8 | UnmodeledDefinition: main | Goto | 4 | parameterinitializer.cpp:19:5:19:5 | FunctionAddress: call to f |
| no_dynamic_init.cpp:9:5:9:8 | UnmodeledDefinition: main | Goto | 4 | stream_it.cpp:18:15:18:16 | VariableAddress: definition of xs |
| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | aggregateinitializer.c:2:6:2:6 | VariableAddress: definition of a |
@@ -463,7 +463,7 @@ ambiguousSuccessors
| nonmembercallexpr.c:1:6:1:6 | UnmodeledDefinition: g | Goto | 2 | nonmembercallexpr.c:1:12:1:12 | NoOp: return ... |
| nonmembercallexpr.c:1:6:1:6 | UnmodeledDefinition: g | Goto | 2 | revsubscriptexpr.c:2:9:2:9 | VariableAddress: definition of x |
| parameterinitializer.cpp:18:5:18:8 | UnmodeledDefinition: main | Goto | 4 | allocators.cpp:16:8:16:10 | VariableAddress: definition of foo |
| parameterinitializer.cpp:18:5:18:8 | UnmodeledDefinition: main | Goto | 4 | no_dynamic_init.cpp:10:16:10:16 | VariableAddress: definition of m |
| parameterinitializer.cpp:18:5:18:8 | UnmodeledDefinition: main | Goto | 4 | no_dynamic_init.cpp:11:3:11:11 | VariableAddress: return ... |
| parameterinitializer.cpp:18:5:18:8 | UnmodeledDefinition: main | Goto | 4 | parameterinitializer.cpp:19:5:19:5 | FunctionAddress: call to f |
| parameterinitializer.cpp:18:5:18:8 | UnmodeledDefinition: main | Goto | 4 | stream_it.cpp:18:15:18:16 | VariableAddress: definition of xs |
| pmcallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | array_delete.cpp:6:12:6:24 | Constant: (Foo *)... |
@@ -515,7 +515,7 @@ ambiguousSuccessors
| staticmembercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
| staticmembercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
| stream_it.cpp:16:5:16:8 | UnmodeledDefinition: main | Goto | 4 | allocators.cpp:16:8:16:10 | VariableAddress: definition of foo |
| stream_it.cpp:16:5:16:8 | UnmodeledDefinition: main | Goto | 4 | no_dynamic_init.cpp:10:16:10:16 | VariableAddress: definition of m |
| stream_it.cpp:16:5:16:8 | UnmodeledDefinition: main | Goto | 4 | no_dynamic_init.cpp:11:3:11:11 | VariableAddress: return ... |
| stream_it.cpp:16:5:16:8 | UnmodeledDefinition: main | Goto | 4 | parameterinitializer.cpp:19:5:19:5 | FunctionAddress: call to f |
| stream_it.cpp:16:5:16:8 | UnmodeledDefinition: main | Goto | 4 | stream_it.cpp:18:15:18:16 | VariableAddress: definition of xs |
| switchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | aggregateinitializer.c:2:6:2:6 | VariableAddress: definition of a |

8
cpp/ql/test/library-tests/syntax-zoo/unaliased_ssa_sanity.expected
View File

@@ -61,7 +61,7 @@ instructionWithoutSuccessor
| vla.c:11:6:11:16 | UnmodeledDefinition: vla_typedef |
ambiguousSuccessors
| allocators.cpp:14:5:14:8 | UnmodeledDefinition: main | Goto | 4 | allocators.cpp:16:8:16:10 | VariableAddress: definition of foo |
| allocators.cpp:14:5:14:8 | UnmodeledDefinition: main | Goto | 4 | no_dynamic_init.cpp:10:16:10:16 | VariableAddress: definition of m |
| allocators.cpp:14:5:14:8 | UnmodeledDefinition: main | Goto | 4 | no_dynamic_init.cpp:11:3:11:11 | VariableAddress: return ... |
| allocators.cpp:14:5:14:8 | UnmodeledDefinition: main | Goto | 4 | parameterinitializer.cpp:19:5:19:5 | FunctionAddress: call to f |
| allocators.cpp:14:5:14:8 | UnmodeledDefinition: main | Goto | 4 | stream_it.cpp:18:15:18:16 | VariableAddress: definition of xs |
| array_delete.cpp:5:6:5:6 | UnmodeledDefinition: f | Goto | 14 | array_delete.cpp:6:12:6:24 | Constant: (Foo *)... |
@@ -367,7 +367,7 @@ ambiguousSuccessors
| newexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
| newexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
| no_dynamic_init.cpp:9:5:9:8 | UnmodeledDefinition: main | Goto | 4 | allocators.cpp:16:8:16:10 | VariableAddress: definition of foo |
| no_dynamic_init.cpp:9:5:9:8 | UnmodeledDefinition: main | Goto | 4 | no_dynamic_init.cpp:10:16:10:16 | VariableAddress: definition of m |
| no_dynamic_init.cpp:9:5:9:8 | UnmodeledDefinition: main | Goto | 4 | no_dynamic_init.cpp:11:3:11:11 | VariableAddress: return ... |
| no_dynamic_init.cpp:9:5:9:8 | UnmodeledDefinition: main | Goto | 4 | parameterinitializer.cpp:19:5:19:5 | FunctionAddress: call to f |
| no_dynamic_init.cpp:9:5:9:8 | UnmodeledDefinition: main | Goto | 4 | stream_it.cpp:18:15:18:16 | VariableAddress: definition of xs |
| nodefaultswitchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | aggregateinitializer.c:2:6:2:6 | VariableAddress: definition of a |
@@ -417,7 +417,7 @@ ambiguousSuccessors
| nonmembercallexpr.c:1:6:1:6 | UnmodeledDefinition: g | Goto | 2 | nonmembercallexpr.c:1:12:1:12 | NoOp: return ... |
| nonmembercallexpr.c:1:6:1:6 | UnmodeledDefinition: g | Goto | 2 | revsubscriptexpr.c:2:9:2:9 | VariableAddress: definition of x |
| parameterinitializer.cpp:18:5:18:8 | UnmodeledDefinition: main | Goto | 4 | allocators.cpp:16:8:16:10 | VariableAddress: definition of foo |
| parameterinitializer.cpp:18:5:18:8 | UnmodeledDefinition: main | Goto | 4 | no_dynamic_init.cpp:10:16:10:16 | VariableAddress: definition of m |
| parameterinitializer.cpp:18:5:18:8 | UnmodeledDefinition: main | Goto | 4 | no_dynamic_init.cpp:11:3:11:11 | VariableAddress: return ... |
| parameterinitializer.cpp:18:5:18:8 | UnmodeledDefinition: main | Goto | 4 | parameterinitializer.cpp:19:5:19:5 | FunctionAddress: call to f |
| parameterinitializer.cpp:18:5:18:8 | UnmodeledDefinition: main | Goto | 4 | stream_it.cpp:18:15:18:16 | VariableAddress: definition of xs |
| pmcallexpr.cpp:6:6:6:6 | UnmodeledDefinition: f | Goto | 14 | array_delete.cpp:6:12:6:24 | Constant: (Foo *)... |
@@ -469,7 +469,7 @@ ambiguousSuccessors
| staticmembercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr.cpp:7:4:7:4 | VariableAddress: definition of c |
| staticmembercallexpr_args.cpp:7:6:7:6 | UnmodeledDefinition: f | Goto | 14 | staticmembercallexpr_args.cpp:8:6:8:6 | VariableAddress: definition of i |
| stream_it.cpp:16:5:16:8 | UnmodeledDefinition: main | Goto | 4 | allocators.cpp:16:8:16:10 | VariableAddress: definition of foo |
| stream_it.cpp:16:5:16:8 | UnmodeledDefinition: main | Goto | 4 | no_dynamic_init.cpp:10:16:10:16 | VariableAddress: definition of m |
| stream_it.cpp:16:5:16:8 | UnmodeledDefinition: main | Goto | 4 | no_dynamic_init.cpp:11:3:11:11 | VariableAddress: return ... |
| stream_it.cpp:16:5:16:8 | UnmodeledDefinition: main | Goto | 4 | parameterinitializer.cpp:19:5:19:5 | FunctionAddress: call to f |
| stream_it.cpp:16:5:16:8 | UnmodeledDefinition: main | Goto | 4 | stream_it.cpp:18:15:18:16 | VariableAddress: definition of xs |
| switchstmt.c:1:12:1:12 | InitializeParameter: i | Goto | 20 | aggregateinitializer.c:2:6:2:6 | VariableAddress: definition of a |

3
cpp/ql/test/library-tests/variables/variables/variable.expected
View File

@@ -59,8 +59,7 @@
| variables.cpp:37:6:37:8 | ap3 | file://:0:0:0:0 | int * | StaticStorageDurationVariable | | |
| variables.cpp:41:7:41:11 | local | file://:0:0:0:0 | char[] | LocalVariable | | |
| variables.cpp:41:7:41:11 | local | file://:0:0:0:0 | char[] | SemanticStackVariable | | |
| variables.cpp:43:14:43:18 | local | file://:0:0:0:0 | int | LocalVariable | | static |
| variables.cpp:43:14:43:18 | local | file://:0:0:0:0 | int | StaticStorageDurationVariable | | static |
| variables.cpp:43:14:43:18 | local | file://:0:0:0:0 | int | StaticLocalVariable | | static |
| variables.cpp:48:9:48:12 | name | file://:0:0:0:0 | char * | Field | | |
| variables.cpp:49:12:49:17 | number | file://:0:0:0:0 | long | Field | | |
| variables.cpp:50:9:50:14 | street | file://:0:0:0:0 | char * | Field | | |

25
cpp/ql/test/query-tests/Likely Bugs/Arithmetic/UnsignedGEZero/UnsignedGEZero.c
View File

@@ -112,4 +112,29 @@ void myFunction() {
assert(CHECK_RANGE(ui, 0, 10)); // reasonable use
assert(UI >= ZERO); // violation (not detected)
assert(ui GE 0); // violation
if ((unsigned char)si >= 0) { // violation
}
if ((unsigned char)(signed int)si >= 0) { // violation
}
if ((signed int)(unsigned char)si >= 0) { // violation
}
if ((unsigned char)(signed char)si >= 0) { // violation
}
if ((signed char)(unsigned char)si >= 0) {
}
if ((signed int)(unsigned char)(signed int)si >= 0) { // violation
}
if ((signed char)(unsigned char)(signed int)si >= 0) {
}
if ((signed int)(unsigned char)(signed char)si >= 0) { // violation
}
if (ui <= 0) {
}
if (0 <= ui) { // violation
}
if (0 < ui) {
}
}

25
cpp/ql/test/query-tests/Likely Bugs/Arithmetic/UnsignedGEZero/UnsignedGEZero.cpp
View File

@@ -112,4 +112,29 @@ void myFunction() {
assert(CHECK_RANGE(ui, 0, 10)); // reasonable use
assert(UI >= ZERO); // violation (not detected)
assert(ui GE 0); // violation
if ((unsigned char)si >= 0) { // violation
}
if ((unsigned char)(signed int)si >= 0) { // violation
}
if ((signed int)(unsigned char)si >= 0) { // violation
}
if ((unsigned char)(signed char)si >= 0) { // violation
}
if ((signed char)(unsigned char)si >= 0) {
}
if ((signed int)(unsigned char)(signed int)si >= 0) { // violation
}
if ((signed char)(unsigned char)(signed int)si >= 0) {
}
if ((signed int)(unsigned char)(signed char)si >= 0) { // violation
}
if (ui <= 0) {
}
if (0 <= ui) { // violation
}
if (0 < ui) {
}
}

14
cpp/ql/test/query-tests/Likely Bugs/Arithmetic/UnsignedGEZero/UnsignedGEZero.expected
View File

@@ -14,6 +14,13 @@
| UnsignedGEZero.c:101:9:101:15 | ... >= ... | Pointless comparison of unsigned value to zero. |
| UnsignedGEZero.c:111:9:111:15 | ... >= ... | Pointless comparison of unsigned value to zero. |
| UnsignedGEZero.c:114:9:114:15 | ... >= ... | Pointless comparison of unsigned value to zero. |
| UnsignedGEZero.c:116:6:116:27 | ... >= ... | Pointless comparison of unsigned value to zero. |
| UnsignedGEZero.c:118:6:118:39 | ... >= ... | Pointless comparison of unsigned value to zero. |
| UnsignedGEZero.c:120:6:120:39 | ... >= ... | Pointless comparison of unsigned value to zero. |
| UnsignedGEZero.c:122:6:122:40 | ... >= ... | Pointless comparison of unsigned value to zero. |
| UnsignedGEZero.c:127:6:127:51 | ... >= ... | Pointless comparison of unsigned value to zero. |
| UnsignedGEZero.c:131:6:131:52 | ... >= ... | Pointless comparison of unsigned value to zero. |
| UnsignedGEZero.c:136:6:136:12 | ... <= ... | Pointless comparison of unsigned value to zero. |
| UnsignedGEZero.cpp:40:6:40:12 | ... >= ... | Pointless comparison of unsigned value to zero. |
| UnsignedGEZero.cpp:48:6:48:15 | ... >= ... | Pointless comparison of unsigned value to zero. |
| UnsignedGEZero.cpp:54:6:54:12 | ... >= ... | Pointless comparison of unsigned value to zero. |
@@ -29,3 +36,10 @@
| UnsignedGEZero.cpp:101:9:101:15 | ... >= ... | Pointless comparison of unsigned value to zero. |
| UnsignedGEZero.cpp:111:9:111:15 | ... >= ... | Pointless comparison of unsigned value to zero. |
| UnsignedGEZero.cpp:114:9:114:15 | ... >= ... | Pointless comparison of unsigned value to zero. |
| UnsignedGEZero.cpp:116:6:116:27 | ... >= ... | Pointless comparison of unsigned value to zero. |
| UnsignedGEZero.cpp:118:6:118:39 | ... >= ... | Pointless comparison of unsigned value to zero. |
| UnsignedGEZero.cpp:120:6:120:39 | ... >= ... | Pointless comparison of unsigned value to zero. |
| UnsignedGEZero.cpp:122:6:122:40 | ... >= ... | Pointless comparison of unsigned value to zero. |
| UnsignedGEZero.cpp:127:6:127:51 | ... >= ... | Pointless comparison of unsigned value to zero. |
| UnsignedGEZero.cpp:131:6:131:52 | ... >= ... | Pointless comparison of unsigned value to zero. |
| UnsignedGEZero.cpp:136:6:136:12 | ... <= ... | Pointless comparison of unsigned value to zero. |

5
cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/UnboundedWrite.expected
View File

@@ -1,10 +1,5 @@
| tests.c:28:3:28:9 | call to sprintf | This 'call to sprintf' with input from $@ may overflow the destination. | tests.c:28:22:28:25 | argv | argv |
| tests.c:29:3:29:9 | call to sprintf | This 'call to sprintf' with input from $@ may overflow the destination. | tests.c:29:28:29:31 | argv | argv |
| tests.c:31:15:31:23 | buffer100 | This 'scanf string argument' with input from $@ may overflow the destination. | tests.c:28:22:28:25 | argv | argv |
| tests.c:31:15:31:23 | buffer100 | This 'scanf string argument' with input from $@ may overflow the destination. | tests.c:29:28:29:31 | argv | argv |
| tests.c:31:15:31:23 | buffer100 | This 'scanf string argument' with input from $@ may overflow the destination. | tests.c:31:15:31:23 | buffer100 | buffer100 |
| tests.c:33:21:33:29 | buffer100 | This 'scanf string argument' with input from $@ may overflow the destination. | tests.c:28:22:28:25 | argv | argv |
| tests.c:33:21:33:29 | buffer100 | This 'scanf string argument' with input from $@ may overflow the destination. | tests.c:29:28:29:31 | argv | argv |
| tests.c:33:21:33:29 | buffer100 | This 'scanf string argument' with input from $@ may overflow the destination. | tests.c:31:15:31:23 | buffer100 | buffer100 |
| tests.c:33:21:33:29 | buffer100 | This 'scanf string argument' with input from $@ may overflow the destination. | tests.c:33:21:33:29 | buffer100 | buffer100 |
| tests.c:34:25:34:33 | buffer100 | This 'sscanf string argument' with input from $@ may overflow the destination. | tests.c:34:10:34:13 | argv | argv |

2
cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/funcs/funcsLocal.expected
View File

@@ -1,5 +1,7 @@
| funcsLocal.c:17:9:17:10 | i1 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | funcsLocal.c:16:8:16:9 | i1 | fread |
| funcsLocal.c:27:9:27:10 | i3 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | funcsLocal.c:26:8:26:9 | i3 | fgets |
| funcsLocal.c:32:9:32:10 | i4 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | funcsLocal.c:31:13:31:17 | call to fgets | fgets |
| funcsLocal.c:32:9:32:10 | i4 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | funcsLocal.c:31:19:31:21 | i41 | fgets |
| funcsLocal.c:37:9:37:10 | i5 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | funcsLocal.c:36:7:36:8 | i5 | gets |
| funcsLocal.c:42:9:42:10 | i6 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | funcsLocal.c:41:13:41:16 | call to gets | gets |
| funcsLocal.c:42:9:42:10 | i6 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | funcsLocal.c:41:18:41:20 | i61 | gets |

1
cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/uncontrolled/ArithmeticUncontrolled.expected
View File

@@ -1,7 +1,6 @@
| test.c:21:17:21:17 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:18:13:18:16 | call to rand | Uncontrolled value |
| test.c:35:5:35:5 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:34:13:34:18 | call to rand | Uncontrolled value |
| test.c:40:5:40:5 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:39:13:39:21 | ... % ... | Uncontrolled value |
| test.c:40:5:40:5 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:39:13:39:22 | call to rand | Uncontrolled value |
| test.c:45:5:45:5 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:44:13:44:16 | call to rand | Uncontrolled value |
| test.c:56:5:56:5 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:54:13:54:16 | call to rand | Uncontrolled value |
| test.c:67:5:67:5 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:66:13:66:16 | call to rand | Uncontrolled value |