hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 03:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' into zlaski/cpp370

Browse Source
This commit is contained in:
zlaski-semmle
2019-06-04 09:47:30 -07:00
committed by GitHub
parent 46b6eac955 813e1e7c91
commit 51e543a41d
543 changed files with 25015 additions and 6631 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
cpp/ql/test/library-tests/conversions/conversions.expected
View File

@@ -122,7 +122,7 @@
| conversions.cpp:179:36:179:37 | (..:: *)... | pointer-to-member derived class conversion | prval | ..:: * | ..:: * |
| conversions.cpp:180:10:180:47 | static_cast<..:: *>... | pointer-to-member derived class conversion | prval | ..:: * | ..:: * |
| conversions.cpp:180:43:180:46 | (..:: *)... | pointer-to-member derived class conversion | prval | ..:: * | ..:: * |
| conversions.cpp:190:22:190:29 | (const String)... | glvalue conversion | lval | const String | String |
| conversions.cpp:190:22:190:29 | (const String)... | glvalue conversion | lval | const String | void |
| conversions.cpp:193:20:193:31 | (const Base)... | glvalue conversion | lval | const Base | Base |
| conversions.cpp:193:31:193:31 | (Base)... | base class conversion | lval | Base | Middle |
| conversions.cpp:193:31:193:31 | (Middle)... | base class conversion | lval | Middle | Derived |

2
cpp/ql/test/library-tests/cpp_builtin_types/bool/Variables.ql
View File

@@ -1,4 +1,4 @@
import cpp
from Variable v
select v, v.getType().getUnspecifiedType()
select v, v.getUnspecifiedType()

23
cpp/ql/test/library-tests/identifiers/qualified_names/qualifiedNames.cpp
View File

@@ -59,3 +59,26 @@ namespace templates {
return getMember(tc, typedefC());
}
}
namespace std {
inline namespace cpp17 {
void functionInTwoNamespaces();
class classInTwoNameSpaces {
};
inline namespace implementation {
namespace ns {
void functionInFourNamespaces();
}
}
}
}
// This code demonstrates that `functionInFourNamespaces` is indeed visible in
// four name spaces.
using void_fptr = void(*)();
void_fptr ptrs[] = {
std::ns::functionInFourNamespaces,
std::cpp17::ns::functionInFourNamespaces,
std::implementation::ns::functionInFourNamespaces,
std::cpp17::implementation::ns::functionInFourNamespaces,
};

14
cpp/ql/test/library-tests/identifiers/qualified_names/qualifiedNames.expected
View File

@@ -52,3 +52,17 @@
| qualifiedNames.cpp:53:12:53:12 | getMember | templates::getMember | templates | | getMember | (not global) |
| qualifiedNames.cpp:53:12:53:20 | getMember | templates::getMember | templates | | getMember | (not global) |
| qualifiedNames.cpp:57:8:57:10 | use | templates::use | templates | | use | (not global) |
| qualifiedNames.cpp:65:10:65:32 | functionInTwoNamespaces | std::cpp17::functionInTwoNamespaces | std | | functionInTwoNamespaces | (not global) |
| qualifiedNames.cpp:65:10:65:32 | functionInTwoNamespaces | std::cpp17::functionInTwoNamespaces | std::cpp17 | | functionInTwoNamespaces | (not global) |
| qualifiedNames.cpp:66:11:66:11 | operator= | std::cpp17::classInTwoNameSpaces::operator= | std | classInTwoNameSpaces | operator= | (not global) |
| qualifiedNames.cpp:66:11:66:11 | operator= | std::cpp17::classInTwoNameSpaces::operator= | std | classInTwoNameSpaces | operator= | (not global) |
| qualifiedNames.cpp:66:11:66:11 | operator= | std::cpp17::classInTwoNameSpaces::operator= | std::cpp17 | classInTwoNameSpaces | operator= | (not global) |
| qualifiedNames.cpp:66:11:66:11 | operator= | std::cpp17::classInTwoNameSpaces::operator= | std::cpp17 | classInTwoNameSpaces | operator= | (not global) |
| qualifiedNames.cpp:66:11:66:30 | classInTwoNameSpaces | std::cpp17::classInTwoNameSpaces | std | | classInTwoNameSpaces | (not global) |
| qualifiedNames.cpp:66:11:66:30 | classInTwoNameSpaces | std::cpp17::classInTwoNameSpaces | std::cpp17 | | classInTwoNameSpaces | (not global) |
| qualifiedNames.cpp:70:14:70:37 | functionInFourNamespaces | std::cpp17::implementation::ns::functionInFourNamespaces | std::cpp17::implementation::ns | | functionInFourNamespaces | (not global) |
| qualifiedNames.cpp:70:14:70:37 | functionInFourNamespaces | std::cpp17::implementation::ns::functionInFourNamespaces | std::cpp17::ns | | functionInFourNamespaces | (not global) |
| qualifiedNames.cpp:70:14:70:37 | functionInFourNamespaces | std::cpp17::implementation::ns::functionInFourNamespaces | std::implementation::ns | | functionInFourNamespaces | (not global) |
| qualifiedNames.cpp:70:14:70:37 | functionInFourNamespaces | std::cpp17::implementation::ns::functionInFourNamespaces | std::ns | | functionInFourNamespaces | (not global) |
| qualifiedNames.cpp:78:7:78:15 | void_fptr | void_fptr | | | void_fptr | void_fptr |
| qualifiedNames.cpp:79:11:79:14 | ptrs | ptrs | | | ptrs | ptrs |

364
cpp/ql/test/library-tests/ir/ir/PrintAST.expected
View File

@@ -5122,25 +5122,19 @@ ir.cpp:
# 809| Conversion = glvalue conversion
# 809| Type = const Base
# 809| ValueCategory = lvalue
# 809| expr: (reference dereference)
# 809| Type = Base
# 809| ValueCategory = lvalue
# 809| expr: (reference to)
# 809| Type = Base &
# 809| expr: call to Base
# 809| Type = void
# 809| ValueCategory = prvalue
# 809| 0: (reference to)
# 809| Type = const Base &
# 809| ValueCategory = prvalue
# 809| expr: call to Base
# 809| Type = void
# 809| ValueCategory = prvalue
# 809| 0: (reference to)
# 809| Type = const Base &
# 809| ValueCategory = prvalue
# 809| expr: (const Base)...
# 809| Conversion = base class conversion
# 809| Type = const Base
# 809| ValueCategory = lvalue
# 809| expr: m
# 809| Type = Middle
# 809| ValueCategory = lvalue
# 809| expr: (const Base)...
# 809| Conversion = base class conversion
# 809| Type = const Base
# 809| ValueCategory = lvalue
# 809| expr: m
# 809| Type = Middle
# 809| ValueCategory = lvalue
# 810| 8: ExprStmt
# 810| 0: (reference dereference)
# 810| Type = Base
@@ -5158,25 +5152,19 @@ ir.cpp:
# 810| Conversion = glvalue conversion
# 810| Type = const Base
# 810| ValueCategory = lvalue
# 810| expr: (reference dereference)
# 810| Type = Base
# 810| ValueCategory = lvalue
# 810| expr: (reference to)
# 810| Type = Base &
# 810| expr: call to Base
# 810| Type = void
# 810| ValueCategory = prvalue
# 810| 0: (reference to)
# 810| Type = const Base &
# 810| ValueCategory = prvalue
# 810| expr: call to Base
# 810| Type = void
# 810| ValueCategory = prvalue
# 810| 0: (reference to)
# 810| Type = const Base &
# 810| ValueCategory = prvalue
# 810| expr: (const Base)...
# 810| Conversion = base class conversion
# 810| Type = const Base
# 810| ValueCategory = lvalue
# 810| expr: m
# 810| Type = Middle
# 810| ValueCategory = lvalue
# 810| expr: (const Base)...
# 810| Conversion = base class conversion
# 810| Type = const Base
# 810| ValueCategory = lvalue
# 810| expr: m
# 810| Type = Middle
# 810| ValueCategory = lvalue
# 811| 9: ExprStmt
# 811| 0: ... = ...
# 811| Type = Base *
@@ -5364,29 +5352,23 @@ ir.cpp:
# 823| Conversion = glvalue conversion
# 823| Type = const Base
# 823| ValueCategory = lvalue
# 823| expr: (reference dereference)
# 823| Type = Base
# 823| ValueCategory = lvalue
# 823| expr: (reference to)
# 823| Type = Base &
# 823| expr: call to Base
# 823| Type = void
# 823| ValueCategory = prvalue
# 823| 0: (reference to)
# 823| Type = const Base &
# 823| ValueCategory = prvalue
# 823| expr: call to Base
# 823| Type = void
# 823| ValueCategory = prvalue
# 823| 0: (reference to)
# 823| Type = const Base &
# 823| ValueCategory = prvalue
# 823| expr: (const Base)...
# 823| Conversion = base class conversion
# 823| Type = const Base
# 823| expr: (const Base)...
# 823| Conversion = base class conversion
# 823| Type = const Base
# 823| ValueCategory = lvalue
# 823| expr: (const Middle)...
# 823| Conversion = base class conversion
# 823| Type = const Middle
# 823| ValueCategory = lvalue
# 823| expr: d
# 823| Type = Derived
# 823| ValueCategory = lvalue
# 823| expr: (const Middle)...
# 823| Conversion = base class conversion
# 823| Type = const Middle
# 823| ValueCategory = lvalue
# 823| expr: d
# 823| Type = Derived
# 823| ValueCategory = lvalue
# 824| 20: ExprStmt
# 824| 0: (reference dereference)
# 824| Type = Base
@@ -5404,29 +5386,23 @@ ir.cpp:
# 824| Conversion = glvalue conversion
# 824| Type = const Base
# 824| ValueCategory = lvalue
# 824| expr: (reference dereference)
# 824| Type = Base
# 824| ValueCategory = lvalue
# 824| expr: (reference to)
# 824| Type = Base &
# 824| expr: call to Base
# 824| Type = void
# 824| ValueCategory = prvalue
# 824| 0: (reference to)
# 824| Type = const Base &
# 824| ValueCategory = prvalue
# 824| expr: call to Base
# 824| Type = void
# 824| ValueCategory = prvalue
# 824| 0: (reference to)
# 824| Type = const Base &
# 824| ValueCategory = prvalue
# 824| expr: (const Base)...
# 824| Conversion = base class conversion
# 824| Type = const Base
# 824| expr: (const Base)...
# 824| Conversion = base class conversion
# 824| Type = const Base
# 824| ValueCategory = lvalue
# 824| expr: (const Middle)...
# 824| Conversion = base class conversion
# 824| Type = const Middle
# 824| ValueCategory = lvalue
# 824| expr: d
# 824| Type = Derived
# 824| ValueCategory = lvalue
# 824| expr: (const Middle)...
# 824| Conversion = base class conversion
# 824| Type = const Middle
# 824| ValueCategory = lvalue
# 824| expr: d
# 824| Type = Derived
# 824| ValueCategory = lvalue
# 825| 21: ExprStmt
# 825| 0: ... = ...
# 825| Type = Base *
@@ -6810,24 +6786,18 @@ ir.cpp:
# 1036| 0: (reference to)
# 1036| Type = lambda [] type at line 1036, col. 21 &
# 1036| ValueCategory = prvalue
# 1036| expr: (reference dereference)
# 1036| expr: [...](...){...}
# 1036| Type = decltype([...](...){...})
# 1036| ValueCategory = xvalue
# 1036| expr: (reference to)
# 1036| Type = lambda [] type at line 1036, col. 21 &
# 1036| 0: {...}
# 1036| Type = decltype([...](...){...})
# 1036| ValueCategory = prvalue
# 1036| expr: [...](...){...}
# 1036| Type = decltype([...](...){...})
# 1036| ValueCategory = xvalue
# 1036| 0: {...}
# 1036| Type = decltype([...](...){...})
# 1036| ValueCategory = prvalue
#-----| .s: call to String
#-----| Type = void
#-----| ValueCategory = prvalue
#-----| .x: x
#-----| Type = int
#-----| ValueCategory = prvalue(load)
#-----| .s: call to String
#-----| Type = void
#-----| ValueCategory = prvalue
#-----| .x: x
#-----| Type = int
#-----| ValueCategory = prvalue(load)
# 1037| 5: ExprStmt
# 1037| 0: call to operator()
# 1037| Type = char
@@ -6897,21 +6867,15 @@ ir.cpp:
# 1040| 0: (reference to)
# 1040| Type = lambda [] type at line 1040, col. 30 &
# 1040| ValueCategory = prvalue
# 1040| expr: (reference dereference)
# 1040| expr: [...](...){...}
# 1040| Type = decltype([...](...){...})
# 1040| ValueCategory = xvalue
# 1040| expr: (reference to)
# 1040| Type = lambda [] type at line 1040, col. 30 &
# 1040| 0: {...}
# 1040| Type = decltype([...](...){...})
# 1040| ValueCategory = prvalue
# 1040| expr: [...](...){...}
# 1040| Type = decltype([...](...){...})
# 1040| ValueCategory = xvalue
# 1040| 0: {...}
# 1040| Type = decltype([...](...){...})
# 1040| ValueCategory = prvalue
#-----| .s: call to String
#-----| Type = void
#-----| ValueCategory = prvalue
#-----| .s: call to String
#-----| Type = void
#-----| ValueCategory = prvalue
# 1041| 9: ExprStmt
# 1041| 0: call to operator()
# 1041| Type = char
@@ -7463,3 +7427,193 @@ ir.cpp:
#-----| -1: this
#-----| Type = const lambda [] type at line 1045, col. 23 *
#-----| ValueCategory = prvalue(load)
# 1050| vector<int>& vector<int>::operator=(vector<int> const&)
# 1050| params:
#-----| 0: p#0
#-----| Type = const vector<int> &
# 1050| vector<int>& vector<int>::operator=(vector<int>&&)
# 1050| params:
#-----| 0: p#0
#-----| Type = vector<int> &&
# 1051| vector<int>::iterator& vector<int>::iterator::operator=(vector<int>::iterator const public&)
# 1051| params:
#-----| 0: p#0
#-----| Type = const iterator &
# 1051| vector<int>::iterator& vector<int>::iterator::operator=(vector<int>::iterator&&)
# 1051| params:
#-----| 0: p#0
#-----| Type = iterator &&
# 1053| vector<T>::iterator& vector<T>::iterator::operator++()
# 1053| params:
# 1053| vector<int>::iterator& vector<int>::iterator::operator++()
# 1053| params:
# 1054| T& vector<T>::iterator::operator*() const
# 1054| params:
# 1054| int& vector<int>::iterator::operator*() const
# 1054| params:
# 1056| bool vector<T>::iterator::operator!=(vector<T>::iterator) const
# 1056| params:
# 1056| 0: right
# 1056| Type = iterator
# 1056| bool vector<int>::iterator::operator!=(vector<int>::iterator) const
# 1056| params:
# 1056| 0: right
# 1056| Type = iterator
# 1059| vector<T>::iterator vector<T>::begin() const
# 1059| params:
# 1059| vector<int>::iterator vector<int>::begin() const
# 1059| params:
# 1060| vector<T>::iterator vector<T>::end() const
# 1060| params:
# 1060| vector<int>::iterator vector<int>::end() const
# 1060| params:
# 1064| bool operator==<T>(iterator, iterator)
# 1064| params:
# 1064| 0: left
# 1064| Type = iterator
# 1064| 1: right
# 1064| Type = iterator
# 1066| bool operator!=<T>(iterator, iterator)
# 1066| params:
# 1066| 0: left
# 1066| Type = iterator
# 1066| 1: right
# 1066| Type = iterator
# 1068| void RangeBasedFor(vector<int> const&)
# 1068| params:
# 1068| 0: v
# 1068| Type = const vector<int> &
# 1068| body: { ... }
# 1069| 0: for(...:...) ...
# 1069| 0: declaration
# 1069| 1: declaration
# 1069| 2: call to operator!=
# 1069| Type = bool
# 1069| ValueCategory = prvalue
#-----| -1: (const iterator)...
#-----| Conversion = glvalue conversion
#-----| Type = const iterator
#-----| ValueCategory = lvalue
#-----| expr: (__begin)
#-----| Type = iterator
#-----| ValueCategory = lvalue
#-----| 0: (__end)
#-----| Type = iterator
#-----| ValueCategory = prvalue(load)
# 1069| 3: (reference dereference)
# 1069| Type = iterator
# 1069| ValueCategory = lvalue
# 1069| expr: call to operator++
# 1069| Type = iterator &
# 1069| ValueCategory = prvalue
#-----| -1: (__begin)
#-----| Type = iterator
#-----| ValueCategory = lvalue
# 1069| 4: declaration
# 1069| 5: { ... }
# 1070| 0: if (...) ...
# 1070| 0: ... > ...
# 1070| Type = bool
# 1070| ValueCategory = prvalue
# 1070| 0: e
# 1070| Type = int
# 1070| ValueCategory = prvalue(load)
# 1070| 1: 0
# 1070| Type = int
# 1070| Value = 0
# 1070| ValueCategory = prvalue
# 1070| 1: { ... }
# 1071| 0: continue;
# 1069| 1: label ...:
# 1075| 1: for(...:...) ...
# 1075| 0: declaration
# 1075| 1: declaration
# 1075| 2: call to operator!=
# 1075| Type = bool
# 1075| ValueCategory = prvalue
#-----| -1: (const iterator)...
#-----| Conversion = glvalue conversion
#-----| Type = const iterator
#-----| ValueCategory = lvalue
#-----| expr: (__begin)
#-----| Type = iterator
#-----| ValueCategory = lvalue
#-----| 0: (__end)
#-----| Type = iterator
#-----| ValueCategory = prvalue(load)
# 1075| 3: (reference dereference)
# 1075| Type = iterator
# 1075| ValueCategory = lvalue
# 1075| expr: call to operator++
# 1075| Type = iterator &
# 1075| ValueCategory = prvalue
#-----| -1: (__begin)
#-----| Type = iterator
#-----| ValueCategory = lvalue
# 1075| 4: declaration
# 1075| 5: { ... }
# 1076| 0: if (...) ...
# 1076| 0: ... < ...
# 1076| Type = bool
# 1076| ValueCategory = prvalue
# 1076| 0: (reference dereference)
# 1076| Type = int
# 1076| ValueCategory = prvalue(load)
# 1076| expr: e
# 1076| Type = const int &
# 1076| ValueCategory = prvalue(load)
# 1076| 1: 5
# 1076| Type = int
# 1076| Value = 5
# 1076| ValueCategory = prvalue
# 1076| 1: { ... }
# 1077| 0: break;
# 1079| 2: label ...:
# 1080| 3: return ...
# 1099| int AsmStmt(int)
# 1099| params:
# 1099| 0: x
# 1099| Type = int
# 1099| body: { ... }
# 1100| 0: asm statement
# 1101| 1: return ...
# 1101| 0: x
# 1101| Type = int
# 1101| ValueCategory = prvalue(load)
# 1104| void AsmStmtWithOutputs(unsigned int&, unsigned int&, unsigned int&, unsigned int&)
# 1104| params:
# 1104| 0: a
# 1104| Type = unsigned int &
# 1104| 1: b
# 1104| Type = unsigned int &
# 1104| 2: c
# 1104| Type = unsigned int &
# 1104| 3: d
# 1104| Type = unsigned int &
# 1105| body: { ... }
# 1106| 0: asm statement
# 1109| 0: (reference dereference)
# 1109| Type = unsigned int
# 1109| ValueCategory = lvalue
# 1109| expr: a
# 1109| Type = unsigned int &
# 1109| ValueCategory = prvalue(load)
# 1109| 1: (reference dereference)
# 1109| Type = unsigned int
# 1109| ValueCategory = lvalue
# 1109| expr: b
# 1109| Type = unsigned int &
# 1109| ValueCategory = prvalue(load)
# 1109| 2: (reference dereference)
# 1109| Type = unsigned int
# 1109| ValueCategory = lvalue
# 1109| expr: c
# 1109| Type = unsigned int &
# 1109| ValueCategory = prvalue(load)
# 1109| 3: (reference dereference)
# 1109| Type = unsigned int
# 1109| ValueCategory = lvalue
# 1109| expr: d
# 1109| Type = unsigned int &
# 1109| ValueCategory = prvalue(load)
# 1111| 1: return ...

47
cpp/ql/test/library-tests/ir/ir/ir.cpp
View File

@@ -1046,6 +1046,39 @@ void Lambda(int x, const String& s) {
lambda_inits(6);
}
template<typename T>
struct vector {
struct iterator {
T* p;
iterator& operator++();
T& operator*() const;
bool operator!=(iterator right) const;
};
iterator begin() const;
iterator end() const;
};
template<typename T>
bool operator==(typename vector<T>::iterator left, typename vector<T>::iterator right);
template<typename T>
bool operator!=(typename vector<T>::iterator left, typename vector<T>::iterator right);
void RangeBasedFor(const vector<int>& v) {
for (int e : v) {
if (e > 0) {
continue;
}
}
for (const int& e : v) {
if (e < 5) {
break;
}
}
}
#if 0 // Explicit capture of `this` requires possible extractor fixes.
struct LambdaContainer {
@@ -1063,4 +1096,18 @@ struct LambdaContainer {
#endif
int AsmStmt(int x) {
__asm__("");
return x;
}
static void AsmStmtWithOutputs(unsigned int& a, unsigned int& b, unsigned int& c, unsigned int& d)
{
__asm__ __volatile__
(
"cpuid\n\t"
: "+a" (a), "+b" (b), "+c" (c), "+d" (d)
);
}
// semmle-extractor-options: -std=c++17

177
cpp/ql/test/library-tests/ir/ir/raw_ir.expected
View File

@@ -4861,3 +4861,180 @@ ir.cpp:
# 1045| v0_29(void) = ReturnValue : &:r0_28, ~mu0_2
# 1045| v0_30(void) = UnmodeledUse : mu*
# 1045| v0_31(void) = ExitFunction :
# 1068| void RangeBasedFor(vector<int> const&)
# 1068| Block 0
# 1068| v0_0(void) = EnterFunction :
# 1068| mu0_1(unknown) = AliasedDefinition :
# 1068| mu0_2(unknown) = UnmodeledDefinition :
# 1068| r0_3(glval<vector<int> &>) = VariableAddress[v] :
# 1068| mu0_4(vector<int> &) = InitializeParameter[v] : &:r0_3
# 1069| r0_5(glval<vector<int> &>) = VariableAddress[(__range)] :
# 1069| r0_6(glval<vector<int> &>) = VariableAddress[v] :
# 1069| r0_7(vector<int> &) = Load : &:r0_6, ~mu0_2
# 1069| mu0_8(vector<int> &) = Store : &:r0_5, r0_7
# 1069| r0_9(glval<iterator>) = VariableAddress[(__begin)] :
#-----| r0_10(glval<vector<int> &>) = VariableAddress[(__range)] :
#-----| r0_11(vector<int> &) = Load : &:r0_10, ~mu0_2
# 1069| r0_12(glval<unknown>) = FunctionAddress[begin] :
# 1069| r0_13(iterator) = Call : func:r0_12, this:r0_11
# 1069| mu0_14(unknown) = ^CallSideEffect : ~mu0_2
# 1069| mu0_15(iterator) = Store : &:r0_9, r0_13
# 1069| r0_16(glval<iterator>) = VariableAddress[(__end)] :
#-----| r0_17(glval<vector<int> &>) = VariableAddress[(__range)] :
#-----| r0_18(vector<int> &) = Load : &:r0_17, ~mu0_2
# 1069| r0_19(glval<unknown>) = FunctionAddress[end] :
# 1069| r0_20(iterator) = Call : func:r0_19, this:r0_18
# 1069| mu0_21(unknown) = ^CallSideEffect : ~mu0_2
# 1069| mu0_22(iterator) = Store : &:r0_16, r0_20
#-----| Goto -> Block 1
#-----| Block 1
#-----| r1_0(glval<iterator>) = VariableAddress[(__begin)] :
#-----| r1_1(glval<iterator>) = Convert : r1_0
# 1069| r1_2(glval<unknown>) = FunctionAddress[operator!=] :
#-----| r1_3(glval<iterator>) = VariableAddress[(__end)] :
#-----| r1_4(iterator) = Load : &:r1_3, ~mu0_2
# 1069| r1_5(bool) = Call : func:r1_2, this:r1_1, 0:r1_4
# 1069| mu1_6(unknown) = ^CallSideEffect : ~mu0_2
# 1069| v1_7(void) = ConditionalBranch : r1_5
#-----| False -> Block 5
#-----| True -> Block 2
# 1069| Block 2
# 1069| r2_0(glval<int>) = VariableAddress[e] :
#-----| r2_1(glval<iterator>) = VariableAddress[(__begin)] :
#-----| r2_2(glval<iterator>) = Convert : r2_1
# 1069| r2_3(glval<unknown>) = FunctionAddress[operator*] :
# 1069| r2_4(int &) = Call : func:r2_3, this:r2_2
# 1069| mu2_5(unknown) = ^CallSideEffect : ~mu0_2
# 1069| r2_6(int) = Load : &:r2_4, ~mu0_2
# 1069| mu2_7(int) = Store : &:r2_0, r2_6
# 1070| r2_8(glval<int>) = VariableAddress[e] :
# 1070| r2_9(int) = Load : &:r2_8, ~mu0_2
# 1070| r2_10(int) = Constant[0] :
# 1070| r2_11(bool) = CompareGT : r2_9, r2_10
# 1070| v2_12(void) = ConditionalBranch : r2_11
#-----| False -> Block 4
#-----| True -> Block 3
# 1071| Block 3
# 1071| v3_0(void) = NoOp :
#-----| Goto -> Block 4
# 1069| Block 4
# 1069| v4_0(void) = NoOp :
#-----| r4_1(glval<iterator>) = VariableAddress[(__begin)] :
# 1069| r4_2(glval<unknown>) = FunctionAddress[operator++] :
# 1069| r4_3(iterator &) = Call : func:r4_2, this:r4_1
# 1069| mu4_4(unknown) = ^CallSideEffect : ~mu0_2
#-----| Goto (back edge) -> Block 1
# 1075| Block 5
# 1075| r5_0(glval<vector<int> &>) = VariableAddress[(__range)] :
# 1075| r5_1(glval<vector<int> &>) = VariableAddress[v] :
# 1075| r5_2(vector<int> &) = Load : &:r5_1, ~mu0_2
# 1075| mu5_3(vector<int> &) = Store : &:r5_0, r5_2
# 1075| r5_4(glval<iterator>) = VariableAddress[(__begin)] :
#-----| r5_5(glval<vector<int> &>) = VariableAddress[(__range)] :
#-----| r5_6(vector<int> &) = Load : &:r5_5, ~mu0_2
# 1075| r5_7(glval<unknown>) = FunctionAddress[begin] :
# 1075| r5_8(iterator) = Call : func:r5_7, this:r5_6
# 1075| mu5_9(unknown) = ^CallSideEffect : ~mu0_2
# 1075| mu5_10(iterator) = Store : &:r5_4, r5_8
# 1075| r5_11(glval<iterator>) = VariableAddress[(__end)] :
#-----| r5_12(glval<vector<int> &>) = VariableAddress[(__range)] :
#-----| r5_13(vector<int> &) = Load : &:r5_12, ~mu0_2
# 1075| r5_14(glval<unknown>) = FunctionAddress[end] :
# 1075| r5_15(iterator) = Call : func:r5_14, this:r5_13
# 1075| mu5_16(unknown) = ^CallSideEffect : ~mu0_2
# 1075| mu5_17(iterator) = Store : &:r5_11, r5_15
#-----| Goto -> Block 6
#-----| Block 6
#-----| r6_0(glval<iterator>) = VariableAddress[(__begin)] :
#-----| r6_1(glval<iterator>) = Convert : r6_0
# 1075| r6_2(glval<unknown>) = FunctionAddress[operator!=] :
#-----| r6_3(glval<iterator>) = VariableAddress[(__end)] :
#-----| r6_4(iterator) = Load : &:r6_3, ~mu0_2
# 1075| r6_5(bool) = Call : func:r6_2, this:r6_1, 0:r6_4
# 1075| mu6_6(unknown) = ^CallSideEffect : ~mu0_2
# 1075| v6_7(void) = ConditionalBranch : r6_5
#-----| False -> Block 10
#-----| True -> Block 8
#-----| Block 7
#-----| r7_0(glval<iterator>) = VariableAddress[(__begin)] :
# 1075| r7_1(glval<unknown>) = FunctionAddress[operator++] :
# 1075| r7_2(iterator &) = Call : func:r7_1, this:r7_0
# 1075| mu7_3(unknown) = ^CallSideEffect : ~mu0_2
#-----| Goto (back edge) -> Block 6
# 1075| Block 8
# 1075| r8_0(glval<int &>) = VariableAddress[e] :
#-----| r8_1(glval<iterator>) = VariableAddress[(__begin)] :
#-----| r8_2(glval<iterator>) = Convert : r8_1
# 1075| r8_3(glval<unknown>) = FunctionAddress[operator*] :
# 1075| r8_4(int &) = Call : func:r8_3, this:r8_2
# 1075| mu8_5(unknown) = ^CallSideEffect : ~mu0_2
# 1075| r8_6(glval<int>) = Convert : r8_4
# 1075| mu8_7(int &) = Store : &:r8_0, r8_6
# 1076| r8_8(glval<int &>) = VariableAddress[e] :
# 1076| r8_9(int &) = Load : &:r8_8, ~mu0_2
# 1076| r8_10(int) = Load : &:r8_9, ~mu0_2
# 1076| r8_11(int) = Constant[5] :
# 1076| r8_12(bool) = CompareLT : r8_10, r8_11
# 1076| v8_13(void) = ConditionalBranch : r8_12
#-----| False -> Block 7
#-----| True -> Block 9
# 1077| Block 9
# 1077| v9_0(void) = NoOp :
#-----| Goto -> Block 10
# 1079| Block 10
# 1079| v10_0(void) = NoOp :
# 1080| v10_1(void) = NoOp :
# 1068| v10_2(void) = ReturnVoid :
# 1068| v10_3(void) = UnmodeledUse : mu*
# 1068| v10_4(void) = ExitFunction :
# 1099| int AsmStmt(int)
# 1099| Block 0
# 1099| v0_0(void) = EnterFunction :
# 1099| mu0_1(unknown) = AliasedDefinition :
# 1099| mu0_2(unknown) = UnmodeledDefinition :
# 1099| r0_3(glval<int>) = VariableAddress[x] :
# 1099| mu0_4(int) = InitializeParameter[x] : &:r0_3
# 1100| mu0_5(unknown) = InlineAsm : ~mu0_2
# 1101| r0_6(glval<int>) = VariableAddress[#return] :
# 1101| r0_7(glval<int>) = VariableAddress[x] :
# 1101| r0_8(int) = Load : &:r0_7, ~mu0_2
# 1101| mu0_9(int) = Store : &:r0_6, r0_8
# 1099| r0_10(glval<int>) = VariableAddress[#return] :
# 1099| v0_11(void) = ReturnValue : &:r0_10, ~mu0_2
# 1099| v0_12(void) = UnmodeledUse : mu*
# 1099| v0_13(void) = ExitFunction :
# 1104| void AsmStmtWithOutputs(unsigned int&, unsigned int&, unsigned int&, unsigned int&)
# 1104| Block 0
# 1104| v0_0(void) = EnterFunction :
# 1104| mu0_1(unknown) = AliasedDefinition :
# 1104| mu0_2(unknown) = UnmodeledDefinition :
# 1104| r0_3(glval<unsigned int &>) = VariableAddress[a] :
# 1104| mu0_4(unsigned int &) = InitializeParameter[a] : &:r0_3
# 1104| r0_5(glval<unsigned int &>) = VariableAddress[b] :
# 1104| mu0_6(unsigned int &) = InitializeParameter[b] : &:r0_5
# 1104| r0_7(glval<unsigned int &>) = VariableAddress[c] :
# 1104| mu0_8(unsigned int &) = InitializeParameter[c] : &:r0_7
# 1104| r0_9(glval<unsigned int &>) = VariableAddress[d] :
# 1104| mu0_10(unsigned int &) = InitializeParameter[d] : &:r0_9
# 1106| r0_11(glval<unsigned int &>) = VariableAddress[a] :
# 1106| r0_12(glval<unsigned int &>) = VariableAddress[b] :
# 1106| r0_13(glval<unsigned int &>) = VariableAddress[c] :
# 1106| r0_14(glval<unsigned int &>) = VariableAddress[d] :
# 1106| mu0_15(unknown) = InlineAsm : ~mu0_2, 0:r0_11, 1:r0_12, 2:r0_13, 3:r0_14
# 1111| v0_16(void) = NoOp :
# 1104| v0_17(void) = ReturnVoid :
# 1104| v0_18(void) = UnmodeledUse : mu*
# 1104| v0_19(void) = ExitFunction :

47
cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
View File

@@ -711,3 +711,50 @@ ssa.cpp:
# 171| v0_28(void) = ReturnVoid :
# 171| v0_29(void) = UnmodeledUse : mu*
# 171| v0_30(void) = ExitFunction :
# 179| int AsmStmt(int*)
# 179| Block 0
# 179| v0_0(void) = EnterFunction :
# 179| m0_1(unknown) = AliasedDefinition :
# 179| mu0_2(unknown) = UnmodeledDefinition :
# 179| r0_3(glval<int *>) = VariableAddress[p] :
# 179| m0_4(int *) = InitializeParameter[p] : &:r0_3
# 180| m0_5(unknown) = InlineAsm : ~mu0_2
# 180| m0_6(unknown) = Chi : total:m0_1, partial:m0_5
# 181| r0_7(glval<int>) = VariableAddress[#return] :
# 181| r0_8(glval<int *>) = VariableAddress[p] :
# 181| r0_9(int *) = Load : &:r0_8, m0_4
# 181| r0_10(int) = Load : &:r0_9, ~m0_6
# 181| m0_11(int) = Store : &:r0_7, r0_10
# 179| r0_12(glval<int>) = VariableAddress[#return] :
# 179| v0_13(void) = ReturnValue : &:r0_12, m0_11
# 179| v0_14(void) = UnmodeledUse : mu*
# 179| v0_15(void) = ExitFunction :
# 184| void AsmStmtWithOutputs(unsigned int&, unsigned int&, unsigned int&, unsigned int&)
# 184| Block 0
# 184| v0_0(void) = EnterFunction :
# 184| m0_1(unknown) = AliasedDefinition :
# 184| mu0_2(unknown) = UnmodeledDefinition :
# 184| r0_3(glval<unsigned int &>) = VariableAddress[a] :
# 184| m0_4(unsigned int &) = InitializeParameter[a] : &:r0_3
# 184| m0_5(unknown) = Chi : total:m0_1, partial:m0_4
# 184| r0_6(glval<unsigned int &>) = VariableAddress[b] :
# 184| m0_7(unsigned int &) = InitializeParameter[b] : &:r0_6
# 184| m0_8(unknown) = Chi : total:m0_5, partial:m0_7
# 184| r0_9(glval<unsigned int &>) = VariableAddress[c] :
# 184| m0_10(unsigned int &) = InitializeParameter[c] : &:r0_9
# 184| m0_11(unknown) = Chi : total:m0_8, partial:m0_10
# 184| r0_12(glval<unsigned int &>) = VariableAddress[d] :
# 184| m0_13(unsigned int &) = InitializeParameter[d] : &:r0_12
# 184| m0_14(unknown) = Chi : total:m0_11, partial:m0_13
# 186| r0_15(glval<unsigned int &>) = VariableAddress[a] :
# 186| r0_16(glval<unsigned int &>) = VariableAddress[b] :
# 186| r0_17(glval<unsigned int &>) = VariableAddress[c] :
# 186| r0_18(glval<unsigned int &>) = VariableAddress[d] :
# 186| m0_19(unknown) = InlineAsm : ~mu0_2, 0:r0_15, 1:r0_16, 2:r0_17, 3:r0_18
# 186| m0_20(unknown) = Chi : total:m0_14, partial:m0_19
# 192| v0_21(void) = NoOp :
# 184| v0_22(void) = ReturnVoid :
# 184| v0_23(void) = UnmodeledUse : mu*
# 184| v0_24(void) = ExitFunction :

15
cpp/ql/test/library-tests/ir/ssa/ssa.cpp
View File

@@ -175,3 +175,18 @@ void WrapperStruct(Wrapper w) {
a = w.f; // MustExactlyOverlap
x = w; // MustTotallyOverlap
}
int AsmStmt(int *p) {
__asm__("");
return *p;
}
static void AsmStmtWithOutputs(unsigned int& a, unsigned int& b, unsigned int& c, unsigned int& d)
{
__asm__ __volatile__
(
"cpuid\n\t"
: "+a" (a), "+b" (b)
: "c" (c), "d" (d)
);
}

41
cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected
View File

@@ -683,3 +683,44 @@ ssa.cpp:
# 171| v0_28(void) = ReturnVoid :
# 171| v0_29(void) = UnmodeledUse : mu*
# 171| v0_30(void) = ExitFunction :
# 179| int AsmStmt(int*)
# 179| Block 0
# 179| v0_0(void) = EnterFunction :
# 179| mu0_1(unknown) = AliasedDefinition :
# 179| mu0_2(unknown) = UnmodeledDefinition :
# 179| r0_3(glval<int *>) = VariableAddress[p] :
# 179| m0_4(int *) = InitializeParameter[p] : &:r0_3
# 180| mu0_5(unknown) = InlineAsm : ~mu0_2
# 181| r0_6(glval<int>) = VariableAddress[#return] :
# 181| r0_7(glval<int *>) = VariableAddress[p] :
# 181| r0_8(int *) = Load : &:r0_7, m0_4
# 181| r0_9(int) = Load : &:r0_8, ~mu0_2
# 181| m0_10(int) = Store : &:r0_6, r0_9
# 179| r0_11(glval<int>) = VariableAddress[#return] :
# 179| v0_12(void) = ReturnValue : &:r0_11, m0_10
# 179| v0_13(void) = UnmodeledUse : mu*
# 179| v0_14(void) = ExitFunction :
# 184| void AsmStmtWithOutputs(unsigned int&, unsigned int&, unsigned int&, unsigned int&)
# 184| Block 0
# 184| v0_0(void) = EnterFunction :
# 184| mu0_1(unknown) = AliasedDefinition :
# 184| mu0_2(unknown) = UnmodeledDefinition :
# 184| r0_3(glval<unsigned int &>) = VariableAddress[a] :
# 184| mu0_4(unsigned int &) = InitializeParameter[a] : &:r0_3
# 184| r0_5(glval<unsigned int &>) = VariableAddress[b] :
# 184| mu0_6(unsigned int &) = InitializeParameter[b] : &:r0_5
# 184| r0_7(glval<unsigned int &>) = VariableAddress[c] :
# 184| mu0_8(unsigned int &) = InitializeParameter[c] : &:r0_7
# 184| r0_9(glval<unsigned int &>) = VariableAddress[d] :
# 184| mu0_10(unsigned int &) = InitializeParameter[d] : &:r0_9
# 186| r0_11(glval<unsigned int &>) = VariableAddress[a] :
# 186| r0_12(glval<unsigned int &>) = VariableAddress[b] :
# 186| r0_13(glval<unsigned int &>) = VariableAddress[c] :
# 186| r0_14(glval<unsigned int &>) = VariableAddress[d] :
# 186| mu0_15(unknown) = InlineAsm : ~mu0_2, 0:r0_11, 1:r0_12, 2:r0_13, 3:r0_14
# 192| v0_16(void) = NoOp :
# 184| v0_17(void) = ReturnVoid :
# 184| v0_18(void) = UnmodeledUse : mu*
# 184| v0_19(void) = ExitFunction :

2
cpp/ql/test/library-tests/literals/aggregate_literals/arrays_child_exprs.ql
View File

@@ -7,5 +7,5 @@ import cpp
from ArrayAggregateLiteral aal, int childIndex, int elementIndex
where aal.getElementExpr(elementIndex) = aal.getChild(childIndex)
select aal, aal.getType().getUnspecifiedType(), childIndex,
select aal, aal.getUnspecifiedType(), childIndex,
aal.getChild(childIndex), elementIndex

2
cpp/ql/test/library-tests/literals/aggregate_literals/classes_child_exprs.ql
View File

@@ -7,4 +7,4 @@ import cpp
from ClassAggregateLiteral cal, int i, Field f
where cal.getFieldExpr(f) = cal.getChild(i)
select cal, cal.getType().getUnspecifiedType(), i, cal.getChild(i), f
select cal, cal.getUnspecifiedType(), i, cal.getChild(i), f

17
cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/lowerBound.expected
View File

@@ -423,6 +423,23 @@
| test.c:398:22:398:22 | y | 5.0 |
| test.c:399:10:399:11 | y1 | 1.0 |
| test.c:399:15:399:16 | y2 | 5.0 |
| test.c:407:3:407:3 | i | -2.147483648E9 |
| test.c:408:7:408:7 | i | 10.0 |
| test.c:410:3:410:3 | i | -2.147483648E9 |
| test.c:411:3:411:3 | i | 10.0 |
| test.c:412:7:412:7 | i | -2.147483648E9 |
| test.c:414:3:414:3 | i | -2.147483648E9 |
| test.c:415:3:415:3 | i | 40.0 |
| test.c:416:7:416:7 | i | -2.147483648E9 |
| test.c:418:3:418:3 | i | -2.147483648E9 |
| test.c:418:7:418:7 | j | -2.147483648E9 |
| test.c:419:7:419:7 | i | 40.0 |
| test.c:421:3:421:3 | i | -2.147483648E9 |
| test.c:421:8:421:8 | j | 40.0 |
| test.c:422:7:422:7 | i | 50.0 |
| test.c:424:3:424:3 | i | -2.147483648E9 |
| test.c:424:13:424:13 | j | -2.147483648E9 |
| test.c:425:7:425:7 | i | -2.147483648E9 |
| test.cpp:10:7:10:7 | b | -2.147483648E9 |
| test.cpp:11:5:11:5 | x | -2.147483648E9 |
| test.cpp:13:10:13:10 | x | -2.147483648E9 |

26
cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/test.c
View File

@@ -398,3 +398,29 @@ unsigned int test_comma01(unsigned int x) {
y2 = (y++, y += 3, y);
return y1 + y2;
}
void out(int i);
void test17() {
int i, j;
i = 10;
out(i); // 10
i = 10;
i += 10;
out(i); // 20
i = 40;
i -= 10;
out(i); // 30
i = j = 40;
out(i); // 40
i = (j += 10);
out(i); // 50
i = 20 + (j -= 10);
out(i); // 60 [BUG: the analysis thinks it's 2^-31 .. 2^31-1]
}

17
cpp/ql/test/library-tests/rangeanalysis/SimpleRangeAnalysis/upperBound.expected
View File

@@ -423,6 +423,23 @@
| test.c:398:22:398:22 | y | 105.0 |
| test.c:399:10:399:11 | y1 | 101.0 |
| test.c:399:15:399:16 | y2 | 105.0 |
| test.c:407:3:407:3 | i | 2.147483647E9 |
| test.c:408:7:408:7 | i | 10.0 |
| test.c:410:3:410:3 | i | 2.147483647E9 |
| test.c:411:3:411:3 | i | 10.0 |
| test.c:412:7:412:7 | i | 2.147483647E9 |
| test.c:414:3:414:3 | i | 2.147483647E9 |
| test.c:415:3:415:3 | i | 40.0 |
| test.c:416:7:416:7 | i | 2.147483647E9 |
| test.c:418:3:418:3 | i | 2.147483647E9 |
| test.c:418:7:418:7 | j | 2.147483647E9 |
| test.c:419:7:419:7 | i | 40.0 |
| test.c:421:3:421:3 | i | 2.147483647E9 |
| test.c:421:8:421:8 | j | 40.0 |
| test.c:422:7:422:7 | i | 50.0 |
| test.c:424:3:424:3 | i | 2.147483647E9 |
| test.c:424:13:424:13 | j | 2.147483647E9 |
| test.c:425:7:425:7 | i | 2.147483647E9 |
| test.cpp:10:7:10:7 | b | 2.147483647E9 |
| test.cpp:11:5:11:5 | x | 2.147483647E9 |
| test.cpp:13:10:13:10 | x | 2.147483647E9 |

2
cpp/ql/test/library-tests/rangeanalysis/signanalysis/SignAnalysis.expected
View File

@@ -16,6 +16,8 @@
| inline_assembly.c:10:3:10:7 | Store: ... = ... | positive strictlyPositive |
| inline_assembly.c:10:7:10:7 | Constant: (unsigned int)... | positive strictlyPositive |
| inline_assembly.c:12:32:12:32 | Load: y | positive strictlyPositive |
| inline_assembly.c:21:29:21:29 | Load: x | positive |
| inline_assembly.c:21:32:21:32 | Load: y | positive |
| minmax.c:16:9:16:10 | Constant: 1 | positive strictlyPositive |
| minmax.c:16:9:16:10 | Store: 1 | positive strictlyPositive |
| minmax.c:16:16:16:17 | Constant: 2 | positive strictlyPositive |

2
cpp/ql/test/library-tests/string_analysis/StringAnalysis.ql
View File

@@ -6,7 +6,7 @@ import cpp
from AnalysedString s, string str
where
if s.(StringLiteral).getType().getUnspecifiedType().(DerivedType).getBaseType() instanceof Wchar_t then (
if s.(StringLiteral).getUnspecifiedType().(DerivedType).getBaseType() instanceof Wchar_t then (
str = "[?]"
) else (
str = s.toString()

2
cpp/ql/test/library-tests/unspecified_type/unspecified_type/unspecified_type.ql
View File

@@ -3,5 +3,5 @@ import cpp
from Variable v
select v,
v.getType().explain(),
v.getType().getUnspecifiedType().explain()
v.getUnspecifiedType().explain()

6
cpp/ql/test/query-tests/Likely Bugs/Memory Management/StackAddressEscapes/ArrayTypeTest.ql
View File

@@ -7,8 +7,8 @@ import cpp
from ArrayExpr arrayExpr
select
arrayExpr,
arrayExpr.getArrayBase().getType().getUnspecifiedType().toString() +
arrayExpr.getArrayBase().getUnspecifiedType().toString() +
", " +
arrayExpr.getArrayBase().getFullyConverted().getType().getUnspecifiedType().toString() +
arrayExpr.getArrayBase().getFullyConverted().getUnspecifiedType().toString() +
", " +
arrayExpr.getType().getUnspecifiedType().toString()
arrayExpr.getUnspecifiedType().toString()

41
cpp/ql/test/query-tests/Likely Bugs/RedundantNullCheckSimple/RedundantNullCheckSimple.cpp
View File

@@ -69,3 +69,44 @@ int test_inverted_logic(int *p) {
return 0;
}
}
void test_indirect_local() {
int a = 0;
int *p = &a;
int **pp = &p;
int x;
x = **pp;
if (*pp == nullptr) { // BAD
return;
}
}
void test_field_local(bool boolvar) {
int a = 0;
struct {
int *p;
} s = { &a };
auto sp = &s;
if (boolvar) {
int x = *sp->p;
if (sp->p == nullptr) { // BAD
return;
}
} else {
int *x = sp->p;
if (sp == nullptr) { // BAD [NOT DETECTED]
return;
}
}
}
struct S {
long **pplong;
void test_phi() {
while (*pplong != nullptr) { // GOOD
pplong++;
}
}
};

2
cpp/ql/test/query-tests/Likely Bugs/RedundantNullCheckSimple/RedundantNullCheckSimple.expected
View File

@@ -1,3 +1,5 @@
| RedundantNullCheckSimple.cpp:4:7:4:7 | Load: p | This null check is redundant because the value is $@ in any case | RedundantNullCheckSimple.cpp:3:7:3:8 | Load: * ... | dereferenced here |
| RedundantNullCheckSimple.cpp:13:8:13:8 | Load: p | This null check is redundant because the value is $@ in any case | RedundantNullCheckSimple.cpp:10:11:10:12 | Load: * ... | dereferenced here |
| RedundantNullCheckSimple.cpp:48:12:48:12 | Load: p | This null check is redundant because the value is $@ in any case | RedundantNullCheckSimple.cpp:51:10:51:11 | Load: * ... | dereferenced here |
| RedundantNullCheckSimple.cpp:79:7:79:9 | Load: * ... | This null check is redundant because the value is $@ in any case | RedundantNullCheckSimple.cpp:78:7:78:10 | Load: * ... | dereferenced here |
| RedundantNullCheckSimple.cpp:93:13:93:13 | Load: p | This null check is redundant because the value is $@ in any case | RedundantNullCheckSimple.cpp:92:13:92:18 | Load: * ... | dereferenced here |

2
cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/IntegerOverflowTainted.expected
View File

@@ -2,3 +2,5 @@
| test3.c:13:16:13:19 | * ... | $@ flows to here and is used in an expression which might overflow negatively. | test3.c:11:15:11:18 | argv | User-provided value |
| test4.cpp:13:17:13:20 | access to array | $@ flows to here and is used in an expression which might overflow negatively. | test4.cpp:9:13:9:16 | argv | User-provided value |
| test5.cpp:10:9:10:15 | call to strtoul | $@ flows to here and is used in an expression which might overflow. | test5.cpp:9:7:9:9 | buf | User-provided value |
| test.c:44:7:44:12 | ... -- | $@ flows to here and is used in an expression which might overflow negatively. | test.c:41:17:41:20 | argv | User-provided value |
| test.c:54:7:54:12 | ... -- | $@ flows to here and is used in an expression which might overflow negatively. | test.c:51:17:51:20 | argv | User-provided value |

0
cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/PotentiallyDangerousFunction.expected → cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/DangerousFunctionOverflow.expected
View File

1
cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/DangerousFunctionOverflow.qlref Normal file
View File

@@ -0,0 +1 @@
Security/CWE/CWE-676/DangerousFunctionOverflow.ql

1
cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/PotentiallyDangerousFunction.qlref
View File

@@ -1 +0,0 @@
Security/CWE/CWE-676/PotentiallyDangerousFunction.ql

2
cpp/ql/test/query-tests/Security/CWE/CWE-676/semmle/PotentiallyDangerousFunction/DangerousFunctionOverflow.expected Normal file
View File

@@ -0,0 +1,2 @@
| test.c:42:2:42:5 | call to gets | gets does not guard against buffer overflow |
| test.c:43:6:43:9 | call to gets | gets does not guard against buffer overflow |

1
cpp/ql/test/query-tests/Security/CWE/CWE-676/semmle/PotentiallyDangerousFunction/DangerousFunctionOverflow.qlref Normal file
View File

@@ -0,0 +1 @@
Security/CWE/CWE-676/DangerousFunctionOverflow.ql

2
cpp/ql/test/query-tests/Security/CWE/CWE-676/semmle/PotentiallyDangerousFunction/PotentiallyDangerousFunction.expected
View File

@@ -1,6 +1,4 @@
| test.c:31:22:31:27 | call to gmtime | Call to gmtime is potentially dangerous |
| test.c:42:2:42:5 | call to gets | gets does not guard against buffer overflow |
| test.c:43:6:43:9 | call to gets | gets does not guard against buffer overflow |
| test.c:48:19:48:27 | call to localtime | Call to localtime is potentially dangerous |
| test.c:49:22:49:26 | call to ctime | Call to ctime is potentially dangerous |
| test.c:50:23:50:29 | call to asctime | Call to asctime is potentially dangerous |

338
cpp/ql/test/successor-tests/conditional_destructors/cfg.expected
View File

@@ -1,175 +1,167 @@
| C1::C1 | false | 268 | 268 | C1 |
| C1::C1 | false | 394 | 394 | C1 |
| C1::C1 | false | 398 | 398 | C1 |
| C1::C1 | false | 435 | 435 | this |
| C1::C1 | false | 436 | 436 | val |
| C1::C1 | false | 438 | 438 | x |
| C1::C1 | false | 440 | 440 | ... = ... |
| C1::C1 | false | 442 | 442 | ExprStmt |
| C1::C1 | false | 444 | 444 | return ... |
| C1::C1 | false | 446 | 446 | { ... } |
| C1::C1 | true | 435 | 436 | |
| C1::C1 | true | 436 | 440 | |
| C1::C1 | true | 438 | 435 | |
| C1::C1 | true | 440 | 444 | |
| C1::C1 | true | 442 | 438 | |
| C1::C1 | true | 444 | 268 | |
| C1::C1 | true | 446 | 442 | |
| C1::operator= | false | 383 | 383 | operator= |
| C1::operator= | false | 390 | 390 | operator= |
| C1::operator== | false | 257 | 257 | operator== |
| C1::operator== | false | 412 | 412 | this |
| C1::operator== | false | 414 | 414 | val |
| C1::operator== | false | 416 | 416 | other |
| C1::operator== | false | 418 | 418 | (reference dereference) |
| C1::operator== | false | 419 | 419 | val |
| C1::operator== | false | 421 | 421 | ... == ... |
| C1::operator== | false | 423 | 423 | return ... |
| C1::operator== | false | 425 | 425 | { ... } |
| C1::operator== | true | 412 | 414 | |
| C1::operator== | true | 414 | 416 | |
| C1::operator== | true | 416 | 419 | |
| C1::operator== | true | 419 | 421 | |
| C1::operator== | true | 421 | 257 | |
| C1::operator== | true | 423 | 412 | |
| C1::operator== | true | 425 | 423 | |
| C2::C2 | false | 201 | 201 | C2 |
| C2::C2 | false | 321 | 321 | C2 |
| C2::C2 | false | 369 | 369 | this |
| C2::C2 | false | 370 | 370 | val |
| C2::C2 | false | 372 | 372 | x |
| C2::C2 | false | 374 | 374 | ... = ... |
| C2::C2 | false | 376 | 376 | ExprStmt |
| C2::C2 | false | 378 | 378 | return ... |
| C2::C2 | false | 380 | 380 | { ... } |
| C2::C2 | true | 369 | 370 | |
| C2::C2 | true | 370 | 374 | |
| C2::C2 | true | 372 | 369 | |
| C2::C2 | true | 374 | 378 | |
| C2::C2 | true | 376 | 372 | |
| C2::C2 | true | 378 | 201 | |
| C2::C2 | true | 380 | 376 | |
| C2::operator= | false | 315 | 315 | operator= |
| C2::operator== | false | 190 | 190 | operator== |
| C2::operator== | false | 335 | 335 | this |
| C2::operator== | false | 337 | 337 | val |
| C2::operator== | false | 339 | 339 | other |
| C2::operator== | false | 341 | 341 | (reference dereference) |
| C2::operator== | false | 342 | 342 | val |
| C2::operator== | false | 344 | 344 | ... == ... |
| C2::operator== | false | 346 | 346 | return ... |
| C2::operator== | false | 348 | 348 | { ... } |
| C2::operator== | true | 335 | 337 | |
| C2::operator== | true | 337 | 339 | |
| C2::operator== | true | 339 | 342 | |
| C2::operator== | true | 342 | 344 | |
| C2::operator== | true | 344 | 190 | |
| C2::operator== | true | 346 | 335 | |
| C2::operator== | true | 348 | 346 | |
| C2::~C2 | false | 350 | 350 | ~C2 |
| C2::~C2 | false | 355 | 355 | ; |
| C2::~C2 | false | 357 | 357 | return ... |
| C2::~C2 | false | 359 | 359 | { ... } |
| C2::~C2 | true | 355 | 357 | |
| C2::~C2 | true | 357 | 350 | |
| C2::~C2 | true | 359 | 355 | |
| __va_list_tag::operator= | false | 105 | 105 | operator= |
| __va_list_tag::operator= | false | 111 | 111 | operator= |
| f1 | false | 248 | 248 | f1 |
| f1 | false | 265 | 265 | call to operator== |
| f1 | false | 266 | 266 | call to C1 |
| f1 | false | 271 | 271 | 1 |
| f1 | false | 272 | 272 | (const C1)... |
| f1 | false | 273 | 273 | call to C1 |
| f1 | false | 277 | 277 | 2 |
| f1 | false | 278 | 278 | (reference to) |
| f1 | false | 279 | 279 | (reference dereference) |
| f1 | false | 280 | 280 | (const C1)... |
| f1 | false | 281 | 281 | (reference to) |
| f1 | false | 282 | 282 | ; |
| f1 | false | 284 | 284 | { ... } |
| f1 | false | 286 | 286 | if (...) ... |
| f1 | false | 289 | 289 | call to operator== |
| f1 | false | 290 | 290 | call to C1 |
| f1 | false | 294 | 294 | 3 |
| C1::C1 | false | 254 | 254 | C1 |
| C1::C1 | false | 420 | 420 | C1 |
| C1::C1 | false | 424 | 424 | C1 |
| C1::C1 | false | 470 | 470 | this |
| C1::C1 | false | 472 | 472 | val |
| C1::C1 | false | 475 | 475 | x |
| C1::C1 | false | 478 | 478 | ... = ... |
| C1::C1 | false | 481 | 481 | ExprStmt |
| C1::C1 | false | 484 | 484 | return ... |
| C1::C1 | false | 487 | 487 | { ... } |
| C1::C1 | true | 470 | 472 | |
| C1::C1 | true | 472 | 478 | |
| C1::C1 | true | 475 | 470 | |
| C1::C1 | true | 478 | 484 | |
| C1::C1 | true | 481 | 475 | |
| C1::C1 | true | 484 | 254 | |
| C1::C1 | true | 487 | 481 | |
| C1::operator= | false | 409 | 409 | operator= |
| C1::operator= | false | 416 | 416 | operator= |
| C1::operator== | false | 241 | 241 | operator== |
| C1::operator== | false | 439 | 439 | this |
| C1::operator== | false | 442 | 442 | val |
| C1::operator== | false | 445 | 445 | other |
| C1::operator== | false | 448 | 448 | (reference dereference) |
| C1::operator== | false | 450 | 450 | val |
| C1::operator== | false | 453 | 453 | ... == ... |
| C1::operator== | false | 456 | 456 | return ... |
| C1::operator== | false | 459 | 459 | { ... } |
| C1::operator== | true | 439 | 442 | |
| C1::operator== | true | 442 | 445 | |
| C1::operator== | true | 445 | 450 | |
| C1::operator== | true | 450 | 453 | |
| C1::operator== | true | 453 | 241 | |
| C1::operator== | true | 456 | 439 | |
| C1::operator== | true | 459 | 456 | |
| C2::C2 | false | 163 | 163 | C2 |
| C2::C2 | false | 329 | 329 | C2 |
| C2::C2 | false | 389 | 389 | this |
| C2::C2 | false | 391 | 391 | val |
| C2::C2 | false | 394 | 394 | x |
| C2::C2 | false | 397 | 397 | ... = ... |
| C2::C2 | false | 400 | 400 | ExprStmt |
| C2::C2 | false | 403 | 403 | return ... |
| C2::C2 | false | 406 | 406 | { ... } |
| C2::C2 | true | 389 | 391 | |
| C2::C2 | true | 391 | 397 | |
| C2::C2 | true | 394 | 389 | |
| C2::C2 | true | 397 | 403 | |
| C2::C2 | true | 400 | 394 | |
| C2::C2 | true | 403 | 163 | |
| C2::C2 | true | 406 | 400 | |
| C2::operator= | false | 323 | 323 | operator= |
| C2::operator== | false | 150 | 150 | operator== |
| C2::operator== | false | 344 | 344 | this |
| C2::operator== | false | 347 | 347 | val |
| C2::operator== | false | 350 | 350 | other |
| C2::operator== | false | 353 | 353 | (reference dereference) |
| C2::operator== | false | 355 | 355 | val |
| C2::operator== | false | 358 | 358 | ... == ... |
| C2::operator== | false | 361 | 361 | return ... |
| C2::operator== | false | 364 | 364 | { ... } |
| C2::operator== | true | 344 | 347 | |
| C2::operator== | true | 347 | 350 | |
| C2::operator== | true | 350 | 355 | |
| C2::operator== | true | 355 | 358 | |
| C2::operator== | true | 358 | 150 | |
| C2::operator== | true | 361 | 344 | |
| C2::operator== | true | 364 | 361 | |
| C2::~C2 | false | 366 | 366 | ~C2 |
| C2::~C2 | false | 372 | 372 | ; |
| C2::~C2 | false | 375 | 375 | return ... |
| C2::~C2 | false | 378 | 378 | { ... } |
| C2::~C2 | true | 372 | 375 | |
| C2::~C2 | true | 375 | 366 | |
| C2::~C2 | true | 378 | 372 | |
| __va_list_tag::operator= | false | 64 | 64 | operator= |
| __va_list_tag::operator= | false | 70 | 70 | operator= |
| f1 | false | 232 | 232 | f1 |
| f1 | false | 250 | 250 | call to operator== |
| f1 | false | 252 | 252 | call to C1 |
| f1 | false | 259 | 259 | 1 |
| f1 | false | 261 | 261 | (const C1)... |
| f1 | false | 263 | 263 | call to C1 |
| f1 | false | 269 | 269 | 2 |
| f1 | false | 271 | 271 | (const C1)... |
| f1 | false | 273 | 273 | (reference to) |
| f1 | false | 275 | 275 | ; |
| f1 | false | 278 | 278 | { ... } |
| f1 | false | 281 | 281 | if (...) ... |
| f1 | false | 285 | 285 | call to operator== |
| f1 | false | 287 | 287 | call to C1 |
| f1 | false | 293 | 293 | 3 |
| f1 | false | 295 | 295 | (const C1)... |
| f1 | false | 296 | 296 | call to C1 |
| f1 | false | 300 | 300 | 3 |
| f1 | false | 301 | 301 | (reference to) |
| f1 | false | 302 | 302 | (reference dereference) |
| f1 | false | 303 | 303 | (const C1)... |
| f1 | false | 304 | 304 | (reference to) |
| f1 | false | 305 | 305 | ; |
| f1 | false | 307 | 307 | { ... } |
| f1 | false | 309 | 309 | if (...) ... |
| f1 | false | 311 | 311 | return ... |
| f1 | false | 313 | 313 | { ... } |
| f1 | true | 265 | 284 | T |
| f1 | true | 265 | 309 | F |
| f1 | true | 266 | 265 | |
| f1 | true | 271 | 266 | |
| f1 | true | 273 | 271 | |
| f1 | true | 277 | 273 | |
| f1 | true | 282 | 309 | |
| f1 | true | 284 | 282 | |
| f1 | true | 286 | 277 | |
| f1 | true | 289 | 307 | T |
| f1 | true | 289 | 311 | F |
| f1 | true | 290 | 289 | |
| f1 | true | 294 | 290 | |
| f1 | true | 296 | 294 | |
| f1 | true | 300 | 296 | |
| f1 | true | 305 | 311 | |
| f1 | true | 307 | 305 | |
| f1 | true | 309 | 300 | |
| f1 | true | 311 | 248 | |
| f1 | true | 313 | 286 | |
| f2 | false | 181 | 181 | f2 |
| f2 | false | 198 | 198 | call to operator== |
| f2 | false | 199 | 199 | call to C2 |
| f2 | false | 204 | 204 | 1 |
| f2 | false | 205 | 205 | (const C2)... |
| f1 | false | 297 | 297 | call to C1 |
| f1 | false | 303 | 303 | 3 |
| f1 | false | 305 | 305 | (const C1)... |
| f1 | false | 307 | 307 | (reference to) |
| f1 | false | 309 | 309 | ; |
| f1 | false | 312 | 312 | { ... } |
| f1 | false | 315 | 315 | if (...) ... |
| f1 | false | 318 | 318 | return ... |
| f1 | false | 321 | 321 | { ... } |
| f1 | true | 250 | 278 | T |
| f1 | true | 250 | 315 | F |
| f1 | true | 252 | 250 | |
| f1 | true | 259 | 252 | |
| f1 | true | 263 | 259 | |
| f1 | true | 269 | 263 | |
| f1 | true | 275 | 315 | |
| f1 | true | 278 | 275 | |
| f1 | true | 281 | 269 | |
| f1 | true | 285 | 312 | T |
| f1 | true | 285 | 318 | F |
| f1 | true | 287 | 285 | |
| f1 | true | 293 | 287 | |
| f1 | true | 297 | 293 | |
| f1 | true | 303 | 297 | |
| f1 | true | 309 | 318 | |
| f1 | true | 312 | 309 | |
| f1 | true | 315 | 303 | |
| f1 | true | 318 | 232 | |
| f1 | true | 321 | 281 | |
| f2 | false | 141 | 141 | f2 |
| f2 | false | 159 | 159 | call to operator== |
| f2 | false | 161 | 161 | call to C2 |
| f2 | false | 168 | 168 | 1 |
| f2 | false | 170 | 170 | (const C2)... |
| f2 | false | 172 | 172 | call to C2 |
| f2 | false | 178 | 178 | 2 |
| f2 | false | 180 | 180 | (const C2)... |
| f2 | false | 182 | 182 | (reference to) |
| f2 | false | 184 | 184 | ; |
| f2 | false | 187 | 187 | { ... } |
| f2 | false | 190 | 190 | if (...) ... |
| f2 | false | 194 | 194 | call to operator== |
| f2 | false | 196 | 196 | call to C2 |
| f2 | false | 202 | 202 | 3 |
| f2 | false | 204 | 204 | (const C2)... |
| f2 | false | 206 | 206 | call to C2 |
| f2 | false | 210 | 210 | 2 |
| f2 | false | 211 | 211 | (reference to) |
| f2 | false | 212 | 212 | (reference dereference) |
| f2 | false | 213 | 213 | (const C2)... |
| f2 | false | 214 | 214 | (reference to) |
| f2 | false | 215 | 215 | ; |
| f2 | false | 217 | 217 | { ... } |
| f2 | false | 219 | 219 | if (...) ... |
| f2 | false | 222 | 222 | call to operator== |
| f2 | false | 223 | 223 | call to C2 |
| f2 | false | 227 | 227 | 3 |
| f2 | false | 228 | 228 | (const C2)... |
| f2 | false | 229 | 229 | call to C2 |
| f2 | false | 233 | 233 | 3 |
| f2 | false | 234 | 234 | (reference to) |
| f2 | false | 235 | 235 | (reference dereference) |
| f2 | false | 236 | 236 | (const C2)... |
| f2 | false | 237 | 237 | (reference to) |
| f2 | false | 238 | 238 | ; |
| f2 | false | 240 | 240 | { ... } |
| f2 | false | 242 | 242 | if (...) ... |
| f2 | false | 244 | 244 | return ... |
| f2 | false | 246 | 246 | { ... } |
| f2 | true | 198 | 217 | T |
| f2 | true | 198 | 242 | F |
| f2 | true | 199 | 198 | |
| f2 | true | 204 | 199 | |
| f2 | true | 206 | 204 | |
| f2 | true | 210 | 206 | |
| f2 | true | 215 | 242 | |
| f2 | true | 217 | 215 | |
| f2 | true | 219 | 210 | |
| f2 | true | 222 | 240 | T |
| f2 | true | 222 | 244 | F |
| f2 | true | 223 | 222 | |
| f2 | true | 227 | 223 | |
| f2 | true | 229 | 227 | |
| f2 | true | 233 | 229 | |
| f2 | true | 238 | 244 | |
| f2 | true | 240 | 238 | |
| f2 | true | 242 | 233 | |
| f2 | true | 244 | 181 | |
| f2 | true | 246 | 219 | |
| f2 | false | 212 | 212 | 3 |
| f2 | false | 214 | 214 | (const C2)... |
| f2 | false | 216 | 216 | (reference to) |
| f2 | false | 218 | 218 | ; |
| f2 | false | 221 | 221 | { ... } |
| f2 | false | 224 | 224 | if (...) ... |
| f2 | false | 227 | 227 | return ... |
| f2 | false | 230 | 230 | { ... } |
| f2 | true | 159 | 187 | T |
| f2 | true | 159 | 224 | F |
| f2 | true | 161 | 159 | |
| f2 | true | 168 | 161 | |
| f2 | true | 172 | 168 | |
| f2 | true | 178 | 172 | |
| f2 | true | 184 | 224 | |
| f2 | true | 187 | 184 | |
| f2 | true | 190 | 178 | |
| f2 | true | 194 | 221 | T |
| f2 | true | 194 | 227 | F |
| f2 | true | 196 | 194 | |
| f2 | true | 202 | 196 | |
| f2 | true | 206 | 202 | |
| f2 | true | 212 | 206 | |
| f2 | true | 218 | 227 | |
| f2 | true | 221 | 218 | |
| f2 | true | 224 | 212 | |
| f2 | true | 227 | 141 | |
| f2 | true | 230 | 190 | |