Merge branch 'master' into rdmarsh/cpp/ir-flow-through-outparams

This commit is contained in:
Robert Marsh
2020-02-03 13:06:35 -08:00
543 changed files with 8302 additions and 2141 deletions

View File

@@ -3,12 +3,14 @@ import cpp
string describe(Element e) {
result = "function " + e.(Function).getFullSignature()
or
result = "function declaration entry for " +
result =
"function declaration entry for " +
e.(FunctionDeclarationEntry).getFunction().getFullSignature()
or
result = "parameter for " + e.(Parameter).getFunction().getFullSignature()
or
result = "parameter declaration entry for " +
result =
"parameter declaration entry for " +
e.(ParameterDeclarationEntry).getFunctionDeclarationEntry().getFunction().getFullSignature()
}

View File

@@ -4,7 +4,8 @@ from Compilation c, int i, string s
// Skip the extractor name; it'll vary depending on platform
where
i > 0 and
s = c
s =
c
.getArgument(i)
.replaceAll("\\", "/")
.regexpReplaceAll(".*(/qltest/predefined_macros)", "<tools>$1")

View File

@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
override string toString() {
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
then
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
result =
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
this.getTarget().getName()
else result = super.toString()
}

View File

@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
override string toString() {
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
then
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
result =
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
this.getTarget().getName()
else result = super.toString()
}

View File

@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
override string toString() {
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
then
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
result =
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
this.getTarget().getName()
else result = super.toString()
}

View File

@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
override string toString() {
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
then
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
result =
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
this.getTarget().getName()
else result = super.toString()
}

View File

@@ -64,7 +64,8 @@ query predicate irGuardsCompare(int startLine, string msg) {
guard.comparesEq(left, right, k, false, sense) and op = " != "
) and
startLine = guard.getLocation().getStartLine() and
msg = left.getAnyDef().getUnconvertedResultExpression() + op +
msg =
left.getAnyDef().getUnconvertedResultExpression() + op +
right.getAnyDef().getUnconvertedResultExpression() + "+" + k + " when " + guard + " is " +
which
)

View File

@@ -21,14 +21,18 @@
| defaulttainttracking.cpp:22:20:22:25 | call to getenv | defaulttainttracking.cpp:22:8:22:33 | (const char *)... |
| defaulttainttracking.cpp:22:20:22:25 | call to getenv | defaulttainttracking.cpp:22:20:22:25 | call to getenv |
| defaulttainttracking.cpp:22:20:22:25 | call to getenv | defaulttainttracking.cpp:22:20:22:32 | (const char *)... |
| defaulttainttracking.cpp:22:20:22:25 | call to getenv | defaulttainttracking.cpp:24:8:24:10 | (const char *)... |
| defaulttainttracking.cpp:22:20:22:25 | call to getenv | defaulttainttracking.cpp:24:8:24:10 | array to pointer conversion |
| defaulttainttracking.cpp:22:20:22:25 | call to getenv | defaulttainttracking.cpp:24:8:24:10 | buf |
| defaulttainttracking.cpp:22:20:22:25 | call to getenv | test_diff.cpp:1:11:1:20 | p#0 |
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:31:40:31:53 | dotted_address |
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:32:11:32:26 | p#0 |
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:38:11:38:21 | env_pointer |
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:38:25:38:30 | call to getenv |
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:38:25:38:37 | (void *)... |
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:39:22:39:22 | a |
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:39:26:39:34 | call to inet_addr |
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:39:36:39:61 | (const char *)... |
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:39:50:39:61 | & ... |
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:40:10:40:10 | a |
| defaulttainttracking.cpp:64:10:64:15 | call to getenv | defaulttainttracking.cpp:9:11:9:20 | p#0 |

View File

@@ -5,8 +5,8 @@
| defaulttainttracking.cpp:22:20:22:25 | call to getenv | defaulttainttracking.cpp:3:21:3:22 | s1 | AST only |
| defaulttainttracking.cpp:22:20:22:25 | call to getenv | defaulttainttracking.cpp:21:8:21:10 | buf | AST only |
| defaulttainttracking.cpp:22:20:22:25 | call to getenv | defaulttainttracking.cpp:22:15:22:17 | buf | AST only |
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:31:40:31:53 | dotted_address | AST only |
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:39:36:39:61 | (const char *)... | AST only |
| defaulttainttracking.cpp:22:20:22:25 | call to getenv | defaulttainttracking.cpp:24:8:24:10 | (const char *)... | IR only |
| defaulttainttracking.cpp:22:20:22:25 | call to getenv | defaulttainttracking.cpp:24:8:24:10 | array to pointer conversion | IR only |
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:39:51:39:61 | env_pointer | AST only |
| defaulttainttracking.cpp:64:10:64:15 | call to getenv | defaulttainttracking.cpp:52:24:52:24 | p | IR only |
| defaulttainttracking.cpp:88:27:88:32 | call to getenv | defaulttainttracking.cpp:9:11:9:20 | p#0 | IR only |

View File

@@ -29,9 +29,9 @@ class Conf extends Configuration {
}
override predicate isAdditionalFlowStep(Node a, Node b) {
b.asPartialDefinition() = any(Call c |
c.getTarget().hasName("insert") and c.getAnArgument() = a.asExpr()
).getQualifier()
b.asPartialDefinition() =
any(Call c | c.getTarget().hasName("insert") and c.getAnArgument() = a.asExpr())
.getQualifier()
or
b.asExpr().(AddressOfExpr).getOperand() = a.asExpr()
}

View File

@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
override string toString() {
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
then
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
result =
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
this.getTarget().getName()
else result = super.toString()
}

View File

@@ -5,7 +5,8 @@ import semmle.code.cpp.ir.internal.IntegerConstant
from IRFunction irFunc, int value
where
value = getValue(getConstantValue(irFunc
value =
getValue(getConstantValue(irFunc
.getReturnInstruction()
.(ReturnValueInstruction)
.getReturnValue()))

View File

@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
override string toString() {
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
then
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
result =
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
this.getTarget().getName()
else result = super.toString()
}

View File

@@ -56,8 +56,8 @@ string functionName(Function f) {
(
if exists(f.getATemplateArgument())
then
templateArgs = "<" + concat(int i | | f.getTemplateArgument(i).toString(), "," order by i) +
">"
templateArgs =
"<" + concat(int i | | f.getTemplateArgument(i).toString(), "," order by i) + ">"
else templateArgs = ""
) and
args = "(" + concat(int i | | f.getParameter(i).getType().toString(), "," order by i) + ")"

View File

@@ -4,7 +4,8 @@ from Function f, string call
where
if exists(f.getACallToThisFunction())
then
call = f.getACallToThisFunction().getLocation().toString() + " " +
call =
f.getACallToThisFunction().getLocation().toString() + " " +
f.getACallToThisFunction().toString()
else call = "<none>"
select f, f.getType(), call

View File

@@ -7,7 +7,8 @@ string functionName(Function f) {
(
if exists(f.getATemplateArgument())
then
templateArgs = "<" +
templateArgs =
"<" +
concat(int i |
exists(f.getTemplateArgument(i))
|
@@ -15,7 +16,8 @@ string functionName(Function f) {
) + ">"
else templateArgs = ""
) and
args = "(" +
args =
"(" +
concat(int i |
exists(f.getParameter(i))
|

View File

@@ -21,8 +21,8 @@ predicate isSetFlowEnd(boolean isEdge, int x, int y, string label) {
(setflow(x, _) or setflow(_, x)) and
isEdge = false and
x = y and
label = "set: {" + concat(Element e | pointstosets(x, unresolveElement(e)) | e.toString(), ", ") +
"}"
label =
"set: {" + concat(Element e | pointstosets(x, unresolveElement(e)) | e.toString(), ", ") + "}"
}
predicate isSetFlow(boolean isEdge, int x, int y, string label) {
@@ -35,8 +35,8 @@ predicate isPointsToSetSrc(boolean isEdge, int x, int y, string label) {
pointstosets(x, _) and
isEdge = false and
x = y and
label = "set: {" + concat(Element e | pointstosets(x, unresolveElement(e)) | e.toString(), ", ") +
"}"
label =
"set: {" + concat(Element e | pointstosets(x, unresolveElement(e)) | e.toString(), ", ") + "}"
}
predicate isPointsToSetDest(boolean isEdge, Element x, Element y, string label) {
@@ -57,7 +57,8 @@ predicate isPointsToSetDest(boolean isEdge, Element x, Element y, string label)
predicate isPointsToSets(boolean isEdge, int x, Element y, string label) {
isEdge = true and
pointstosets(x, unresolveElement(y)) and
label = "pt: {" + concat(Element e | pointstosets(x, unresolveElement(e)) | e.toString(), ", ") +
label =
"pt: {" + concat(Element e | pointstosets(x, unresolveElement(e)) | e.toString(), ", ") +
"} -> " + y.toString()
}

View File

@@ -2,6 +2,6 @@ import cpp
from Struct s, string distinct
where
distinct = count(Struct x | x.getName() = s.getName()) + " different struct(s) called " +
s.getName()
distinct =
count(Struct x | x.getName() = s.getName()) + " different struct(s) called " + s.getName()
select s, distinct

View File

@@ -2,9 +2,10 @@ import cpp
import semmle.code.cpp.controlflow.SubBasicBlocks
string subBasicBlockDebugInfo(SubBasicBlock sbb) {
result = sbb.getStart().toString() + " [line " + sbb.getStart().getLocation().getStartLine() + "-"
+ sbb.getEnd().getLocation().getEndLine() + ", " + sbb.getNumberOfNodes() + " nodes, " +
"pos " + (sbb.getRankInBasicBlock(_) - 1) +
result =
sbb.getStart().toString() + " [line " + sbb.getStart().getLocation().getStartLine() + "-" +
sbb.getEnd().getLocation().getEndLine() + ", " + sbb.getNumberOfNodes() + " nodes, " + "pos " +
(sbb.getRankInBasicBlock(_) - 1) +
any(string s | if sbb.firstInBB() then s = " (first in BB)" else s = "") +
any(string s | if sbb.lastInBB() then s = " (last in BB)" else s = "") + ", " +
count(sbb.getAPredecessor()) + " predecessors, " + count(sbb.getASuccessor()) + " successors" +

View File

@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
override string toString() {
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
then
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
result =
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
this.getTarget().getName()
else result = super.toString()
}
@@ -66,7 +67,8 @@ Element getScopeElement(ControlFlowNode x) {
string getScopeName(ControlFlowNode x) {
exists(Function scope | scope = getScopeElement(x) |
differentScope(scope) and
result = scope.getFile().getBaseName().splitAt(".", 0) + "__" +
result =
scope.getFile().getBaseName().splitAt(".", 0) + "__" +
scope.getQualifiedName().replaceAll("::", "_")
)
or

View File

@@ -9,7 +9,8 @@ class FunctionMonkeyPatch extends Function {
(
if exists(this.getATemplateArgument())
then
templateArgs = "<" +
templateArgs =
"<" +
concat(int i |
exists(this.getTemplateArgument(i))
|
@@ -17,7 +18,8 @@ class FunctionMonkeyPatch extends Function {
) + ">"
else templateArgs = ""
) and
args = "(" +
args =
"(" +
concat(int i |
exists(this.getParameter(i))
|

View File

@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
override string toString() {
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
then
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
result =
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
this.getTarget().getName()
else result = super.toString()
}

View File

@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
override string toString() {
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
then
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
result =
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
this.getTarget().getName()
else result = super.toString()
}

View File

@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
override string toString() {
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
then
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
result =
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
this.getTarget().getName()
else result = super.toString()
}

View File

@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
override string toString() {
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
then
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
result =
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
this.getTarget().getName()
else result = super.toString()
}

View File

@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
override string toString() {
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
then
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
result =
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
this.getTarget().getName()
else result = super.toString()
}

View File

@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
override string toString() {
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
then
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
result =
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
this.getTarget().getName()
else result = super.toString()
}

View File

@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
override string toString() {
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
then
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
result =
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
this.getTarget().getName()
else result = super.toString()
}

View File

@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
override string toString() {
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
then
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
result =
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
this.getTarget().getName()
else result = super.toString()
}

View File

@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
override string toString() {
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
then
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
result =
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
this.getTarget().getName()
else result = super.toString()
}

View File

@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
override string toString() {
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
then
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
result =
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
this.getTarget().getName()
else result = super.toString()
}