mirror of
https://github.com/github/codeql.git
synced 2026-04-29 18:55:14 +02:00
Merge branch 'master' into rdmarsh/cpp/ir-flow-through-outparams
This commit is contained in:
@@ -3,12 +3,14 @@ import cpp
|
||||
string describe(Element e) {
|
||||
result = "function " + e.(Function).getFullSignature()
|
||||
or
|
||||
result = "function declaration entry for " +
|
||||
result =
|
||||
"function declaration entry for " +
|
||||
e.(FunctionDeclarationEntry).getFunction().getFullSignature()
|
||||
or
|
||||
result = "parameter for " + e.(Parameter).getFunction().getFullSignature()
|
||||
or
|
||||
result = "parameter declaration entry for " +
|
||||
result =
|
||||
"parameter declaration entry for " +
|
||||
e.(ParameterDeclarationEntry).getFunctionDeclarationEntry().getFunction().getFullSignature()
|
||||
}
|
||||
|
||||
|
||||
@@ -4,7 +4,8 @@ from Compilation c, int i, string s
|
||||
// Skip the extractor name; it'll vary depending on platform
|
||||
where
|
||||
i > 0 and
|
||||
s = c
|
||||
s =
|
||||
c
|
||||
.getArgument(i)
|
||||
.replaceAll("\\", "/")
|
||||
.regexpReplaceAll(".*(/qltest/predefined_macros)", "<tools>$1")
|
||||
|
||||
@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
|
||||
override string toString() {
|
||||
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
|
||||
then
|
||||
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
result =
|
||||
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
this.getTarget().getName()
|
||||
else result = super.toString()
|
||||
}
|
||||
|
||||
@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
|
||||
override string toString() {
|
||||
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
|
||||
then
|
||||
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
result =
|
||||
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
this.getTarget().getName()
|
||||
else result = super.toString()
|
||||
}
|
||||
|
||||
@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
|
||||
override string toString() {
|
||||
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
|
||||
then
|
||||
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
result =
|
||||
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
this.getTarget().getName()
|
||||
else result = super.toString()
|
||||
}
|
||||
|
||||
@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
|
||||
override string toString() {
|
||||
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
|
||||
then
|
||||
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
result =
|
||||
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
this.getTarget().getName()
|
||||
else result = super.toString()
|
||||
}
|
||||
|
||||
@@ -64,7 +64,8 @@ query predicate irGuardsCompare(int startLine, string msg) {
|
||||
guard.comparesEq(left, right, k, false, sense) and op = " != "
|
||||
) and
|
||||
startLine = guard.getLocation().getStartLine() and
|
||||
msg = left.getAnyDef().getUnconvertedResultExpression() + op +
|
||||
msg =
|
||||
left.getAnyDef().getUnconvertedResultExpression() + op +
|
||||
right.getAnyDef().getUnconvertedResultExpression() + "+" + k + " when " + guard + " is " +
|
||||
which
|
||||
)
|
||||
|
||||
@@ -21,14 +21,18 @@
|
||||
| defaulttainttracking.cpp:22:20:22:25 | call to getenv | defaulttainttracking.cpp:22:8:22:33 | (const char *)... |
|
||||
| defaulttainttracking.cpp:22:20:22:25 | call to getenv | defaulttainttracking.cpp:22:20:22:25 | call to getenv |
|
||||
| defaulttainttracking.cpp:22:20:22:25 | call to getenv | defaulttainttracking.cpp:22:20:22:32 | (const char *)... |
|
||||
| defaulttainttracking.cpp:22:20:22:25 | call to getenv | defaulttainttracking.cpp:24:8:24:10 | (const char *)... |
|
||||
| defaulttainttracking.cpp:22:20:22:25 | call to getenv | defaulttainttracking.cpp:24:8:24:10 | array to pointer conversion |
|
||||
| defaulttainttracking.cpp:22:20:22:25 | call to getenv | defaulttainttracking.cpp:24:8:24:10 | buf |
|
||||
| defaulttainttracking.cpp:22:20:22:25 | call to getenv | test_diff.cpp:1:11:1:20 | p#0 |
|
||||
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:31:40:31:53 | dotted_address |
|
||||
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:32:11:32:26 | p#0 |
|
||||
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:38:11:38:21 | env_pointer |
|
||||
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:38:25:38:30 | call to getenv |
|
||||
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:38:25:38:37 | (void *)... |
|
||||
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:39:22:39:22 | a |
|
||||
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:39:26:39:34 | call to inet_addr |
|
||||
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:39:36:39:61 | (const char *)... |
|
||||
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:39:50:39:61 | & ... |
|
||||
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:40:10:40:10 | a |
|
||||
| defaulttainttracking.cpp:64:10:64:15 | call to getenv | defaulttainttracking.cpp:9:11:9:20 | p#0 |
|
||||
|
||||
@@ -5,8 +5,8 @@
|
||||
| defaulttainttracking.cpp:22:20:22:25 | call to getenv | defaulttainttracking.cpp:3:21:3:22 | s1 | AST only |
|
||||
| defaulttainttracking.cpp:22:20:22:25 | call to getenv | defaulttainttracking.cpp:21:8:21:10 | buf | AST only |
|
||||
| defaulttainttracking.cpp:22:20:22:25 | call to getenv | defaulttainttracking.cpp:22:15:22:17 | buf | AST only |
|
||||
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:31:40:31:53 | dotted_address | AST only |
|
||||
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:39:36:39:61 | (const char *)... | AST only |
|
||||
| defaulttainttracking.cpp:22:20:22:25 | call to getenv | defaulttainttracking.cpp:24:8:24:10 | (const char *)... | IR only |
|
||||
| defaulttainttracking.cpp:22:20:22:25 | call to getenv | defaulttainttracking.cpp:24:8:24:10 | array to pointer conversion | IR only |
|
||||
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:39:51:39:61 | env_pointer | AST only |
|
||||
| defaulttainttracking.cpp:64:10:64:15 | call to getenv | defaulttainttracking.cpp:52:24:52:24 | p | IR only |
|
||||
| defaulttainttracking.cpp:88:27:88:32 | call to getenv | defaulttainttracking.cpp:9:11:9:20 | p#0 | IR only |
|
||||
|
||||
@@ -29,9 +29,9 @@ class Conf extends Configuration {
|
||||
}
|
||||
|
||||
override predicate isAdditionalFlowStep(Node a, Node b) {
|
||||
b.asPartialDefinition() = any(Call c |
|
||||
c.getTarget().hasName("insert") and c.getAnArgument() = a.asExpr()
|
||||
).getQualifier()
|
||||
b.asPartialDefinition() =
|
||||
any(Call c | c.getTarget().hasName("insert") and c.getAnArgument() = a.asExpr())
|
||||
.getQualifier()
|
||||
or
|
||||
b.asExpr().(AddressOfExpr).getOperand() = a.asExpr()
|
||||
}
|
||||
|
||||
@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
|
||||
override string toString() {
|
||||
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
|
||||
then
|
||||
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
result =
|
||||
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
this.getTarget().getName()
|
||||
else result = super.toString()
|
||||
}
|
||||
|
||||
@@ -5,7 +5,8 @@ import semmle.code.cpp.ir.internal.IntegerConstant
|
||||
|
||||
from IRFunction irFunc, int value
|
||||
where
|
||||
value = getValue(getConstantValue(irFunc
|
||||
value =
|
||||
getValue(getConstantValue(irFunc
|
||||
.getReturnInstruction()
|
||||
.(ReturnValueInstruction)
|
||||
.getReturnValue()))
|
||||
|
||||
@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
|
||||
override string toString() {
|
||||
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
|
||||
then
|
||||
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
result =
|
||||
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
this.getTarget().getName()
|
||||
else result = super.toString()
|
||||
}
|
||||
|
||||
@@ -56,8 +56,8 @@ string functionName(Function f) {
|
||||
(
|
||||
if exists(f.getATemplateArgument())
|
||||
then
|
||||
templateArgs = "<" + concat(int i | | f.getTemplateArgument(i).toString(), "," order by i) +
|
||||
">"
|
||||
templateArgs =
|
||||
"<" + concat(int i | | f.getTemplateArgument(i).toString(), "," order by i) + ">"
|
||||
else templateArgs = ""
|
||||
) and
|
||||
args = "(" + concat(int i | | f.getParameter(i).getType().toString(), "," order by i) + ")"
|
||||
|
||||
@@ -4,7 +4,8 @@ from Function f, string call
|
||||
where
|
||||
if exists(f.getACallToThisFunction())
|
||||
then
|
||||
call = f.getACallToThisFunction().getLocation().toString() + " " +
|
||||
call =
|
||||
f.getACallToThisFunction().getLocation().toString() + " " +
|
||||
f.getACallToThisFunction().toString()
|
||||
else call = "<none>"
|
||||
select f, f.getType(), call
|
||||
|
||||
@@ -7,7 +7,8 @@ string functionName(Function f) {
|
||||
(
|
||||
if exists(f.getATemplateArgument())
|
||||
then
|
||||
templateArgs = "<" +
|
||||
templateArgs =
|
||||
"<" +
|
||||
concat(int i |
|
||||
exists(f.getTemplateArgument(i))
|
||||
|
|
||||
@@ -15,7 +16,8 @@ string functionName(Function f) {
|
||||
) + ">"
|
||||
else templateArgs = ""
|
||||
) and
|
||||
args = "(" +
|
||||
args =
|
||||
"(" +
|
||||
concat(int i |
|
||||
exists(f.getParameter(i))
|
||||
|
|
||||
|
||||
@@ -21,8 +21,8 @@ predicate isSetFlowEnd(boolean isEdge, int x, int y, string label) {
|
||||
(setflow(x, _) or setflow(_, x)) and
|
||||
isEdge = false and
|
||||
x = y and
|
||||
label = "set: {" + concat(Element e | pointstosets(x, unresolveElement(e)) | e.toString(), ", ") +
|
||||
"}"
|
||||
label =
|
||||
"set: {" + concat(Element e | pointstosets(x, unresolveElement(e)) | e.toString(), ", ") + "}"
|
||||
}
|
||||
|
||||
predicate isSetFlow(boolean isEdge, int x, int y, string label) {
|
||||
@@ -35,8 +35,8 @@ predicate isPointsToSetSrc(boolean isEdge, int x, int y, string label) {
|
||||
pointstosets(x, _) and
|
||||
isEdge = false and
|
||||
x = y and
|
||||
label = "set: {" + concat(Element e | pointstosets(x, unresolveElement(e)) | e.toString(), ", ") +
|
||||
"}"
|
||||
label =
|
||||
"set: {" + concat(Element e | pointstosets(x, unresolveElement(e)) | e.toString(), ", ") + "}"
|
||||
}
|
||||
|
||||
predicate isPointsToSetDest(boolean isEdge, Element x, Element y, string label) {
|
||||
@@ -57,7 +57,8 @@ predicate isPointsToSetDest(boolean isEdge, Element x, Element y, string label)
|
||||
predicate isPointsToSets(boolean isEdge, int x, Element y, string label) {
|
||||
isEdge = true and
|
||||
pointstosets(x, unresolveElement(y)) and
|
||||
label = "pt: {" + concat(Element e | pointstosets(x, unresolveElement(e)) | e.toString(), ", ") +
|
||||
label =
|
||||
"pt: {" + concat(Element e | pointstosets(x, unresolveElement(e)) | e.toString(), ", ") +
|
||||
"} -> " + y.toString()
|
||||
}
|
||||
|
||||
|
||||
@@ -2,6 +2,6 @@ import cpp
|
||||
|
||||
from Struct s, string distinct
|
||||
where
|
||||
distinct = count(Struct x | x.getName() = s.getName()) + " different struct(s) called " +
|
||||
s.getName()
|
||||
distinct =
|
||||
count(Struct x | x.getName() = s.getName()) + " different struct(s) called " + s.getName()
|
||||
select s, distinct
|
||||
|
||||
@@ -2,9 +2,10 @@ import cpp
|
||||
import semmle.code.cpp.controlflow.SubBasicBlocks
|
||||
|
||||
string subBasicBlockDebugInfo(SubBasicBlock sbb) {
|
||||
result = sbb.getStart().toString() + " [line " + sbb.getStart().getLocation().getStartLine() + "-"
|
||||
+ sbb.getEnd().getLocation().getEndLine() + ", " + sbb.getNumberOfNodes() + " nodes, " +
|
||||
"pos " + (sbb.getRankInBasicBlock(_) - 1) +
|
||||
result =
|
||||
sbb.getStart().toString() + " [line " + sbb.getStart().getLocation().getStartLine() + "-" +
|
||||
sbb.getEnd().getLocation().getEndLine() + ", " + sbb.getNumberOfNodes() + " nodes, " + "pos " +
|
||||
(sbb.getRankInBasicBlock(_) - 1) +
|
||||
any(string s | if sbb.firstInBB() then s = " (first in BB)" else s = "") +
|
||||
any(string s | if sbb.lastInBB() then s = " (last in BB)" else s = "") + ", " +
|
||||
count(sbb.getAPredecessor()) + " predecessors, " + count(sbb.getASuccessor()) + " successors" +
|
||||
|
||||
@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
|
||||
override string toString() {
|
||||
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
|
||||
then
|
||||
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
result =
|
||||
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
this.getTarget().getName()
|
||||
else result = super.toString()
|
||||
}
|
||||
@@ -66,7 +67,8 @@ Element getScopeElement(ControlFlowNode x) {
|
||||
string getScopeName(ControlFlowNode x) {
|
||||
exists(Function scope | scope = getScopeElement(x) |
|
||||
differentScope(scope) and
|
||||
result = scope.getFile().getBaseName().splitAt(".", 0) + "__" +
|
||||
result =
|
||||
scope.getFile().getBaseName().splitAt(".", 0) + "__" +
|
||||
scope.getQualifiedName().replaceAll("::", "_")
|
||||
)
|
||||
or
|
||||
|
||||
@@ -9,7 +9,8 @@ class FunctionMonkeyPatch extends Function {
|
||||
(
|
||||
if exists(this.getATemplateArgument())
|
||||
then
|
||||
templateArgs = "<" +
|
||||
templateArgs =
|
||||
"<" +
|
||||
concat(int i |
|
||||
exists(this.getTemplateArgument(i))
|
||||
|
|
||||
@@ -17,7 +18,8 @@ class FunctionMonkeyPatch extends Function {
|
||||
) + ">"
|
||||
else templateArgs = ""
|
||||
) and
|
||||
args = "(" +
|
||||
args =
|
||||
"(" +
|
||||
concat(int i |
|
||||
exists(this.getParameter(i))
|
||||
|
|
||||
|
||||
@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
|
||||
override string toString() {
|
||||
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
|
||||
then
|
||||
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
result =
|
||||
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
this.getTarget().getName()
|
||||
else result = super.toString()
|
||||
}
|
||||
|
||||
@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
|
||||
override string toString() {
|
||||
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
|
||||
then
|
||||
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
result =
|
||||
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
this.getTarget().getName()
|
||||
else result = super.toString()
|
||||
}
|
||||
|
||||
@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
|
||||
override string toString() {
|
||||
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
|
||||
then
|
||||
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
result =
|
||||
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
this.getTarget().getName()
|
||||
else result = super.toString()
|
||||
}
|
||||
|
||||
@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
|
||||
override string toString() {
|
||||
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
|
||||
then
|
||||
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
result =
|
||||
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
this.getTarget().getName()
|
||||
else result = super.toString()
|
||||
}
|
||||
|
||||
@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
|
||||
override string toString() {
|
||||
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
|
||||
then
|
||||
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
result =
|
||||
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
this.getTarget().getName()
|
||||
else result = super.toString()
|
||||
}
|
||||
|
||||
@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
|
||||
override string toString() {
|
||||
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
|
||||
then
|
||||
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
result =
|
||||
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
this.getTarget().getName()
|
||||
else result = super.toString()
|
||||
}
|
||||
|
||||
@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
|
||||
override string toString() {
|
||||
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
|
||||
then
|
||||
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
result =
|
||||
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
this.getTarget().getName()
|
||||
else result = super.toString()
|
||||
}
|
||||
|
||||
@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
|
||||
override string toString() {
|
||||
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
|
||||
then
|
||||
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
result =
|
||||
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
this.getTarget().getName()
|
||||
else result = super.toString()
|
||||
}
|
||||
|
||||
@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
|
||||
override string toString() {
|
||||
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
|
||||
then
|
||||
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
result =
|
||||
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
this.getTarget().getName()
|
||||
else result = super.toString()
|
||||
}
|
||||
|
||||
@@ -5,7 +5,8 @@ class DestructorCallEnhanced extends DestructorCall {
|
||||
override string toString() {
|
||||
if exists(this.getQualifier().(VariableAccess).getTarget().getName())
|
||||
then
|
||||
result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
result =
|
||||
"call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." +
|
||||
this.getTarget().getName()
|
||||
else result = super.toString()
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user