From 8039e117ba18bc1ba8fe61f77df7f52c04f80eb9 Mon Sep 17 00:00:00 2001 From: Mathias Vorreiter Pedersen Date: Mon, 20 Nov 2023 12:15:52 +0000 Subject: [PATCH] C++: Add more global-variable flow tests. --- .../dataflow/dataflow-tests/TestBase.qll | 8 ++ .../dataflow-consistency.expected | 6 ++ .../dataflow-tests/test-source-sink.expected | 10 +++ .../dataflow/dataflow-tests/test.cpp | 78 ++++++++++++++++++- 4 files changed, 101 insertions(+), 1 deletion(-) diff --git a/cpp/ql/test/library-tests/dataflow/dataflow-tests/TestBase.qll b/cpp/ql/test/library-tests/dataflow/dataflow-tests/TestBase.qll index 77087dbd3ee..528e7ca6ad3 100644 --- a/cpp/ql/test/library-tests/dataflow/dataflow-tests/TestBase.qll +++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/TestBase.qll @@ -71,6 +71,14 @@ module IRTest { or source.asIndirectExpr(1).(FunctionCall).getTarget().getName() = "indirect_source" or + source.asExpr().(StringLiteral).getValue() = "source" + or + // indirect_source(n) gives the dataflow node representing the indirect node after n dereferences. + exists(int n, string s | + n = s.regexpCapture("indirect_source\\((\\d)\\)", 1).toInt() and + source.asIndirectExpr(n).(StringLiteral).getValue() = s + ) + or source.asParameter().getName().matches("source%") or source.(DataFlow::DefinitionByReferenceNode).getParameter().getName().matches("ref_source%") diff --git a/cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-consistency.expected b/cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-consistency.expected index 068376778b2..a98cfd7e22a 100644 --- a/cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-consistency.expected +++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-consistency.expected @@ -1,5 +1,11 @@ uniqueEnclosingCallable +| test.cpp:864:44:864:58 | {...} | Node should have one enclosing callable but has 0. | +| test.cpp:864:47:864:54 | call to source | Node should have one enclosing callable but has 0. | +| test.cpp:872:46:872:51 | call to source | Node should have one enclosing callable but has 0. | +| test.cpp:872:53:872:56 | 1 | Node should have one enclosing callable but has 0. | uniqueCallEnclosingCallable +| test.cpp:864:47:864:54 | call to source | Call should have one enclosing callable but has 0. | +| test.cpp:872:46:872:51 | call to source | Call should have one enclosing callable but has 0. | uniqueType uniqueNodeLocation missingLocation diff --git a/cpp/ql/test/library-tests/dataflow/dataflow-tests/test-source-sink.expected b/cpp/ql/test/library-tests/dataflow/dataflow-tests/test-source-sink.expected index 7e9f560ac0f..6e84e48c792 100644 --- a/cpp/ql/test/library-tests/dataflow/dataflow-tests/test-source-sink.expected +++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/test-source-sink.expected @@ -120,6 +120,7 @@ astFlow | test.cpp:797:22:797:28 | ref arg content | test.cpp:798:19:798:25 | content | | test.cpp:842:11:842:16 | call to source | test.cpp:844:8:844:8 | y | | test.cpp:846:13:846:27 | call to indirect_source | test.cpp:848:23:848:25 | rpx | +| test.cpp:860:54:860:59 | call to source | test.cpp:861:10:861:37 | static_local_pointer_dynamic | | true_upon_entry.cpp:17:11:17:16 | call to source | true_upon_entry.cpp:21:8:21:8 | x | | true_upon_entry.cpp:27:9:27:14 | call to source | true_upon_entry.cpp:29:8:29:8 | x | | true_upon_entry.cpp:33:11:33:16 | call to source | true_upon_entry.cpp:39:8:39:8 | x | @@ -282,6 +283,15 @@ irFlow | test.cpp:832:21:832:26 | call to source | test.cpp:836:10:836:22 | global_direct | | test.cpp:842:11:842:16 | call to source | test.cpp:844:8:844:8 | y | | test.cpp:846:13:846:27 | call to indirect_source indirection | test.cpp:848:17:848:25 | rpx indirection | +| test.cpp:853:55:853:62 | call to source | test.cpp:854:10:854:36 | * ... | +| test.cpp:860:54:860:59 | call to source | test.cpp:861:10:861:37 | static_local_pointer_dynamic | +| test.cpp:872:46:872:51 | call to source | test.cpp:875:10:875:31 | global_pointer_dynamic | +| test.cpp:881:64:881:83 | indirect_source(2) indirection | test.cpp:886:19:886:54 | static_local_array_static_indirect_2 indirection | +| test.cpp:890:54:890:61 | source | test.cpp:893:10:893:36 | static_local_pointer_static | +| test.cpp:891:65:891:84 | indirect_source(1) indirection | test.cpp:895:19:895:56 | static_local_pointer_static_indirect_1 indirection | +| test.cpp:902:56:902:75 | indirect_source(2) indirection | test.cpp:911:19:911:48 | global_array_static_indirect_2 indirection | +| test.cpp:914:46:914:53 | source | test.cpp:919:10:919:30 | global_pointer_static | +| test.cpp:915:57:915:76 | indirect_source(1) indirection | test.cpp:921:19:921:50 | global_pointer_static_indirect_1 indirection | | true_upon_entry.cpp:9:11:9:16 | call to source | true_upon_entry.cpp:13:8:13:8 | x | | true_upon_entry.cpp:17:11:17:16 | call to source | true_upon_entry.cpp:21:8:21:8 | x | | true_upon_entry.cpp:27:9:27:14 | call to source | true_upon_entry.cpp:29:8:29:8 | x | diff --git a/cpp/ql/test/library-tests/dataflow/dataflow-tests/test.cpp b/cpp/ql/test/library-tests/dataflow/dataflow-tests/test.cpp index 022ee63706a..58e56f2dcf0 100644 --- a/cpp/ql/test/library-tests/dataflow/dataflow-tests/test.cpp +++ b/cpp/ql/test/library-tests/dataflow/dataflow-tests/test.cpp @@ -1,5 +1,5 @@ int source(); -void sink(int); void sink(const int *); void sink(int **); void indirect_sink(...); +void sink(...); void indirect_sink(...); void intraprocedural_with_local_flow() { int t2; @@ -846,4 +846,80 @@ void test_references() { int* px = indirect_source(); int*& rpx = px; indirect_sink((int*)rpx); // $ ast,ir +} + +namespace GlobalArrays { + void test1() { + static const int static_local_array_dynamic[] = { ::source() }; + sink(*static_local_array_dynamic); // $ ir MISSING: ast + } + + const int* source(bool); + + void test2() { + static const int* static_local_pointer_dynamic = source(true); + sink(static_local_pointer_dynamic); // $ ast,ir + } + + static const int global_array_dynamic[] = { ::source() }; + + void test3() { + sink(*global_array_dynamic); // $ MISSING: ir,ast // Missing in IR because no 'IRFunction' for global_array is generated because the type of global_array_dynamic is "deeply const". + } + + const int* source(bool); + + static const int* global_pointer_dynamic = source(true); + + void test4() { + sink(global_pointer_dynamic); // $ ir MISSING: ast + } + + void test5() { + static const char static_local_array_static[] = "source"; + static const char static_local_array_static_indirect_1[] = "indirect_source(1)"; + static const char static_local_array_static_indirect_2[] = "indirect_source(2)"; + sink(static_local_array_static); // clean + sink(static_local_array_static_indirect_1); // $ MISSING: ast,ir + indirect_sink(static_local_array_static_indirect_1); // clean + sink(static_local_array_static_indirect_2); // clean + indirect_sink(static_local_array_static_indirect_2); // $ ir MISSING: ast + } + + void test6() { + static const char* static_local_pointer_static = "source"; + static const char* static_local_pointer_static_indirect_1 = "indirect_source(1)"; + static const char* static_local_pointer_static_indirect_2 = "indirect_source(2)"; + sink(static_local_pointer_static); // $ ir MISSING: ast + sink(static_local_pointer_static_indirect_1); // clean + indirect_sink(static_local_pointer_static_indirect_1); // $ ir MISSING: ast + sink(static_local_pointer_static_indirect_2); // clean: static_local_pointer_static_indirect_2 does not have 2 indirections + indirect_sink(static_local_pointer_static_indirect_2); // clean: static_local_pointer_static_indirect_2 does not have 2 indirections + } + + static const char global_array_static[] = "source"; + static const char global_array_static_indirect_1[] = "indirect_source(1)"; + static const char global_array_static_indirect_2[] = "indirect_source(2)"; + + void test7() { + sink(global_array_static); // clean + sink(*global_array_static); // clean + sink(global_array_static_indirect_1); // $ MISSING: ir,ast + sink(*global_array_static_indirect_1); // clean + indirect_sink(global_array_static); // clean + indirect_sink(global_array_static_indirect_1); // clean + indirect_sink(global_array_static_indirect_2); // $ ir MISSING: ast + } + + static const char* global_pointer_static = "source"; + static const char* global_pointer_static_indirect_1 = "indirect_source(1)"; + static const char* global_pointer_static_indirect_2 = "indirect_source(2)"; + + void test8() { + sink(global_pointer_static); // $ ir MISSING: ast + sink(global_pointer_static_indirect_1); // clean + indirect_sink(global_pointer_static_indirect_1); // $ ir MISSING: ast + sink(global_pointer_static_indirect_2); // clean: global_pointer_static_indirect_2 does not have 2 indirections + indirect_sink(global_pointer_static_indirect_2); // clean: global_pointer_static_indirect_2 does not have 2 indirections + } } \ No newline at end of file