hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-04 05:05:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix regression due to primary instructions for side effects not being computed correctly in the presence of synthetic temporary objects.

Browse Source
This commit is contained in:
Dave Bartolomeo
2020-10-22 12:55:30 -04:00
parent f7eeadadd9
commit b62bda6c3a
4 changed files with 20 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll
View File

@@ -8,6 +8,16 @@ private import TranslatedElement
private import TranslatedExpr
private import TranslatedFunction
/**
* Gets the `CallInstruction` from the `TranslatedCallExpr` for the specified expression.
*/
private CallInstruction getTranslatedCallInstruction(Call call) {
exists(TranslatedCallExpr translatedCall |
translatedCall.getExpr() = call and
result = translatedCall.getInstruction(CallTag())
)
}
/**
* The IR translation of a call to a function. The call may be from an actual
* call in the source code, or could be a call that is part of the translation
@@ -388,7 +398,7 @@ class TranslatedAllocationSideEffects extends TranslatedSideEffects,
tag = OnlyInstructionTag() and
if expr instanceof NewOrNewArrayExpr
then result = getTranslatedAllocatorCall(expr).getInstruction(CallTag())
else result = getTranslatedExpr(expr).getInstruction(CallTag())
else result = getTranslatedCallInstruction(expr)
}
}
@@ -409,7 +419,7 @@ class TranslatedCallSideEffects extends TranslatedSideEffects, TTranslatedCallSi
override Instruction getPrimaryInstructionForSideEffect(InstructionTag tag) {
tag = OnlyInstructionTag() and
result = getTranslatedExpr(expr).getInstruction(CallTag())
result = getTranslatedCallInstruction(expr)
}
}
@@ -599,7 +609,7 @@ class TranslatedSideEffect extends TranslatedElement, TTranslatedArgumentSideEff
override Instruction getPrimaryInstructionForSideEffect(InstructionTag tag) {
tag = OnlyInstructionTag() and
result = getTranslatedExpr(call).getInstruction(CallTag())
result = getTranslatedCallInstruction(call)
}
final override int getInstructionIndex(InstructionTag tag) {

5
cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll
View File

@@ -15,8 +15,9 @@ private import TranslatedStmt
import TranslatedCall
/**
* Gets the TranslatedExpr for the specified expression. If `expr` is a load,
* the result is the TranslatedExpr for the load portion.
* Gets the TranslatedExpr for the specified expression. If `expr` is a load or synthesized
* temporary object, the result is the TranslatedExpr for the load or synthetic temporary object
* portion.
*/
TranslatedExpr getTranslatedExpr(Expr expr) {
result.getExpr() = expr and

3
cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected
View File

@@ -25,8 +25,7 @@
| map.cpp:76:9:76:13 | map.cpp:66:37:66:42 | IR only |
| map.cpp:79:9:79:13 | map.cpp:66:37:66:42 | IR only |
| map.cpp:80:9:80:14 | map.cpp:66:37:66:42 | IR only |
| map.cpp:87:34:87:38 | map.cpp:87:17:87:22 | AST only |
| map.cpp:91:34:91:39 | map.cpp:91:24:91:29 | AST only |
| map.cpp:90:34:90:38 | map.cpp:90:24:90:29 | IR only |
| map.cpp:108:7:108:54 | map.cpp:108:39:108:44 | IR only |
| map.cpp:111:7:111:48 | map.cpp:111:34:111:39 | IR only |
| map.cpp:155:12:155:16 | map.cpp:108:39:108:44 | IR only |

3
cpp/ql/test/library-tests/dataflow/taint-tests/test_ir.expected
View File

@@ -67,7 +67,10 @@
| map.cpp:79:9:79:13 | first | map.cpp:66:37:66:42 | call to source |
| map.cpp:80:9:80:14 | second | map.cpp:66:37:66:42 | call to source |
| map.cpp:81:7:81:7 | l | map.cpp:66:37:66:42 | call to source |
| map.cpp:87:34:87:38 | first | map.cpp:87:17:87:22 | call to source |
| map.cpp:89:7:89:32 | call to pair | map.cpp:89:24:89:29 | call to source |
| map.cpp:90:34:90:38 | first | map.cpp:90:24:90:29 | call to source |
| map.cpp:91:34:91:39 | second | map.cpp:91:24:91:29 | call to source |
| map.cpp:108:7:108:54 | call to iterator | map.cpp:108:39:108:44 | call to source |
| map.cpp:110:10:110:15 | call to insert | map.cpp:110:62:110:67 | call to source |
| map.cpp:111:7:111:48 | call to iterator | map.cpp:111:34:111:39 | call to source |