hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-25 08:45:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Handle more cases that require synthesizing temporary objects

Browse Source 
- Parens around qualifier expressions
- Inheritance conversions involving class prvalues
This commit is contained in:
Dave Bartolomeo
2020-10-23 12:04:09 -04:00
parent 99072483b8
commit bace0dca6d
7 changed files with 298 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected
View File

@@ -106,8 +106,8 @@
| string.cpp:363:11:363:16 | string.cpp:358:18:358:23 | AST only |
| string.cpp:382:8:382:14 | string.cpp:374:18:374:23 | IR only |
| string.cpp:383:13:383:15 | string.cpp:374:18:374:23 | IR only |
| string.cpp:396:8:396:8 | string.cpp:389:18:389:23 | AST only |
| string.cpp:397:8:397:8 | string.cpp:389:18:389:23 | AST only |
| string.cpp:396:8:396:15 | string.cpp:389:18:389:23 | IR only |
| string.cpp:397:8:397:15 | string.cpp:389:18:389:23 | IR only |
| string.cpp:399:8:399:8 | string.cpp:389:18:389:23 | AST only |
| string.cpp:401:8:401:8 | string.cpp:389:18:389:23 | AST only |
| string.cpp:404:8:404:11 | string.cpp:389:18:389:23 | IR only |

4
cpp/ql/test/library-tests/dataflow/taint-tests/test_ir.expected
View File

@@ -362,6 +362,10 @@
| string.cpp:382:8:382:14 | (reference dereference) | string.cpp:374:18:374:23 | call to source |
| string.cpp:383:13:383:13 | call to operator[] | string.cpp:374:18:374:23 | call to source |
| string.cpp:383:13:383:15 | (reference dereference) | string.cpp:374:18:374:23 | call to source |
| string.cpp:396:8:396:8 | call to operator* | string.cpp:389:18:389:23 | call to source |
| string.cpp:396:8:396:15 | (reference dereference) | string.cpp:389:18:389:23 | call to source |
| string.cpp:397:8:397:8 | call to operator* | string.cpp:389:18:389:23 | call to source |
| string.cpp:397:8:397:15 | (reference dereference) | string.cpp:389:18:389:23 | call to source |
| string.cpp:404:8:404:8 | call to operator* | string.cpp:389:18:389:23 | call to source |
| string.cpp:404:8:404:11 | (reference dereference) | string.cpp:389:18:389:23 | call to source |
| string.cpp:407:8:407:8 | call to operator* | string.cpp:389:18:389:23 | call to source |

112
cpp/ql/test/library-tests/ir/ir/PrintAST.expected
View File

@@ -10650,6 +10650,10 @@ ir.cpp:
# 1360| params:
# 1360| 0: [Parameter] v
# 1360| Type = [Class] destructor_only
# 1363| [FunctionTemplateInstantiation,TopLevelFunction] POD_Derived returnValue<POD_Derived>()
# 1363| params:
# 1363| [FunctionTemplateInstantiation,TopLevelFunction] POD_Middle returnValue<POD_Middle>()
# 1363| params:
# 1363| [FunctionTemplateInstantiation,TopLevelFunction] Point returnValue<Point>()
# 1363| params:
# 1363| [FunctionTemplateInstantiation,TopLevelFunction] String returnValue<String>()
@@ -11161,6 +11165,114 @@ ir.cpp:
# 1426| Value = [Literal] 5
# 1426| ValueCategory = prvalue
# 1427| 4: [ReturnStmt] return ...
# 1429| [CopyAssignmentOperator] POD_Base& POD_Base::operator=(POD_Base const&)
# 1429| params:
#-----| 0: [Parameter] (unnamed parameter 0)
#-----| Type = [LValueReferenceType] const POD_Base &
# 1429| [MoveAssignmentOperator] POD_Base& POD_Base::operator=(POD_Base&&)
# 1429| params:
#-----| 0: [Parameter] (unnamed parameter 0)
#-----| Type = [RValueReferenceType] POD_Base &&
# 1432| [ConstMemberFunction] float POD_Base::f() const
# 1432| params:
# 1435| [CopyAssignmentOperator] POD_Middle& POD_Middle::operator=(POD_Middle const&)
# 1435| params:
#-----| 0: [Parameter] (unnamed parameter 0)
#-----| Type = [LValueReferenceType] const POD_Middle &
# 1435| [MoveAssignmentOperator] POD_Middle& POD_Middle::operator=(POD_Middle&&)
# 1435| params:
#-----| 0: [Parameter] (unnamed parameter 0)
#-----| Type = [RValueReferenceType] POD_Middle &&
# 1435| [Constructor] void POD_Middle::POD_Middle()
# 1435| params:
# 1439| [CopyAssignmentOperator] POD_Derived& POD_Derived::operator=(POD_Derived const&)
# 1439| params:
#-----| 0: [Parameter] (unnamed parameter 0)
#-----| Type = [LValueReferenceType] const POD_Derived &
# 1439| [MoveAssignmentOperator] POD_Derived& POD_Derived::operator=(POD_Derived&&)
# 1439| params:
#-----| 0: [Parameter] (unnamed parameter 0)
#-----| Type = [RValueReferenceType] POD_Derived &&
# 1439| [Constructor] void POD_Derived::POD_Derived()
# 1439| params:
# 1443| [TopLevelFunction] void temporary_hierarchy()
# 1443| params:
# 1443| body: [BlockStmt] { ... }
# 1444| 0: [DeclStmt] declaration
# 1444| 0: [VariableDeclarationEntry] definition of b
# 1444| Type = [Struct] POD_Base
# 1444| init: [Initializer] initializer for b
# 1444| expr: [CStyleCast] (POD_Base)...
# 1444| Conversion = [BaseClassConversion] base class conversion
# 1444| Type = [Struct] POD_Base
# 1444| ValueCategory = prvalue
# 1444| expr: [FunctionCall] call to returnValue
# 1444| Type = [Struct] POD_Middle
# 1444| ValueCategory = prvalue
# 1445| 1: [ExprStmt] ExprStmt
# 1445| 0: [AssignExpr] ... = ...
# 1445| Type = [Struct] POD_Base
# 1445| ValueCategory = lvalue
# 1445| 0: [VariableAccess] b
# 1445| Type = [Struct] POD_Base
# 1445| ValueCategory = lvalue
# 1445| 1: [CStyleCast] (POD_Base)...
# 1445| Conversion = [BaseClassConversion] base class conversion
# 1445| Type = [Struct] POD_Base
# 1445| ValueCategory = prvalue(load)
# 1445| expr: [CStyleCast] (POD_Middle)...
# 1445| Conversion = [BaseClassConversion] base class conversion
# 1445| Type = [Struct] POD_Middle
# 1445| ValueCategory = lvalue
# 1445| expr: [TemporaryObjectExpr] temporary object
# 1445| Type = [Struct] POD_Derived
# 1445| ValueCategory = lvalue
# 1445| expr: [ParenthesisExpr] (...)
# 1445| Type = [Struct] POD_Derived
# 1445| ValueCategory = prvalue
# 1445| expr: [FunctionCall] call to returnValue
# 1445| Type = [Struct] POD_Derived
# 1445| ValueCategory = prvalue
# 1446| 2: [DeclStmt] declaration
# 1446| 0: [VariableDeclarationEntry] definition of x
# 1446| Type = [IntType] int
# 1446| init: [Initializer] initializer for x
# 1446| expr: [ValueFieldAccess] x
# 1446| Type = [IntType] int
# 1446| ValueCategory = prvalue
# 1446| -1: [CStyleCast] (POD_Base)...
# 1446| Conversion = [BaseClassConversion] base class conversion
# 1446| Type = [Struct] POD_Base
# 1446| ValueCategory = prvalue
# 1446| expr: [CStyleCast] (POD_Middle)...
# 1446| Conversion = [BaseClassConversion] base class conversion
# 1446| Type = [Struct] POD_Middle
# 1446| ValueCategory = prvalue
# 1446| expr: [FunctionCall] call to returnValue
# 1446| Type = [Struct] POD_Derived
# 1446| ValueCategory = prvalue
# 1447| 3: [DeclStmt] declaration
# 1447| 0: [VariableDeclarationEntry] definition of f
# 1447| Type = [FloatType] float
# 1447| init: [Initializer] initializer for f
# 1447| expr: [FunctionCall] call to f
# 1447| Type = [FloatType] float
# 1447| ValueCategory = prvalue
# 1447| -1: [CStyleCast] (const POD_Base)...
# 1447| Conversion = [BaseClassConversion] base class conversion
# 1447| Type = [SpecifiedType] const POD_Base
# 1447| ValueCategory = prvalue
# 1447| expr: [CStyleCast] (POD_Middle)...
# 1447| Conversion = [BaseClassConversion] base class conversion
# 1447| Type = [Struct] POD_Middle
# 1447| ValueCategory = prvalue
# 1447| expr: [ParenthesisExpr] (...)
# 1447| Type = [Struct] POD_Derived
# 1447| ValueCategory = prvalue
# 1447| expr: [FunctionCall] call to returnValue
# 1447| Type = [Struct] POD_Derived
# 1447| ValueCategory = prvalue
# 1448| 4: [ReturnStmt] return ...
perf-regression.cpp:
# 4| [CopyAssignmentOperator] Big& Big::operator=(Big const&)
# 4| params:

21
cpp/ql/test/library-tests/ir/ir/ir.cpp
View File

@@ -1426,4 +1426,25 @@ void temporary_unusual_fields() {
float f = returnValue<UnusualFields>().a[5];
}
struct POD_Base {
int x;
float f() const;
};
struct POD_Middle : POD_Base {
int y;
};
struct POD_Derived : POD_Middle {
int z;
};
void temporary_hierarchy() {
POD_Base b = returnValue<POD_Middle>();
b = (returnValue<POD_Derived>()); // Multiple conversions plus parens
int x = returnValue<POD_Derived>().x;
float f = (returnValue<POD_Derived>()).f();
}
// semmle-extractor-options: -std=c++17 --clang

54
cpp/ql/test/library-tests/ir/ir/raw_ir.expected
View File

@@ -7867,6 +7867,60 @@ ir.cpp:
# 1421| v1421_5(void) = AliasedUse : ~m?
# 1421| v1421_6(void) = ExitFunction :
# 1443| void temporary_hierarchy()
# 1443| Block 0
# 1443| v1443_1(void) = EnterFunction :
# 1443| mu1443_2(unknown) = AliasedDefinition :
# 1443| mu1443_3(unknown) = InitializeNonLocal :
# 1444| r1444_1(glval<POD_Base>) = VariableAddress[b] :
# 1444| r1444_2(glval<unknown>) = FunctionAddress[returnValue] :
# 1444| r1444_3(POD_Middle) = Call[returnValue] : func:r1444_2
# 1444| mu1444_4(unknown) = ^CallSideEffect : ~m?
# 1444| r1444_5(glval<POD_Middle>) = VariableAddress[#temp1444:18] :
# 1444| mu1444_6(POD_Middle) = Store[#temp1444:18] : &:r1444_5, r1444_3
# 1444| r1444_7(glval<POD_Base>) = ConvertToNonVirtualBase[POD_Middle : POD_Base] : r1444_5
# 1444| r1444_8(POD_Base) = Load[?] : &:r1444_7, ~m?
# 1444| mu1444_9(POD_Base) = Store[b] : &:r1444_1, r1444_8
# 1445| r1445_1(glval<POD_Derived>) = VariableAddress[#temp1445:9] :
# 1445| r1445_2(glval<unknown>) = FunctionAddress[returnValue] :
# 1445| r1445_3(POD_Derived) = Call[returnValue] : func:r1445_2
# 1445| mu1445_4(unknown) = ^CallSideEffect : ~m?
# 1445| mu1445_5(POD_Derived) = Store[#temp1445:9] : &:r1445_1, r1445_3
# 1445| r1445_6(glval<POD_Middle>) = ConvertToNonVirtualBase[POD_Derived : POD_Middle] : r1445_1
# 1445| r1445_7(glval<POD_Base>) = ConvertToNonVirtualBase[POD_Middle : POD_Base] : r1445_6
# 1445| r1445_8(POD_Base) = Load[?] : &:r1445_7, ~m?
# 1445| r1445_9(glval<POD_Base>) = VariableAddress[b] :
# 1445| mu1445_10(POD_Base) = Store[b] : &:r1445_9, r1445_8
# 1446| r1446_1(glval<int>) = VariableAddress[x] :
# 1446| r1446_2(glval<unknown>) = FunctionAddress[returnValue] :
# 1446| r1446_3(POD_Derived) = Call[returnValue] : func:r1446_2
# 1446| mu1446_4(unknown) = ^CallSideEffect : ~m?
# 1446| r1446_5(glval<POD_Derived>) = VariableAddress[#temp1446:13] :
# 1446| mu1446_6(POD_Derived) = Store[#temp1446:13] : &:r1446_5, r1446_3
# 1446| r1446_7(glval<POD_Middle>) = ConvertToNonVirtualBase[POD_Derived : POD_Middle] : r1446_5
# 1446| r1446_8(glval<POD_Base>) = ConvertToNonVirtualBase[POD_Middle : POD_Base] : r1446_7
# 1446| r1446_9(glval<int>) = FieldAddress[x] : r1446_8
# 1446| r1446_10(int) = Load[?] : &:r1446_9, ~m?
# 1446| mu1446_11(int) = Store[x] : &:r1446_1, r1446_10
# 1447| r1447_1(glval<float>) = VariableAddress[f] :
# 1447| r1447_2(glval<unknown>) = FunctionAddress[returnValue] :
# 1447| r1447_3(POD_Derived) = Call[returnValue] : func:r1447_2
# 1447| mu1447_4(unknown) = ^CallSideEffect : ~m?
# 1447| r1447_5(glval<POD_Derived>) = VariableAddress[#temp1447:16] :
# 1447| mu1447_6(POD_Derived) = Store[#temp1447:16] : &:r1447_5, r1447_3
# 1447| r1447_7(glval<POD_Middle>) = ConvertToNonVirtualBase[POD_Derived : POD_Middle] : r1447_5
# 1447| r1447_8(glval<POD_Base>) = ConvertToNonVirtualBase[POD_Middle : POD_Base] : r1447_7
# 1447| r1447_9(glval<unknown>) = FunctionAddress[f] :
# 1447| r1447_10(float) = Call[f] : func:r1447_9, this:r1447_8
# 1447| mu1447_11(unknown) = ^CallSideEffect : ~m?
# 1447| v1447_12(void) = ^BufferReadSideEffect[-1] : &:r1447_8, ~m?
# 1447| mu1447_13(POD_Base) = ^IndirectMayWriteSideEffect[-1] : &:r1447_8
# 1447| mu1447_14(float) = Store[f] : &:r1447_1, r1447_10
# 1448| v1448_1(void) = NoOp :
# 1443| v1443_4(void) = ReturnVoid :
# 1443| v1443_5(void) = AliasedUse : ~m?
# 1443| v1443_6(void) = ExitFunction :
perf-regression.cpp:
# 6| void Big::Big()
# 6| Block 0