mirror of
https://github.com/github/codeql.git
synced 2025-12-22 11:46:32 +01:00
C++: Sync up identical files and restore imports
This commit is contained in:
@@ -94,30 +94,6 @@ private predicate numberableInstruction(Instruction instr) {
|
|||||||
instr instanceof LoadTotalOverlapInstruction
|
instr instanceof LoadTotalOverlapInstruction
|
||||||
}
|
}
|
||||||
|
|
||||||
predicate multipleValueNumbers(Instruction instr, int n) {
|
|
||||||
n > 1 and
|
|
||||||
(
|
|
||||||
n =
|
|
||||||
strictcount(IRFunction irFunc, Language::AST ast |
|
|
||||||
variableAddressValueNumber(instr, irFunc, ast)
|
|
||||||
)
|
|
||||||
or
|
|
||||||
n =
|
|
||||||
strictcount(IRFunction irFunc, Language::AST var |
|
|
||||||
initializeParameterValueNumber(instr, irFunc, var)
|
|
||||||
)
|
|
||||||
or
|
|
||||||
n = strictcount(IRFunction irFunc | initializeThisValueNumber(instr, irFunc))
|
|
||||||
or
|
|
||||||
n = strictcount(IRFunction irFunc, string value | constantValueNumber(instr, irFunc, value))
|
|
||||||
or
|
|
||||||
n =
|
|
||||||
strictcount(IRFunction irFunc, IRType type, string value |
|
|
||||||
stringConstantValueNumber(instr, irFunc, type, value)
|
|
||||||
)
|
|
||||||
)
|
|
||||||
}
|
|
||||||
|
|
||||||
private predicate variableAddressValueNumber(
|
private predicate variableAddressValueNumber(
|
||||||
VariableAddressInstruction instr, IRFunction irFunc, Language::AST ast
|
VariableAddressInstruction instr, IRFunction irFunc, Language::AST ast
|
||||||
) {
|
) {
|
||||||
|
|||||||
@@ -9,9 +9,7 @@ newtype TValueNumber =
|
|||||||
initializeParameterValueNumber(_, irFunc, var)
|
initializeParameterValueNumber(_, irFunc, var)
|
||||||
} or
|
} or
|
||||||
TInitializeThisValueNumber(IRFunction irFunc) { initializeThisValueNumber(_, irFunc) } or
|
TInitializeThisValueNumber(IRFunction irFunc) { initializeThisValueNumber(_, irFunc) } or
|
||||||
TConstantValueNumber(IRFunction irFunc, IRType type, string value) {
|
TConstantValueNumber(IRFunction irFunc, string value) { constantValueNumber(_, irFunc, value) } or
|
||||||
constantValueNumber(_, irFunc, type, value)
|
|
||||||
} or
|
|
||||||
TStringConstantValueNumber(IRFunction irFunc, IRType type, string value) {
|
TStringConstantValueNumber(IRFunction irFunc, IRType type, string value) {
|
||||||
stringConstantValueNumber(_, irFunc, type, value)
|
stringConstantValueNumber(_, irFunc, type, value)
|
||||||
} or
|
} or
|
||||||
@@ -19,29 +17,26 @@ newtype TValueNumber =
|
|||||||
fieldAddressValueNumber(_, irFunc, field, objectAddress)
|
fieldAddressValueNumber(_, irFunc, field, objectAddress)
|
||||||
} or
|
} or
|
||||||
TBinaryValueNumber(
|
TBinaryValueNumber(
|
||||||
IRFunction irFunc, Opcode opcode, IRType type, TValueNumber leftOperand,
|
IRFunction irFunc, Opcode opcode, TValueNumber leftOperand, TValueNumber rightOperand
|
||||||
TValueNumber rightOperand
|
|
||||||
) {
|
) {
|
||||||
binaryValueNumber(_, irFunc, opcode, type, leftOperand, rightOperand)
|
binaryValueNumber(_, irFunc, opcode, leftOperand, rightOperand)
|
||||||
} or
|
} or
|
||||||
TPointerArithmeticValueNumber(
|
TPointerArithmeticValueNumber(
|
||||||
IRFunction irFunc, Opcode opcode, IRType type, int elementSize, TValueNumber leftOperand,
|
IRFunction irFunc, Opcode opcode, int elementSize, TValueNumber leftOperand,
|
||||||
TValueNumber rightOperand
|
TValueNumber rightOperand
|
||||||
) {
|
) {
|
||||||
pointerArithmeticValueNumber(_, irFunc, opcode, type, elementSize, leftOperand, rightOperand)
|
pointerArithmeticValueNumber(_, irFunc, opcode, elementSize, leftOperand, rightOperand)
|
||||||
} or
|
} or
|
||||||
TUnaryValueNumber(IRFunction irFunc, Opcode opcode, IRType type, TValueNumber operand) {
|
TUnaryValueNumber(IRFunction irFunc, Opcode opcode, TValueNumber operand) {
|
||||||
unaryValueNumber(_, irFunc, opcode, type, operand)
|
unaryValueNumber(_, irFunc, opcode, operand)
|
||||||
} or
|
} or
|
||||||
TInheritanceConversionValueNumber(
|
TInheritanceConversionValueNumber(
|
||||||
IRFunction irFunc, Opcode opcode, Class baseClass, Class derivedClass, TValueNumber operand
|
IRFunction irFunc, Opcode opcode, Class baseClass, Class derivedClass, TValueNumber operand
|
||||||
) {
|
) {
|
||||||
inheritanceConversionValueNumber(_, irFunc, opcode, baseClass, derivedClass, operand)
|
inheritanceConversionValueNumber(_, irFunc, opcode, baseClass, derivedClass, operand)
|
||||||
} or
|
} or
|
||||||
TLoadTotalOverlapValueNumber(
|
TLoadTotalOverlapValueNumber(IRFunction irFunc, TValueNumber memOperand, TValueNumber operand) {
|
||||||
IRFunction irFunc, IRType type, TValueNumber memOperand, TValueNumber operand
|
loadTotalOverlapValueNumber(_, irFunc, memOperand, operand)
|
||||||
) {
|
|
||||||
loadTotalOverlapValueNumber(_, irFunc, type, memOperand, operand)
|
|
||||||
} or
|
} or
|
||||||
TUniqueValueNumber(IRFunction irFunc, Instruction instr) { uniqueValueNumber(instr, irFunc) }
|
TUniqueValueNumber(IRFunction irFunc, Instruction instr) { uniqueValueNumber(instr, irFunc) }
|
||||||
|
|
||||||
@@ -106,7 +101,8 @@ private predicate variableAddressValueNumber(
|
|||||||
// The underlying AST element is used as value-numbering key instead of the
|
// The underlying AST element is used as value-numbering key instead of the
|
||||||
// `IRVariable` to work around a problem where a variable or expression with
|
// `IRVariable` to work around a problem where a variable or expression with
|
||||||
// multiple types gives rise to multiple `IRVariable`s.
|
// multiple types gives rise to multiple `IRVariable`s.
|
||||||
instr.getIRVariable().getAST() = ast
|
instr.getIRVariable().getAST() = ast and
|
||||||
|
strictcount(instr.getIRVariable().getAST()) = 1
|
||||||
}
|
}
|
||||||
|
|
||||||
private predicate initializeParameterValueNumber(
|
private predicate initializeParameterValueNumber(
|
||||||
@@ -123,11 +119,8 @@ private predicate initializeThisValueNumber(InitializeThisInstruction instr, IRF
|
|||||||
instr.getEnclosingIRFunction() = irFunc
|
instr.getEnclosingIRFunction() = irFunc
|
||||||
}
|
}
|
||||||
|
|
||||||
private predicate constantValueNumber(
|
predicate constantValueNumber(ConstantInstruction instr, IRFunction irFunc, string value) {
|
||||||
ConstantInstruction instr, IRFunction irFunc, IRType type, string value
|
|
||||||
) {
|
|
||||||
instr.getEnclosingIRFunction() = irFunc and
|
instr.getEnclosingIRFunction() = irFunc and
|
||||||
instr.getResultIRType() = type and
|
|
||||||
instr.getValue() = value
|
instr.getValue() = value
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -145,42 +138,40 @@ private predicate fieldAddressValueNumber(
|
|||||||
) {
|
) {
|
||||||
instr.getEnclosingIRFunction() = irFunc and
|
instr.getEnclosingIRFunction() = irFunc and
|
||||||
instr.getField() = field and
|
instr.getField() = field and
|
||||||
|
strictcount(instr.getField()) = 1 and
|
||||||
tvalueNumber(instr.getObjectAddress()) = objectAddress
|
tvalueNumber(instr.getObjectAddress()) = objectAddress
|
||||||
}
|
}
|
||||||
|
|
||||||
private predicate binaryValueNumber(
|
private predicate binaryValueNumber(
|
||||||
BinaryInstruction instr, IRFunction irFunc, Opcode opcode, IRType type, TValueNumber leftOperand,
|
BinaryInstruction instr, IRFunction irFunc, Opcode opcode, TValueNumber leftOperand,
|
||||||
TValueNumber rightOperand
|
TValueNumber rightOperand
|
||||||
) {
|
) {
|
||||||
instr.getEnclosingIRFunction() = irFunc and
|
instr.getEnclosingIRFunction() = irFunc and
|
||||||
not instr instanceof PointerArithmeticInstruction and
|
not instr instanceof PointerArithmeticInstruction and
|
||||||
instr.getOpcode() = opcode and
|
instr.getOpcode() = opcode and
|
||||||
instr.getResultIRType() = type and
|
|
||||||
tvalueNumber(instr.getLeft()) = leftOperand and
|
tvalueNumber(instr.getLeft()) = leftOperand and
|
||||||
tvalueNumber(instr.getRight()) = rightOperand
|
tvalueNumber(instr.getRight()) = rightOperand
|
||||||
}
|
}
|
||||||
|
|
||||||
private predicate pointerArithmeticValueNumber(
|
private predicate pointerArithmeticValueNumber(
|
||||||
PointerArithmeticInstruction instr, IRFunction irFunc, Opcode opcode, IRType type,
|
PointerArithmeticInstruction instr, IRFunction irFunc, Opcode opcode, int elementSize,
|
||||||
int elementSize, TValueNumber leftOperand, TValueNumber rightOperand
|
TValueNumber leftOperand, TValueNumber rightOperand
|
||||||
) {
|
) {
|
||||||
instr.getEnclosingIRFunction() = irFunc and
|
instr.getEnclosingIRFunction() = irFunc and
|
||||||
instr.getOpcode() = opcode and
|
instr.getOpcode() = opcode and
|
||||||
instr.getResultIRType() = type and
|
|
||||||
instr.getElementSize() = elementSize and
|
instr.getElementSize() = elementSize and
|
||||||
tvalueNumber(instr.getLeft()) = leftOperand and
|
tvalueNumber(instr.getLeft()) = leftOperand and
|
||||||
tvalueNumber(instr.getRight()) = rightOperand
|
tvalueNumber(instr.getRight()) = rightOperand
|
||||||
}
|
}
|
||||||
|
|
||||||
private predicate unaryValueNumber(
|
private predicate unaryValueNumber(
|
||||||
UnaryInstruction instr, IRFunction irFunc, Opcode opcode, IRType type, TValueNumber operand
|
UnaryInstruction instr, IRFunction irFunc, Opcode opcode, TValueNumber operand
|
||||||
) {
|
) {
|
||||||
instr.getEnclosingIRFunction() = irFunc and
|
instr.getEnclosingIRFunction() = irFunc and
|
||||||
not instr instanceof InheritanceConversionInstruction and
|
not instr instanceof InheritanceConversionInstruction and
|
||||||
not instr instanceof CopyInstruction and
|
not instr instanceof CopyInstruction and
|
||||||
not instr instanceof FieldAddressInstruction and
|
not instr instanceof FieldAddressInstruction and
|
||||||
instr.getOpcode() = opcode and
|
instr.getOpcode() = opcode and
|
||||||
instr.getResultIRType() = type and
|
|
||||||
tvalueNumber(instr.getUnary()) = operand
|
tvalueNumber(instr.getUnary()) = operand
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -196,11 +187,10 @@ private predicate inheritanceConversionValueNumber(
|
|||||||
}
|
}
|
||||||
|
|
||||||
private predicate loadTotalOverlapValueNumber(
|
private predicate loadTotalOverlapValueNumber(
|
||||||
LoadTotalOverlapInstruction instr, IRFunction irFunc, IRType type, TValueNumber memOperand,
|
LoadTotalOverlapInstruction instr, IRFunction irFunc, TValueNumber memOperand,
|
||||||
TValueNumber operand
|
TValueNumber operand
|
||||||
) {
|
) {
|
||||||
instr.getEnclosingIRFunction() = irFunc and
|
instr.getEnclosingIRFunction() = irFunc and
|
||||||
instr.getResultIRType() = type and
|
|
||||||
tvalueNumber(instr.getAnOperand().(MemoryOperand).getAnyDef()) = memOperand and
|
tvalueNumber(instr.getAnOperand().(MemoryOperand).getAnyDef()) = memOperand and
|
||||||
tvalueNumberOfOperand(instr.getAnOperand().(AddressOperand)) = operand
|
tvalueNumberOfOperand(instr.getAnOperand().(AddressOperand)) = operand
|
||||||
}
|
}
|
||||||
@@ -255,9 +245,9 @@ private TValueNumber nonUniqueValueNumber(Instruction instr) {
|
|||||||
initializeThisValueNumber(instr, irFunc) and
|
initializeThisValueNumber(instr, irFunc) and
|
||||||
result = TInitializeThisValueNumber(irFunc)
|
result = TInitializeThisValueNumber(irFunc)
|
||||||
or
|
or
|
||||||
exists(IRType type, string value |
|
exists(string value |
|
||||||
constantValueNumber(instr, irFunc, type, value) and
|
constantValueNumber(instr, irFunc, value) and
|
||||||
result = TConstantValueNumber(irFunc, type, value)
|
result = TConstantValueNumber(irFunc, value)
|
||||||
)
|
)
|
||||||
or
|
or
|
||||||
exists(IRType type, string value |
|
exists(IRType type, string value |
|
||||||
@@ -270,14 +260,14 @@ private TValueNumber nonUniqueValueNumber(Instruction instr) {
|
|||||||
result = TFieldAddressValueNumber(irFunc, field, objectAddress)
|
result = TFieldAddressValueNumber(irFunc, field, objectAddress)
|
||||||
)
|
)
|
||||||
or
|
or
|
||||||
exists(Opcode opcode, IRType type, TValueNumber leftOperand, TValueNumber rightOperand |
|
exists(Opcode opcode, TValueNumber leftOperand, TValueNumber rightOperand |
|
||||||
binaryValueNumber(instr, irFunc, opcode, type, leftOperand, rightOperand) and
|
binaryValueNumber(instr, irFunc, opcode, leftOperand, rightOperand) and
|
||||||
result = TBinaryValueNumber(irFunc, opcode, type, leftOperand, rightOperand)
|
result = TBinaryValueNumber(irFunc, opcode, leftOperand, rightOperand)
|
||||||
)
|
)
|
||||||
or
|
or
|
||||||
exists(Opcode opcode, IRType type, TValueNumber operand |
|
exists(Opcode opcode, TValueNumber operand |
|
||||||
unaryValueNumber(instr, irFunc, opcode, type, operand) and
|
unaryValueNumber(instr, irFunc, opcode, operand) and
|
||||||
result = TUnaryValueNumber(irFunc, opcode, type, operand)
|
result = TUnaryValueNumber(irFunc, opcode, operand)
|
||||||
)
|
)
|
||||||
or
|
or
|
||||||
exists(
|
exists(
|
||||||
@@ -287,19 +277,15 @@ private TValueNumber nonUniqueValueNumber(Instruction instr) {
|
|||||||
result = TInheritanceConversionValueNumber(irFunc, opcode, baseClass, derivedClass, operand)
|
result = TInheritanceConversionValueNumber(irFunc, opcode, baseClass, derivedClass, operand)
|
||||||
)
|
)
|
||||||
or
|
or
|
||||||
exists(
|
exists(Opcode opcode, int elementSize, TValueNumber leftOperand, TValueNumber rightOperand |
|
||||||
Opcode opcode, IRType type, int elementSize, TValueNumber leftOperand,
|
pointerArithmeticValueNumber(instr, irFunc, opcode, elementSize, leftOperand, rightOperand) and
|
||||||
TValueNumber rightOperand
|
|
||||||
|
|
|
||||||
pointerArithmeticValueNumber(instr, irFunc, opcode, type, elementSize, leftOperand,
|
|
||||||
rightOperand) and
|
|
||||||
result =
|
result =
|
||||||
TPointerArithmeticValueNumber(irFunc, opcode, type, elementSize, leftOperand, rightOperand)
|
TPointerArithmeticValueNumber(irFunc, opcode, elementSize, leftOperand, rightOperand)
|
||||||
)
|
)
|
||||||
or
|
or
|
||||||
exists(IRType type, TValueNumber memOperand, TValueNumber operand |
|
exists(TValueNumber memOperand, TValueNumber operand |
|
||||||
loadTotalOverlapValueNumber(instr, irFunc, type, memOperand, operand) and
|
loadTotalOverlapValueNumber(instr, irFunc, memOperand, operand) and
|
||||||
result = TLoadTotalOverlapValueNumber(irFunc, type, memOperand, operand)
|
result = TLoadTotalOverlapValueNumber(irFunc, memOperand, operand)
|
||||||
)
|
)
|
||||||
or
|
or
|
||||||
// The value number of a copy is just the value number of its source value.
|
// The value number of a copy is just the value number of its source value.
|
||||||
|
|||||||
@@ -9,9 +9,7 @@ newtype TValueNumber =
|
|||||||
initializeParameterValueNumber(_, irFunc, var)
|
initializeParameterValueNumber(_, irFunc, var)
|
||||||
} or
|
} or
|
||||||
TInitializeThisValueNumber(IRFunction irFunc) { initializeThisValueNumber(_, irFunc) } or
|
TInitializeThisValueNumber(IRFunction irFunc) { initializeThisValueNumber(_, irFunc) } or
|
||||||
TConstantValueNumber(IRFunction irFunc, IRType type, string value) {
|
TConstantValueNumber(IRFunction irFunc, string value) { constantValueNumber(_, irFunc, value) } or
|
||||||
constantValueNumber(_, irFunc, type, value)
|
|
||||||
} or
|
|
||||||
TStringConstantValueNumber(IRFunction irFunc, IRType type, string value) {
|
TStringConstantValueNumber(IRFunction irFunc, IRType type, string value) {
|
||||||
stringConstantValueNumber(_, irFunc, type, value)
|
stringConstantValueNumber(_, irFunc, type, value)
|
||||||
} or
|
} or
|
||||||
@@ -19,29 +17,26 @@ newtype TValueNumber =
|
|||||||
fieldAddressValueNumber(_, irFunc, field, objectAddress)
|
fieldAddressValueNumber(_, irFunc, field, objectAddress)
|
||||||
} or
|
} or
|
||||||
TBinaryValueNumber(
|
TBinaryValueNumber(
|
||||||
IRFunction irFunc, Opcode opcode, IRType type, TValueNumber leftOperand,
|
IRFunction irFunc, Opcode opcode, TValueNumber leftOperand, TValueNumber rightOperand
|
||||||
TValueNumber rightOperand
|
|
||||||
) {
|
) {
|
||||||
binaryValueNumber(_, irFunc, opcode, type, leftOperand, rightOperand)
|
binaryValueNumber(_, irFunc, opcode, leftOperand, rightOperand)
|
||||||
} or
|
} or
|
||||||
TPointerArithmeticValueNumber(
|
TPointerArithmeticValueNumber(
|
||||||
IRFunction irFunc, Opcode opcode, IRType type, int elementSize, TValueNumber leftOperand,
|
IRFunction irFunc, Opcode opcode, int elementSize, TValueNumber leftOperand,
|
||||||
TValueNumber rightOperand
|
TValueNumber rightOperand
|
||||||
) {
|
) {
|
||||||
pointerArithmeticValueNumber(_, irFunc, opcode, type, elementSize, leftOperand, rightOperand)
|
pointerArithmeticValueNumber(_, irFunc, opcode, elementSize, leftOperand, rightOperand)
|
||||||
} or
|
} or
|
||||||
TUnaryValueNumber(IRFunction irFunc, Opcode opcode, IRType type, TValueNumber operand) {
|
TUnaryValueNumber(IRFunction irFunc, Opcode opcode, TValueNumber operand) {
|
||||||
unaryValueNumber(_, irFunc, opcode, type, operand)
|
unaryValueNumber(_, irFunc, opcode, operand)
|
||||||
} or
|
} or
|
||||||
TInheritanceConversionValueNumber(
|
TInheritanceConversionValueNumber(
|
||||||
IRFunction irFunc, Opcode opcode, Class baseClass, Class derivedClass, TValueNumber operand
|
IRFunction irFunc, Opcode opcode, Class baseClass, Class derivedClass, TValueNumber operand
|
||||||
) {
|
) {
|
||||||
inheritanceConversionValueNumber(_, irFunc, opcode, baseClass, derivedClass, operand)
|
inheritanceConversionValueNumber(_, irFunc, opcode, baseClass, derivedClass, operand)
|
||||||
} or
|
} or
|
||||||
TLoadTotalOverlapValueNumber(
|
TLoadTotalOverlapValueNumber(IRFunction irFunc, TValueNumber memOperand, TValueNumber operand) {
|
||||||
IRFunction irFunc, IRType type, TValueNumber memOperand, TValueNumber operand
|
loadTotalOverlapValueNumber(_, irFunc, memOperand, operand)
|
||||||
) {
|
|
||||||
loadTotalOverlapValueNumber(_, irFunc, type, memOperand, operand)
|
|
||||||
} or
|
} or
|
||||||
TUniqueValueNumber(IRFunction irFunc, Instruction instr) { uniqueValueNumber(instr, irFunc) }
|
TUniqueValueNumber(IRFunction irFunc, Instruction instr) { uniqueValueNumber(instr, irFunc) }
|
||||||
|
|
||||||
@@ -106,7 +101,8 @@ private predicate variableAddressValueNumber(
|
|||||||
// The underlying AST element is used as value-numbering key instead of the
|
// The underlying AST element is used as value-numbering key instead of the
|
||||||
// `IRVariable` to work around a problem where a variable or expression with
|
// `IRVariable` to work around a problem where a variable or expression with
|
||||||
// multiple types gives rise to multiple `IRVariable`s.
|
// multiple types gives rise to multiple `IRVariable`s.
|
||||||
instr.getIRVariable().getAST() = ast
|
instr.getIRVariable().getAST() = ast and
|
||||||
|
strictcount(instr.getIRVariable().getAST()) = 1
|
||||||
}
|
}
|
||||||
|
|
||||||
private predicate initializeParameterValueNumber(
|
private predicate initializeParameterValueNumber(
|
||||||
@@ -123,11 +119,8 @@ private predicate initializeThisValueNumber(InitializeThisInstruction instr, IRF
|
|||||||
instr.getEnclosingIRFunction() = irFunc
|
instr.getEnclosingIRFunction() = irFunc
|
||||||
}
|
}
|
||||||
|
|
||||||
private predicate constantValueNumber(
|
predicate constantValueNumber(ConstantInstruction instr, IRFunction irFunc, string value) {
|
||||||
ConstantInstruction instr, IRFunction irFunc, IRType type, string value
|
|
||||||
) {
|
|
||||||
instr.getEnclosingIRFunction() = irFunc and
|
instr.getEnclosingIRFunction() = irFunc and
|
||||||
instr.getResultIRType() = type and
|
|
||||||
instr.getValue() = value
|
instr.getValue() = value
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -145,42 +138,40 @@ private predicate fieldAddressValueNumber(
|
|||||||
) {
|
) {
|
||||||
instr.getEnclosingIRFunction() = irFunc and
|
instr.getEnclosingIRFunction() = irFunc and
|
||||||
instr.getField() = field and
|
instr.getField() = field and
|
||||||
|
strictcount(instr.getField()) = 1 and
|
||||||
tvalueNumber(instr.getObjectAddress()) = objectAddress
|
tvalueNumber(instr.getObjectAddress()) = objectAddress
|
||||||
}
|
}
|
||||||
|
|
||||||
private predicate binaryValueNumber(
|
private predicate binaryValueNumber(
|
||||||
BinaryInstruction instr, IRFunction irFunc, Opcode opcode, IRType type, TValueNumber leftOperand,
|
BinaryInstruction instr, IRFunction irFunc, Opcode opcode, TValueNumber leftOperand,
|
||||||
TValueNumber rightOperand
|
TValueNumber rightOperand
|
||||||
) {
|
) {
|
||||||
instr.getEnclosingIRFunction() = irFunc and
|
instr.getEnclosingIRFunction() = irFunc and
|
||||||
not instr instanceof PointerArithmeticInstruction and
|
not instr instanceof PointerArithmeticInstruction and
|
||||||
instr.getOpcode() = opcode and
|
instr.getOpcode() = opcode and
|
||||||
instr.getResultIRType() = type and
|
|
||||||
tvalueNumber(instr.getLeft()) = leftOperand and
|
tvalueNumber(instr.getLeft()) = leftOperand and
|
||||||
tvalueNumber(instr.getRight()) = rightOperand
|
tvalueNumber(instr.getRight()) = rightOperand
|
||||||
}
|
}
|
||||||
|
|
||||||
private predicate pointerArithmeticValueNumber(
|
private predicate pointerArithmeticValueNumber(
|
||||||
PointerArithmeticInstruction instr, IRFunction irFunc, Opcode opcode, IRType type,
|
PointerArithmeticInstruction instr, IRFunction irFunc, Opcode opcode, int elementSize,
|
||||||
int elementSize, TValueNumber leftOperand, TValueNumber rightOperand
|
TValueNumber leftOperand, TValueNumber rightOperand
|
||||||
) {
|
) {
|
||||||
instr.getEnclosingIRFunction() = irFunc and
|
instr.getEnclosingIRFunction() = irFunc and
|
||||||
instr.getOpcode() = opcode and
|
instr.getOpcode() = opcode and
|
||||||
instr.getResultIRType() = type and
|
|
||||||
instr.getElementSize() = elementSize and
|
instr.getElementSize() = elementSize and
|
||||||
tvalueNumber(instr.getLeft()) = leftOperand and
|
tvalueNumber(instr.getLeft()) = leftOperand and
|
||||||
tvalueNumber(instr.getRight()) = rightOperand
|
tvalueNumber(instr.getRight()) = rightOperand
|
||||||
}
|
}
|
||||||
|
|
||||||
private predicate unaryValueNumber(
|
private predicate unaryValueNumber(
|
||||||
UnaryInstruction instr, IRFunction irFunc, Opcode opcode, IRType type, TValueNumber operand
|
UnaryInstruction instr, IRFunction irFunc, Opcode opcode, TValueNumber operand
|
||||||
) {
|
) {
|
||||||
instr.getEnclosingIRFunction() = irFunc and
|
instr.getEnclosingIRFunction() = irFunc and
|
||||||
not instr instanceof InheritanceConversionInstruction and
|
not instr instanceof InheritanceConversionInstruction and
|
||||||
not instr instanceof CopyInstruction and
|
not instr instanceof CopyInstruction and
|
||||||
not instr instanceof FieldAddressInstruction and
|
not instr instanceof FieldAddressInstruction and
|
||||||
instr.getOpcode() = opcode and
|
instr.getOpcode() = opcode and
|
||||||
instr.getResultIRType() = type and
|
|
||||||
tvalueNumber(instr.getUnary()) = operand
|
tvalueNumber(instr.getUnary()) = operand
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -196,11 +187,10 @@ private predicate inheritanceConversionValueNumber(
|
|||||||
}
|
}
|
||||||
|
|
||||||
private predicate loadTotalOverlapValueNumber(
|
private predicate loadTotalOverlapValueNumber(
|
||||||
LoadTotalOverlapInstruction instr, IRFunction irFunc, IRType type, TValueNumber memOperand,
|
LoadTotalOverlapInstruction instr, IRFunction irFunc, TValueNumber memOperand,
|
||||||
TValueNumber operand
|
TValueNumber operand
|
||||||
) {
|
) {
|
||||||
instr.getEnclosingIRFunction() = irFunc and
|
instr.getEnclosingIRFunction() = irFunc and
|
||||||
instr.getResultIRType() = type and
|
|
||||||
tvalueNumber(instr.getAnOperand().(MemoryOperand).getAnyDef()) = memOperand and
|
tvalueNumber(instr.getAnOperand().(MemoryOperand).getAnyDef()) = memOperand and
|
||||||
tvalueNumberOfOperand(instr.getAnOperand().(AddressOperand)) = operand
|
tvalueNumberOfOperand(instr.getAnOperand().(AddressOperand)) = operand
|
||||||
}
|
}
|
||||||
@@ -255,9 +245,9 @@ private TValueNumber nonUniqueValueNumber(Instruction instr) {
|
|||||||
initializeThisValueNumber(instr, irFunc) and
|
initializeThisValueNumber(instr, irFunc) and
|
||||||
result = TInitializeThisValueNumber(irFunc)
|
result = TInitializeThisValueNumber(irFunc)
|
||||||
or
|
or
|
||||||
exists(IRType type, string value |
|
exists(string value |
|
||||||
constantValueNumber(instr, irFunc, type, value) and
|
constantValueNumber(instr, irFunc, value) and
|
||||||
result = TConstantValueNumber(irFunc, type, value)
|
result = TConstantValueNumber(irFunc, value)
|
||||||
)
|
)
|
||||||
or
|
or
|
||||||
exists(IRType type, string value |
|
exists(IRType type, string value |
|
||||||
@@ -270,14 +260,14 @@ private TValueNumber nonUniqueValueNumber(Instruction instr) {
|
|||||||
result = TFieldAddressValueNumber(irFunc, field, objectAddress)
|
result = TFieldAddressValueNumber(irFunc, field, objectAddress)
|
||||||
)
|
)
|
||||||
or
|
or
|
||||||
exists(Opcode opcode, IRType type, TValueNumber leftOperand, TValueNumber rightOperand |
|
exists(Opcode opcode, TValueNumber leftOperand, TValueNumber rightOperand |
|
||||||
binaryValueNumber(instr, irFunc, opcode, type, leftOperand, rightOperand) and
|
binaryValueNumber(instr, irFunc, opcode, leftOperand, rightOperand) and
|
||||||
result = TBinaryValueNumber(irFunc, opcode, type, leftOperand, rightOperand)
|
result = TBinaryValueNumber(irFunc, opcode, leftOperand, rightOperand)
|
||||||
)
|
)
|
||||||
or
|
or
|
||||||
exists(Opcode opcode, IRType type, TValueNumber operand |
|
exists(Opcode opcode, TValueNumber operand |
|
||||||
unaryValueNumber(instr, irFunc, opcode, type, operand) and
|
unaryValueNumber(instr, irFunc, opcode, operand) and
|
||||||
result = TUnaryValueNumber(irFunc, opcode, type, operand)
|
result = TUnaryValueNumber(irFunc, opcode, operand)
|
||||||
)
|
)
|
||||||
or
|
or
|
||||||
exists(
|
exists(
|
||||||
@@ -287,19 +277,15 @@ private TValueNumber nonUniqueValueNumber(Instruction instr) {
|
|||||||
result = TInheritanceConversionValueNumber(irFunc, opcode, baseClass, derivedClass, operand)
|
result = TInheritanceConversionValueNumber(irFunc, opcode, baseClass, derivedClass, operand)
|
||||||
)
|
)
|
||||||
or
|
or
|
||||||
exists(
|
exists(Opcode opcode, int elementSize, TValueNumber leftOperand, TValueNumber rightOperand |
|
||||||
Opcode opcode, IRType type, int elementSize, TValueNumber leftOperand,
|
pointerArithmeticValueNumber(instr, irFunc, opcode, elementSize, leftOperand, rightOperand) and
|
||||||
TValueNumber rightOperand
|
|
||||||
|
|
|
||||||
pointerArithmeticValueNumber(instr, irFunc, opcode, type, elementSize, leftOperand,
|
|
||||||
rightOperand) and
|
|
||||||
result =
|
result =
|
||||||
TPointerArithmeticValueNumber(irFunc, opcode, type, elementSize, leftOperand, rightOperand)
|
TPointerArithmeticValueNumber(irFunc, opcode, elementSize, leftOperand, rightOperand)
|
||||||
)
|
)
|
||||||
or
|
or
|
||||||
exists(IRType type, TValueNumber memOperand, TValueNumber operand |
|
exists(TValueNumber memOperand, TValueNumber operand |
|
||||||
loadTotalOverlapValueNumber(instr, irFunc, type, memOperand, operand) and
|
loadTotalOverlapValueNumber(instr, irFunc, memOperand, operand) and
|
||||||
result = TLoadTotalOverlapValueNumber(irFunc, type, memOperand, operand)
|
result = TLoadTotalOverlapValueNumber(irFunc, memOperand, operand)
|
||||||
)
|
)
|
||||||
or
|
or
|
||||||
// The value number of a copy is just the value number of its source value.
|
// The value number of a copy is just the value number of its source value.
|
||||||
|
|||||||
@@ -2,4 +2,4 @@
|
|||||||
* Support for tracking tainted data through the program.
|
* Support for tracking tainted data through the program.
|
||||||
*/
|
*/
|
||||||
|
|
||||||
import semmle.code.cpp.ir.dataflow.DefaultTaintTracking
|
import TaintTrackingImpl
|
||||||
|
|||||||
@@ -1 +1 @@
|
|||||||
import semmle.code.cpp.ir.internal.ASTValueNumbering
|
import GlobalValueNumberingImpl
|
||||||
|
|||||||
Reference in New Issue
Block a user