mirror of
https://github.com/github/codeql.git
synced 2026-04-28 02:05:14 +02:00
Merge pull request #106 from dave-bartolomeo/dave/LF
Force LF line endings for .ql, .qll, .qlref, and .dbscheme
This commit is contained in:
@@ -1,49 +1,49 @@
|
||||
import cpp
|
||||
import semmle.code.cpp.ssa.internal.IntegerConstant as Ints
|
||||
|
||||
bindingset[n]
|
||||
string resultString(int n) {
|
||||
if Ints::hasValue(n) then
|
||||
result = n.toString()
|
||||
else
|
||||
result = "unknown"
|
||||
}
|
||||
|
||||
from string expr, int res
|
||||
where
|
||||
expr = "0 + 0" and res = Ints::add(0, 0) or
|
||||
expr = "0 + INT_MAX" and res = Ints::add(0, Ints::maxValue()) or
|
||||
expr = "0 + -INT_MAX" and res = Ints::add(0, Ints::minValue()) or
|
||||
expr = "1 + INT_MAX" and res = Ints::add(1, Ints::maxValue()) or
|
||||
expr = "1 + -INT_MAX" and res = Ints::add(1, Ints::minValue()) or
|
||||
expr = "unknown + unknown" and res = Ints::add(Ints::unknown(), Ints::unknown()) or
|
||||
expr = "5 + unknown" and res = Ints::add(5, Ints::unknown()) or
|
||||
expr = "unknown + 5" and res = Ints::add(Ints::unknown(), 5) or
|
||||
expr = "0 - INT_MAX" and res = Ints::sub(0, Ints::maxValue()) or
|
||||
expr = "0 - -INT_MAX" and res = Ints::sub(0, Ints::minValue()) or
|
||||
expr = "-1 - INT_MAX" and res = Ints::sub(-1, Ints::maxValue()) or
|
||||
expr = "-1 - -INT_MAX" and res = Ints::sub(-1, Ints::minValue()) or
|
||||
expr = "unknown - unknown" and res = Ints::sub(Ints::unknown(), Ints::unknown()) or
|
||||
expr = "5 - unknown" and res = Ints::sub(5, Ints::unknown()) or
|
||||
expr = "unknown - 5" and res = Ints::sub(Ints::unknown(), 5) or
|
||||
expr = "0 * 0" and res = Ints::mul(0, 0) or
|
||||
expr = "5 * 7" and res = Ints::mul(5, 7) or
|
||||
expr = "0 * INT_MAX" and res = Ints::mul(0, Ints::maxValue()) or
|
||||
expr = "2 * INT_MAX" and res = Ints::mul(2, Ints::maxValue()) or
|
||||
expr = "-1 * -INT_MAX" and res = Ints::mul(-1, Ints::minValue()) or
|
||||
expr = "INT_MAX * INT_MAX" and res = Ints::mul(Ints::maxValue(), Ints::maxValue()) or
|
||||
expr = "0 * unknown" and res = Ints::mul(0, Ints::unknown()) or
|
||||
expr = "35 / 7" and res = Ints::div(35, 7) or
|
||||
expr = "35 / 8" and res = Ints::div(35, 8) or
|
||||
expr = "35 / -7" and res = Ints::div(35, -7) or
|
||||
expr = "35 / -8" and res = Ints::div(35, -8) or
|
||||
expr = "-35 / 7" and res = Ints::div(-35, 7) or
|
||||
expr = "-35 / 8" and res = Ints::div(-35, 8) or
|
||||
expr = "-35 / -7" and res = Ints::div(-35, -7) or
|
||||
expr = "-35 / -8" and res = Ints::div(-35, -8) or
|
||||
expr = "0 / -INT_MAX" and res = Ints::div(0, Ints::minValue()) or
|
||||
expr = "INT_MAX / 0" and res = Ints::div(Ints::maxValue(), 0) or
|
||||
expr = "0 / unknown" and res = Ints::div(0, Ints::unknown()) or
|
||||
expr = "unknown / 3" and res = Ints::div(Ints::unknown(), 3) or
|
||||
expr = "unknown / unknown" and res = Ints::div(Ints::unknown(), Ints::unknown())
|
||||
select expr, resultString(res)
|
||||
import cpp
|
||||
import semmle.code.cpp.ssa.internal.IntegerConstant as Ints
|
||||
|
||||
bindingset[n]
|
||||
string resultString(int n) {
|
||||
if Ints::hasValue(n) then
|
||||
result = n.toString()
|
||||
else
|
||||
result = "unknown"
|
||||
}
|
||||
|
||||
from string expr, int res
|
||||
where
|
||||
expr = "0 + 0" and res = Ints::add(0, 0) or
|
||||
expr = "0 + INT_MAX" and res = Ints::add(0, Ints::maxValue()) or
|
||||
expr = "0 + -INT_MAX" and res = Ints::add(0, Ints::minValue()) or
|
||||
expr = "1 + INT_MAX" and res = Ints::add(1, Ints::maxValue()) or
|
||||
expr = "1 + -INT_MAX" and res = Ints::add(1, Ints::minValue()) or
|
||||
expr = "unknown + unknown" and res = Ints::add(Ints::unknown(), Ints::unknown()) or
|
||||
expr = "5 + unknown" and res = Ints::add(5, Ints::unknown()) or
|
||||
expr = "unknown + 5" and res = Ints::add(Ints::unknown(), 5) or
|
||||
expr = "0 - INT_MAX" and res = Ints::sub(0, Ints::maxValue()) or
|
||||
expr = "0 - -INT_MAX" and res = Ints::sub(0, Ints::minValue()) or
|
||||
expr = "-1 - INT_MAX" and res = Ints::sub(-1, Ints::maxValue()) or
|
||||
expr = "-1 - -INT_MAX" and res = Ints::sub(-1, Ints::minValue()) or
|
||||
expr = "unknown - unknown" and res = Ints::sub(Ints::unknown(), Ints::unknown()) or
|
||||
expr = "5 - unknown" and res = Ints::sub(5, Ints::unknown()) or
|
||||
expr = "unknown - 5" and res = Ints::sub(Ints::unknown(), 5) or
|
||||
expr = "0 * 0" and res = Ints::mul(0, 0) or
|
||||
expr = "5 * 7" and res = Ints::mul(5, 7) or
|
||||
expr = "0 * INT_MAX" and res = Ints::mul(0, Ints::maxValue()) or
|
||||
expr = "2 * INT_MAX" and res = Ints::mul(2, Ints::maxValue()) or
|
||||
expr = "-1 * -INT_MAX" and res = Ints::mul(-1, Ints::minValue()) or
|
||||
expr = "INT_MAX * INT_MAX" and res = Ints::mul(Ints::maxValue(), Ints::maxValue()) or
|
||||
expr = "0 * unknown" and res = Ints::mul(0, Ints::unknown()) or
|
||||
expr = "35 / 7" and res = Ints::div(35, 7) or
|
||||
expr = "35 / 8" and res = Ints::div(35, 8) or
|
||||
expr = "35 / -7" and res = Ints::div(35, -7) or
|
||||
expr = "35 / -8" and res = Ints::div(35, -8) or
|
||||
expr = "-35 / 7" and res = Ints::div(-35, 7) or
|
||||
expr = "-35 / 8" and res = Ints::div(-35, 8) or
|
||||
expr = "-35 / -7" and res = Ints::div(-35, -7) or
|
||||
expr = "-35 / -8" and res = Ints::div(-35, -8) or
|
||||
expr = "0 / -INT_MAX" and res = Ints::div(0, Ints::minValue()) or
|
||||
expr = "INT_MAX / 0" and res = Ints::div(Ints::maxValue(), 0) or
|
||||
expr = "0 / unknown" and res = Ints::div(0, Ints::unknown()) or
|
||||
expr = "unknown / 3" and res = Ints::div(Ints::unknown(), 3) or
|
||||
expr = "unknown / unknown" and res = Ints::div(Ints::unknown(), Ints::unknown())
|
||||
select expr, resultString(res)
|
||||
|
||||
@@ -1,22 +1,22 @@
|
||||
import default
|
||||
import semmle.code.cpp.ssa.internal.ssa.AliasAnalysis
|
||||
import semmle.code.cpp.ir.IR
|
||||
|
||||
predicate shouldEscape(IRAutomaticUserVariable var) {
|
||||
exists(string name |
|
||||
name = var.getVariable().getName() and
|
||||
name.matches("no_%") and
|
||||
not name.matches("no_ssa_%")
|
||||
)
|
||||
}
|
||||
|
||||
from IRAutomaticUserVariable var
|
||||
where
|
||||
exists(FunctionIR funcIR |
|
||||
funcIR = var.getFunctionIR() and
|
||||
(
|
||||
(shouldEscape(var) and variableAddressEscapes(var)) or
|
||||
(not shouldEscape(var) and not variableAddressEscapes(var))
|
||||
)
|
||||
)
|
||||
select var
|
||||
import default
|
||||
import semmle.code.cpp.ssa.internal.ssa.AliasAnalysis
|
||||
import semmle.code.cpp.ir.IR
|
||||
|
||||
predicate shouldEscape(IRAutomaticUserVariable var) {
|
||||
exists(string name |
|
||||
name = var.getVariable().getName() and
|
||||
name.matches("no_%") and
|
||||
not name.matches("no_ssa_%")
|
||||
)
|
||||
}
|
||||
|
||||
from IRAutomaticUserVariable var
|
||||
where
|
||||
exists(FunctionIR funcIR |
|
||||
funcIR = var.getFunctionIR() and
|
||||
(
|
||||
(shouldEscape(var) and variableAddressEscapes(var)) or
|
||||
(not shouldEscape(var) and not variableAddressEscapes(var))
|
||||
)
|
||||
)
|
||||
select var
|
||||
|
||||
@@ -1,11 +1,11 @@
|
||||
import default
|
||||
import semmle.code.cpp.ssa.internal.ssa.AliasAnalysis
|
||||
import semmle.code.cpp.ir.IR
|
||||
|
||||
from Instruction instr, string pointsTo
|
||||
where
|
||||
exists(IRVariable var, int bitOffset |
|
||||
resultPointsTo(instr, var, bitOffset) and
|
||||
pointsTo = var.toString() + getBitOffsetString(bitOffset)
|
||||
)
|
||||
select instr.getLocation().toString(), instr.getOperationString(), pointsTo
|
||||
import default
|
||||
import semmle.code.cpp.ssa.internal.ssa.AliasAnalysis
|
||||
import semmle.code.cpp.ir.IR
|
||||
|
||||
from Instruction instr, string pointsTo
|
||||
where
|
||||
exists(IRVariable var, int bitOffset |
|
||||
resultPointsTo(instr, var, bitOffset) and
|
||||
pointsTo = var.toString() + getBitOffsetString(bitOffset)
|
||||
)
|
||||
select instr.getLocation().toString(), instr.getOperationString(), pointsTo
|
||||
|
||||
@@ -1,21 +1,21 @@
|
||||
import default
|
||||
import semmle.code.cpp.ssa.internal.aliased_ssa.AliasAnalysis
|
||||
import semmle.code.cpp.ssa.SSAIR
|
||||
|
||||
predicate shouldEscape(IRAutomaticUserVariable var) {
|
||||
exists(string name |
|
||||
name = var.getVariable().getName() and
|
||||
name.matches("no_%")
|
||||
)
|
||||
}
|
||||
|
||||
from IRAutomaticUserVariable var
|
||||
where
|
||||
exists(FunctionIR funcIR |
|
||||
funcIR = var.getFunctionIR() and
|
||||
(
|
||||
(shouldEscape(var) and variableAddressEscapes(var)) or
|
||||
(not shouldEscape(var) and not variableAddressEscapes(var))
|
||||
)
|
||||
)
|
||||
select var
|
||||
import default
|
||||
import semmle.code.cpp.ssa.internal.aliased_ssa.AliasAnalysis
|
||||
import semmle.code.cpp.ssa.SSAIR
|
||||
|
||||
predicate shouldEscape(IRAutomaticUserVariable var) {
|
||||
exists(string name |
|
||||
name = var.getVariable().getName() and
|
||||
name.matches("no_%")
|
||||
)
|
||||
}
|
||||
|
||||
from IRAutomaticUserVariable var
|
||||
where
|
||||
exists(FunctionIR funcIR |
|
||||
funcIR = var.getFunctionIR() and
|
||||
(
|
||||
(shouldEscape(var) and variableAddressEscapes(var)) or
|
||||
(not shouldEscape(var) and not variableAddressEscapes(var))
|
||||
)
|
||||
)
|
||||
select var
|
||||
|
||||
@@ -1,89 +1,89 @@
|
||||
import default
|
||||
|
||||
query predicate newExprs(NewExpr expr, string type, string sig, int size, int alignment, string form) {
|
||||
exists(Function allocator, Type allocatedType |
|
||||
expr.getAllocator() = allocator and
|
||||
sig = allocator.getFullSignature() and
|
||||
allocatedType = expr.getAllocatedType() and
|
||||
type = allocatedType.toString() and
|
||||
size = allocatedType.getSize() and
|
||||
alignment = allocatedType.getAlignment() and
|
||||
if expr.hasAlignedAllocation() then form = "aligned" else form = ""
|
||||
)
|
||||
}
|
||||
|
||||
query predicate newArrayExprs(NewArrayExpr expr, string type, string sig, int size, int alignment, string form) {
|
||||
exists(Function allocator, Type elementType |
|
||||
expr.getAllocator() = allocator and
|
||||
sig = allocator.getFullSignature() and
|
||||
elementType = expr.getAllocatedElementType() and
|
||||
type = elementType.toString() and
|
||||
size = elementType.getSize() and
|
||||
alignment = elementType.getAlignment() and
|
||||
if expr.hasAlignedAllocation() then form = "aligned" else form = ""
|
||||
)
|
||||
}
|
||||
|
||||
query predicate newExprDeallocators(NewExpr expr, string type, string sig, int size, int alignment, string form) {
|
||||
exists(Function deallocator, Type allocatedType |
|
||||
expr.getDeallocator() = deallocator and
|
||||
sig = deallocator.getFullSignature() and
|
||||
allocatedType = expr.getAllocatedType() and
|
||||
type = allocatedType.toString() and
|
||||
size = allocatedType.getSize() and
|
||||
alignment = allocatedType.getAlignment() and
|
||||
exists(string sized, string aligned |
|
||||
(if expr.hasAlignedDeallocation() then aligned = "aligned" else aligned = "") and
|
||||
(if expr.hasSizedDeallocation() then sized = "sized" else sized = "") and
|
||||
form = sized + " " + aligned
|
||||
)
|
||||
)
|
||||
}
|
||||
|
||||
query predicate newArrayExprDeallocators(NewArrayExpr expr, string type, string sig, int size, int alignment, string form) {
|
||||
exists(Function deallocator, Type elementType |
|
||||
expr.getDeallocator() = deallocator and
|
||||
sig = deallocator.getFullSignature() and
|
||||
elementType = expr.getAllocatedElementType() and
|
||||
type = elementType.toString() and
|
||||
size = elementType.getSize() and
|
||||
alignment = elementType.getAlignment() and
|
||||
exists(string sized, string aligned |
|
||||
(if expr.hasAlignedDeallocation() then aligned = "aligned" else aligned = "") and
|
||||
(if expr.hasSizedDeallocation() then sized = "sized" else sized = "") and
|
||||
form = sized + " " + aligned
|
||||
)
|
||||
)
|
||||
}
|
||||
|
||||
query predicate deleteExprs(DeleteExpr expr, string type, string sig, int size, int alignment, string form) {
|
||||
exists(Function deallocator, Type deletedType |
|
||||
expr.getDeallocator() = deallocator and
|
||||
sig = deallocator.getFullSignature() and
|
||||
deletedType = expr.getDeletedObjectType() and
|
||||
type = deletedType.toString() and
|
||||
size = deletedType.getSize() and
|
||||
alignment = deletedType.getAlignment() and
|
||||
exists(string sized, string aligned |
|
||||
(if expr.hasAlignedDeallocation() then aligned = "aligned" else aligned = "") and
|
||||
(if expr.hasSizedDeallocation() then sized = "sized" else sized = "") and
|
||||
form = sized + " " + aligned
|
||||
)
|
||||
)
|
||||
}
|
||||
|
||||
query predicate deleteArrayExprs(DeleteArrayExpr expr, string type, string sig, int size, int alignment, string form) {
|
||||
exists(Function deallocator, Type elementType |
|
||||
expr.getDeallocator() = deallocator and
|
||||
sig = deallocator.getFullSignature() and
|
||||
elementType = expr.getDeletedElementType() and
|
||||
type = elementType.toString() and
|
||||
size = elementType.getSize() and
|
||||
alignment = elementType.getAlignment() and
|
||||
exists(string sized, string aligned |
|
||||
(if expr.hasAlignedDeallocation() then aligned = "aligned" else aligned = "") and
|
||||
(if expr.hasSizedDeallocation() then sized = "sized" else sized = "") and
|
||||
form = sized + " " + aligned
|
||||
)
|
||||
)
|
||||
}
|
||||
import default
|
||||
|
||||
query predicate newExprs(NewExpr expr, string type, string sig, int size, int alignment, string form) {
|
||||
exists(Function allocator, Type allocatedType |
|
||||
expr.getAllocator() = allocator and
|
||||
sig = allocator.getFullSignature() and
|
||||
allocatedType = expr.getAllocatedType() and
|
||||
type = allocatedType.toString() and
|
||||
size = allocatedType.getSize() and
|
||||
alignment = allocatedType.getAlignment() and
|
||||
if expr.hasAlignedAllocation() then form = "aligned" else form = ""
|
||||
)
|
||||
}
|
||||
|
||||
query predicate newArrayExprs(NewArrayExpr expr, string type, string sig, int size, int alignment, string form) {
|
||||
exists(Function allocator, Type elementType |
|
||||
expr.getAllocator() = allocator and
|
||||
sig = allocator.getFullSignature() and
|
||||
elementType = expr.getAllocatedElementType() and
|
||||
type = elementType.toString() and
|
||||
size = elementType.getSize() and
|
||||
alignment = elementType.getAlignment() and
|
||||
if expr.hasAlignedAllocation() then form = "aligned" else form = ""
|
||||
)
|
||||
}
|
||||
|
||||
query predicate newExprDeallocators(NewExpr expr, string type, string sig, int size, int alignment, string form) {
|
||||
exists(Function deallocator, Type allocatedType |
|
||||
expr.getDeallocator() = deallocator and
|
||||
sig = deallocator.getFullSignature() and
|
||||
allocatedType = expr.getAllocatedType() and
|
||||
type = allocatedType.toString() and
|
||||
size = allocatedType.getSize() and
|
||||
alignment = allocatedType.getAlignment() and
|
||||
exists(string sized, string aligned |
|
||||
(if expr.hasAlignedDeallocation() then aligned = "aligned" else aligned = "") and
|
||||
(if expr.hasSizedDeallocation() then sized = "sized" else sized = "") and
|
||||
form = sized + " " + aligned
|
||||
)
|
||||
)
|
||||
}
|
||||
|
||||
query predicate newArrayExprDeallocators(NewArrayExpr expr, string type, string sig, int size, int alignment, string form) {
|
||||
exists(Function deallocator, Type elementType |
|
||||
expr.getDeallocator() = deallocator and
|
||||
sig = deallocator.getFullSignature() and
|
||||
elementType = expr.getAllocatedElementType() and
|
||||
type = elementType.toString() and
|
||||
size = elementType.getSize() and
|
||||
alignment = elementType.getAlignment() and
|
||||
exists(string sized, string aligned |
|
||||
(if expr.hasAlignedDeallocation() then aligned = "aligned" else aligned = "") and
|
||||
(if expr.hasSizedDeallocation() then sized = "sized" else sized = "") and
|
||||
form = sized + " " + aligned
|
||||
)
|
||||
)
|
||||
}
|
||||
|
||||
query predicate deleteExprs(DeleteExpr expr, string type, string sig, int size, int alignment, string form) {
|
||||
exists(Function deallocator, Type deletedType |
|
||||
expr.getDeallocator() = deallocator and
|
||||
sig = deallocator.getFullSignature() and
|
||||
deletedType = expr.getDeletedObjectType() and
|
||||
type = deletedType.toString() and
|
||||
size = deletedType.getSize() and
|
||||
alignment = deletedType.getAlignment() and
|
||||
exists(string sized, string aligned |
|
||||
(if expr.hasAlignedDeallocation() then aligned = "aligned" else aligned = "") and
|
||||
(if expr.hasSizedDeallocation() then sized = "sized" else sized = "") and
|
||||
form = sized + " " + aligned
|
||||
)
|
||||
)
|
||||
}
|
||||
|
||||
query predicate deleteArrayExprs(DeleteArrayExpr expr, string type, string sig, int size, int alignment, string form) {
|
||||
exists(Function deallocator, Type elementType |
|
||||
expr.getDeallocator() = deallocator and
|
||||
sig = deallocator.getFullSignature() and
|
||||
elementType = expr.getDeletedElementType() and
|
||||
type = elementType.toString() and
|
||||
size = elementType.getSize() and
|
||||
alignment = elementType.getAlignment() and
|
||||
exists(string sized, string aligned |
|
||||
(if expr.hasAlignedDeallocation() then aligned = "aligned" else aligned = "") and
|
||||
(if expr.hasSizedDeallocation() then sized = "sized" else sized = "") and
|
||||
form = sized + " " + aligned
|
||||
)
|
||||
)
|
||||
}
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
import cpp
|
||||
import semmle.code.cpp.controlflow.Guards
|
||||
|
||||
from GuardCondition guard
|
||||
import cpp
|
||||
import semmle.code.cpp.controlflow.Guards
|
||||
|
||||
from GuardCondition guard
|
||||
select guard
|
||||
@@ -1,15 +1,15 @@
|
||||
import default
|
||||
|
||||
string getValueCategoryString(Expr expr) {
|
||||
if expr.isLValueCategory() then
|
||||
result = "lval"
|
||||
else if expr.isXValueCategory() then
|
||||
result = "xval"
|
||||
else if expr.hasLValueToRValueConversion() then
|
||||
result = "prval(load)"
|
||||
else
|
||||
result = "prval"
|
||||
}
|
||||
|
||||
from Cast cast
|
||||
select cast, cast.getSemanticConversionString(), getValueCategoryString(cast), cast.getType().toString(), cast.getExpr().getType().toString()
|
||||
import default
|
||||
|
||||
string getValueCategoryString(Expr expr) {
|
||||
if expr.isLValueCategory() then
|
||||
result = "lval"
|
||||
else if expr.isXValueCategory() then
|
||||
result = "xval"
|
||||
else if expr.hasLValueToRValueConversion() then
|
||||
result = "prval(load)"
|
||||
else
|
||||
result = "prval"
|
||||
}
|
||||
|
||||
from Cast cast
|
||||
select cast, cast.getSemanticConversionString(), getValueCategoryString(cast), cast.getType().toString(), cast.getExpr().getType().toString()
|
||||
|
||||
@@ -1 +1 @@
|
||||
semmle/code/cpp/ASTSanity.ql
|
||||
semmle/code/cpp/ASTSanity.ql
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
import cpp
|
||||
|
||||
from Expr e, Variable v
|
||||
where varbind(unresolveElement(e), unresolveElement(v))
|
||||
select e, v
|
||||
import cpp
|
||||
|
||||
from Expr e, Variable v
|
||||
where varbind(unresolveElement(e), unresolveElement(v))
|
||||
select e, v
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
/**
|
||||
* @name InitializerAccesses
|
||||
*/
|
||||
import cpp
|
||||
import cpp
|
||||
|
||||
from Initializer i, VariableAccess va
|
||||
where i.getExpr().getAChild*() = va
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
import cpp
|
||||
|
||||
//this query should find the baseType of CC* to be CC, not C.
|
||||
from DerivedType t, Type baseType
|
||||
where t.getBaseType() = baseType
|
||||
select t, baseType
|
||||
import cpp
|
||||
|
||||
//this query should find the baseType of CC* to be CC, not C.
|
||||
from DerivedType t, Type baseType
|
||||
where t.getBaseType() = baseType
|
||||
select t, baseType
|
||||
|
||||
@@ -1,26 +1,26 @@
|
||||
import cpp
|
||||
|
||||
from ComparisonOperation co, string s
|
||||
where
|
||||
(
|
||||
co instanceof EqualityOperation and s = "EqualityOperation"
|
||||
) or (
|
||||
co instanceof EQExpr and s = "EQExpr"
|
||||
) or (
|
||||
co instanceof NEExpr and s = "NEExpr"
|
||||
) or (
|
||||
co instanceof RelationalOperation and s = "RelationalOperation"
|
||||
) or (
|
||||
s = "getGreaterOperand() = " + co.(RelationalOperation).getGreaterOperand().toString()
|
||||
) or (
|
||||
s = "getLesserOperand() = " + co.(RelationalOperation).getLesserOperand().toString()
|
||||
) or (
|
||||
co instanceof GTExpr and s = "GTExpr"
|
||||
) or (
|
||||
co instanceof LTExpr and s = "LTExpr"
|
||||
) or (
|
||||
co instanceof GEExpr and s = "GEExpr"
|
||||
) or (
|
||||
co instanceof LEExpr and s = "LEExpr"
|
||||
)
|
||||
select co, s
|
||||
import cpp
|
||||
|
||||
from ComparisonOperation co, string s
|
||||
where
|
||||
(
|
||||
co instanceof EqualityOperation and s = "EqualityOperation"
|
||||
) or (
|
||||
co instanceof EQExpr and s = "EQExpr"
|
||||
) or (
|
||||
co instanceof NEExpr and s = "NEExpr"
|
||||
) or (
|
||||
co instanceof RelationalOperation and s = "RelationalOperation"
|
||||
) or (
|
||||
s = "getGreaterOperand() = " + co.(RelationalOperation).getGreaterOperand().toString()
|
||||
) or (
|
||||
s = "getLesserOperand() = " + co.(RelationalOperation).getLesserOperand().toString()
|
||||
) or (
|
||||
co instanceof GTExpr and s = "GTExpr"
|
||||
) or (
|
||||
co instanceof LTExpr and s = "LTExpr"
|
||||
) or (
|
||||
co instanceof GEExpr and s = "GEExpr"
|
||||
) or (
|
||||
co instanceof LEExpr and s = "LEExpr"
|
||||
)
|
||||
select co, s
|
||||
|
||||
@@ -1,37 +1,37 @@
|
||||
import cpp
|
||||
|
||||
predicate describe(UnaryOperation uo, string s)
|
||||
{
|
||||
(
|
||||
uo instanceof UnaryArithmeticOperation and s = "UnaryArithmeticOperation"
|
||||
) or (
|
||||
uo instanceof UnaryMinusExpr and s = "UnaryMinusExpr"
|
||||
) or (
|
||||
uo instanceof UnaryPlusExpr and s = "UnaryPlusExpr"
|
||||
) or (
|
||||
uo instanceof ConjugationExpr and s = "ConjugationExpr"
|
||||
) or (
|
||||
uo instanceof CrementOperation and s = "CrementOperation"
|
||||
) or (
|
||||
uo instanceof IncrementOperation and s = "IncrementOperation"
|
||||
) or (
|
||||
uo instanceof DecrementOperation and s = "DecrementOperation"
|
||||
) or (
|
||||
uo instanceof PrefixCrementOperation and s = "PrefixCrementOperation"
|
||||
) or (
|
||||
uo instanceof PostfixCrementOperation and s = "PostfixCrementOperation"
|
||||
) or (
|
||||
uo instanceof AddressOfExpr and s = "AddressOfExpr"
|
||||
) or (
|
||||
s = "getAddressable() = " + uo.(AddressOfExpr).getAddressable().toString()
|
||||
) or (
|
||||
uo instanceof PointerDereferenceExpr and s = "PointerDereferenceExpr"
|
||||
) or (
|
||||
uo instanceof UnaryLogicalOperation and s = "UnaryLogicalOperation"
|
||||
) or (
|
||||
uo instanceof NotExpr and s = "NotExpr"
|
||||
)
|
||||
}
|
||||
|
||||
from UnaryOperation uo
|
||||
select uo, uo.getOperator(), concat(string s | describe(uo, s) | s, ", ")
|
||||
import cpp
|
||||
|
||||
predicate describe(UnaryOperation uo, string s)
|
||||
{
|
||||
(
|
||||
uo instanceof UnaryArithmeticOperation and s = "UnaryArithmeticOperation"
|
||||
) or (
|
||||
uo instanceof UnaryMinusExpr and s = "UnaryMinusExpr"
|
||||
) or (
|
||||
uo instanceof UnaryPlusExpr and s = "UnaryPlusExpr"
|
||||
) or (
|
||||
uo instanceof ConjugationExpr and s = "ConjugationExpr"
|
||||
) or (
|
||||
uo instanceof CrementOperation and s = "CrementOperation"
|
||||
) or (
|
||||
uo instanceof IncrementOperation and s = "IncrementOperation"
|
||||
) or (
|
||||
uo instanceof DecrementOperation and s = "DecrementOperation"
|
||||
) or (
|
||||
uo instanceof PrefixCrementOperation and s = "PrefixCrementOperation"
|
||||
) or (
|
||||
uo instanceof PostfixCrementOperation and s = "PostfixCrementOperation"
|
||||
) or (
|
||||
uo instanceof AddressOfExpr and s = "AddressOfExpr"
|
||||
) or (
|
||||
s = "getAddressable() = " + uo.(AddressOfExpr).getAddressable().toString()
|
||||
) or (
|
||||
uo instanceof PointerDereferenceExpr and s = "PointerDereferenceExpr"
|
||||
) or (
|
||||
uo instanceof UnaryLogicalOperation and s = "UnaryLogicalOperation"
|
||||
) or (
|
||||
uo instanceof NotExpr and s = "NotExpr"
|
||||
)
|
||||
}
|
||||
|
||||
from UnaryOperation uo
|
||||
select uo, uo.getOperator(), concat(string s | describe(uo, s) | s, ", ")
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
import cpp
|
||||
|
||||
from Expr e
|
||||
where e.isUnevaluated()
|
||||
select e
|
||||
import cpp
|
||||
|
||||
from Expr e
|
||||
where e.isUnevaluated()
|
||||
select e
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
import cpp
|
||||
|
||||
from Expr e
|
||||
where e.hasLValueToRValueConversion()
|
||||
select e
|
||||
import cpp
|
||||
|
||||
from Expr e
|
||||
where e.hasLValueToRValueConversion()
|
||||
select e
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
import cpp
|
||||
|
||||
from Expr e, string valcat
|
||||
where
|
||||
e.isLValueCategory() and valcat = "lvalue" or
|
||||
e.isXValueCategory() and valcat = "xvalue"
|
||||
select e, e.getType().toString(), valcat
|
||||
import cpp
|
||||
|
||||
from Expr e, string valcat
|
||||
where
|
||||
e.isLValueCategory() and valcat = "lvalue" or
|
||||
e.isXValueCategory() and valcat = "xvalue"
|
||||
select e, e.getType().toString(), valcat
|
||||
|
||||
@@ -1,11 +1,11 @@
|
||||
/**
|
||||
* @name EnumConst
|
||||
* @kind table
|
||||
*/
|
||||
import cpp
|
||||
|
||||
from Enum e, Declaration c, string reason
|
||||
where (c.(EnumConstant).getDeclaringEnum() = e and reason = "getDeclaringEnum()") or
|
||||
(c.(EnumConstant).getType() = e and reason = "getType()") or
|
||||
(c.(Field).getDeclaringType() = e and reason = "getDeclaringType()")
|
||||
select e, c, reason
|
||||
/**
|
||||
* @name EnumConst
|
||||
* @kind table
|
||||
*/
|
||||
import cpp
|
||||
|
||||
from Enum e, Declaration c, string reason
|
||||
where (c.(EnumConstant).getDeclaringEnum() = e and reason = "getDeclaringEnum()") or
|
||||
(c.(EnumConstant).getType() = e and reason = "getType()") or
|
||||
(c.(Field).getDeclaringType() = e and reason = "getDeclaringType()")
|
||||
select e, c, reason
|
||||
|
||||
@@ -1,40 +1,40 @@
|
||||
/**
|
||||
* @name Fields
|
||||
* @kind table
|
||||
*/
|
||||
import cpp
|
||||
|
||||
predicate nameCheck(Declaration d) {
|
||||
count(d.toString()) = 1 and
|
||||
count(string s | d.hasName(s)) = 1 and
|
||||
d.hasName(d.toString())
|
||||
}
|
||||
|
||||
string accessType(Field f) {
|
||||
(f.isPublic() and result = "public") or
|
||||
(f.isProtected() and result = "protected") or
|
||||
(f.isPrivate() and result = "private")
|
||||
}
|
||||
|
||||
string fieldType(Field f) {
|
||||
result = f.getType().getAQlClass() and
|
||||
(
|
||||
result.matches("%Type") or
|
||||
result = "Enum"
|
||||
)
|
||||
}
|
||||
|
||||
string pointedType(Field f) {
|
||||
if f.getType() instanceof PointerType then (
|
||||
result = f.getType().(PointerType).getBaseType().toString()
|
||||
) else (
|
||||
result = ""
|
||||
)
|
||||
}
|
||||
|
||||
from Class c, Field f
|
||||
where f.getDeclaringType() = c and
|
||||
c.getAField() = f and
|
||||
nameCheck(c) and
|
||||
nameCheck(f)
|
||||
select c, f, accessType(f), fieldType(f), pointedType(f)
|
||||
/**
|
||||
* @name Fields
|
||||
* @kind table
|
||||
*/
|
||||
import cpp
|
||||
|
||||
predicate nameCheck(Declaration d) {
|
||||
count(d.toString()) = 1 and
|
||||
count(string s | d.hasName(s)) = 1 and
|
||||
d.hasName(d.toString())
|
||||
}
|
||||
|
||||
string accessType(Field f) {
|
||||
(f.isPublic() and result = "public") or
|
||||
(f.isProtected() and result = "protected") or
|
||||
(f.isPrivate() and result = "private")
|
||||
}
|
||||
|
||||
string fieldType(Field f) {
|
||||
result = f.getType().getAQlClass() and
|
||||
(
|
||||
result.matches("%Type") or
|
||||
result = "Enum"
|
||||
)
|
||||
}
|
||||
|
||||
string pointedType(Field f) {
|
||||
if f.getType() instanceof PointerType then (
|
||||
result = f.getType().(PointerType).getBaseType().toString()
|
||||
) else (
|
||||
result = ""
|
||||
)
|
||||
}
|
||||
|
||||
from Class c, Field f
|
||||
where f.getDeclaringType() = c and
|
||||
c.getAField() = f and
|
||||
nameCheck(c) and
|
||||
nameCheck(f)
|
||||
select c, f, accessType(f), fieldType(f), pointedType(f)
|
||||
|
||||
@@ -1,30 +1,30 @@
|
||||
import default
|
||||
import semmle.code.cpp.ssa.SSAIR
|
||||
import semmle.code.cpp.ssa.internal.IntegerConstant
|
||||
|
||||
language[monotonicAggregates]
|
||||
IntValue getConstantValue(Instruction instr) {
|
||||
result = instr.(IntegerConstantInstruction).getValue().toInt() or
|
||||
exists(BinaryInstruction binInstr, IntValue left, IntValue right |
|
||||
binInstr = instr and
|
||||
left = getConstantValue(binInstr.getLeftOperand()) and
|
||||
right = getConstantValue(binInstr.getRightOperand()) and
|
||||
(
|
||||
binInstr instanceof AddInstruction and result = add(left, right) or
|
||||
binInstr instanceof SubInstruction and result = sub(left, right) or
|
||||
binInstr instanceof MulInstruction and result = mul(left, right) or
|
||||
binInstr instanceof DivInstruction and result = div(left, right)
|
||||
)
|
||||
) or
|
||||
result = getConstantValue(instr.(CopyInstruction).getSourceValue()) or
|
||||
exists(PhiInstruction phi |
|
||||
phi = instr and
|
||||
result = max(Instruction operand | operand = phi.getAnOperand() | getConstantValue(operand)) and
|
||||
result = min(Instruction operand | operand = phi.getAnOperand() | getConstantValue(operand))
|
||||
)
|
||||
}
|
||||
|
||||
from FunctionIR funcIR, int value
|
||||
where
|
||||
value = getValue(getConstantValue(funcIR.getReturnInstruction().(ReturnValueInstruction).getReturnValue()))
|
||||
select funcIR, value
|
||||
import default
|
||||
import semmle.code.cpp.ssa.SSAIR
|
||||
import semmle.code.cpp.ssa.internal.IntegerConstant
|
||||
|
||||
language[monotonicAggregates]
|
||||
IntValue getConstantValue(Instruction instr) {
|
||||
result = instr.(IntegerConstantInstruction).getValue().toInt() or
|
||||
exists(BinaryInstruction binInstr, IntValue left, IntValue right |
|
||||
binInstr = instr and
|
||||
left = getConstantValue(binInstr.getLeftOperand()) and
|
||||
right = getConstantValue(binInstr.getRightOperand()) and
|
||||
(
|
||||
binInstr instanceof AddInstruction and result = add(left, right) or
|
||||
binInstr instanceof SubInstruction and result = sub(left, right) or
|
||||
binInstr instanceof MulInstruction and result = mul(left, right) or
|
||||
binInstr instanceof DivInstruction and result = div(left, right)
|
||||
)
|
||||
) or
|
||||
result = getConstantValue(instr.(CopyInstruction).getSourceValue()) or
|
||||
exists(PhiInstruction phi |
|
||||
phi = instr and
|
||||
result = max(Instruction operand | operand = phi.getAnOperand() | getConstantValue(operand)) and
|
||||
result = min(Instruction operand | operand = phi.getAnOperand() | getConstantValue(operand))
|
||||
)
|
||||
}
|
||||
|
||||
from FunctionIR funcIR, int value
|
||||
where
|
||||
value = getValue(getConstantValue(funcIR.getReturnInstruction().(ReturnValueInstruction).getReturnValue()))
|
||||
select funcIR, value
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
import default
|
||||
import semmle.code.cpp.ssa.SSAIR
|
||||
|
||||
from FunctionIR funcIR
|
||||
select funcIR.toString(), count(funcIR.getABlock())
|
||||
import default
|
||||
import semmle.code.cpp.ssa.SSAIR
|
||||
|
||||
from FunctionIR funcIR
|
||||
select funcIR.toString(), count(funcIR.getABlock())
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
import cpp
|
||||
|
||||
from ArrayType a, ArrayAggregateLiteral al, int i
|
||||
where a = al.getType()
|
||||
select al, a, i, al.getElementExpr(i)
|
||||
import cpp
|
||||
|
||||
from ArrayType a, ArrayAggregateLiteral al, int i
|
||||
where a = al.getType()
|
||||
select al, a, i, al.getElementExpr(i)
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
import cpp
|
||||
|
||||
from ArrayType a, ArrayAggregateLiteral al, int i
|
||||
where a = al.getType()
|
||||
and al.isValueInitialized(i)
|
||||
select al, a, i
|
||||
import cpp
|
||||
|
||||
from ArrayType a, ArrayAggregateLiteral al, int i
|
||||
where a = al.getType()
|
||||
and al.isValueInitialized(i)
|
||||
select al, a, i
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
import cpp
|
||||
|
||||
from Class c, ClassAggregateLiteral al, Field f
|
||||
where c = al.getType()
|
||||
and f = c.getAField()
|
||||
select al, c, f, al.getFieldExpr(f)
|
||||
import cpp
|
||||
|
||||
from Class c, ClassAggregateLiteral al, Field f
|
||||
where c = al.getType()
|
||||
and f = c.getAField()
|
||||
select al, c, f, al.getFieldExpr(f)
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
import cpp
|
||||
|
||||
from Class c, ClassAggregateLiteral al, Field f
|
||||
where c = al.getType()
|
||||
and al.isValueInitialized(f)
|
||||
select al, c, f
|
||||
import cpp
|
||||
|
||||
from Class c, ClassAggregateLiteral al, Field f
|
||||
where c = al.getType()
|
||||
and al.isValueInitialized(f)
|
||||
select al, c, f
|
||||
|
||||
@@ -2,13 +2,13 @@
|
||||
* @name Parameters3
|
||||
* @kind table
|
||||
*/
|
||||
import cpp
|
||||
|
||||
from Function f, int i, Parameter p, string pname, boolean named
|
||||
import cpp
|
||||
|
||||
from Function f, int i, Parameter p, string pname, boolean named
|
||||
where f.hasName("Dispatch")
|
||||
and f.getParameter(i) = p
|
||||
and p.getName() = pname
|
||||
and (
|
||||
p.isNamed() and named = true
|
||||
or not p.isNamed() and named = false)
|
||||
or not p.isNamed() and named = false)
|
||||
select f, i, pname, named
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
import cpp
|
||||
|
||||
from BreakStmt b, Stmt s
|
||||
where b.getBreakable() = s
|
||||
select b, s
|
||||
import cpp
|
||||
|
||||
from BreakStmt b, Stmt s
|
||||
where b.getBreakable() = s
|
||||
select b, s
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
import cpp
|
||||
|
||||
from Variable v
|
||||
select v
|
||||
import cpp
|
||||
|
||||
from Variable v
|
||||
select v
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
import cpp
|
||||
|
||||
from Variable v, Class t
|
||||
where t = v.getType().(PointerType).getBaseType()
|
||||
select v, t, count(t.getAMember())
|
||||
import cpp
|
||||
|
||||
from Variable v, Class t
|
||||
where t = v.getType().(PointerType).getBaseType()
|
||||
select v, t, count(t.getAMember())
|
||||
|
||||
@@ -1,29 +1,29 @@
|
||||
import cpp
|
||||
|
||||
class MutexTypeForTest extends MutexType {
|
||||
MutexTypeForTest() {
|
||||
this.(Class).getName() = "Mutex7"
|
||||
}
|
||||
|
||||
override predicate mustlockAccess(FunctionCall fc, Expr arg) {
|
||||
exists(Function f |
|
||||
f = fc.getTarget() and
|
||||
f.getName() = "custom_l" and
|
||||
f.getDeclaringType() = this and
|
||||
arg = fc.getQualifier()
|
||||
)
|
||||
}
|
||||
|
||||
override predicate trylockAccess(FunctionCall fc, Expr arg) {
|
||||
none()
|
||||
}
|
||||
|
||||
override predicate unlockAccess(FunctionCall fc, Expr arg) {
|
||||
exists(Function f |
|
||||
f = fc.getTarget() and
|
||||
f.getName() = "custom_ul" and
|
||||
f.getDeclaringType() = this and
|
||||
arg = fc.getQualifier()
|
||||
)
|
||||
}
|
||||
}
|
||||
import cpp
|
||||
|
||||
class MutexTypeForTest extends MutexType {
|
||||
MutexTypeForTest() {
|
||||
this.(Class).getName() = "Mutex7"
|
||||
}
|
||||
|
||||
override predicate mustlockAccess(FunctionCall fc, Expr arg) {
|
||||
exists(Function f |
|
||||
f = fc.getTarget() and
|
||||
f.getName() = "custom_l" and
|
||||
f.getDeclaringType() = this and
|
||||
arg = fc.getQualifier()
|
||||
)
|
||||
}
|
||||
|
||||
override predicate trylockAccess(FunctionCall fc, Expr arg) {
|
||||
none()
|
||||
}
|
||||
|
||||
override predicate unlockAccess(FunctionCall fc, Expr arg) {
|
||||
exists(Function f |
|
||||
f = fc.getTarget() and
|
||||
f.getName() = "custom_ul" and
|
||||
f.getDeclaringType() = this and
|
||||
arg = fc.getQualifier()
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
import Critical.MemoryFreed
|
||||
|
||||
from FreedExpr fe
|
||||
select fe
|
||||
import Critical.MemoryFreed
|
||||
|
||||
from FreedExpr fe
|
||||
select fe
|
||||
|
||||
@@ -1 +1 @@
|
||||
Critical/NewArrayDeleteMismatch.ql
|
||||
Critical/NewArrayDeleteMismatch.ql
|
||||
|
||||
@@ -1 +1 @@
|
||||
Critical/NewDeleteArrayMismatch.ql
|
||||
Critical/NewDeleteArrayMismatch.ql
|
||||
|
||||
@@ -1 +1 @@
|
||||
Critical/NewFreeMismatch.ql
|
||||
Critical/NewFreeMismatch.ql
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
import cpp
|
||||
|
||||
from ControlFlowNode n
|
||||
select n.getLocation().getStartLine(), n.getControlFlowScope(), n,
|
||||
count(n.getAPredecessor()), count(n.getASuccessor())
|
||||
import cpp
|
||||
|
||||
from ControlFlowNode n
|
||||
select n.getLocation().getStartLine(), n.getControlFlowScope(), n,
|
||||
count(n.getAPredecessor()), count(n.getASuccessor())
|
||||
|
||||
Reference in New Issue
Block a user