Merge pull request #106 from dave-bartolomeo/dave/LF

Force LF line endings for .ql, .qll, .qlref, and .dbscheme
This commit is contained in:
Pavel Avgustinov
2018-08-27 10:04:53 +01:00
committed by GitHub
111 changed files with 7331 additions and 7312 deletions

View File

@@ -1,49 +1,49 @@
import cpp
import semmle.code.cpp.ssa.internal.IntegerConstant as Ints
bindingset[n]
string resultString(int n) {
if Ints::hasValue(n) then
result = n.toString()
else
result = "unknown"
}
from string expr, int res
where
expr = "0 + 0" and res = Ints::add(0, 0) or
expr = "0 + INT_MAX" and res = Ints::add(0, Ints::maxValue()) or
expr = "0 + -INT_MAX" and res = Ints::add(0, Ints::minValue()) or
expr = "1 + INT_MAX" and res = Ints::add(1, Ints::maxValue()) or
expr = "1 + -INT_MAX" and res = Ints::add(1, Ints::minValue()) or
expr = "unknown + unknown" and res = Ints::add(Ints::unknown(), Ints::unknown()) or
expr = "5 + unknown" and res = Ints::add(5, Ints::unknown()) or
expr = "unknown + 5" and res = Ints::add(Ints::unknown(), 5) or
expr = "0 - INT_MAX" and res = Ints::sub(0, Ints::maxValue()) or
expr = "0 - -INT_MAX" and res = Ints::sub(0, Ints::minValue()) or
expr = "-1 - INT_MAX" and res = Ints::sub(-1, Ints::maxValue()) or
expr = "-1 - -INT_MAX" and res = Ints::sub(-1, Ints::minValue()) or
expr = "unknown - unknown" and res = Ints::sub(Ints::unknown(), Ints::unknown()) or
expr = "5 - unknown" and res = Ints::sub(5, Ints::unknown()) or
expr = "unknown - 5" and res = Ints::sub(Ints::unknown(), 5) or
expr = "0 * 0" and res = Ints::mul(0, 0) or
expr = "5 * 7" and res = Ints::mul(5, 7) or
expr = "0 * INT_MAX" and res = Ints::mul(0, Ints::maxValue()) or
expr = "2 * INT_MAX" and res = Ints::mul(2, Ints::maxValue()) or
expr = "-1 * -INT_MAX" and res = Ints::mul(-1, Ints::minValue()) or
expr = "INT_MAX * INT_MAX" and res = Ints::mul(Ints::maxValue(), Ints::maxValue()) or
expr = "0 * unknown" and res = Ints::mul(0, Ints::unknown()) or
expr = "35 / 7" and res = Ints::div(35, 7) or
expr = "35 / 8" and res = Ints::div(35, 8) or
expr = "35 / -7" and res = Ints::div(35, -7) or
expr = "35 / -8" and res = Ints::div(35, -8) or
expr = "-35 / 7" and res = Ints::div(-35, 7) or
expr = "-35 / 8" and res = Ints::div(-35, 8) or
expr = "-35 / -7" and res = Ints::div(-35, -7) or
expr = "-35 / -8" and res = Ints::div(-35, -8) or
expr = "0 / -INT_MAX" and res = Ints::div(0, Ints::minValue()) or
expr = "INT_MAX / 0" and res = Ints::div(Ints::maxValue(), 0) or
expr = "0 / unknown" and res = Ints::div(0, Ints::unknown()) or
expr = "unknown / 3" and res = Ints::div(Ints::unknown(), 3) or
expr = "unknown / unknown" and res = Ints::div(Ints::unknown(), Ints::unknown())
select expr, resultString(res)
import cpp
import semmle.code.cpp.ssa.internal.IntegerConstant as Ints
bindingset[n]
string resultString(int n) {
if Ints::hasValue(n) then
result = n.toString()
else
result = "unknown"
}
from string expr, int res
where
expr = "0 + 0" and res = Ints::add(0, 0) or
expr = "0 + INT_MAX" and res = Ints::add(0, Ints::maxValue()) or
expr = "0 + -INT_MAX" and res = Ints::add(0, Ints::minValue()) or
expr = "1 + INT_MAX" and res = Ints::add(1, Ints::maxValue()) or
expr = "1 + -INT_MAX" and res = Ints::add(1, Ints::minValue()) or
expr = "unknown + unknown" and res = Ints::add(Ints::unknown(), Ints::unknown()) or
expr = "5 + unknown" and res = Ints::add(5, Ints::unknown()) or
expr = "unknown + 5" and res = Ints::add(Ints::unknown(), 5) or
expr = "0 - INT_MAX" and res = Ints::sub(0, Ints::maxValue()) or
expr = "0 - -INT_MAX" and res = Ints::sub(0, Ints::minValue()) or
expr = "-1 - INT_MAX" and res = Ints::sub(-1, Ints::maxValue()) or
expr = "-1 - -INT_MAX" and res = Ints::sub(-1, Ints::minValue()) or
expr = "unknown - unknown" and res = Ints::sub(Ints::unknown(), Ints::unknown()) or
expr = "5 - unknown" and res = Ints::sub(5, Ints::unknown()) or
expr = "unknown - 5" and res = Ints::sub(Ints::unknown(), 5) or
expr = "0 * 0" and res = Ints::mul(0, 0) or
expr = "5 * 7" and res = Ints::mul(5, 7) or
expr = "0 * INT_MAX" and res = Ints::mul(0, Ints::maxValue()) or
expr = "2 * INT_MAX" and res = Ints::mul(2, Ints::maxValue()) or
expr = "-1 * -INT_MAX" and res = Ints::mul(-1, Ints::minValue()) or
expr = "INT_MAX * INT_MAX" and res = Ints::mul(Ints::maxValue(), Ints::maxValue()) or
expr = "0 * unknown" and res = Ints::mul(0, Ints::unknown()) or
expr = "35 / 7" and res = Ints::div(35, 7) or
expr = "35 / 8" and res = Ints::div(35, 8) or
expr = "35 / -7" and res = Ints::div(35, -7) or
expr = "35 / -8" and res = Ints::div(35, -8) or
expr = "-35 / 7" and res = Ints::div(-35, 7) or
expr = "-35 / 8" and res = Ints::div(-35, 8) or
expr = "-35 / -7" and res = Ints::div(-35, -7) or
expr = "-35 / -8" and res = Ints::div(-35, -8) or
expr = "0 / -INT_MAX" and res = Ints::div(0, Ints::minValue()) or
expr = "INT_MAX / 0" and res = Ints::div(Ints::maxValue(), 0) or
expr = "0 / unknown" and res = Ints::div(0, Ints::unknown()) or
expr = "unknown / 3" and res = Ints::div(Ints::unknown(), 3) or
expr = "unknown / unknown" and res = Ints::div(Ints::unknown(), Ints::unknown())
select expr, resultString(res)

View File

@@ -1,22 +1,22 @@
import default
import semmle.code.cpp.ssa.internal.ssa.AliasAnalysis
import semmle.code.cpp.ir.IR
predicate shouldEscape(IRAutomaticUserVariable var) {
exists(string name |
name = var.getVariable().getName() and
name.matches("no_%") and
not name.matches("no_ssa_%")
)
}
from IRAutomaticUserVariable var
where
exists(FunctionIR funcIR |
funcIR = var.getFunctionIR() and
(
(shouldEscape(var) and variableAddressEscapes(var)) or
(not shouldEscape(var) and not variableAddressEscapes(var))
)
)
select var
import default
import semmle.code.cpp.ssa.internal.ssa.AliasAnalysis
import semmle.code.cpp.ir.IR
predicate shouldEscape(IRAutomaticUserVariable var) {
exists(string name |
name = var.getVariable().getName() and
name.matches("no_%") and
not name.matches("no_ssa_%")
)
}
from IRAutomaticUserVariable var
where
exists(FunctionIR funcIR |
funcIR = var.getFunctionIR() and
(
(shouldEscape(var) and variableAddressEscapes(var)) or
(not shouldEscape(var) and not variableAddressEscapes(var))
)
)
select var

View File

@@ -1,11 +1,11 @@
import default
import semmle.code.cpp.ssa.internal.ssa.AliasAnalysis
import semmle.code.cpp.ir.IR
from Instruction instr, string pointsTo
where
exists(IRVariable var, int bitOffset |
resultPointsTo(instr, var, bitOffset) and
pointsTo = var.toString() + getBitOffsetString(bitOffset)
)
select instr.getLocation().toString(), instr.getOperationString(), pointsTo
import default
import semmle.code.cpp.ssa.internal.ssa.AliasAnalysis
import semmle.code.cpp.ir.IR
from Instruction instr, string pointsTo
where
exists(IRVariable var, int bitOffset |
resultPointsTo(instr, var, bitOffset) and
pointsTo = var.toString() + getBitOffsetString(bitOffset)
)
select instr.getLocation().toString(), instr.getOperationString(), pointsTo

View File

@@ -1,21 +1,21 @@
import default
import semmle.code.cpp.ssa.internal.aliased_ssa.AliasAnalysis
import semmle.code.cpp.ssa.SSAIR
predicate shouldEscape(IRAutomaticUserVariable var) {
exists(string name |
name = var.getVariable().getName() and
name.matches("no_%")
)
}
from IRAutomaticUserVariable var
where
exists(FunctionIR funcIR |
funcIR = var.getFunctionIR() and
(
(shouldEscape(var) and variableAddressEscapes(var)) or
(not shouldEscape(var) and not variableAddressEscapes(var))
)
)
select var
import default
import semmle.code.cpp.ssa.internal.aliased_ssa.AliasAnalysis
import semmle.code.cpp.ssa.SSAIR
predicate shouldEscape(IRAutomaticUserVariable var) {
exists(string name |
name = var.getVariable().getName() and
name.matches("no_%")
)
}
from IRAutomaticUserVariable var
where
exists(FunctionIR funcIR |
funcIR = var.getFunctionIR() and
(
(shouldEscape(var) and variableAddressEscapes(var)) or
(not shouldEscape(var) and not variableAddressEscapes(var))
)
)
select var

View File

@@ -1,89 +1,89 @@
import default
query predicate newExprs(NewExpr expr, string type, string sig, int size, int alignment, string form) {
exists(Function allocator, Type allocatedType |
expr.getAllocator() = allocator and
sig = allocator.getFullSignature() and
allocatedType = expr.getAllocatedType() and
type = allocatedType.toString() and
size = allocatedType.getSize() and
alignment = allocatedType.getAlignment() and
if expr.hasAlignedAllocation() then form = "aligned" else form = ""
)
}
query predicate newArrayExprs(NewArrayExpr expr, string type, string sig, int size, int alignment, string form) {
exists(Function allocator, Type elementType |
expr.getAllocator() = allocator and
sig = allocator.getFullSignature() and
elementType = expr.getAllocatedElementType() and
type = elementType.toString() and
size = elementType.getSize() and
alignment = elementType.getAlignment() and
if expr.hasAlignedAllocation() then form = "aligned" else form = ""
)
}
query predicate newExprDeallocators(NewExpr expr, string type, string sig, int size, int alignment, string form) {
exists(Function deallocator, Type allocatedType |
expr.getDeallocator() = deallocator and
sig = deallocator.getFullSignature() and
allocatedType = expr.getAllocatedType() and
type = allocatedType.toString() and
size = allocatedType.getSize() and
alignment = allocatedType.getAlignment() and
exists(string sized, string aligned |
(if expr.hasAlignedDeallocation() then aligned = "aligned" else aligned = "") and
(if expr.hasSizedDeallocation() then sized = "sized" else sized = "") and
form = sized + " " + aligned
)
)
}
query predicate newArrayExprDeallocators(NewArrayExpr expr, string type, string sig, int size, int alignment, string form) {
exists(Function deallocator, Type elementType |
expr.getDeallocator() = deallocator and
sig = deallocator.getFullSignature() and
elementType = expr.getAllocatedElementType() and
type = elementType.toString() and
size = elementType.getSize() and
alignment = elementType.getAlignment() and
exists(string sized, string aligned |
(if expr.hasAlignedDeallocation() then aligned = "aligned" else aligned = "") and
(if expr.hasSizedDeallocation() then sized = "sized" else sized = "") and
form = sized + " " + aligned
)
)
}
query predicate deleteExprs(DeleteExpr expr, string type, string sig, int size, int alignment, string form) {
exists(Function deallocator, Type deletedType |
expr.getDeallocator() = deallocator and
sig = deallocator.getFullSignature() and
deletedType = expr.getDeletedObjectType() and
type = deletedType.toString() and
size = deletedType.getSize() and
alignment = deletedType.getAlignment() and
exists(string sized, string aligned |
(if expr.hasAlignedDeallocation() then aligned = "aligned" else aligned = "") and
(if expr.hasSizedDeallocation() then sized = "sized" else sized = "") and
form = sized + " " + aligned
)
)
}
query predicate deleteArrayExprs(DeleteArrayExpr expr, string type, string sig, int size, int alignment, string form) {
exists(Function deallocator, Type elementType |
expr.getDeallocator() = deallocator and
sig = deallocator.getFullSignature() and
elementType = expr.getDeletedElementType() and
type = elementType.toString() and
size = elementType.getSize() and
alignment = elementType.getAlignment() and
exists(string sized, string aligned |
(if expr.hasAlignedDeallocation() then aligned = "aligned" else aligned = "") and
(if expr.hasSizedDeallocation() then sized = "sized" else sized = "") and
form = sized + " " + aligned
)
)
}
import default
query predicate newExprs(NewExpr expr, string type, string sig, int size, int alignment, string form) {
exists(Function allocator, Type allocatedType |
expr.getAllocator() = allocator and
sig = allocator.getFullSignature() and
allocatedType = expr.getAllocatedType() and
type = allocatedType.toString() and
size = allocatedType.getSize() and
alignment = allocatedType.getAlignment() and
if expr.hasAlignedAllocation() then form = "aligned" else form = ""
)
}
query predicate newArrayExprs(NewArrayExpr expr, string type, string sig, int size, int alignment, string form) {
exists(Function allocator, Type elementType |
expr.getAllocator() = allocator and
sig = allocator.getFullSignature() and
elementType = expr.getAllocatedElementType() and
type = elementType.toString() and
size = elementType.getSize() and
alignment = elementType.getAlignment() and
if expr.hasAlignedAllocation() then form = "aligned" else form = ""
)
}
query predicate newExprDeallocators(NewExpr expr, string type, string sig, int size, int alignment, string form) {
exists(Function deallocator, Type allocatedType |
expr.getDeallocator() = deallocator and
sig = deallocator.getFullSignature() and
allocatedType = expr.getAllocatedType() and
type = allocatedType.toString() and
size = allocatedType.getSize() and
alignment = allocatedType.getAlignment() and
exists(string sized, string aligned |
(if expr.hasAlignedDeallocation() then aligned = "aligned" else aligned = "") and
(if expr.hasSizedDeallocation() then sized = "sized" else sized = "") and
form = sized + " " + aligned
)
)
}
query predicate newArrayExprDeallocators(NewArrayExpr expr, string type, string sig, int size, int alignment, string form) {
exists(Function deallocator, Type elementType |
expr.getDeallocator() = deallocator and
sig = deallocator.getFullSignature() and
elementType = expr.getAllocatedElementType() and
type = elementType.toString() and
size = elementType.getSize() and
alignment = elementType.getAlignment() and
exists(string sized, string aligned |
(if expr.hasAlignedDeallocation() then aligned = "aligned" else aligned = "") and
(if expr.hasSizedDeallocation() then sized = "sized" else sized = "") and
form = sized + " " + aligned
)
)
}
query predicate deleteExprs(DeleteExpr expr, string type, string sig, int size, int alignment, string form) {
exists(Function deallocator, Type deletedType |
expr.getDeallocator() = deallocator and
sig = deallocator.getFullSignature() and
deletedType = expr.getDeletedObjectType() and
type = deletedType.toString() and
size = deletedType.getSize() and
alignment = deletedType.getAlignment() and
exists(string sized, string aligned |
(if expr.hasAlignedDeallocation() then aligned = "aligned" else aligned = "") and
(if expr.hasSizedDeallocation() then sized = "sized" else sized = "") and
form = sized + " " + aligned
)
)
}
query predicate deleteArrayExprs(DeleteArrayExpr expr, string type, string sig, int size, int alignment, string form) {
exists(Function deallocator, Type elementType |
expr.getDeallocator() = deallocator and
sig = deallocator.getFullSignature() and
elementType = expr.getDeletedElementType() and
type = elementType.toString() and
size = elementType.getSize() and
alignment = elementType.getAlignment() and
exists(string sized, string aligned |
(if expr.hasAlignedDeallocation() then aligned = "aligned" else aligned = "") and
(if expr.hasSizedDeallocation() then sized = "sized" else sized = "") and
form = sized + " " + aligned
)
)
}

View File

@@ -1,5 +1,5 @@
import cpp
import semmle.code.cpp.controlflow.Guards
from GuardCondition guard
import cpp
import semmle.code.cpp.controlflow.Guards
from GuardCondition guard
select guard

View File

@@ -1,15 +1,15 @@
import default
string getValueCategoryString(Expr expr) {
if expr.isLValueCategory() then
result = "lval"
else if expr.isXValueCategory() then
result = "xval"
else if expr.hasLValueToRValueConversion() then
result = "prval(load)"
else
result = "prval"
}
from Cast cast
select cast, cast.getSemanticConversionString(), getValueCategoryString(cast), cast.getType().toString(), cast.getExpr().getType().toString()
import default
string getValueCategoryString(Expr expr) {
if expr.isLValueCategory() then
result = "lval"
else if expr.isXValueCategory() then
result = "xval"
else if expr.hasLValueToRValueConversion() then
result = "prval(load)"
else
result = "prval"
}
from Cast cast
select cast, cast.getSemanticConversionString(), getValueCategoryString(cast), cast.getType().toString(), cast.getExpr().getType().toString()

View File

@@ -1 +1 @@
semmle/code/cpp/ASTSanity.ql
semmle/code/cpp/ASTSanity.ql

View File

@@ -1,5 +1,5 @@
import cpp
from Expr e, Variable v
where varbind(unresolveElement(e), unresolveElement(v))
select e, v
import cpp
from Expr e, Variable v
where varbind(unresolveElement(e), unresolveElement(v))
select e, v

View File

@@ -1,7 +1,7 @@
/**
* @name InitializerAccesses
*/
import cpp
import cpp
from Initializer i, VariableAccess va
where i.getExpr().getAChild*() = va

View File

@@ -1,6 +1,6 @@
import cpp
//this query should find the baseType of CC* to be CC, not C.
from DerivedType t, Type baseType
where t.getBaseType() = baseType
select t, baseType
import cpp
//this query should find the baseType of CC* to be CC, not C.
from DerivedType t, Type baseType
where t.getBaseType() = baseType
select t, baseType

View File

@@ -1,26 +1,26 @@
import cpp
from ComparisonOperation co, string s
where
(
co instanceof EqualityOperation and s = "EqualityOperation"
) or (
co instanceof EQExpr and s = "EQExpr"
) or (
co instanceof NEExpr and s = "NEExpr"
) or (
co instanceof RelationalOperation and s = "RelationalOperation"
) or (
s = "getGreaterOperand() = " + co.(RelationalOperation).getGreaterOperand().toString()
) or (
s = "getLesserOperand() = " + co.(RelationalOperation).getLesserOperand().toString()
) or (
co instanceof GTExpr and s = "GTExpr"
) or (
co instanceof LTExpr and s = "LTExpr"
) or (
co instanceof GEExpr and s = "GEExpr"
) or (
co instanceof LEExpr and s = "LEExpr"
)
select co, s
import cpp
from ComparisonOperation co, string s
where
(
co instanceof EqualityOperation and s = "EqualityOperation"
) or (
co instanceof EQExpr and s = "EQExpr"
) or (
co instanceof NEExpr and s = "NEExpr"
) or (
co instanceof RelationalOperation and s = "RelationalOperation"
) or (
s = "getGreaterOperand() = " + co.(RelationalOperation).getGreaterOperand().toString()
) or (
s = "getLesserOperand() = " + co.(RelationalOperation).getLesserOperand().toString()
) or (
co instanceof GTExpr and s = "GTExpr"
) or (
co instanceof LTExpr and s = "LTExpr"
) or (
co instanceof GEExpr and s = "GEExpr"
) or (
co instanceof LEExpr and s = "LEExpr"
)
select co, s

View File

@@ -1,37 +1,37 @@
import cpp
predicate describe(UnaryOperation uo, string s)
{
(
uo instanceof UnaryArithmeticOperation and s = "UnaryArithmeticOperation"
) or (
uo instanceof UnaryMinusExpr and s = "UnaryMinusExpr"
) or (
uo instanceof UnaryPlusExpr and s = "UnaryPlusExpr"
) or (
uo instanceof ConjugationExpr and s = "ConjugationExpr"
) or (
uo instanceof CrementOperation and s = "CrementOperation"
) or (
uo instanceof IncrementOperation and s = "IncrementOperation"
) or (
uo instanceof DecrementOperation and s = "DecrementOperation"
) or (
uo instanceof PrefixCrementOperation and s = "PrefixCrementOperation"
) or (
uo instanceof PostfixCrementOperation and s = "PostfixCrementOperation"
) or (
uo instanceof AddressOfExpr and s = "AddressOfExpr"
) or (
s = "getAddressable() = " + uo.(AddressOfExpr).getAddressable().toString()
) or (
uo instanceof PointerDereferenceExpr and s = "PointerDereferenceExpr"
) or (
uo instanceof UnaryLogicalOperation and s = "UnaryLogicalOperation"
) or (
uo instanceof NotExpr and s = "NotExpr"
)
}
from UnaryOperation uo
select uo, uo.getOperator(), concat(string s | describe(uo, s) | s, ", ")
import cpp
predicate describe(UnaryOperation uo, string s)
{
(
uo instanceof UnaryArithmeticOperation and s = "UnaryArithmeticOperation"
) or (
uo instanceof UnaryMinusExpr and s = "UnaryMinusExpr"
) or (
uo instanceof UnaryPlusExpr and s = "UnaryPlusExpr"
) or (
uo instanceof ConjugationExpr and s = "ConjugationExpr"
) or (
uo instanceof CrementOperation and s = "CrementOperation"
) or (
uo instanceof IncrementOperation and s = "IncrementOperation"
) or (
uo instanceof DecrementOperation and s = "DecrementOperation"
) or (
uo instanceof PrefixCrementOperation and s = "PrefixCrementOperation"
) or (
uo instanceof PostfixCrementOperation and s = "PostfixCrementOperation"
) or (
uo instanceof AddressOfExpr and s = "AddressOfExpr"
) or (
s = "getAddressable() = " + uo.(AddressOfExpr).getAddressable().toString()
) or (
uo instanceof PointerDereferenceExpr and s = "PointerDereferenceExpr"
) or (
uo instanceof UnaryLogicalOperation and s = "UnaryLogicalOperation"
) or (
uo instanceof NotExpr and s = "NotExpr"
)
}
from UnaryOperation uo
select uo, uo.getOperator(), concat(string s | describe(uo, s) | s, ", ")

View File

@@ -1,5 +1,5 @@
import cpp
from Expr e
where e.isUnevaluated()
select e
import cpp
from Expr e
where e.isUnevaluated()
select e

View File

@@ -1,5 +1,5 @@
import cpp
from Expr e
where e.hasLValueToRValueConversion()
select e
import cpp
from Expr e
where e.hasLValueToRValueConversion()
select e

View File

@@ -1,7 +1,7 @@
import cpp
from Expr e, string valcat
where
e.isLValueCategory() and valcat = "lvalue" or
e.isXValueCategory() and valcat = "xvalue"
select e, e.getType().toString(), valcat
import cpp
from Expr e, string valcat
where
e.isLValueCategory() and valcat = "lvalue" or
e.isXValueCategory() and valcat = "xvalue"
select e, e.getType().toString(), valcat

View File

@@ -1,11 +1,11 @@
/**
* @name EnumConst
* @kind table
*/
import cpp
from Enum e, Declaration c, string reason
where (c.(EnumConstant).getDeclaringEnum() = e and reason = "getDeclaringEnum()") or
(c.(EnumConstant).getType() = e and reason = "getType()") or
(c.(Field).getDeclaringType() = e and reason = "getDeclaringType()")
select e, c, reason
/**
* @name EnumConst
* @kind table
*/
import cpp
from Enum e, Declaration c, string reason
where (c.(EnumConstant).getDeclaringEnum() = e and reason = "getDeclaringEnum()") or
(c.(EnumConstant).getType() = e and reason = "getType()") or
(c.(Field).getDeclaringType() = e and reason = "getDeclaringType()")
select e, c, reason

View File

@@ -1,40 +1,40 @@
/**
* @name Fields
* @kind table
*/
import cpp
predicate nameCheck(Declaration d) {
count(d.toString()) = 1 and
count(string s | d.hasName(s)) = 1 and
d.hasName(d.toString())
}
string accessType(Field f) {
(f.isPublic() and result = "public") or
(f.isProtected() and result = "protected") or
(f.isPrivate() and result = "private")
}
string fieldType(Field f) {
result = f.getType().getAQlClass() and
(
result.matches("%Type") or
result = "Enum"
)
}
string pointedType(Field f) {
if f.getType() instanceof PointerType then (
result = f.getType().(PointerType).getBaseType().toString()
) else (
result = ""
)
}
from Class c, Field f
where f.getDeclaringType() = c and
c.getAField() = f and
nameCheck(c) and
nameCheck(f)
select c, f, accessType(f), fieldType(f), pointedType(f)
/**
* @name Fields
* @kind table
*/
import cpp
predicate nameCheck(Declaration d) {
count(d.toString()) = 1 and
count(string s | d.hasName(s)) = 1 and
d.hasName(d.toString())
}
string accessType(Field f) {
(f.isPublic() and result = "public") or
(f.isProtected() and result = "protected") or
(f.isPrivate() and result = "private")
}
string fieldType(Field f) {
result = f.getType().getAQlClass() and
(
result.matches("%Type") or
result = "Enum"
)
}
string pointedType(Field f) {
if f.getType() instanceof PointerType then (
result = f.getType().(PointerType).getBaseType().toString()
) else (
result = ""
)
}
from Class c, Field f
where f.getDeclaringType() = c and
c.getAField() = f and
nameCheck(c) and
nameCheck(f)
select c, f, accessType(f), fieldType(f), pointedType(f)

View File

@@ -1,30 +1,30 @@
import default
import semmle.code.cpp.ssa.SSAIR
import semmle.code.cpp.ssa.internal.IntegerConstant
language[monotonicAggregates]
IntValue getConstantValue(Instruction instr) {
result = instr.(IntegerConstantInstruction).getValue().toInt() or
exists(BinaryInstruction binInstr, IntValue left, IntValue right |
binInstr = instr and
left = getConstantValue(binInstr.getLeftOperand()) and
right = getConstantValue(binInstr.getRightOperand()) and
(
binInstr instanceof AddInstruction and result = add(left, right) or
binInstr instanceof SubInstruction and result = sub(left, right) or
binInstr instanceof MulInstruction and result = mul(left, right) or
binInstr instanceof DivInstruction and result = div(left, right)
)
) or
result = getConstantValue(instr.(CopyInstruction).getSourceValue()) or
exists(PhiInstruction phi |
phi = instr and
result = max(Instruction operand | operand = phi.getAnOperand() | getConstantValue(operand)) and
result = min(Instruction operand | operand = phi.getAnOperand() | getConstantValue(operand))
)
}
from FunctionIR funcIR, int value
where
value = getValue(getConstantValue(funcIR.getReturnInstruction().(ReturnValueInstruction).getReturnValue()))
select funcIR, value
import default
import semmle.code.cpp.ssa.SSAIR
import semmle.code.cpp.ssa.internal.IntegerConstant
language[monotonicAggregates]
IntValue getConstantValue(Instruction instr) {
result = instr.(IntegerConstantInstruction).getValue().toInt() or
exists(BinaryInstruction binInstr, IntValue left, IntValue right |
binInstr = instr and
left = getConstantValue(binInstr.getLeftOperand()) and
right = getConstantValue(binInstr.getRightOperand()) and
(
binInstr instanceof AddInstruction and result = add(left, right) or
binInstr instanceof SubInstruction and result = sub(left, right) or
binInstr instanceof MulInstruction and result = mul(left, right) or
binInstr instanceof DivInstruction and result = div(left, right)
)
) or
result = getConstantValue(instr.(CopyInstruction).getSourceValue()) or
exists(PhiInstruction phi |
phi = instr and
result = max(Instruction operand | operand = phi.getAnOperand() | getConstantValue(operand)) and
result = min(Instruction operand | operand = phi.getAnOperand() | getConstantValue(operand))
)
}
from FunctionIR funcIR, int value
where
value = getValue(getConstantValue(funcIR.getReturnInstruction().(ReturnValueInstruction).getReturnValue()))
select funcIR, value

View File

@@ -1,5 +1,5 @@
import default
import semmle.code.cpp.ssa.SSAIR
from FunctionIR funcIR
select funcIR.toString(), count(funcIR.getABlock())
import default
import semmle.code.cpp.ssa.SSAIR
from FunctionIR funcIR
select funcIR.toString(), count(funcIR.getABlock())

View File

@@ -1,5 +1,5 @@
import cpp
from ArrayType a, ArrayAggregateLiteral al, int i
where a = al.getType()
select al, a, i, al.getElementExpr(i)
import cpp
from ArrayType a, ArrayAggregateLiteral al, int i
where a = al.getType()
select al, a, i, al.getElementExpr(i)

View File

@@ -1,6 +1,6 @@
import cpp
from ArrayType a, ArrayAggregateLiteral al, int i
where a = al.getType()
and al.isValueInitialized(i)
select al, a, i
import cpp
from ArrayType a, ArrayAggregateLiteral al, int i
where a = al.getType()
and al.isValueInitialized(i)
select al, a, i

View File

@@ -1,6 +1,6 @@
import cpp
from Class c, ClassAggregateLiteral al, Field f
where c = al.getType()
and f = c.getAField()
select al, c, f, al.getFieldExpr(f)
import cpp
from Class c, ClassAggregateLiteral al, Field f
where c = al.getType()
and f = c.getAField()
select al, c, f, al.getFieldExpr(f)

View File

@@ -1,6 +1,6 @@
import cpp
from Class c, ClassAggregateLiteral al, Field f
where c = al.getType()
and al.isValueInitialized(f)
select al, c, f
import cpp
from Class c, ClassAggregateLiteral al, Field f
where c = al.getType()
and al.isValueInitialized(f)
select al, c, f

View File

@@ -2,13 +2,13 @@
* @name Parameters3
* @kind table
*/
import cpp
from Function f, int i, Parameter p, string pname, boolean named
import cpp
from Function f, int i, Parameter p, string pname, boolean named
where f.hasName("Dispatch")
and f.getParameter(i) = p
and p.getName() = pname
and (
p.isNamed() and named = true
or not p.isNamed() and named = false)
or not p.isNamed() and named = false)
select f, i, pname, named

View File

@@ -1,5 +1,5 @@
import cpp
from BreakStmt b, Stmt s
where b.getBreakable() = s
select b, s
import cpp
from BreakStmt b, Stmt s
where b.getBreakable() = s
select b, s

View File

@@ -1,4 +1,4 @@
import cpp
from Variable v
select v
import cpp
from Variable v
select v

View File

@@ -1,5 +1,5 @@
import cpp
from Variable v, Class t
where t = v.getType().(PointerType).getBaseType()
select v, t, count(t.getAMember())
import cpp
from Variable v, Class t
where t = v.getType().(PointerType).getBaseType()
select v, t, count(t.getAMember())

View File

@@ -1,29 +1,29 @@
import cpp
class MutexTypeForTest extends MutexType {
MutexTypeForTest() {
this.(Class).getName() = "Mutex7"
}
override predicate mustlockAccess(FunctionCall fc, Expr arg) {
exists(Function f |
f = fc.getTarget() and
f.getName() = "custom_l" and
f.getDeclaringType() = this and
arg = fc.getQualifier()
)
}
override predicate trylockAccess(FunctionCall fc, Expr arg) {
none()
}
override predicate unlockAccess(FunctionCall fc, Expr arg) {
exists(Function f |
f = fc.getTarget() and
f.getName() = "custom_ul" and
f.getDeclaringType() = this and
arg = fc.getQualifier()
)
}
}
import cpp
class MutexTypeForTest extends MutexType {
MutexTypeForTest() {
this.(Class).getName() = "Mutex7"
}
override predicate mustlockAccess(FunctionCall fc, Expr arg) {
exists(Function f |
f = fc.getTarget() and
f.getName() = "custom_l" and
f.getDeclaringType() = this and
arg = fc.getQualifier()
)
}
override predicate trylockAccess(FunctionCall fc, Expr arg) {
none()
}
override predicate unlockAccess(FunctionCall fc, Expr arg) {
exists(Function f |
f = fc.getTarget() and
f.getName() = "custom_ul" and
f.getDeclaringType() = this and
arg = fc.getQualifier()
)
}
}

View File

@@ -1,4 +1,4 @@
import Critical.MemoryFreed
from FreedExpr fe
select fe
import Critical.MemoryFreed
from FreedExpr fe
select fe

View File

@@ -1 +1 @@
Critical/NewArrayDeleteMismatch.ql
Critical/NewArrayDeleteMismatch.ql

View File

@@ -1 +1 @@
Critical/NewDeleteArrayMismatch.ql
Critical/NewDeleteArrayMismatch.ql

View File

@@ -1 +1 @@
Critical/NewFreeMismatch.ql
Critical/NewFreeMismatch.ql

View File

@@ -1,5 +1,5 @@
import cpp
from ControlFlowNode n
select n.getLocation().getStartLine(), n.getControlFlowScope(), n,
count(n.getAPredecessor()), count(n.getASuccessor())
import cpp
from ControlFlowNode n
select n.getLocation().getStartLine(), n.getControlFlowScope(), n,
count(n.getAPredecessor()), count(n.getASuccessor())