hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 10:45:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: Remove 'ReferenceToInstruction' from the list of instructions we interpret as a load. This makes use lose a bunch of flow, and we'll restore this flow in the next commit.

Browse Source
This commit is contained in:
Mathias Vorreiter Pedersen
2021-11-11 10:01:19 +00:00
parent 10bca3544c
commit dbcd4d6d5d
10 changed files with 105 additions and 104 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll
View File

@@ -244,17 +244,6 @@ Instruction getDestinationAddress(Instruction instr) {
]
}
class ReferenceToInstruction extends CopyValueInstruction {
ReferenceToInstruction() {
this.getResultType() instanceof Cpp::ReferenceType and
not this.getUnary().getResultType() instanceof Cpp::ReferenceType
}
Instruction getSourceAddress() { result = getSourceAddressOperand().getDef() }
Operand getSourceAddressOperand() { result = this.getUnaryOperand() }
}
/** Gets the source address of `instr` if it is an instruction that behaves like a `LoadInstruction`. */
Instruction getSourceAddress(Instruction instr) { result = getSourceAddressOperand(instr).getDef() }
@@ -266,11 +255,7 @@ Operand getSourceAddressOperand(Instruction instr) {
result =
[
instr.(LoadInstruction).getSourceAddressOperand(),
instr.(ReadSideEffectInstruction).getArgumentOperand(),
// `ReferenceToInstruction` is really more of an address-of operation,
// but by including it in this list we break out of `flowOutOfAddressStep` at an
// instruction that, at the source level, looks like a use of a variable.
instr.(ReferenceToInstruction).getSourceAddressOperand()
instr.(ReadSideEffectInstruction).getArgumentOperand()
]
}
@@ -295,10 +280,6 @@ Operand getSourceValueOperand(Instruction instr) {
result = instr.(LoadInstruction).getSourceValueOperand()
or
result = instr.(ReadSideEffectInstruction).getSideEffectOperand()
or
// See the comment on the `ReferenceToInstruction` disjunct in `getSourceAddressOperand` for why
// this case is included.
result = instr.(ReferenceToInstruction).getSourceValueOperand()
}
/**

8
cpp/ql/test/library-tests/dataflow/dataflow-tests/lambdas.cpp
View File

@@ -18,7 +18,7 @@ void test_lambdas()
sink(a()); // $ ast,ir
auto b = [&] {
sink(t); // $ ast,ir
sink(t); // $ ast MISSING: ir
sink(u);
v = source(); // (v is reference captured)
};
@@ -26,19 +26,19 @@ void test_lambdas()
sink(v); // $ MISSING: ast,ir
auto c = [=] {
sink(t); // $ ast,ir
sink(t); // $ ast MISSING: ir
sink(u);
};
c();
auto d = [](int a, int b) {
sink(a); // $ ast,ir
sink(a); // $ ast MISSING: ir
sink(b);
};
d(t, u);
auto e = [](int &a, int &b, int &c) {
sink(a); // $ ast,ir
sink(a); // $ ast MISSING: ir
sink(b);
c = source();
};

2
cpp/ql/test/library-tests/dataflow/dataflow-tests/test.cpp
View File

@@ -100,7 +100,7 @@ void local_references(int &source1, int clean1) {
int t = source();
int &ref = t;
t = clean1;
sink(ref); // $ SPURIOUS: ast,ir
sink(ref); // $ SPURIOUS: ast
}
{

142
cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected
View File

@@ -537,8 +537,8 @@ edges
| complex.cpp:11:22:11:23 | a_ [post update] | complex.cpp:11:22:11:23 | this [post update] [a_] |
| complex.cpp:12:17:12:17 | b | complex.cpp:12:22:12:23 | b_ [post update] |
| complex.cpp:12:22:12:23 | b_ [post update] | complex.cpp:12:22:12:23 | this [post update] [b_] |
| complex.cpp:40:17:40:17 | b [inner, f, a_] | complex.cpp:42:8:42:8 | (reference dereference) [read] [inner, f, a_] |
| complex.cpp:40:17:40:17 | b [inner, f, b_] | complex.cpp:43:8:43:8 | (reference dereference) [read] [inner, f, b_] |
| complex.cpp:40:17:40:17 | *b [inner, f, a_] | complex.cpp:42:8:42:8 | (reference dereference) [read] [inner, f, a_] |
| complex.cpp:40:17:40:17 | *b [inner, f, b_] | complex.cpp:43:8:43:8 | (reference dereference) [read] [inner, f, b_] |
| complex.cpp:42:8:42:8 | (reference dereference) [read] [inner, f, a_] | complex.cpp:42:10:42:14 | inner [read] [f, a_] |
| complex.cpp:42:10:42:14 | inner [read] [f, a_] | complex.cpp:42:16:42:16 | f [read] [a_] |
| complex.cpp:42:16:42:16 | f [read] [a_] | complex.cpp:42:18:42:18 | f [a_] |
@@ -549,38 +549,38 @@ edges
| complex.cpp:43:16:43:16 | f [read] [b_] | complex.cpp:43:18:43:18 | f [b_] |
| complex.cpp:43:18:43:18 | f [b_] | complex.cpp:10:7:10:7 | this [b_] |
| complex.cpp:43:18:43:18 | f [b_] | complex.cpp:43:18:43:18 | call to b |
| complex.cpp:53:3:53:4 | b1 [post update] [inner, f, a_] | complex.cpp:59:3:59:5 | b1 [inner, f, a_] |
| complex.cpp:53:3:53:4 | b1 [post update] [inner, f, a_] | complex.cpp:59:7:59:8 | b1 indirection [inner, f, a_] |
| complex.cpp:53:6:53:10 | inner [post update] [f, a_] | complex.cpp:53:3:53:4 | b1 [post update] [inner, f, a_] |
| complex.cpp:53:12:53:12 | f [post update] [a_] | complex.cpp:53:6:53:10 | inner [post update] [f, a_] |
| complex.cpp:53:14:53:17 | call to user_input | complex.cpp:11:17:11:17 | a |
| complex.cpp:53:14:53:17 | call to user_input | complex.cpp:53:14:53:17 | f [post update] [a_] |
| complex.cpp:53:14:53:17 | f [post update] [a_] | complex.cpp:53:12:53:12 | f [post update] [a_] |
| complex.cpp:53:19:53:28 | call to user_input | complex.cpp:53:14:53:17 | call to user_input |
| complex.cpp:54:3:54:4 | b2 [post update] [inner, f, b_] | complex.cpp:62:3:62:5 | b2 [inner, f, b_] |
| complex.cpp:54:3:54:4 | b2 [post update] [inner, f, b_] | complex.cpp:62:7:62:8 | b2 indirection [inner, f, b_] |
| complex.cpp:54:6:54:10 | inner [post update] [f, b_] | complex.cpp:54:3:54:4 | b2 [post update] [inner, f, b_] |
| complex.cpp:54:12:54:12 | f [post update] [b_] | complex.cpp:54:6:54:10 | inner [post update] [f, b_] |
| complex.cpp:54:14:54:17 | call to user_input | complex.cpp:12:17:12:17 | b |
| complex.cpp:54:14:54:17 | call to user_input | complex.cpp:54:14:54:17 | f [post update] [b_] |
| complex.cpp:54:14:54:17 | f [post update] [b_] | complex.cpp:54:12:54:12 | f [post update] [b_] |
| complex.cpp:54:19:54:28 | call to user_input | complex.cpp:54:14:54:17 | call to user_input |
| complex.cpp:55:3:55:4 | b3 [post update] [inner, f, a_] | complex.cpp:65:3:65:5 | b3 [inner, f, a_] |
| complex.cpp:55:3:55:4 | b3 [post update] [inner, f, a_] | complex.cpp:65:7:65:8 | b3 indirection [inner, f, a_] |
| complex.cpp:55:6:55:10 | inner [post update] [f, a_] | complex.cpp:55:3:55:4 | b3 [post update] [inner, f, a_] |
| complex.cpp:55:12:55:12 | f [post update] [a_] | complex.cpp:55:6:55:10 | inner [post update] [f, a_] |
| complex.cpp:55:14:55:17 | call to user_input | complex.cpp:11:17:11:17 | a |
| complex.cpp:55:14:55:17 | call to user_input | complex.cpp:55:14:55:17 | f [post update] [a_] |
| complex.cpp:55:14:55:17 | f [post update] [a_] | complex.cpp:55:12:55:12 | f [post update] [a_] |
| complex.cpp:55:19:55:28 | call to user_input | complex.cpp:55:14:55:17 | call to user_input |
| complex.cpp:56:3:56:4 | b3 [post update] [inner, f, b_] | complex.cpp:65:3:65:5 | b3 [inner, f, b_] |
| complex.cpp:56:3:56:4 | b3 [post update] [inner, f, b_] | complex.cpp:65:7:65:8 | b3 indirection [inner, f, b_] |
| complex.cpp:56:6:56:10 | inner [post update] [f, b_] | complex.cpp:56:3:56:4 | b3 [post update] [inner, f, b_] |
| complex.cpp:56:12:56:12 | f [post update] [b_] | complex.cpp:56:6:56:10 | inner [post update] [f, b_] |
| complex.cpp:56:14:56:17 | call to user_input | complex.cpp:12:17:12:17 | b |
| complex.cpp:56:14:56:17 | call to user_input | complex.cpp:56:14:56:17 | f [post update] [b_] |
| complex.cpp:56:14:56:17 | f [post update] [b_] | complex.cpp:56:12:56:12 | f [post update] [b_] |
| complex.cpp:56:19:56:28 | call to user_input | complex.cpp:56:14:56:17 | call to user_input |
| complex.cpp:59:3:59:5 | b1 [inner, f, a_] | complex.cpp:40:17:40:17 | b [inner, f, a_] |
| complex.cpp:62:3:62:5 | b2 [inner, f, b_] | complex.cpp:40:17:40:17 | b [inner, f, b_] |
| complex.cpp:65:3:65:5 | b3 [inner, f, a_] | complex.cpp:40:17:40:17 | b [inner, f, a_] |
| complex.cpp:65:3:65:5 | b3 [inner, f, b_] | complex.cpp:40:17:40:17 | b [inner, f, b_] |
| complex.cpp:59:7:59:8 | b1 indirection [inner, f, a_] | complex.cpp:40:17:40:17 | *b [inner, f, a_] |
| complex.cpp:62:7:62:8 | b2 indirection [inner, f, b_] | complex.cpp:40:17:40:17 | *b [inner, f, b_] |
| complex.cpp:65:7:65:8 | b3 indirection [inner, f, a_] | complex.cpp:40:17:40:17 | *b [inner, f, a_] |
| complex.cpp:65:7:65:8 | b3 indirection [inner, f, b_] | complex.cpp:40:17:40:17 | *b [inner, f, b_] |
| conflated.cpp:10:4:10:5 | (reference dereference) [post update] [p] | conflated.cpp:11:9:11:10 | (reference dereference) [read] [p] |
| conflated.cpp:10:7:10:7 | FieldAddress [post update] | conflated.cpp:10:4:10:5 | (reference dereference) [post update] [p] |
| conflated.cpp:10:11:10:20 | call to user_input | conflated.cpp:10:7:10:7 | FieldAddress [post update] |
@@ -616,7 +616,8 @@ edges
| conflated.cpp:61:12:61:15 | FieldAddress [read] [y] | conflated.cpp:61:12:61:15 | next [read] [y] |
| conflated.cpp:61:12:61:15 | next [read] [y] | conflated.cpp:61:18:61:18 | FieldAddress [read] |
| conflated.cpp:61:18:61:18 | FieldAddress [read] | conflated.cpp:61:18:61:18 | y |
| constructors.cpp:18:9:18:9 | this [a_] | constructors.cpp:18:22:18:23 | this [read] [a_] |
| constructors.cpp:18:9:18:9 | *#this [a_] | constructors.cpp:18:22:18:23 | this [read] [a_] |
| constructors.cpp:18:9:18:9 | *#this [b_] | constructors.cpp:18:9:18:9 | ReturnIndirection [b_] |
| constructors.cpp:18:22:18:23 | FieldAddress [read] | constructors.cpp:18:9:18:9 | ReturnValue |
| constructors.cpp:18:22:18:23 | this [read] [a_] | constructors.cpp:18:22:18:23 | FieldAddress [read] |
| constructors.cpp:19:9:19:9 | this [b_] | constructors.cpp:19:22:19:23 | this [read] [b_] |
@@ -626,32 +627,36 @@ edges
| constructors.cpp:23:20:23:20 | b | constructors.cpp:23:32:23:36 | FieldAddress [post update] |
| constructors.cpp:23:25:23:29 | FieldAddress [post update] | constructors.cpp:23:5:23:7 | this [post update] [a_] |
| constructors.cpp:23:32:23:36 | FieldAddress [post update] | constructors.cpp:23:5:23:7 | this [post update] [b_] |
| constructors.cpp:26:15:26:15 | f [a_] | constructors.cpp:28:12:28:12 | f [a_] |
| constructors.cpp:26:15:26:15 | f [b_] | constructors.cpp:29:12:29:12 | f [b_] |
| constructors.cpp:28:12:28:12 | f [a_] | constructors.cpp:18:9:18:9 | this [a_] |
| constructors.cpp:28:12:28:12 | f [a_] | constructors.cpp:28:12:28:12 | call to a |
| constructors.cpp:26:15:26:15 | *f [a_] | constructors.cpp:28:10:28:10 | f indirection [a_] |
| constructors.cpp:26:15:26:15 | *f [b_] | constructors.cpp:28:10:28:10 | f indirection [b_] |
| constructors.cpp:26:15:26:15 | *f [b_] | constructors.cpp:29:12:29:12 | f [b_] |
| constructors.cpp:28:10:28:10 | a output argument [b_] | constructors.cpp:29:12:29:12 | f [b_] |
| constructors.cpp:28:10:28:10 | f indirection [a_] | constructors.cpp:18:9:18:9 | *#this [a_] |
| constructors.cpp:28:10:28:10 | f indirection [a_] | constructors.cpp:28:12:28:12 | call to a |
| constructors.cpp:28:10:28:10 | f indirection [b_] | constructors.cpp:18:9:18:9 | *#this [b_] |
| constructors.cpp:28:10:28:10 | f indirection [b_] | constructors.cpp:28:10:28:10 | a output argument [b_] |
| constructors.cpp:29:12:29:12 | f [b_] | constructors.cpp:19:9:19:9 | this [b_] |
| constructors.cpp:29:12:29:12 | f [b_] | constructors.cpp:29:12:29:12 | call to b |
| constructors.cpp:34:11:34:20 | call to user_input | constructors.cpp:34:11:34:26 | call to user_input |
| constructors.cpp:34:11:34:26 | Argument this [post update] [a_] | constructors.cpp:40:5:40:7 | f [a_] |
| constructors.cpp:34:11:34:26 | Argument this [post update] [a_] | constructors.cpp:40:9:40:9 | f indirection [a_] |
| constructors.cpp:34:11:34:26 | call to user_input | constructors.cpp:23:13:23:13 | a |
| constructors.cpp:34:11:34:26 | call to user_input | constructors.cpp:34:11:34:26 | Argument this [post update] [a_] |
| constructors.cpp:35:11:35:26 | Argument this [post update] [b_] | constructors.cpp:43:5:43:7 | g [b_] |
| constructors.cpp:35:11:35:26 | Argument this [post update] [b_] | constructors.cpp:43:9:43:9 | g indirection [b_] |
| constructors.cpp:35:11:35:26 | call to user_input | constructors.cpp:23:20:23:20 | b |
| constructors.cpp:35:11:35:26 | call to user_input | constructors.cpp:35:11:35:26 | Argument this [post update] [b_] |
| constructors.cpp:35:14:35:23 | call to user_input | constructors.cpp:35:11:35:26 | call to user_input |
| constructors.cpp:36:11:36:20 | call to user_input | constructors.cpp:36:11:36:37 | call to user_input |
| constructors.cpp:36:11:36:37 | Argument this [post update] [a_] | constructors.cpp:46:5:46:7 | h [a_] |
| constructors.cpp:36:11:36:37 | Argument this [post update] [b_] | constructors.cpp:46:5:46:7 | h [b_] |
| constructors.cpp:36:11:36:37 | Argument this [post update] [a_] | constructors.cpp:46:9:46:9 | h indirection [a_] |
| constructors.cpp:36:11:36:37 | Argument this [post update] [b_] | constructors.cpp:46:9:46:9 | h indirection [b_] |
| constructors.cpp:36:11:36:37 | call to user_input | constructors.cpp:23:13:23:13 | a |
| constructors.cpp:36:11:36:37 | call to user_input | constructors.cpp:23:20:23:20 | b |
| constructors.cpp:36:11:36:37 | call to user_input | constructors.cpp:36:11:36:37 | Argument this [post update] [a_] |
| constructors.cpp:36:11:36:37 | call to user_input | constructors.cpp:36:11:36:37 | Argument this [post update] [b_] |
| constructors.cpp:36:25:36:34 | call to user_input | constructors.cpp:36:11:36:37 | call to user_input |
| constructors.cpp:40:5:40:7 | f [a_] | constructors.cpp:26:15:26:15 | f [a_] |
| constructors.cpp:43:5:43:7 | g [b_] | constructors.cpp:26:15:26:15 | f [b_] |
| constructors.cpp:46:5:46:7 | h [a_] | constructors.cpp:26:15:26:15 | f [a_] |
| constructors.cpp:46:5:46:7 | h [b_] | constructors.cpp:26:15:26:15 | f [b_] |
| constructors.cpp:40:9:40:9 | f indirection [a_] | constructors.cpp:26:15:26:15 | *f [a_] |
| constructors.cpp:43:9:43:9 | g indirection [b_] | constructors.cpp:26:15:26:15 | *f [b_] |
| constructors.cpp:46:9:46:9 | h indirection [a_] | constructors.cpp:26:15:26:15 | *f [a_] |
| constructors.cpp:46:9:46:9 | h indirection [b_] | constructors.cpp:26:15:26:15 | *f [b_] |
| qualifiers.cpp:9:21:9:25 | value | qualifiers.cpp:9:36:9:36 | a [post update] |
| qualifiers.cpp:9:36:9:36 | a [post update] | qualifiers.cpp:9:30:9:33 | this [post update] [a] |
| qualifiers.cpp:12:40:12:44 | value | qualifiers.cpp:12:56:12:56 | a [post update] |
@@ -730,7 +735,8 @@ edges
| realistic.cpp:61:32:61:34 | baz [read] [userInput, bufferLen] | realistic.cpp:61:37:61:45 | userInput [read] [bufferLen] |
| realistic.cpp:61:37:61:45 | userInput [read] [bufferLen] | realistic.cpp:61:47:61:55 | FieldAddress [read] |
| realistic.cpp:61:47:61:55 | FieldAddress [read] | realistic.cpp:61:14:61:55 | (void *)... |
| simple.cpp:18:9:18:9 | this [a_] | simple.cpp:18:22:18:23 | this [read] [a_] |
| simple.cpp:18:9:18:9 | *#this [a_] | simple.cpp:18:22:18:23 | this [read] [a_] |
| simple.cpp:18:9:18:9 | *#this [b_] | simple.cpp:18:9:18:9 | ReturnIndirection [b_] |
| simple.cpp:18:22:18:23 | FieldAddress [read] | simple.cpp:18:9:18:9 | ReturnValue |
| simple.cpp:18:22:18:23 | this [read] [a_] | simple.cpp:18:22:18:23 | FieldAddress [read] |
| simple.cpp:19:9:19:9 | this [b_] | simple.cpp:19:22:19:23 | this [read] [b_] |
@@ -741,36 +747,40 @@ edges
| simple.cpp:21:10:21:13 | *#this [a_] | simple.cpp:21:10:21:13 | ReturnIndirection [a_] |
| simple.cpp:21:19:21:19 | b | simple.cpp:21:24:21:25 | b_ [post update] |
| simple.cpp:21:24:21:25 | b_ [post update] | simple.cpp:21:24:21:25 | this [post update] [b_] |
| simple.cpp:26:15:26:15 | f [a_] | simple.cpp:28:12:28:12 | f [a_] |
| simple.cpp:26:15:26:15 | f [b_] | simple.cpp:29:12:29:12 | f [b_] |
| simple.cpp:28:12:28:12 | f [a_] | simple.cpp:18:9:18:9 | this [a_] |
| simple.cpp:28:12:28:12 | f [a_] | simple.cpp:28:12:28:12 | call to a |
| simple.cpp:26:15:26:15 | *f [a_] | simple.cpp:28:10:28:10 | f indirection [a_] |
| simple.cpp:26:15:26:15 | *f [b_] | simple.cpp:28:10:28:10 | f indirection [b_] |
| simple.cpp:26:15:26:15 | *f [b_] | simple.cpp:29:12:29:12 | f [b_] |
| simple.cpp:28:10:28:10 | a output argument [b_] | simple.cpp:29:12:29:12 | f [b_] |
| simple.cpp:28:10:28:10 | f indirection [a_] | simple.cpp:18:9:18:9 | *#this [a_] |
| simple.cpp:28:10:28:10 | f indirection [a_] | simple.cpp:28:12:28:12 | call to a |
| simple.cpp:28:10:28:10 | f indirection [b_] | simple.cpp:18:9:18:9 | *#this [b_] |
| simple.cpp:28:10:28:10 | f indirection [b_] | simple.cpp:28:10:28:10 | a output argument [b_] |
| simple.cpp:29:12:29:12 | f [b_] | simple.cpp:19:9:19:9 | this [b_] |
| simple.cpp:29:12:29:12 | f [b_] | simple.cpp:29:12:29:12 | call to b |
| simple.cpp:39:7:39:10 | call to user_input | simple.cpp:20:19:20:19 | a |
| simple.cpp:39:7:39:10 | call to user_input | simple.cpp:39:7:39:10 | f [post update] [a_] |
| simple.cpp:39:7:39:10 | f [post update] [a_] | simple.cpp:45:5:45:7 | f [a_] |
| simple.cpp:39:7:39:10 | f [post update] [a_] | simple.cpp:45:9:45:9 | f indirection [a_] |
| simple.cpp:39:12:39:21 | call to user_input | simple.cpp:39:7:39:10 | call to user_input |
| simple.cpp:40:7:40:10 | call to user_input | simple.cpp:21:19:21:19 | b |
| simple.cpp:40:7:40:10 | call to user_input | simple.cpp:40:7:40:10 | g [post update] [b_] |
| simple.cpp:40:7:40:10 | g [post update] [b_] | simple.cpp:48:5:48:7 | g [b_] |
| simple.cpp:40:7:40:10 | g [post update] [b_] | simple.cpp:48:9:48:9 | g indirection [b_] |
| simple.cpp:40:12:40:21 | call to user_input | simple.cpp:40:7:40:10 | call to user_input |
| simple.cpp:41:7:41:10 | call to user_input | simple.cpp:20:19:20:19 | a |
| simple.cpp:41:7:41:10 | call to user_input | simple.cpp:41:7:41:10 | h [post update] [a_] |
| simple.cpp:41:7:41:10 | h [post update] [a_] | simple.cpp:42:5:42:5 | h indirection [a_] |
| simple.cpp:41:7:41:10 | h [post update] [a_] | simple.cpp:51:5:51:7 | h [a_] |
| simple.cpp:41:7:41:10 | h [post update] [a_] | simple.cpp:51:9:51:9 | h indirection [a_] |
| simple.cpp:41:12:41:21 | call to user_input | simple.cpp:41:7:41:10 | call to user_input |
| simple.cpp:42:5:42:5 | h indirection [a_] | simple.cpp:21:10:21:13 | *#this [a_] |
| simple.cpp:42:5:42:5 | h indirection [a_] | simple.cpp:42:5:42:5 | setB output argument [a_] |
| simple.cpp:42:5:42:5 | setB output argument [a_] | simple.cpp:51:5:51:7 | h [a_] |
| simple.cpp:42:5:42:5 | setB output argument [a_] | simple.cpp:51:9:51:9 | h indirection [a_] |
| simple.cpp:42:7:42:10 | call to user_input | simple.cpp:21:19:21:19 | b |
| simple.cpp:42:7:42:10 | call to user_input | simple.cpp:42:7:42:10 | h [post update] [b_] |
| simple.cpp:42:7:42:10 | h [post update] [b_] | simple.cpp:51:5:51:7 | h [b_] |
| simple.cpp:42:7:42:10 | h [post update] [b_] | simple.cpp:51:9:51:9 | h indirection [b_] |
| simple.cpp:42:12:42:21 | call to user_input | simple.cpp:42:7:42:10 | call to user_input |
| simple.cpp:45:5:45:7 | f [a_] | simple.cpp:26:15:26:15 | f [a_] |
| simple.cpp:48:5:48:7 | g [b_] | simple.cpp:26:15:26:15 | f [b_] |
| simple.cpp:51:5:51:7 | h [a_] | simple.cpp:26:15:26:15 | f [a_] |
| simple.cpp:51:5:51:7 | h [b_] | simple.cpp:26:15:26:15 | f [b_] |
| simple.cpp:45:9:45:9 | f indirection [a_] | simple.cpp:26:15:26:15 | *f [a_] |
| simple.cpp:48:9:48:9 | g indirection [b_] | simple.cpp:26:15:26:15 | *f [b_] |
| simple.cpp:51:9:51:9 | h indirection [a_] | simple.cpp:26:15:26:15 | *f [a_] |
| simple.cpp:51:9:51:9 | h indirection [b_] | simple.cpp:26:15:26:15 | *f [b_] |
| simple.cpp:65:5:65:5 | a [post update] [i] | simple.cpp:67:10:67:11 | a2 [read] [i] |
| simple.cpp:65:7:65:7 | i [post update] | simple.cpp:65:5:65:5 | a [post update] [i] |
| simple.cpp:65:11:65:20 | call to user_input | simple.cpp:65:7:65:7 | i [post update] |
@@ -1366,8 +1376,8 @@ nodes
| complex.cpp:12:17:12:17 | b | semmle.label | b |
| complex.cpp:12:22:12:23 | b_ [post update] | semmle.label | b_ [post update] |
| complex.cpp:12:22:12:23 | this [post update] [b_] | semmle.label | this [post update] [b_] |
| complex.cpp:40:17:40:17 | b [inner, f, a_] | semmle.label | b [inner, f, a_] |
| complex.cpp:40:17:40:17 | b [inner, f, b_] | semmle.label | b [inner, f, b_] |
| complex.cpp:40:17:40:17 | *b [inner, f, a_] | semmle.label | *b [inner, f, a_] |
| complex.cpp:40:17:40:17 | *b [inner, f, b_] | semmle.label | *b [inner, f, b_] |
| complex.cpp:42:8:42:8 | (reference dereference) [read] [inner, f, a_] | semmle.label | (reference dereference) [read] [inner, f, a_] |
| complex.cpp:42:10:42:14 | inner [read] [f, a_] | semmle.label | inner [read] [f, a_] |
| complex.cpp:42:16:42:16 | f [read] [a_] | semmle.label | f [read] [a_] |
@@ -1402,10 +1412,10 @@ nodes
| complex.cpp:56:14:56:17 | call to user_input | semmle.label | call to user_input |
| complex.cpp:56:14:56:17 | f [post update] [b_] | semmle.label | f [post update] [b_] |
| complex.cpp:56:19:56:28 | call to user_input | semmle.label | call to user_input |
| complex.cpp:59:3:59:5 | b1 [inner, f, a_] | semmle.label | b1 [inner, f, a_] |
| complex.cpp:62:3:62:5 | b2 [inner, f, b_] | semmle.label | b2 [inner, f, b_] |
| complex.cpp:65:3:65:5 | b3 [inner, f, a_] | semmle.label | b3 [inner, f, a_] |
| complex.cpp:65:3:65:5 | b3 [inner, f, b_] | semmle.label | b3 [inner, f, b_] |
| complex.cpp:59:7:59:8 | b1 indirection [inner, f, a_] | semmle.label | b1 indirection [inner, f, a_] |
| complex.cpp:62:7:62:8 | b2 indirection [inner, f, b_] | semmle.label | b2 indirection [inner, f, b_] |
| complex.cpp:65:7:65:8 | b3 indirection [inner, f, a_] | semmle.label | b3 indirection [inner, f, a_] |
| complex.cpp:65:7:65:8 | b3 indirection [inner, f, b_] | semmle.label | b3 indirection [inner, f, b_] |
| conflated.cpp:10:4:10:5 | (reference dereference) [post update] [p] | semmle.label | (reference dereference) [post update] [p] |
| conflated.cpp:10:7:10:7 | FieldAddress [post update] | semmle.label | FieldAddress [post update] |
| conflated.cpp:10:11:10:20 | call to user_input | semmle.label | call to user_input |
@@ -1447,8 +1457,10 @@ nodes
| conflated.cpp:61:12:61:15 | next [read] [y] | semmle.label | next [read] [y] |
| conflated.cpp:61:18:61:18 | FieldAddress [read] | semmle.label | FieldAddress [read] |
| conflated.cpp:61:18:61:18 | y | semmle.label | y |
| constructors.cpp:18:9:18:9 | *#this [a_] | semmle.label | *#this [a_] |
| constructors.cpp:18:9:18:9 | *#this [b_] | semmle.label | *#this [b_] |
| constructors.cpp:18:9:18:9 | ReturnIndirection [b_] | semmle.label | ReturnIndirection [b_] |
| constructors.cpp:18:9:18:9 | ReturnValue | semmle.label | ReturnValue |
| constructors.cpp:18:9:18:9 | this [a_] | semmle.label | this [a_] |
| constructors.cpp:18:22:18:23 | FieldAddress [read] | semmle.label | FieldAddress [read] |
| constructors.cpp:18:22:18:23 | this [read] [a_] | semmle.label | this [read] [a_] |
| constructors.cpp:19:9:19:9 | ReturnValue | semmle.label | ReturnValue |
@@ -1461,10 +1473,12 @@ nodes
| constructors.cpp:23:20:23:20 | b | semmle.label | b |
| constructors.cpp:23:25:23:29 | FieldAddress [post update] | semmle.label | FieldAddress [post update] |
| constructors.cpp:23:32:23:36 | FieldAddress [post update] | semmle.label | FieldAddress [post update] |
| constructors.cpp:26:15:26:15 | f [a_] | semmle.label | f [a_] |
| constructors.cpp:26:15:26:15 | f [b_] | semmle.label | f [b_] |
| constructors.cpp:26:15:26:15 | *f [a_] | semmle.label | *f [a_] |
| constructors.cpp:26:15:26:15 | *f [b_] | semmle.label | *f [b_] |
| constructors.cpp:28:10:28:10 | a output argument [b_] | semmle.label | a output argument [b_] |
| constructors.cpp:28:10:28:10 | f indirection [a_] | semmle.label | f indirection [a_] |
| constructors.cpp:28:10:28:10 | f indirection [b_] | semmle.label | f indirection [b_] |
| constructors.cpp:28:12:28:12 | call to a | semmle.label | call to a |
| constructors.cpp:28:12:28:12 | f [a_] | semmle.label | f [a_] |
| constructors.cpp:29:12:29:12 | call to b | semmle.label | call to b |
| constructors.cpp:29:12:29:12 | f [b_] | semmle.label | f [b_] |
| constructors.cpp:34:11:34:20 | call to user_input | semmle.label | call to user_input |
@@ -1479,10 +1493,10 @@ nodes
| constructors.cpp:36:11:36:37 | call to user_input | semmle.label | call to user_input |
| constructors.cpp:36:11:36:37 | call to user_input | semmle.label | call to user_input |
| constructors.cpp:36:25:36:34 | call to user_input | semmle.label | call to user_input |
| constructors.cpp:40:5:40:7 | f [a_] | semmle.label | f [a_] |
| constructors.cpp:43:5:43:7 | g [b_] | semmle.label | g [b_] |
| constructors.cpp:46:5:46:7 | h [a_] | semmle.label | h [a_] |
| constructors.cpp:46:5:46:7 | h [b_] | semmle.label | h [b_] |
| constructors.cpp:40:9:40:9 | f indirection [a_] | semmle.label | f indirection [a_] |
| constructors.cpp:43:9:43:9 | g indirection [b_] | semmle.label | g indirection [b_] |
| constructors.cpp:46:9:46:9 | h indirection [a_] | semmle.label | h indirection [a_] |
| constructors.cpp:46:9:46:9 | h indirection [b_] | semmle.label | h indirection [b_] |
| qualifiers.cpp:9:21:9:25 | value | semmle.label | value |
| qualifiers.cpp:9:30:9:33 | this [post update] [a] | semmle.label | this [post update] [a] |
| qualifiers.cpp:9:36:9:36 | a [post update] | semmle.label | a [post update] |
@@ -1568,8 +1582,10 @@ nodes
| realistic.cpp:61:32:61:34 | baz [read] [userInput, bufferLen] | semmle.label | baz [read] [userInput, bufferLen] |
| realistic.cpp:61:37:61:45 | userInput [read] [bufferLen] | semmle.label | userInput [read] [bufferLen] |
| realistic.cpp:61:47:61:55 | FieldAddress [read] | semmle.label | FieldAddress [read] |
| simple.cpp:18:9:18:9 | *#this [a_] | semmle.label | *#this [a_] |
| simple.cpp:18:9:18:9 | *#this [b_] | semmle.label | *#this [b_] |
| simple.cpp:18:9:18:9 | ReturnIndirection [b_] | semmle.label | ReturnIndirection [b_] |
| simple.cpp:18:9:18:9 | ReturnValue | semmle.label | ReturnValue |
| simple.cpp:18:9:18:9 | this [a_] | semmle.label | this [a_] |
| simple.cpp:18:22:18:23 | FieldAddress [read] | semmle.label | FieldAddress [read] |
| simple.cpp:18:22:18:23 | this [read] [a_] | semmle.label | this [read] [a_] |
| simple.cpp:19:9:19:9 | ReturnValue | semmle.label | ReturnValue |
@@ -1584,10 +1600,12 @@ nodes
| simple.cpp:21:19:21:19 | b | semmle.label | b |
| simple.cpp:21:24:21:25 | b_ [post update] | semmle.label | b_ [post update] |
| simple.cpp:21:24:21:25 | this [post update] [b_] | semmle.label | this [post update] [b_] |
| simple.cpp:26:15:26:15 | f [a_] | semmle.label | f [a_] |
| simple.cpp:26:15:26:15 | f [b_] | semmle.label | f [b_] |
| simple.cpp:26:15:26:15 | *f [a_] | semmle.label | *f [a_] |
| simple.cpp:26:15:26:15 | *f [b_] | semmle.label | *f [b_] |
| simple.cpp:28:10:28:10 | a output argument [b_] | semmle.label | a output argument [b_] |
| simple.cpp:28:10:28:10 | f indirection [a_] | semmle.label | f indirection [a_] |
| simple.cpp:28:10:28:10 | f indirection [b_] | semmle.label | f indirection [b_] |
| simple.cpp:28:12:28:12 | call to a | semmle.label | call to a |
| simple.cpp:28:12:28:12 | f [a_] | semmle.label | f [a_] |
| simple.cpp:29:12:29:12 | call to b | semmle.label | call to b |
| simple.cpp:29:12:29:12 | f [b_] | semmle.label | f [b_] |
| simple.cpp:39:7:39:10 | call to user_input | semmle.label | call to user_input |
@@ -1604,10 +1622,10 @@ nodes
| simple.cpp:42:7:42:10 | call to user_input | semmle.label | call to user_input |
| simple.cpp:42:7:42:10 | h [post update] [b_] | semmle.label | h [post update] [b_] |
| simple.cpp:42:12:42:21 | call to user_input | semmle.label | call to user_input |
| simple.cpp:45:5:45:7 | f [a_] | semmle.label | f [a_] |
| simple.cpp:48:5:48:7 | g [b_] | semmle.label | g [b_] |
| simple.cpp:51:5:51:7 | h [a_] | semmle.label | h [a_] |
| simple.cpp:51:5:51:7 | h [b_] | semmle.label | h [b_] |
| simple.cpp:45:9:45:9 | f indirection [a_] | semmle.label | f indirection [a_] |
| simple.cpp:48:9:48:9 | g indirection [b_] | semmle.label | g indirection [b_] |
| simple.cpp:51:9:51:9 | h indirection [a_] | semmle.label | h indirection [a_] |
| simple.cpp:51:9:51:9 | h indirection [b_] | semmle.label | h indirection [b_] |
| simple.cpp:65:5:65:5 | a [post update] [i] | semmle.label | a [post update] [i] |
| simple.cpp:65:7:65:7 | i [post update] | semmle.label | i [post update] |
| simple.cpp:65:11:65:20 | call to user_input | semmle.label | call to user_input |
@@ -1698,7 +1716,8 @@ subpaths
| complex.cpp:54:14:54:17 | call to user_input | complex.cpp:12:17:12:17 | b | complex.cpp:12:22:12:23 | this [post update] [b_] | complex.cpp:54:14:54:17 | f [post update] [b_] |
| complex.cpp:55:14:55:17 | call to user_input | complex.cpp:11:17:11:17 | a | complex.cpp:11:22:11:23 | this [post update] [a_] | complex.cpp:55:14:55:17 | f [post update] [a_] |
| complex.cpp:56:14:56:17 | call to user_input | complex.cpp:12:17:12:17 | b | complex.cpp:12:22:12:23 | this [post update] [b_] | complex.cpp:56:14:56:17 | f [post update] [b_] |
| constructors.cpp:28:12:28:12 | f [a_] | constructors.cpp:18:9:18:9 | this [a_] | constructors.cpp:18:9:18:9 | ReturnValue | constructors.cpp:28:12:28:12 | call to a |
| constructors.cpp:28:10:28:10 | f indirection [a_] | constructors.cpp:18:9:18:9 | *#this [a_] | constructors.cpp:18:9:18:9 | ReturnValue | constructors.cpp:28:12:28:12 | call to a |
| constructors.cpp:28:10:28:10 | f indirection [b_] | constructors.cpp:18:9:18:9 | *#this [b_] | constructors.cpp:18:9:18:9 | ReturnIndirection [b_] | constructors.cpp:28:10:28:10 | a output argument [b_] |
| constructors.cpp:29:12:29:12 | f [b_] | constructors.cpp:19:9:19:9 | this [b_] | constructors.cpp:19:9:19:9 | ReturnValue | constructors.cpp:29:12:29:12 | call to b |
| constructors.cpp:34:11:34:26 | call to user_input | constructors.cpp:23:13:23:13 | a | constructors.cpp:23:5:23:7 | this [post update] [a_] | constructors.cpp:34:11:34:26 | Argument this [post update] [a_] |
| constructors.cpp:35:11:35:26 | call to user_input | constructors.cpp:23:20:23:20 | b | constructors.cpp:23:5:23:7 | this [post update] [b_] | constructors.cpp:35:11:35:26 | Argument this [post update] [b_] |
@@ -1708,7 +1727,8 @@ subpaths
| qualifiers.cpp:32:5:32:15 | call to user_input | qualifiers.cpp:12:40:12:44 | value | qualifiers.cpp:12:49:12:53 | inner [post update] [a] | qualifiers.cpp:32:5:32:15 | call to getInner [post update] [a] |
| qualifiers.cpp:37:5:37:17 | call to user_input | qualifiers.cpp:13:42:13:46 | value | qualifiers.cpp:13:51:13:55 | (reference dereference) [post update] [a] | qualifiers.cpp:37:5:37:17 | * ... [post update] [a] |
| qualifiers.cpp:37:5:37:17 | call to user_input | qualifiers.cpp:13:42:13:46 | value | qualifiers.cpp:13:51:13:55 | inner [post update] [a] | qualifiers.cpp:37:5:37:17 | * ... [post update] [a] |
| simple.cpp:28:12:28:12 | f [a_] | simple.cpp:18:9:18:9 | this [a_] | simple.cpp:18:9:18:9 | ReturnValue | simple.cpp:28:12:28:12 | call to a |
| simple.cpp:28:10:28:10 | f indirection [a_] | simple.cpp:18:9:18:9 | *#this [a_] | simple.cpp:18:9:18:9 | ReturnValue | simple.cpp:28:12:28:12 | call to a |
| simple.cpp:28:10:28:10 | f indirection [b_] | simple.cpp:18:9:18:9 | *#this [b_] | simple.cpp:18:9:18:9 | ReturnIndirection [b_] | simple.cpp:28:10:28:10 | a output argument [b_] |
| simple.cpp:29:12:29:12 | f [b_] | simple.cpp:19:9:19:9 | this [b_] | simple.cpp:19:9:19:9 | ReturnValue | simple.cpp:29:12:29:12 | call to b |
| simple.cpp:39:7:39:10 | call to user_input | simple.cpp:20:19:20:19 | a | simple.cpp:20:24:20:25 | this [post update] [a_] | simple.cpp:39:7:39:10 | f [post update] [a_] |
| simple.cpp:40:7:40:10 | call to user_input | simple.cpp:21:19:21:19 | b | simple.cpp:21:24:21:25 | this [post update] [b_] | simple.cpp:40:7:40:10 | g [post update] [b_] |

4
cpp/ql/test/library-tests/dataflow/smart-pointers-taint/test.cpp
View File

@@ -21,9 +21,9 @@ void test_unique_ptr_struct() {
std::unique_ptr<A> p1(new A{source(), 0});
std::unique_ptr<A> p2 = std::make_unique<A>(source(), 0);
sink(p1->x); // $ ir MISSING: ast
sink(p1->x); // $ MISSING: ast,ir
sink(p1->y);
sink(p2->x); // $ ir=22:46 MISSING: ast
sink(p2->x); // $ MISSING: ast,ir=22:46
sink(p2->y);
}

8
cpp/ql/test/library-tests/dataflow/taint-tests/string.cpp
View File

@@ -119,20 +119,20 @@ void test_string_constructors_assignments()
void test_range_based_for_loop_string() {
std::string s(source());
for(char c : s) {
sink(c); // $ ast,ir
sink(c); // $ ast MISSING: ir
}
for(std::string::iterator it = s.begin(); it != s.end(); ++it) {
sink(*it); // $ ast,ir
sink(*it); // $ ast MISSING: ir
}
for(char& c : s) {
sink(c); // $ ast,ir
sink(c); // $ ast MISSING: ir
}
const std::string const_s(source());
for(const char& c : const_s) {
sink(c); // $ ast,ir
sink(c); // $ ast MISSING: ir
}
}

4
cpp/ql/test/library-tests/dataflow/taint-tests/swap1.cpp
View File

@@ -100,7 +100,7 @@ void test_move_assignment_operator()
y = std::move(x);
sink(y.data1); // $ ir ast=95:15 SPURIOUS: ast=93:23
sink(x.data1); // $ ast,ir
sink(x.data1); // $ ast MISSING: ir
}
void test_move_constructor()
@@ -142,7 +142,7 @@ void test_move_assignment_method()
y.move_assign(std::move(x));
sink(y.data1); // $ ir ast=137:15 SPURIOUS: ast=135:23
sink(x.data1); // $ ast,ir
sink(x.data1); // $ ast MISSING: ir
}
}

4
cpp/ql/test/library-tests/dataflow/taint-tests/swap2.cpp
View File

@@ -100,7 +100,7 @@ void test_move_assignment_operator()
y = std::move(x);
sink(y.data1); // $ ir ast=95:15 SPURIOUS: ast=93:23
sink(x.data1); // $ ast,ir
sink(x.data1); // $ ast MISSING: ir
}
void test_move_constructor()
@@ -142,7 +142,7 @@ void test_move_assignment_method()
y.move_assign(std::move(x));
sink(y.data1); // $ ir ast=137:15 SPURIOUS: ast=135:23
sink(x.data1); // $ ast,ir
sink(x.data1); // $ ast MISSING: ir
}
}

8
cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp
View File

@@ -233,7 +233,7 @@ void test_lambdas()
sink(a()); // $ ast,ir
auto b = [&] {
sink(t); // $ ast,ir
sink(t); // $ ast MISSING: ir
sink(u); // clean
v = source(); // (v is reference captured)
};
@@ -241,19 +241,19 @@ void test_lambdas()
sink(v); // $ MISSING: ast,ir
auto c = [=] {
sink(t); // $ ast,ir
sink(t); // $ ast MISSING: ir
sink(u); // clean
};
c();
auto d = [](int a, int b) {
sink(a); // $ ast,ir
sink(a); // $ ast MISSING: ir
sink(b); // clean
};
d(t, u);
auto e = [](int &a, int &b, int &c) {
sink(a); // $ ast,ir
sink(a); // $ ast MISSING: ir
sink(b); // clean
c = source();
};

8
cpp/ql/test/library-tests/dataflow/taint-tests/vector.cpp
View File

@@ -17,20 +17,20 @@ void test_range_based_for_loop_vector(int source1) {
std::vector<int> v(100, source1);
for(int x : v) {
sink(x); // $ ast,ir
sink(x); // $ ast MISSING: ir
}
for(std::vector<int>::iterator it = v.begin(); it != v.end(); ++it) {
sink(*it); // $ ast,ir
sink(*it); // $ ast MISSING: ir
}
for(int& x : v) {
sink(x); // $ ast,ir
sink(x); // $ ast MISSING: ir
}
const std::vector<int> const_v(100, source1);
for(const int& x : const_v) {
sink(x); // $ ast,ir
sink(x); // $ ast MISSING: ir
}
}