Commit Graph

12858 Commits

Author SHA1 Message Date
Jason Reed
9c0be34fd4 C++: Remove accidental redundancy. 2019-03-28 20:39:29 -04:00
Jason Reed
23ee7ee928 C++: Teach range analysis to pay attention to NaNs. 2019-03-28 20:39:29 -04:00
Geoffrey White
f358e61719 CPP: Add a reference about include optimization to the qhelp for AV Rule 35. 2019-03-28 16:37:50 +00:00
Geoffrey White
faa23a53be CPP: Update expected for changes elsewhere. 2019-03-28 15:49:36 +00:00
Geoffrey White
e7c02027f5 CPP: Fix 'BAD'. 2019-03-28 15:49:36 +00:00
Geoffrey White
743b17af50 CPP: Autoformat. 2019-03-28 15:49:36 +00:00
Geoffrey White
0b85966b31 CPP: Fix dubious [old] taint library results involving strlen. 2019-03-28 15:49:36 +00:00
Geoffrey White
8c75e730e4 CPP: Widen TaintedAllocationSize.ql. 2019-03-28 15:49:36 +00:00
Geoffrey White
dab1bba25c CPP: Add a test of TaintedAllocationSize. 2019-03-28 15:49:36 +00:00
Jonas Jensen
debc441d03 Merge pull request #1158 from geoffw0/moremsalloc
CPP: Add more allocation functions to Alloc.qll
2019-03-27 13:51:39 +01:00
Geoffrey White
885df8754e Merge pull request #1165 from dave-bartolomeo/dave/CompareFP
C++: Fix FP in PointlessComparison due to preprocessor
2019-03-27 10:54:26 +00:00
Jonas Jensen
36ba56c690 C++: Tests for PointlessComparison shortcomings 2019-03-27 10:48:35 +01:00
Jonas Jensen
1ffeebcfea C++: Range analysis: support casts from/to typedef 2019-03-27 10:48:35 +01:00
Jonas Jensen
1c71c74ce5 C++: Tests showing problems with casts of typedefs 2019-03-27 10:48:35 +01:00
Jonas Jensen
10585e719d C++: Support widening casts in range analysis
This makes sure we can conclude from `(int)myShort == 0` that `myShort`
is 0 even though we can no longer conclude from `(short)myInt == 0` that
`myInt` is 0. Without this, we lost a good result in the test for
`InfiniteLoopWithUnsatisfiableExitCondition.ql`.
2019-03-27 10:48:34 +01:00
Jonas Jensen
640f900efd C++: Add missing getFullyConverted for unary +/- 2019-03-27 10:48:34 +01:00
Jonas Jensen
50559d5e63 C++: Accept test output change
The new output looks correct, although I'm not sure if it's correct for
the right reasons.
2019-03-27 10:48:34 +01:00
Jonas Jensen
b827e7a1ea C++: Fix use-after-cast bug in SimpleRangeAnalysis
Like everywhere else in the range analysis, operands to comparison
operators must be considered in their fully-converted form.
2019-03-27 10:48:34 +01:00
Jonas Jensen
ad61b4f55e C++: Add test to demonstrate use-after-cast bugs 2019-03-27 10:48:34 +01:00
semmledocs-ac
fa260872b5 Merge pull request #1081 from rdmarsh2/rdmarsh/cpp/alloca-in-loop
C++: docs for AllocaInLoop
2019-03-27 09:10:24 +00:00
Jonas Jensen
581e765f97 Merge pull request #1168 from geoffw0/format-amp
CPP: %@ in format strings
2019-03-27 09:08:39 +01:00
Robert Marsh
578ed146ed Merge pull request #1115 from dave-bartolomeo/dave/Lambdas
C++: IR construction for lambda expressions
2019-03-26 15:08:34 -07:00
Robert Marsh
30f744a824 C++/Docs: fix whitespace in AllocaInLoop.qhelp 2019-03-26 15:07:28 -07:00
Dave Bartolomeo
127b759bad C++: Move a couple predicates into Exclusions.qll 2019-03-26 14:51:28 -07:00
Dave Bartolomeo
f13fc42a85 C++: Make recursive predicates recursive and non-recursive predicates non-recursive 2019-03-26 14:36:35 -07:00
Geoffrey White
1d0c74daa7 CPP: Fix typo. 2019-03-26 14:34:55 +00:00
Jonas Jensen
c923e4cd36 Merge pull request #1091 from geoffw0/opts
CPP: Speed up AV Rule 35.ql
2019-03-26 15:13:53 +01:00
Geoffrey White
69f87d8eee CPP: Fix ODASA-3654. 2019-03-26 12:54:44 +00:00
Jonas Jensen
bdd6965d1b Merge branch 'master' into moremsalloc 2019-03-26 13:50:14 +01:00
Geoffrey White
bd138238b0 CPP: Add a test of ODASA-3654. 2019-03-26 12:37:32 +00:00
Jonas Jensen
010bb61cbb Merge pull request #1164 from geoffw0/overflowdest-enable
CPP: Re-enable OverflowDestination.ql on the security dashboard.
2019-03-26 10:53:34 +01:00
Dave Bartolomeo
669ac2f4b4 C++: Fix FP in PointlessComparison due to preprocessor
Reported by an LGTM customer here: https://discuss.lgtm.com/t/2-false-positives-in-c-for-comparison-is-always-same/1943.

Even though the comparison is pointless in the preprocessor configuration in effect during extraction, it is not pointless in other preprocessor configurations. Similar to ExprHasNoEffect, we'll now exclude results in functions that contain preprocessor-excluded code. I factored the similar code already used in ExprHasNoEffect in a non-recursive version into Preprocessor.qll, leaving the recursive version in ExprHasNoEffect.ql. I believe the recursive version is too aggressive for PointerlessComparison, which does no interprocedural analysis.
2019-03-25 16:19:18 -07:00
Dave Bartolomeo
e25c578011 C++: Use #if 0 instead of comment to exclude broken test case. 2019-03-25 11:10:13 -07:00
Dave Bartolomeo
2e752f48ff C++: Add more Lambda IR test cases
New tests for mixed =/& captures and for captures with initializers
2019-03-25 11:05:53 -07:00
Dave Bartolomeo
8770258714 C++: Add LambdaExpression.getInitializer() 2019-03-25 10:52:57 -07:00
Geoffrey White
193c61c5b5 CPP: Re-enable OverflowDestination.ql on the security dashboard. 2019-03-25 17:40:22 +00:00
Geoffrey White
9b31b4e364 CPP: Fix false positive. 2019-03-25 11:57:23 +00:00
Geoffrey White
7b88bf7617 CPP: Add a test. 2019-03-25 09:22:18 +00:00
Ziemowit Laski
29af56d21b [CPP-340] Refine the test query for mismatching args/params by applying
C promotion rules.  The following issues are now flagged:
             (1) passing a larger type than the receiver can accept
                 (e.g., long long -> int)
             (2) passing a type of different signedness than the
                 parameter specified.
2019-03-24 19:42:05 -07:00
Dave Bartolomeo
d20e5bc69c C++: IR construction for lambda expressions
The IR construction code wasn't handling lambda expressions, so I added `TranslatedLambdaExpression`. It's pretty straightforward: it creates a temporary variable, initializes it with an `Uninitialized` instruction, then initializes the individual captured fields with the initializer list supplied in the AST.

When testing the case of a lambda with no captures, I noticed that we weren't handling initialization of empty structs with an initializer list correctly, so I fixed that along the way.

I was getting confused by the bad indentation for wrapped lines in
TranslatedInitialization.qll, so I fixed that up in a separate commit.
2019-03-22 15:17:27 -07:00
Dave Bartolomeo
f0bd1ab7ab C++: Remove overaggressive line breaks in TranslatedInitialization.qll 2019-03-22 15:17:27 -07:00
Geoffrey White
7fd08233c3 CPP: Optimize AV Rule 35's usesMacro. 2019-03-22 14:43:58 +00:00
Geoffrey White
444259a9ad CPP: Back out support for 'SysAllocString', as PointsTo doesn't support the free(pointer-to-pointer) pattern in 'SysReAllocString' leading to unaccaptable FPs. 2019-03-22 10:59:51 +00:00
Geoffrey White
fbe584f3e1 CPP: Support more MS alloc functions. 2019-03-22 10:59:51 +00:00
Jonas Jensen
db8db8669b Merge pull request #1141 from geoffw0/newfreebug
CPP: Fix a bug in NewFree.qll
2019-03-21 17:22:00 +01:00
Jonas Jensen
552842346c C++: Fix special-casing of Qt library
The `Expr.getType` predicate returns a pointer type since that's the
type of the `new`-expression as a whole. To find the class type, we use
`NewExpr.getAllocatedType`.

This commit reduces the number of alerts in a Qt snapshot from 229 to
51, and it removes the two false positives in
https://github.com/Subsurface-divelog/subsurface.
2019-03-21 13:37:18 +01:00
Jonas Jensen
a59a9f6075 C++: Add test cases for Qt's QObject
The Qt library requires client code to call `new` but not `delete`.
2019-03-21 13:31:50 +01:00
Geoffrey White
867f357b36 CPP: Correct the test. 2019-03-21 10:57:44 +00:00
Ziemowit Laski
5a092d0fed [CPP-340] Create three QL queries: (1) mismatched argument types,
(2) too few arguments and (3) too many arguments.
    Create new 'UnderspecifiedFunction' folders for both queries and tests.
2019-03-20 19:42:51 -07:00
Geoffrey White
5a56740ee6 Merge pull request #1124 from jbj/weak-cryptographic-algorithm-perf
C++: Fix performance of BrokenCryptoAlgorithm.ql
2019-03-20 18:01:58 +00:00