Commit Graph

13844 Commits

Author SHA1 Message Date
Geoffrey White
800555865a CPP: More test cases. 2018-10-05 16:40:54 +01:00
Geoffrey White
2af56b89b1 CPP: Add a test where different wide types are present. 2018-10-05 15:32:36 +01:00
Geoffrey White
39f030b8f7 CPP: Annotate test. 2018-10-05 15:32:36 +01:00
Geoffrey White
e74721e3a4 CPP: Test fixes as a result of changes. 2018-10-05 15:32:36 +01:00
Geoffrey White
6e5207ce3c CPP: Allow declarations of library printf functions in source (repairs most of the tests). 2018-10-05 15:32:36 +01:00
Robert Marsh
fe8f7e9624 C++: consider attributes when finding wide string functions 2018-10-05 15:32:36 +01:00
Robert Marsh
5b8925c699 C++: document new predicate 2018-10-05 15:32:36 +01:00
Robert Marsh
a3459ddf08 C++: add support for custom wide character sizes
Certain Microsoft projects, such as CoreCLR and ChakraCore, use a
library called the PAL, which enables two-byte strings in the printf
family of functions, even when built on a platform with four-byte
strings. This adds support for determining the size of a wide character
from the definitions of such functions, rather than assuming that they
match the compiler's wchar_t.
2018-10-05 15:32:35 +01:00
Jonas Jensen
11e03b3161 C++: Fix primitive_basic_block_member join order
This predicate looked like a join of two already-computed predicates,
but it was a bit more complicated because the `*` operator expands into
two cases: the reflexive case and the transitive case. The join order
for the transitive case placed the `PrimitiveBasicBlock` charpred call
_after_ the `member_step+` call, which means that all the tuples of
`member_step+` passed through the pipeline.

This commit changes the implementation by fully writing out the
expansion of `*` into two cases, where the base case is manually
specialised to make sure the join orderer doesn't get tempted into
reusing the same strategy for both cases. This speeds up the predicate
from 2m38s to 1s on a snapshot of our own C/C++ code.
2018-10-05 14:26:04 +02:00
Jonas Jensen
265852058d C++: Faster implementation of BB entry node
The existing implementation of `primitive_basic_block_entry_node` was
"cleverly" computing two properties about `node` with a single
`strictcount`: whether `node` had multiple predecessors and whether any
of those predecessors had more than once successor. This was fast enough
on most snapshots, but on the snapshot of our own code it took 37
seconds to compute `primitive_basic_block_entry_node` and its auxiliary
predicates. This is likely to have affected other large snapshots too.

With this change, the property is computed like in our other languages,
and it brings the run time down to 4 seconds.
2018-10-05 14:20:03 +02:00
Robert Marsh
f3539e472c C++: add cached module to SimplerangeAnalysis 2018-10-04 15:25:10 -07:00
Jonas Jensen
4720c5ab60 Merge pull request #264 from raulgarciamsft/users/raulga/c6276
C++: incorrect string type conversion
2018-10-04 21:06:07 +02:00
Robert Marsh
d6f6d67c13 Merge pull request #281 from kevinbackhouse/GlobalValueNumberingBugFix
Workaround for getFullyConverted returning multiple results.
2018-10-04 09:54:36 -07:00
Kevin Backhouse
6df9bc855a Workaround for getFullyConverted returning multiple results. 2018-10-04 15:40:18 +01:00
Pavel Avgustinov
6d77a791ac UseInOwnInitialiser: Refactor logic slightly.
By pulling out the class `VariableAccessInInitialiser`, we can
avoid some redundant work on pathological databases, improving
performance.
2018-10-04 14:25:59 +01:00
semmle-qlci
30412caa16 Merge pull request #276 from jbj/PointlessComparison-templates
Approved by kevinbackhouse
2018-10-04 12:34:52 +01:00
Raul Garcia
3873cbdde0 Chnaging the @name & @description. 2018-10-03 15:32:34 -07:00
Jonas Jensen
9c0ba51873 C++: Make cpp/missing-return visible on LGTM again 2018-10-03 15:02:15 +02:00
Jonas Jensen
364c9a6961 C++: Suppress pointless compare in template inst.
It still runs on uninstantiated templates because its underlying
libraries do. It's not clear whether that leads to other false
positives, but that's independent of the change I'm making here.
2018-10-03 14:48:11 +02:00
Jonas Jensen
2eea359f79 C++: Test for PointlessComparison with templates 2018-10-03 14:47:00 +02:00
Jonas Jensen
4ad4b19911 Merge pull request #189 from geoffw0/wrongtypedef
CPP: Permit more typedefs in WrongTypeFormatArguments.ql
2018-10-03 09:40:06 +02:00
Raul Garcia
492b511cdf Merge operation 2018-10-02 11:27:39 -07:00
Raul Garcia
230724c085 Updates based on feedback 2018-10-02 11:17:23 -07:00
Tobias Smolka
51dcdeff59 C++: support Decltype in suspicious-call-to-memset 2018-10-02 16:47:04 +02:00
Raul Garcia
99e6708b2b Merge branch 'master' into users/raulga/c6276 2018-10-01 10:28:54 -07:00
Raul Garcia
253b8d1287 C++ : cpp/incorrect-string-type-conversion
Cast between semantically different string types: char* from/to wchar_t*
NOTE: Please let me know if you want to use a different CWE than CWE-704
2018-10-01 10:25:49 -07:00
Aditya Sharad
337defdf3d Merge master into next. 2018-10-01 17:39:27 +01:00
Jonas Jensen
308631e8ff C++: Add two recent queries to query suites 2018-10-01 13:42:12 +02:00
Aditya Sharad
0882eb7bb3 Merge rc/1.18 into master. 2018-10-01 12:08:16 +01:00
Jonas Jensen
532a64f211 C++: Name/description of HResultBooleanConversion
This commit changes the name and description of the new
`HResultBooleanConversion` query to follow our internal guidelines.
2018-10-01 12:12:00 +02:00
Dave Bartolomeo
37091953dc C++: Fix test expectations after rebase 2018-09-30 08:25:42 -07:00
Dave Bartolomeo
eb987d5da9 C++: Make Instruction.toString() less expensive
Previously, `Instruction.toString()` returned the same string that is used in IR dumps, which requires numbering all instructions and generating a unique string for each instruction. This is too expensive on large snapshots. I've moved the original code into the new `Instruction.getDumpString()`, and made `Instruction.toString()` just return the opcode plus `getAST().toString()`.
2018-09-30 08:22:15 -07:00
Jonas Jensen
16004facd9 Merge pull request #197 from rdmarsh2/rdmarsh/cpp/ir-guards
IR-based guards library
2018-09-28 21:14:08 +02:00
Aditya Sharad
1c71a856e1 Version: Bump to 1.18.1 dev. 2018-09-28 16:39:44 +01:00
Robert Marsh
93732d8b5a C++: Combine IR guard tests into one ql file
This is motivated by test performance; IR compilation happens separately
for each test and takes a bit over a minute, so combining these 8 tests
saves about 10 minutes of test running.
2018-09-27 13:53:02 -07:00
Pavel Avgustinov
c7137cee75 Merge pull request #245 from adityasharad/merge/1.18-next-270918
Merge rc/1.18 into next.
2018-09-27 21:51:44 +01:00
Robert Marsh
b6cc6a3b23 C++: Fix BinaryLogicalOperators always being guards 2018-09-27 13:09:15 -07:00
Robert Marsh
f323fa1df8 C++: test changes from previous commit
The IR for the conversion to bool results in a comparison where the left
hand side is not the result of any expression in the AST, so they can't
be usefully converted back to the AST
2018-09-27 13:06:57 -07:00
Nick Rolfe
a55d6d7631 C++: CRLF -> LF in .expected file 2018-09-27 17:03:31 +01:00
Aditya Sharad
5ff9e3514d Merge rc/1.18 into next. 2018-09-27 15:20:25 +01:00
ian-semmle
077ce6a4be Merge pull request #242 from jbj/unresolveCheckResult
C++: Make unresolve dispatch on `result`
2018-09-27 14:59:34 +01:00
Jonas Jensen
19435e07a1 C++: Fix join order in CommentedOutCode
After the recent inlining of `unresolveElement`, the join order in
`CommentedOutCode` became a problem. The join orderer was tempted to
join the two `hasLocationInfo` calls first because they had one column
in common. With this commit, they have no columns in common. It follows
from the other predicates in the same file that this column would be the
same, so there is no need to assert it in this predicate and risk that
the join orderer uses that information.

On Wireshark, the `CommentBlock::hasLocationInfo` predicate goes from
taking 2m2s to taking 180ms. The query produces the same 7,448 alerts.
2018-09-27 14:07:13 +02:00
Jonas Jensen
0da452d59a C++: Revert object-orientation of unresolveElement
The change to make `unresolveElement` a member predicate was helpful for
the optimiser when it dispatched on `this`, but now that it "dispatches"
on `result` it's just an unnecessary pollution of the `ElementBase`
namespace.
2018-09-27 13:25:30 +02:00
Jonas Jensen
c61b311682 C++: Make unresolve dispatch on result, not this
This change means that there are no results for `unresolveElement(t)`
where `t` is a "junk type" -- a class definition that is not in the
image of `resolveClass`. These "junk types" still exist as `Element`s,
but they will never be returned by any predicate that goes through
`unresolveElement` to query the db.

We get a small reduction in DIL size and a significant speed
improvement. The DIL for `NewArrayDeleteMismatch.ql` is reduced from
27,630 lines to 27,507 lines, and the total analysis time for the LGTM
suite on jdk8u is reduced from 1158s to 984s.
2018-09-27 13:23:11 +02:00
Aditya Sharad
4767d85a96 Merge pull request #239 from ian-semmle/type_mention
C++: Update test output
2018-09-27 11:02:46 +01:00
Ian Lynagh
fd91374b2f C++: Update test output 2018-09-26 18:22:20 +01:00
Aditya Sharad
51697f077c Version: Bump to 1.18.0 release. 2018-09-26 18:18:20 +01:00
Aditya Sharad
4ff79b046d C++: Update HashCons test output. 2018-09-26 17:56:21 +01:00
Anders Schack-Mulligen
9198f5b9bd CPP/CSharp/Java/Javascript: Use concat in XMLParent.allCharactersString(). 2018-09-26 15:47:21 +02:00
Anders Schack-Mulligen
26c1397216 CPP/CSharp/Javascript: Clean up QLDoc and bring the different XML.qll files closer. 2018-09-26 15:36:20 +02:00