Commit Graph

13930 Commits

Author SHA1 Message Date
Dave Bartolomeo
bbe8e7ebfc C++: fix typo, ThrowExpr -> ReThrowExpr
Co-Authored-By: rdmarsh2 <rdmarsh2@gmail.com>
2019-01-31 10:47:17 -08:00
Dave Bartolomeo
ab1f96fb2c Merge pull request #770 from jbj/cfg-static-init-pr
C++: Add addresses to `Expr.isConstant`
2019-01-31 10:24:48 -08:00
Dave Bartolomeo
b0b2fc80c1 Merge pull request #855 from jbj/ir-getRealParent
C++: Simplify TranslatedElement.getRealParent
2019-01-31 10:15:30 -08:00
Dave Bartolomeo
8896d3bf88 Merge pull request #856 from jbj/ir-getInstructionOperandDefinition
C++: Speed up `getInstructionOperandDefinition`
2019-01-31 10:11:59 -08:00
Robert Marsh
ffb46638b0 C++: use more field overrides in IR generation 2019-01-31 07:47:21 -08:00
Robert Marsh
fa56981bce C++: use field overrides in TranslatedExpr 2019-01-31 07:47:21 -08:00
Jonas Jensen
be2a480394 Merge pull request #843 from geoffw0/strtoul
CPP: Improve ArithmeticTainted.ql
2019-01-31 07:04:17 -08:00
Jonas Jensen
b55573ebe3 C++: Accept test changes in ir_gvn.expected 2019-01-31 10:08:16 +01:00
Jonas Jensen
35d7fb5322 C++: Fix TranslatedElement.getInstruction perf
This relation was almost 40x the size it needed to be on Wireshark
because it lacked a restriction on the `tag` parameter. To implement
that restriction efficiently, I had to split the relation in two to
dictate the join order.

With the fix, `getInstruction` now computes the same as
`getInstructionTranslatedElementAndTag`, so the latter could be
simplified.

I made a corresponding change to `TranslatedElement.getTempVariable` for
the sake of consistency.
2019-01-31 08:45:02 +01:00
Jonas Jensen
947634f66f C++: Speed up getInstructionOperandDefinition
A part of `SSAConstruction.getInstructionOperandDefinition` was more
expensive than it had to be. On a ChakraCore snapshot, this changes the
tuple counts from

    3020569 ~2%       {3} r40 = JOIN OperandTag::TUnmodeledUseOperand#f WITH Instruction::Instruction::getFunction_dispred#ff CARTESIAN PRODUCT OUTPUT FIELDS {Instruction::Instruction::getFunction_dispred#ff.<0>,OperandTag::TUnmodeledUseOperand#f.<0>,Instruction::Instruction::getFunction_dispred#ff.<1>}
    62405   ~0%       {3} r41 = JOIN r40 WITH Instruction::UnmodeledUseInstruction#class#fffffff ON r40.<0>=Instruction::UnmodeledUseInstruction#class#fffffff.<0> OUTPUT FIELDS {r40.<2>,r40.<1>,r40.<0>}
    2868421 ~1%       {3} r42 = JOIN r41 WITH Instruction::Instruction::getFunction_dispred#ff_10#join_rhs ON r41.<0>=Instruction::Instruction::getFunction_dispred#ff_10#join_rhs.<0> OUTPUT FIELDS {Instruction::Instruction::getFunction_dispred#ff_10#join_rhs.<1>,r41.<1>,r41.<2>}
    62405   ~0%       {3} r43 = JOIN r42 WITH Instruction::UnmodeledDefinitionInstruction#class#fffffff ON r42.<0>=Instruction::UnmodeledDefinitionInstruction#class#fffffff.<0> OUTPUT FIELDS {r42.<2>,r42.<1>,r42.<0>}

to

    (0s) Starting to evaluate predicate SSAConstruction::Cached::getUnmodeledUseInstruction#ff
    (0s) Tuple counts:
    62405   ~0%     {2} r1 = JOIN Instruction::UnmodeledUseInstruction#class#fffffff WITH Instruction::Instruction::getFunction_dispred#ff ON Instruction::UnmodeledUseInstruction#class#fffffff.<0>=Instruction::Instruction::getFunction_dispred#ff.<0> OUTPUT FIELDS {Instruction::Instruction::getFunction_dispred#ff.<1>,Instruction::Instruction::getFunction_dispred#ff.<0>}
                                      return r1
    ...
    75716   ~0%       {3} r40 = JOIN OperandTag::TUnmodeledUseOperand#f WITH FunctionIR::FunctionIR::getUnmodeledDefinitionInstruction#ff CARTESIAN PRODUCT OUTPUT FIELDS {FunctionIR::FunctionIR::getUnmodeledDefinitionInstruction#ff.<0>,OperandTag::TUnmodeledUseOperand#f.<0>,FunctionIR::FunctionIR::getUnmodeledDefinitionInstruction#ff.<1>}
    62405   ~0%       {3} r41 = JOIN r40 WITH FunctionIR::FunctionIR::getUnmodeledUseInstruction#ff ON r40.<0>=FunctionIR::FunctionIR::getUnmodeledUseInstruction#ff.<0> OUTPUT FIELDS {FunctionIR::FunctionIR::getUnmodeledUseInstruction#ff.<1>,r40.<1>,r40.<2>}
2019-01-31 08:43:00 +01:00
Jonas Jensen
5b685383c8 C++: Simplify TranslatedElement.getRealParent
Now that we have `Expr.getParentWithConversions`, we can implement
`TranslatedElement.getRealParent` simpler. This implementation also
avoids recursion.
2019-01-31 08:41:29 +01:00
Geoffrey White
07adf6f201 CPP: Handle array accesses. 2019-01-30 18:36:32 +00:00
Geoffrey White
4685f193f5 CPP: Widen varMaybeStackAllocated. 2019-01-30 18:36:32 +00:00
Geoffrey White
c87036f2fd CPP: Simplify. 2019-01-30 18:36:32 +00:00
Geoffrey White
276738a435 CPP: Auto-format the query. 2019-01-30 18:36:32 +00:00
Geoffrey White
25e11512db CPP: Add a test of ReturnStackAllocatedMemory. 2019-01-30 18:36:31 +00:00
james
7cc1442ecb Update link text 2019-01-30 09:44:07 +00:00
james
a98aae0a24 update links to lgtm.com/docs 2019-01-30 08:02:03 +00:00
james
81137aa7b4 update links to locations in .ql files 2019-01-30 08:02:02 +00:00
james
9d1a050f35 update links to locations in .qll files 2019-01-30 08:01:49 +00:00
Jonas Jensen
d776d9f903 Merge pull request #821 from geoffw0/query-tags-case
CPP: Improve ArrayArgSizeMismatch.ql
2019-01-29 03:52:52 -08:00
semmle-qlci
bf64fee4bd Merge pull request #790 from rdmarsh2/rdmarsh/cpp/futile-params
Approved by semmledocs-ac
2019-01-28 22:11:44 +00:00
Robert Marsh
9642a78bde C++: add FutileParams.ql to C++ suite
In theory this query will produce no results on C++ code; in practice, I
suspect the "cpp" suite is often run on code compiled as C, so it is
likely to be worth running anyways.
2019-01-28 09:40:19 -08:00
Geoffrey White
b0805f8e79 CPP: Adjust ArithmeticTainted.ql so that it can work on non-VariableAccesses. 2019-01-28 17:36:56 +00:00
Robert Marsh
54fdf9f29d C++/Docs: respond to doc comments on PR 2019-01-28 09:34:45 -08:00
Geoffrey White
f1dc538796 CPP: Add a test using strtoul in a taint query. 2019-01-28 16:59:02 +00:00
Jonas Jensen
ccfb1c229a Merge pull request #831 from geoffw0/query-tags-5
CPP: Tweak tags for consistency
2019-01-28 10:55:09 +01:00
Jonas Jensen
4d441a3bdb Merge pull request #824 from geoffw0/fread
CPP: Add 'fread' to BufferAccess.qll
2019-01-28 09:07:22 +01:00
Jonas Jensen
0dad04bd7e Merge pull request #829 from geoffw0/deprecate-fpv
CPP: Deprecate FunctionPointerVariable and FunctionPointerMemberVariable
2019-01-28 08:47:49 +01:00
Robert Marsh
9decbd9c9f C++: new irreducible CFG test for range analysis 2019-01-25 13:12:40 -08:00
Geoffrey White
1328cb8013 CPP: Tweak tags for consistency across near duplicate queries. 2019-01-25 16:50:05 +00:00
Geoffrey White
98ba308207 CPP: Use memberMayBeVarSize. 2019-01-25 16:40:11 +00:00
Geoffrey White
c527f9c90c CPP: Upgrade precision to high. 2019-01-25 16:38:25 +00:00
Jonas Jensen
c90d4bb24c Merge pull request #822 from geoffw0/query-tags-4
CPP: Query tags 4
2019-01-25 17:08:56 +01:00
Geoffrey White
7bc734aa50 CPP: Deprecate FunctionPointerVariable and FunctionPointerMemberVariable. 2019-01-25 14:57:37 +00:00
Jonas Jensen
ba8bf94d7b C++: Account for chi nodes in back-edge detection 2019-01-25 15:32:19 +01:00
Jonas Jensen
560dbdf984 C++: Test demonstrating chi node back edge bug
This test shows that the back-edge detection does not properly account
for chi nodes in the translation to aliased SSA.
2019-01-25 15:28:53 +01:00
Jonas Jensen
9963270d63 C++: Annotate back edges in IR debug output 2019-01-25 14:16:45 +01:00
Geoffrey White
1a044a0a22 CPP: Add 'fread' to BufferAccess.qll. 2019-01-25 12:58:25 +00:00
Geoffrey White
fd6365838b CPP: Add test cases involving fread. 2019-01-25 12:58:25 +00:00
Jonas Jensen
62509ffb69 C++: Add a back-edge safeguard
This prevents loops of non-back-edges on ChakraCore (see #811).
2019-01-25 12:12:31 +01:00
Jonas Jensen
5b2b961a44 C++: Fix comment (edge is not unique) 2019-01-25 11:28:23 +01:00
Jonas Jensen
34659422db C++: Simplify isStrictlyForwardGoto
We had an existing `Location.isBefore` predicate that was just right for
this use case. Performance is great thanks to magic.
2019-01-25 09:59:28 +01:00
Jonas Jensen
6d09a9b324 C++: Enable range analysis for irreducible CFGs
This adds one new test result (`i >= 0` on line 130).
2019-01-25 09:31:07 +01:00
Jonas Jensen
2aca40a021 Merge pull request #736 from geoffw0/macroinv2
CPP: Deprecate MacroInvocationExpr and MacroInvocationStmt
2019-01-25 09:02:02 +01:00
semmle-qlci
281c944432 Merge pull request #774 from jbj/dataflow-asExpr-conversion
Approved by dave-bartolomeo
2019-01-25 08:00:51 +00:00
Robert Marsh
44d8e6b6e2 C++: respond to PR comments 2019-01-24 10:50:56 -08:00
Geoffrey White
45476f3047 Merge pull request #739 from jbj/strcpy-fixups
C++: Clean up "Use of string copy function in a condition" query
2019-01-24 17:50:40 +00:00
Geoffrey White
c9c7ca9f0c CPP: Tag metric queries. 2019-01-24 17:36:13 +00:00
Geoffrey White
d042890842 CPP: Assign a query precision. 2019-01-24 15:15:03 +00:00