Robert Marsh
a9d7990596
C++: make unaliased_ssa IR stage sound
2021-05-06 08:14:33 -07:00
Robert Marsh
d95ef89cee
C++: add test for IR alias analysis soundness
2021-05-06 08:14:32 -07:00
Dave Bartolomeo
383210096c
C++: Isolate models from AST dataflow's reference/object conflation
...
`DataFlowFunction` models treat references a pointers - an explicit level of indirection. The AST dataflow library generally treats references as if they were the referred-to object. This commit removes a workaround in the dataflow model for unary `operator*` on smart pointers, and makes the AST dataflow library adjust the results of querying the model so that a returned reference only gets flow that was modeled as going to the dereference of the return value.
This fixes some missing flow in IR dataflow, and recovers some (presumably) missing reverse taint flow in AST taint tracking as well.
2021-04-21 18:09:44 -04:00
Dave Bartolomeo
1d0cb0407d
Merge from main
2021-04-20 23:37:04 -04:00
Dave Bartolomeo
a447b049fc
C++: Impoved alias analysis of smart pointers
2021-04-20 19:42:06 -04:00
Mathias Vorreiter Pedersen
61d4d17225
C++: Simplify smart pointer model and accept test changes.
2021-04-20 09:57:58 +02:00
Robert Marsh
fe57876fd8
Merge pull request #5643 from dbartol/smart-pointers/side-effect-refactor
...
C++: Refactor some side effect generation code
2021-04-14 09:59:41 -07:00
Jonas Jensen
b4f01c9afa
Merge pull request #5578 from MathiasVP/ast-flow-smart-pointers
...
C++: AST dataflow through smart pointers
2021-04-14 16:39:05 +02:00
Mathias Vorreiter Pedersen
bc7cc2f7ce
C++: Remove rule that wasn't needed.
2021-04-14 14:50:27 +02:00
Mathias Vorreiter Pedersen
da36508714
Revert "C++: As response to the review comments this commit adds a reference-to-pointer state to AddressFlow. A call to an unwrapper function now adds a pointer -> reference-to-pointer transition, and a ReferenceDereference adds a reference-to-pointer -> pointer transition."
...
This reverts commit 5aeaab7c6d
2021-04-14 14:41:22 +02:00
Dave Bartolomeo
697b2dcde8
C++: Add missing store step for single-field struct use
...
We have special code to handle field flow for single-field structs, but that special case was too specific. Some `Store`s to single-field structs have no `Chi` instruction, which is the case that we handled already. However, it is possible for the `Store` to have a `Chi` instruction (e.g. for `{AllAliased}`), but still have a use of the result of the `Store` directly. We now add a `PostUpdateNode` for the result of the `Store` itself in those cases, just like we already did if the `Store` had no `Chi`.
2021-04-12 18:11:41 -04:00
Mathias Vorreiter Pedersen
037e6369ce
C++: Ensure all values are bound in both disjunctions.
2021-04-12 18:27:21 +02:00
Mathias Vorreiter Pedersen
5aeaab7c6d
C++: As response to the review comments this commit adds a reference-to-pointer state to AddressFlow. A call to an unwrapper function now adds a pointer -> reference-to-pointer transition, and a ReferenceDereference adds a reference-to-pointer -> pointer transition.
2021-04-12 16:01:01 +02:00
Dave Bartolomeo
0a86642056
C++: Refactor some side effect generation code
...
This change was necessary for my upcoming changes to introduce side effect instructions for indirections of smart pointers. The code to decide which parameters have which side effects appeared in both the IPA constructor for `TTranslatedSideEffect` and in `TranslatedCall`. These two versions didn't quite agree, especially once the `SideEffectFunction` model provides its own side effects instead of the defaults.
The relevant code has now been factored out into `SideEffects.qll`. This queries the model if one exists, and provides default side effects if no model exists. This fixes at least one existing issue, where we were emitting a buffer read side effect for `*this` instead of an indirect read side effect. This accounts for all of the IR diffs in the tests.
2021-04-09 16:14:03 -04:00
Mathias Vorreiter Pedersen
1510fe370d
C++: Add cases for const pointer wrapper references to AddressFlow and FlowVar.
2021-04-09 20:58:05 +02:00
Mathias Vorreiter Pedersen
2329b31601
C++: Replace the new SmartPointerPartialDefinition with additional steps in AddressFlow.qll
2021-04-09 20:49:45 +02:00
Mathias Vorreiter Pedersen
a460e3ad3d
Merge branch 'main' into ast-flow-smart-pointers
2021-04-09 19:41:10 +02:00
Mathias Vorreiter Pedersen
996cda9b97
C++: Fix incorrect test annotation.
2021-04-09 14:46:46 +02:00
Mathias Vorreiter Pedersen
80d5b17900
C++: Remove the dataflow rule for smart_ptr -> *smart_ptr.
2021-04-09 14:20:51 +02:00
Mathias Vorreiter Pedersen
cae0060a89
C++: Replace the new rules in DataFlowUtil with a dataflow model for pointer wrapper classes.
2021-04-09 14:06:58 +02:00
Mathias Vorreiter Pedersen
0a6aef71a2
C++: Respond to review comments.
2021-04-09 12:29:13 +02:00
Mathias Vorreiter Pedersen
8382e85901
C++: Add flow into the source of read step and out of the target of a store step for smart pointers in AST dataflow.
2021-04-06 14:05:55 +02:00
Mathias Vorreiter Pedersen
f07d844362
C++: Add a test containing missing read/store dataflow steps for smart pointers.
2021-04-06 13:59:27 +02:00
Mathias Vorreiter Pedersen
32a8b9a857
C++: Move copy constructor to its own line and accept test changes.
2021-04-06 08:56:14 +02:00
Mathias Vorreiter Pedersen
9ff894bf83
C++: Add support for AST dataflow out of functions that take a smart pointer by value.
2021-03-31 13:54:32 +02:00
Mathias Vorreiter Pedersen
8159098dc0
C++: Add test from issue #5190 .
2021-03-31 11:32:01 +02:00
Mathias Vorreiter Pedersen
09ba25fe9b
C++: Accept test changes. I'm actually not sure why we lose these results (and lose the field conflation, yay) It might be due to #3364 .
2021-03-30 10:24:01 +02:00
Mathias Vorreiter Pedersen
8c95a9ae39
Merge branch 'main' into definitions-for-unique_ptr
2021-03-30 10:20:36 +02:00
Mathias Vorreiter Pedersen
5a4efab742
C++: Add tests for shared_ptr.
2021-03-29 18:04:20 +02:00
Mathias Vorreiter Pedersen
8dc7b6403a
C++: Add shared_ptr and unique_ptr implementations. Also add some very basic tests.
2021-03-26 12:03:59 +01:00
Mathias Vorreiter Pedersen
983b64a05f
Merge branch 'main' into rdmarsh/cpp/use-taint-configuration-dtt
2021-03-26 09:11:12 +01:00
Mathias Vorreiter Pedersen
0b4650a4c9
C++: Accept test changes.
2021-03-23 10:27:19 +01:00
Mathias Vorreiter Pedersen
7d0cfc69f1
C++: Don't override getParameterSizeIndex in the model for Accept. This fixes IR construction of calls to accept.
2021-03-23 09:53:09 +01:00
Mathias Vorreiter Pedersen
0ff7cc845c
C++: Add reduced testcase that broke IR construction in #5492 .
2021-03-23 09:53:04 +01:00
Mathias Vorreiter Pedersen
dd6b27df24
C++: Fix test annotation.
2021-03-16 22:35:47 +01:00
Mathias Vorreiter Pedersen
a2d75c4fed
Merge branch 'main' into rdmarsh/cpp/use-taint-configuration-dtt
2021-03-11 18:06:37 +01:00
Mathias Vorreiter Pedersen
01cc2f2c77
Merge pull request #5366 from MathiasVP/better-path-explanation-for-this-indirection
...
C++: Replace 'Argument -1 indirection' with 'This indirection'
2021-03-11 10:48:44 +01:00
Jonas Jensen
e1adf5e8b0
Merge pull request #5218 from MathiasVP/no-write-side-effects-for-const-pointer-params
...
C++: Don't generate write side effects for const parameter indirections
2021-03-11 09:48:05 +01:00
Mathias Vorreiter Pedersen
0b6589c8be
C++: Accept test changes.
2021-03-10 15:47:06 +01:00
Mathias Vorreiter Pedersen
0f6c56ad74
C++: Use names that better match the AST dataflow library.
2021-03-10 11:44:19 +01:00
Mathias Vorreiter Pedersen
19d08d7b40
Merge branch 'main' into rdmarsh/cpp/use-taint-configuration-dtt
2021-03-09 12:35:44 +01:00
Mathias Vorreiter Pedersen
d14b993aba
C++: Replace 'Argument -1 indirection' with 'This indirection'.
2021-03-09 10:22:21 +01:00
Mathias Vorreiter Pedersen
e2c0bf3cc0
C++: Show arguments in path explanations and accept test changes.
2021-03-08 12:44:05 +01:00
Mathias Vorreiter Pedersen
bd842403c8
C++: Add testcase
2021-03-05 08:06:22 +01:00
Mathias Vorreiter Pedersen
23876cb581
C++: Only allow taint to a FieldAddressInstruction if it's a union type.
2021-03-04 16:29:44 +01:00
Mathias Vorreiter Pedersen
6c14288fa7
C++: Use new predicate and accept test changes.
2021-03-04 16:05:38 +01:00
Mathias Vorreiter Pedersen
eb4f1e1ba0
C++: Restore some of the lost test results by doing operand -> instruction taint steps in IR TaintTracking.
2021-03-02 15:45:40 +01:00
Mathias Vorreiter Pedersen
23d3109071
C++: Use taintedWithPath in more tests. This is the predicate that's currently hooked up to the new IR taint tracking library.
2021-03-02 13:40:39 +01:00
Mathias Vorreiter Pedersen
6ba35f4aac
C++: Fix function renaming and accept test change.
2021-03-02 11:31:24 +01:00
Mathias Vorreiter Pedersen
9f02c144a8
C++: Remove files that were incorrectly added when resolving merge conflicts.
2021-03-02 11:14:49 +01:00
