Commit Graph

2357 Commits

Author SHA1 Message Date
Jonas Jensen
399b64b9a6 C++: Enable cpp/alloca-in-loop on LGTM
Now that the query has both tests and qhelp, we can use it on LGTM. This
commit also adds a change note.

I renamed the query to reduce confusion from the lower-case unquoted
word "alloca".
2019-05-01 08:33:32 +02:00
Jonas Jensen
54091e87fa Merge pull request #1136 from zlaski-semmle/cpp340a
[CPP-340] Refinements to FutileParams.ql etc.
2019-05-01 08:21:35 +02:00
Ziemowit Laski
17066cfe3e [CPP-340] Adjust annotations in test.c file. 2019-04-30 13:21:36 -07:00
Ziemowit Laski
be77eb7367 [CPP-340] Add new test cases to test.c; this required the .expected
files to be regenerated.
2019-04-29 15:30:28 -07:00
Robert Marsh
514d405630 C++: Use CallInstruction as DataFlowCall 2019-04-29 14:18:09 -07:00
Tom Hvitved
5f6e9121b3 C++: Generalize FunctionCall to Call in data-flow library 2019-04-29 20:42:07 +02:00
Tom Hvitved
29e59e6d1e Address review comments 2019-04-29 20:19:31 +02:00
semmle-qlci
2ede941097 Merge pull request #1291 from jbj/backEdgeSuccessor-perf
Approved by dave-bartolomeo
2019-04-29 18:18:27 +01:00
semmle-qlci
0ffba8b4eb Merge pull request #1289 from jbj/dominanceFrontier-iterated-ir
Approved by dave-bartolomeo
2019-04-29 18:14:20 +01:00
semmle-qlci
d53f5aac13 Merge pull request #1228 from jbj/ir-result-type-docs
Approved by dave-bartolomeo
2019-04-29 18:07:22 +01:00
Ziemowit Laski
a0cfe826ee [CPP-340] Replace whitelist with f.getBlock() test. Fix doc comment. 2019-04-29 09:58:31 -07:00
Jonas Jensen
5fd425ae95 C++: fix IRBlock::backEdgeSuccessor performance
The `IRBlock::backEdgeSuccessor` predicate, in its three copies, had
become slow:

    6:IRBlock::Cached::backEdgeSuccessor#fff ...... 1m1s
    7:IRBlock::Cached::backEdgeSuccessor#2#fff .... 52.3s
    8:IRBlock::Cached::backEdgeSuccessor#3#fff .... 26.4s

The slow part was finding all the nodes involved in cycles in the
`forwardEdgeRaw` graph. This was done with `forwardEdgeRaw+(pred, pred)`,
but that got compiled into a materialization of `forwardEdgeRaw+`, which
is a huge relation with 1,816,752,107 rows on Wireshark:

    (1474s) Starting to evaluate predicate IRBlock::Cached::backEdgeSuccessor#3#fff
    (1501s) Tuple counts:
    0          ~0%     {2} r1 = SELECT #IRBlock::Cached::forwardEdgeRaw#3#ffPlus ON FIELDS #IRBlock::Cached::forwardEdgeRaw#3#ffPlus.<0>=#IRBlock::Cached::forwardEdgeRaw#3#ffPlus.<1>
    0          ~0%     {1} r2 = SCAN r1 OUTPUT FIELDS {r1.<0>}
    0          ~0%     {3} r3 = JOIN r2 WITH IRBlock::Cached::blockSuccessor#6#fff ON r2.<0>=IRBlock::Cached::blockSuccessor#6#fff.<0> OUTPUT FIELDS {r2.<0>,IRBlock::Cached::blockSuccessor#6#fff.<1>,IRBlock::Cached::blockSuccessor#6#fff.<2>}
    12411      ~7%     {3} r4 = IRBlock::Cached::backEdgeSuccessorRaw#3#fff \/ r3
                       return r4
    (1501s)  >>> Relation IRBlock::Cached::backEdgeSuccessor#3#fff: 12411 rows using 0 MB

The problem is the `SELECT`. It's fast to join on a fastTC result once
we know what we're looking for, so this fix materializes the identity
relation on `IRBlock` and joins with that so the fastTC ends up on the
RHS of a join, where it's fast. I had to introduce a helper predicate
because even with `noopt` I couldn't get `pred = pred2` to come _before_
`forwardEdgeRaw+(pred, pred2)`. The predicate now takes less than a
second to evaluate:

    (539s) Starting to evaluate predicate IRBlock::Cached::backEdgeSuccessor#fff
    (539s)  >>> Relation IRBlock::Cached::blockImmediatelyDominates#ff: 574677 rows using 0 MB
    (539s) 	 ... created with 574677 rows and 2 columns.
    (539s) Tuple counts:
    702445     ~1%     {2} r1 = SELECT IRBlock::Cached::blockIdentity#ff ON FIELDS IRBlock::Cached::blockIdentity#ff.<0>=IRBlock::Cached::blockIdentity#ff.<1>
    702445     ~1%     {2} r2 = SCAN r1 OUTPUT FIELDS {r1.<0>,r1.<0>}
    0          ~0%     {1} r3 = JOIN r2 WITH #IRBlock::Cached::forwardEdgeRaw#ffPlus ON r2.<0>=#IRBlock::Cached::forwardEdgeRaw#ffPlus.<0> AND r2.<1>=#IRBlock::Cached::forwardEdgeRaw#ffPlus.<1> OUTPUT FIELDS {r2.<0>}
    0          ~0%     {3} r4 = JOIN r3 WITH IRBlock::Cached::blockSuccessor#2#fff ON r3.<0>=IRBlock::Cached::blockSuccessor#2#fff.<0> OUTPUT FIELDS {r3.<0>,IRBlock::Cached::blockSuccessor#2#fff.<1>,IRBlock::Cached::blockSuccessor#2#fff.<2>}
    20487      ~0%     {3} r5 = IRBlock::Cached::backEdgeSuccessorRaw#fff \/ r4
                       return r5
    (539s)  >>> Relation IRBlock::Cached::backEdgeSuccessor#fff: 20487 rows using 0 MB
2019-04-29 15:44:50 +02:00
Jonas Jensen
cd7ba176ab C++: iterated dominance frontier algorithm for IR
Use the iterated dominance frontier algorithm to speed up dominance
frontier calculations. The implementation is copied from d310338c9b.

Before this change, the SSA calculations for unaliased and aliased SSA
used 169.9 seconds in total on these predicates:

    7:Dominance::getDominanceFrontier#2#ff .. 49s
    7:Dominance::blockDominates#2#ff ........ 47.5s
    8:Dominance::getDominanceFrontier#ff .... 44.4s
    8:Dominance::blockDominates#ff .......... 29s

After this change, the above predicates are replaced by two copies of
`getDominanceFrontier`, each of which takes less than a second.
2019-04-29 13:01:37 +02:00
ian-semmle
5fd10b56a2 Merge pull request #1280 from jbj/noTarget-workaround
C++: Work around extractor issue CPP-383
2019-04-29 10:47:06 +01:00
Jonas Jensen
c112a4dd20 Merge pull request #1285 from geoffw0/rnperf
CPP: Improve performance of RedundantNullCheckSimple.ql
2019-04-29 08:41:43 +02:00
Ziemowit Laski
4a760b1561 [CPP-340] Delete ArgumentsToImplicit.ql and associated files.
Reduce MistypedFunctionArguments.ql precision to `medium`.
2019-04-28 13:49:46 -07:00
Jonas Jensen
bdb678a318 Merge pull request #1267 from rdmarsh2/rdmarsh/cpp/def-by-ref-taint
C++: add taint edges to DefinitionByReferenceNode
2019-04-26 08:50:20 +02:00
Robert Marsh
f5c57b77e6 C++: fix whitespace 2019-04-25 16:16:27 -07:00
Geoffrey White
63b6942d0d CPP: Improve performance of RedundantNullCheckSimple.ql. 2019-04-25 15:56:49 +01:00
Jonas Jensen
48a3385809 C++: Work around extractor issue CPP-383
This fixes `PointlessComparison.ql` on https://github.com/an-tao/drogon.
The QL is a bit obfuscated because it looks for a pattern that's
impossible according to the dbscheme. There is no accompanying test
because we haven't been able to boil this problem down to a simple test
case. If we could, we'd fix it directly in the extractor instead.
2019-04-25 15:05:27 +02:00
Ziemowit Laski
ac58bdfc58 [CPP-340] For MistypedFunctionArguments.ql, add support for pointers to pointers and pointers to arrays. 2019-04-24 14:54:01 -07:00
Jonas Jensen
1dcfd21a5c Merge pull request #1264 from geoffw0/redundantnullperf
CPP: Add qhelp for RedundantNullCheckSimple.ql.
2019-04-24 10:25:23 +02:00
Robert Marsh
919f5c616f C++: comment and test for taint flow via memcpy 2019-04-23 11:17:18 -07:00
Geoffrey White
6234b26496 CPP: Make some repairs manually. 2019-04-23 14:45:27 +01:00
Geoffrey White
e395f5215f CPP: Autoformat 'Critical'. 2019-04-23 14:45:27 +01:00
Robert Marsh
262f724235 C++: add taint edges to DefinitionByReferenceNode 2019-04-22 10:39:02 -07:00
Robert Marsh
45a35a8572 Merge pull request #1265 from rdmarsh2/rdmarsh/cpp/gvn-string-pooling
C++: string pooling in IR value numbering
2019-04-22 09:29:44 -07:00
Ziemowit Laski
36b2c14f88 [CPP-340] Minor formatting tweaks 2019-04-19 11:46:54 -07:00
Robert Marsh
e7ca6c8bd9 C++: test for value number string pooling 2019-04-19 10:50:52 -07:00
Ziemowit Laski
62b030d27f [CPP-340] Add a fourth query, ArgumentsToImplicit.ql, to deal strictly with implicitly declared
functions.  TooManyArguments.ql will now deal with explicitly declared/prototyped functions.
2019-04-18 17:56:41 -07:00
Robert Marsh
3907ef98a3 C++: value number string constants 2019-04-18 16:14:54 -07:00
Robert Marsh
c6f01265be Merge pull request #1263 from geoffw0/bufferoverflowqueries
CPP: Resolve overlap between OverflowCalculated.ql and NoSpaceForZeroTerminator.ql
2019-04-18 13:21:57 -04:00
Geoffrey White
eaed0004a3 CPP: Add qhelp for RedundantNullCheckSimple.ql. 2019-04-18 12:47:07 +01:00
Geoffrey White
57a4e52b47 CPP: Remove the overlap between these two queries. 2019-04-18 10:33:33 +01:00
Geoffrey White
ca6ba36d87 CPP: Unify and improve the MallocCall classes. 2019-04-18 10:30:18 +01:00
Geoffrey White
1ba8364c3b CPP: Add more test cases. 2019-04-18 10:28:34 +01:00
Geoffrey White
8856442f7f CPP: Add NoSpaceForZeroTerminator to the OverflowCalculated test. 2019-04-18 09:19:44 +01:00
Geoffrey White
12650f85c5 CPP: Rename a test file. 2019-04-18 09:16:55 +01:00
Geoffrey White
c674f54129 Merge pull request #1259 from xiemaisi/cpp/typo-fix
CPP: Fix two doc comments.
2019-04-17 16:48:23 +01:00
Nick Rolfe
bf204ecdf8 C++: update expected extractor arguments to match qltest runner changes 2019-04-17 12:30:04 +01:00
Max Schaefer
599185e125 CPP: Fix two doc comments. 2019-04-17 10:49:38 +01:00
Geoffrey White
f33b24c917 Merge pull request #1239 from jbj/qlformat-1
C++: Autoformat QL code in Architecture and Best Practices
2019-04-17 09:56:29 +01:00
Ziemowit Laski
65130c40ab [CPP-340] Add white list (for false positive suppression) to TooManyArguments.ql 2019-04-16 14:02:34 -07:00
Robert Marsh
09d0548c81 Merge pull request #1237 from geoffw0/commentedoutcode2
CPP: Fix FPs from detecting commented out preprocessor logic
2019-04-16 10:31:42 -07:00
Geoffrey White
2d15163e30 CPP: Test of a comment inside #if 0. 2019-04-16 15:37:21 +01:00
Ziemowit Laski
61c91b67aa [CPP-340] Refactor MistypedFunctionArguments.ql further. 2019-04-14 11:31:10 -07:00
Ziemowit Laski
b58f414ede [CPP-340] Add more test case; exclude K&R definitions of functions when looking
up ()-declarations; refactor QL code.
2019-04-12 17:25:33 -07:00
Jonas Jensen
29aa5f550c C++: Tidy up code so it looks good after qlformat 2019-04-12 10:43:24 +02:00
Nick Rolfe
baf091235c C++: change expected test output following extractor frontend upgrade 2019-04-11 17:45:35 +01:00
Geoffrey White
1e0e3192bb CPP: Restrict to #elif, #else, #endif. 2019-04-11 15:14:21 +01:00