Commit Graph

5006 Commits

Author SHA1 Message Date
Geoffrey White
fbff44ea45 C++: Add reverse taint as well. 2020-08-27 10:09:51 +01:00
Geoffrey White
6ae96baaf6 C++: Model std::vector::data. 2020-08-27 10:08:58 +01:00
Geoffrey White
2235c19593 C++: Add test cases for 'assign' and extra cases for 'data'. 2020-08-27 10:08:42 +01:00
Jonas Jensen
f3e98c3bea C++: Fix join order of FlowVar::definedPartiallyAt
This predicate was very slow on kamailio/kamailio:

    (696s) Tuple counts for FlowVar::FlowVar::definedPartiallyAt_dispred#ff:
    703569     ~3%     {3} r1 = SCAN FlowVar::FlowVar_internal::TBlockVar#fff AS I OUTPUT I.<1>, I.<0>, I.<2>
    7679540588 ~3%     {3} r2 = JOIN r1 WITH FlowVar::PartialDefinitions::PartialDefinition::partiallyDefines_dispred#ff_10#join_rhs AS R ON FIRST 1 OUTPUT R.<1>, r1.<1>, r1.<2>
    567217     ~2%     {2} r3 = JOIN r2 WITH project#FlowVar::PartialDefinitions::PartialDefinition#class#fff#2 AS R ON FIRST 2 OUTPUT r2.<2>, r2.<0>
                       return r3

After this change, the predicate takes no time at all:

    (22s) Tuple counts for FlowVar::FlowVar::definedPartiallyAt_dispred#ff:
    703569  ~3%     {3} r1 = SCAN FlowVar::FlowVar_internal::TBlockVar#fff AS I OUTPUT I.<1>, I.<0>, I.<2>
    567217  ~2%     {2} r2 = JOIN r1 WITH FlowVar::PartialDefinitions::PartialDefinition::partiallyDefinesVariableAt#fff_120#join_rhs AS R ON FIRST 2 OUTPUT r1.<2>, R.<2>
                    return r2

Looking at the code, it turned out that the predicates
`partiallyDefines` and `getSubBasicBlockStart` were almost always used
together and could therefore be merged into a single predicate to get
better join orderings. The predicate `partiallyDefinesThis` was never
used.
2020-08-27 09:52:22 +02:00
Jonas Jensen
2b720b332b C++: Fix join order in reachesWithoutAssignment
The negation in this predicate did not get pulled into an
`#antijoin_rhs` predicate but got materialized as part of each
iteration, which meant that the temporary `ControlFlowNode` column did
not get projected away. The tuple counts looked like this on
kamailio/kamailio (iteration 20):

    5724      ~13%      {3} r9 = JOIN r8 WITH BasicBlocks::Cached::bb_successor_cached#ff@staged_ext AS R ON FIRST 2 OUTPUT r8.<2>, r8.<3>, r8.<1>
    5724      ~12%      {3} r10 = JOIN r8 WITH BasicBlocks::Cached::bb_successor_cached#ff@staged_ext AS R ON FIRST 2 OUTPUT r8.<3>, r8.<2>, r8.<1>
    124717061 ~11%      {4} r11 = JOIN r10 WITH project#FlowVar::FlowVar_internal::assignmentLikeOperation#ffff_10#join_rhs AS R ON FIRST 1 OUTPUT R.<1>, r10.<2>, r10.<1>, r10.<0>
    66        ~0%       {3} r12 = JOIN r11 WITH project#BasicBlocks::Cached::basic_block_member AS R ON FIRST 2 OUTPUT r11.<2>, r11.<3>, r11.<1>
    66                  {3} r13 = MATERIALIZE r12 AS antijoin_rhs
    5658      ~14%      {3} r14 = r9 AND NOT r13(r9.<0>, r9.<1>, r9.<2>)

After manually pulling out the join inside the negation, the time per
iteration drops from ~30 to <1s. The pipeline above is replaced with

    892394  ~0%      {4} r6 = r5 AND NOT FlowVar::FlowVar_internal::assignsToVar#fb AS R(r5.<3>, r5.<2>)
    892394  ~0%      {4} r7 = SCAN r6 OUTPUT r6.<1>, r6.<3>, r6.<0>, r6.<2>
    5658    ~11%     {3} r8 = JOIN r7 WITH BasicBlocks::Cached::bb_successor_cached#ff@staged_ext AS R ON FIRST 2 OUTPUT r7.<2>, r7.<1>, r7.<3>
2020-08-27 09:52:22 +02:00
Robert Marsh
c0edc08315 C++: Simplify non-member iterator operator models 2020-08-26 16:19:03 -07:00
Robert Marsh
994e845ab0 C++: use set literals in iterator models 2020-08-26 16:08:39 -07:00
Robert Marsh
6f0cc16979 C++: remove non-existent operators from model 2020-08-26 15:52:53 -07:00
Mathias Vorreiter Pedersen
1221165792 Merge branch 'main' into mathiasvp/read-step-without-memory-operands 2020-08-26 19:13:54 +02:00
Mathias Vorreiter Pedersen
d900a70738 C++: Accept test changes in query tests 2020-08-26 18:10:21 +02:00
Taus Brock-Nannestad
0f221ccfa2 Merge branch 'main' into python-cpp-make-inline-test-libs-language-agnostic 2020-08-26 17:23:25 +02:00
Mathias Vorreiter Pedersen
dd8984dfc5 C++: Keep ExplicitFieldStoreQualifierNode private 2020-08-26 16:14:58 +02:00
Taus Brock-Nannestad
a824d75e4f C++: Add documentation for the LineComment class 2020-08-26 16:02:26 +02:00
Mathias Vorreiter Pedersen
e4807c0181 C++: Accept test changes 2020-08-26 15:51:09 +02:00
Mathias Vorreiter Pedersen
9d9c78c9f6 C++: Use the information provided by the IR alias analysis to detect dataflow read and store steps. 2020-08-26 15:51:03 +02:00
Mathias Vorreiter Pedersen
2a8ee90828 C++: Demonstrate lack of flow when taking the address of a field and loading it afterwards 2020-08-26 15:50:57 +02:00
Jonas Jensen
f60abd8cf9 Merge pull request #4125 from geoffw0/oparray2
C++: Model operator[]
2020-08-26 13:44:02 +02:00
Nick Rolfe
00316dca8b Merge pull request #4120 from github/igfoo/global_vars
C++: Give fewer types to global variables
2020-08-26 12:29:41 +01:00
Taus Brock-Nannestad
f8ba4c1579 CPP: Make inline expectation test library language agnostic.
In preparation for adding this to Python, I have split out the
definition of the comment class in a separate file (which will be
specific to each language).
2020-08-26 13:06:24 +02:00
Geoffrey White
3f04530d84 C++: Autoformat. 2020-08-26 09:34:06 +01:00
Robert Marsh
83260740ff C++: QLDoc for StdStringBeginEnd 2020-08-25 13:28:13 -07:00
Robert Marsh
c3a65148bc C++: add some missing QLDoc 2020-08-25 13:24:54 -07:00
Robert Marsh
34ddbc0dc2 C++: add std::string::end to model 2020-08-25 13:22:00 -07:00
Geoffrey White
fdf45f02f1 C++: Autoformat. 2020-08-25 18:53:19 +01:00
Geoffrey White
c083c6235d C++: Explicitly model data flow in through reference return values. 2020-08-25 16:20:12 +01:00
Geoffrey White
76a07f7292 C++: Use [, ...] syntax. 2020-08-25 12:30:06 +01:00
Geoffrey White
d31987d496 C++: Additional QLDoc. 2020-08-25 12:21:06 +01:00
Geoffrey White
23a792b8c6 C++: Add tests of nested vectors. 2020-08-25 12:13:32 +01:00
Robert Marsh
9aa3735165 C++: add tests for non-std:: iterators 2020-08-24 14:19:34 -07:00
Geoffrey White
adbfad21ef C++: Correct the localFlow test. 2020-08-24 18:05:30 +01:00
Geoffrey White
ae807f7f33 C++: Autoformat. 2020-08-24 17:36:07 +01:00
Geoffrey White
1c38a4d5d6 Update cpp/ql/src/semmle/code/cpp/dataflow/internal/TaintTrackingUtil.qll
Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com>
2020-08-24 14:33:51 +01:00
Geoffrey White
d3c8ffb995 C++: Clean up, comment, and restrict the new flow to the post-update node of the returned reference. 2020-08-24 14:07:06 +01:00
Geoffrey White
f2caa8a2b0 C++: Reverse taint through function models returning a reference. 2020-08-24 14:05:04 +01:00
Geoffrey White
f25ef26c37 C++: Permit taint flow to the left side of an assignment. 2020-08-24 14:01:49 +01:00
Geoffrey White
1da78ada14 C++: Model 'operator[]' and 'at' for std::string, std::vector and other containers. 2020-08-24 13:58:43 +01:00
Geoffrey White
f6770c5b88 C++: Add tests for std::string 'operator[]' and 'at()'. 2020-08-24 13:49:39 +01:00
Jonas Jensen
b2cd98a98f C++: Confirm correct behaviour on C++20
Making `constexpr` imply `const` was correct for C++11 and was a correct
emulation of a GCC bug on GCC < 5.0. This test confirms that the problem
isn't there in C++20.
2020-08-24 13:42:40 +02:00
Philippe Antoine
07610e0899 Format document 2020-08-24 13:12:54 +02:00
Ian Lynagh
3ead154c9a C++: Add VariableDeclarationEntry test to library-tests/variables/global 2020-08-24 11:51:52 +01:00
Jonas Jensen
cd8e9a1ece C++: Demonstrate that constexpr implies const
This test shows that a member function declared `constexpr` also gets a
`const` specifier.
2020-08-24 11:39:41 +02:00
Ian Lynagh
fb62ce6d25 C++: Give fewer types to global variables
Follows change in the extractor.
2020-08-24 00:49:33 +01:00
Mathias Vorreiter Pedersen
6f750dac88 Merge remote-tracking branch 'origin/main' into alternative-instruction-operand-flow 2020-08-23 18:46:07 +02:00
Robert Marsh
bc0d21879d Merge branch 'main' into rdmarsh2/cpp/input-iterators-1
Resolve test conflict
2020-08-21 14:36:27 -07:00
Robert Marsh
141d240813 C++: autoformat 2020-08-21 14:22:44 -07:00
Robert Marsh
4c82753e8d C++: remove constexpr in stl.h temporarily 2020-08-21 14:22:32 -07:00
Robert Marsh
94d4e05c25 C++: Fix iterator taint flow 2020-08-21 14:04:45 -07:00
Robert Marsh
656340f5c6 C++: more tests for string iterator flow 2020-08-21 13:48:36 -07:00
Geoffrey White
3d171f358a Merge remote-tracking branch 'upstream/main' into vecmethods 2020-08-20 13:29:28 +01:00
Geoffrey White
258b61c5f8 Update cpp/ql/src/semmle/code/cpp/models/implementations/StdContainer.qll
Co-authored-by: Jonas Jensen <jbj@github.com>
2020-08-20 12:53:23 +01:00