Commit Graph

6915 Commits

Author SHA1 Message Date
Dave Bartolomeo
de5c77c4e2 Update cpp/ql/src/Architecture/Refactoring Opportunities/ClassesWithManyFields.ql
Co-Authored-By: geoffw0 <40627776+geoffw0@users.noreply.github.com>
2019-05-01 10:36:00 +01:00
Geoffrey White
89c26ca394 CPP: Rewrite the VDE grouping in ClassesWithManyField.ql to be more performant (and modern). 2019-05-01 10:35:59 +01:00
Geoffrey White
0cc4b23484 CPP: QLDoc some predicates. 2019-05-01 10:35:57 +01:00
Geoffrey White
ab0505ea65 CPP: Undo autoformat so that things can merge. 2019-05-01 10:35:30 +01:00
Jonas Jensen
1203c7305a Merge pull request #1261 from geoffw0/autoformat
CPP: Autoformat the Critical queries directory
2019-05-01 11:19:21 +02:00
Geoffrey White
09ce95575a CPP: Fix merge. 2019-05-01 09:08:44 +01:00
Jonas Jensen
40aea2f76d C++: Shorten alert message
We don't write the reason for the alert in the alert message.
2019-05-01 08:33:36 +02:00
Jonas Jensen
e38ac9f88a C++: suppress alerts in tightly bounded loops 2019-05-01 08:33:35 +02:00
Jonas Jensen
399b64b9a6 C++: Enable cpp/alloca-in-loop on LGTM
Now that the query has both tests and qhelp, we can use it on LGTM. This
commit also adds a change note.

I renamed the query to reduce confusion from the lower-case unquoted
word "alloca".
2019-05-01 08:33:32 +02:00
Jonas Jensen
54091e87fa Merge pull request #1136 from zlaski-semmle/cpp340a
[CPP-340] Refinements to FutileParams.ql etc.
2019-05-01 08:21:35 +02:00
Ziemowit Laski
17066cfe3e [CPP-340] Adjust annotations in test.c file. 2019-04-30 13:21:36 -07:00
Ziemowit Laski
be77eb7367 [CPP-340] Add new test cases to test.c; this required the .expected
files to be regenerated.
2019-04-29 15:30:28 -07:00
Robert Marsh
514d405630 C++: Use CallInstruction as DataFlowCall 2019-04-29 14:18:09 -07:00
Tom Hvitved
5f6e9121b3 C++: Generalize FunctionCall to Call in data-flow library 2019-04-29 20:42:07 +02:00
Tom Hvitved
29e59e6d1e Address review comments 2019-04-29 20:19:31 +02:00
semmle-qlci
2ede941097 Merge pull request #1291 from jbj/backEdgeSuccessor-perf
Approved by dave-bartolomeo
2019-04-29 18:18:27 +01:00
semmle-qlci
0ffba8b4eb Merge pull request #1289 from jbj/dominanceFrontier-iterated-ir
Approved by dave-bartolomeo
2019-04-29 18:14:20 +01:00
semmle-qlci
d53f5aac13 Merge pull request #1228 from jbj/ir-result-type-docs
Approved by dave-bartolomeo
2019-04-29 18:07:22 +01:00
Ziemowit Laski
a0cfe826ee [CPP-340] Replace whitelist with f.getBlock() test. Fix doc comment. 2019-04-29 09:58:31 -07:00
Jonas Jensen
5fd425ae95 C++: fix IRBlock::backEdgeSuccessor performance
The `IRBlock::backEdgeSuccessor` predicate, in its three copies, had
become slow:

    6:IRBlock::Cached::backEdgeSuccessor#fff ...... 1m1s
    7:IRBlock::Cached::backEdgeSuccessor#2#fff .... 52.3s
    8:IRBlock::Cached::backEdgeSuccessor#3#fff .... 26.4s

The slow part was finding all the nodes involved in cycles in the
`forwardEdgeRaw` graph. This was done with `forwardEdgeRaw+(pred, pred)`,
but that got compiled into a materialization of `forwardEdgeRaw+`, which
is a huge relation with 1,816,752,107 rows on Wireshark:

    (1474s) Starting to evaluate predicate IRBlock::Cached::backEdgeSuccessor#3#fff
    (1501s) Tuple counts:
    0          ~0%     {2} r1 = SELECT #IRBlock::Cached::forwardEdgeRaw#3#ffPlus ON FIELDS #IRBlock::Cached::forwardEdgeRaw#3#ffPlus.<0>=#IRBlock::Cached::forwardEdgeRaw#3#ffPlus.<1>
    0          ~0%     {1} r2 = SCAN r1 OUTPUT FIELDS {r1.<0>}
    0          ~0%     {3} r3 = JOIN r2 WITH IRBlock::Cached::blockSuccessor#6#fff ON r2.<0>=IRBlock::Cached::blockSuccessor#6#fff.<0> OUTPUT FIELDS {r2.<0>,IRBlock::Cached::blockSuccessor#6#fff.<1>,IRBlock::Cached::blockSuccessor#6#fff.<2>}
    12411      ~7%     {3} r4 = IRBlock::Cached::backEdgeSuccessorRaw#3#fff \/ r3
                       return r4
    (1501s)  >>> Relation IRBlock::Cached::backEdgeSuccessor#3#fff: 12411 rows using 0 MB

The problem is the `SELECT`. It's fast to join on a fastTC result once
we know what we're looking for, so this fix materializes the identity
relation on `IRBlock` and joins with that so the fastTC ends up on the
RHS of a join, where it's fast. I had to introduce a helper predicate
because even with `noopt` I couldn't get `pred = pred2` to come _before_
`forwardEdgeRaw+(pred, pred2)`. The predicate now takes less than a
second to evaluate:

    (539s) Starting to evaluate predicate IRBlock::Cached::backEdgeSuccessor#fff
    (539s)  >>> Relation IRBlock::Cached::blockImmediatelyDominates#ff: 574677 rows using 0 MB
    (539s) 	 ... created with 574677 rows and 2 columns.
    (539s) Tuple counts:
    702445     ~1%     {2} r1 = SELECT IRBlock::Cached::blockIdentity#ff ON FIELDS IRBlock::Cached::blockIdentity#ff.<0>=IRBlock::Cached::blockIdentity#ff.<1>
    702445     ~1%     {2} r2 = SCAN r1 OUTPUT FIELDS {r1.<0>,r1.<0>}
    0          ~0%     {1} r3 = JOIN r2 WITH #IRBlock::Cached::forwardEdgeRaw#ffPlus ON r2.<0>=#IRBlock::Cached::forwardEdgeRaw#ffPlus.<0> AND r2.<1>=#IRBlock::Cached::forwardEdgeRaw#ffPlus.<1> OUTPUT FIELDS {r2.<0>}
    0          ~0%     {3} r4 = JOIN r3 WITH IRBlock::Cached::blockSuccessor#2#fff ON r3.<0>=IRBlock::Cached::blockSuccessor#2#fff.<0> OUTPUT FIELDS {r3.<0>,IRBlock::Cached::blockSuccessor#2#fff.<1>,IRBlock::Cached::blockSuccessor#2#fff.<2>}
    20487      ~0%     {3} r5 = IRBlock::Cached::backEdgeSuccessorRaw#fff \/ r4
                       return r5
    (539s)  >>> Relation IRBlock::Cached::backEdgeSuccessor#fff: 20487 rows using 0 MB
2019-04-29 15:44:50 +02:00
Jonas Jensen
cd7ba176ab C++: iterated dominance frontier algorithm for IR
Use the iterated dominance frontier algorithm to speed up dominance
frontier calculations. The implementation is copied from d310338c9b.

Before this change, the SSA calculations for unaliased and aliased SSA
used 169.9 seconds in total on these predicates:

    7:Dominance::getDominanceFrontier#2#ff .. 49s
    7:Dominance::blockDominates#2#ff ........ 47.5s
    8:Dominance::getDominanceFrontier#ff .... 44.4s
    8:Dominance::blockDominates#ff .......... 29s

After this change, the above predicates are replaced by two copies of
`getDominanceFrontier`, each of which takes less than a second.
2019-04-29 13:01:37 +02:00
ian-semmle
5fd10b56a2 Merge pull request #1280 from jbj/noTarget-workaround
C++: Work around extractor issue CPP-383
2019-04-29 10:47:06 +01:00
Jonas Jensen
c112a4dd20 Merge pull request #1285 from geoffw0/rnperf
CPP: Improve performance of RedundantNullCheckSimple.ql
2019-04-29 08:41:43 +02:00
Ziemowit Laski
4a760b1561 [CPP-340] Delete ArgumentsToImplicit.ql and associated files.
Reduce MistypedFunctionArguments.ql precision to `medium`.
2019-04-28 13:49:46 -07:00
Jonas Jensen
bdb678a318 Merge pull request #1267 from rdmarsh2/rdmarsh/cpp/def-by-ref-taint
C++: add taint edges to DefinitionByReferenceNode
2019-04-26 08:50:20 +02:00
Robert Marsh
f5c57b77e6 C++: fix whitespace 2019-04-25 16:16:27 -07:00
Geoffrey White
63b6942d0d CPP: Improve performance of RedundantNullCheckSimple.ql. 2019-04-25 15:56:49 +01:00
Jonas Jensen
48a3385809 C++: Work around extractor issue CPP-383
This fixes `PointlessComparison.ql` on https://github.com/an-tao/drogon.
The QL is a bit obfuscated because it looks for a pattern that's
impossible according to the dbscheme. There is no accompanying test
because we haven't been able to boil this problem down to a simple test
case. If we could, we'd fix it directly in the extractor instead.
2019-04-25 15:05:27 +02:00
Ziemowit Laski
ac58bdfc58 [CPP-340] For MistypedFunctionArguments.ql, add support for pointers to pointers and pointers to arrays. 2019-04-24 14:54:01 -07:00
Jonas Jensen
1dcfd21a5c Merge pull request #1264 from geoffw0/redundantnullperf
CPP: Add qhelp for RedundantNullCheckSimple.ql.
2019-04-24 10:25:23 +02:00
Robert Marsh
919f5c616f C++: comment and test for taint flow via memcpy 2019-04-23 11:17:18 -07:00
Geoffrey White
6234b26496 CPP: Make some repairs manually. 2019-04-23 14:45:27 +01:00
Geoffrey White
e395f5215f CPP: Autoformat 'Critical'. 2019-04-23 14:45:27 +01:00
Robert Marsh
262f724235 C++: add taint edges to DefinitionByReferenceNode 2019-04-22 10:39:02 -07:00
Robert Marsh
45a35a8572 Merge pull request #1265 from rdmarsh2/rdmarsh/cpp/gvn-string-pooling
C++: string pooling in IR value numbering
2019-04-22 09:29:44 -07:00
Ziemowit Laski
36b2c14f88 [CPP-340] Minor formatting tweaks 2019-04-19 11:46:54 -07:00
Robert Marsh
e7ca6c8bd9 C++: test for value number string pooling 2019-04-19 10:50:52 -07:00
Ziemowit Laski
62b030d27f [CPP-340] Add a fourth query, ArgumentsToImplicit.ql, to deal strictly with implicitly declared
functions.  TooManyArguments.ql will now deal with explicitly declared/prototyped functions.
2019-04-18 17:56:41 -07:00
Robert Marsh
3907ef98a3 C++: value number string constants 2019-04-18 16:14:54 -07:00
Robert Marsh
c6f01265be Merge pull request #1263 from geoffw0/bufferoverflowqueries
CPP: Resolve overlap between OverflowCalculated.ql and NoSpaceForZeroTerminator.ql
2019-04-18 13:21:57 -04:00
Geoffrey White
eaed0004a3 CPP: Add qhelp for RedundantNullCheckSimple.ql. 2019-04-18 12:47:07 +01:00
Geoffrey White
57a4e52b47 CPP: Remove the overlap between these two queries. 2019-04-18 10:33:33 +01:00
Geoffrey White
ca6ba36d87 CPP: Unify and improve the MallocCall classes. 2019-04-18 10:30:18 +01:00
Geoffrey White
1ba8364c3b CPP: Add more test cases. 2019-04-18 10:28:34 +01:00
Geoffrey White
8856442f7f CPP: Add NoSpaceForZeroTerminator to the OverflowCalculated test. 2019-04-18 09:19:44 +01:00
Geoffrey White
12650f85c5 CPP: Rename a test file. 2019-04-18 09:16:55 +01:00
Geoffrey White
c674f54129 Merge pull request #1259 from xiemaisi/cpp/typo-fix
CPP: Fix two doc comments.
2019-04-17 16:48:23 +01:00
Nick Rolfe
bf204ecdf8 C++: update expected extractor arguments to match qltest runner changes 2019-04-17 12:30:04 +01:00
Max Schaefer
599185e125 CPP: Fix two doc comments. 2019-04-17 10:49:38 +01:00
Geoffrey White
f33b24c917 Merge pull request #1239 from jbj/qlformat-1
C++: Autoformat QL code in Architecture and Best Practices
2019-04-17 09:56:29 +01:00