Commit Graph

137 Commits

Author SHA1 Message Date
Jonas Jensen
9fb5fbd995 C++: Restructure UnsafeUseOfStrcat for performance
This query gets optimized badly, and it has started timing out when we
run it on our own code base. Most of the evaluation time is spent in an
RA predicate named `#select#cpe#1#f#antijoin_rhs#1`, which takes 1m36s a
Wireshark snapshot.

This restructuring of the code makes the problematic RA predicate go
away.
2018-09-12 09:37:17 +02:00
semmle-qlci
10329fa188 Merge pull request #134 from jbj/getOperandMemoryAccess-this
Approved by dave-bartolomeo
2018-09-06 09:18:57 +01:00
semmle-qlci
43e1e62d3a Merge pull request #133 from jbj/IRBlock-number-split
Approved by dave-bartolomeo
2018-09-05 14:58:15 +01:00
semmle-qlci
a70526f79f Merge pull request #123 from jbj/primitive-bb-number-split
Approved by dave-bartolomeo
2018-09-05 13:21:14 +01:00
Jonas Jensen
e0c073360b C++: Remove CP in getOperandMemoryAccess
The overrides of `Instruction.getOperandMemoryAccess` did not relate
`this` to any of its other parameters, which made it attempt to compute
the Cartesian product of `Instruction` and `TPhiOperand`. This happened
only during computation of aliased SSA. Perhaps the optimizer was able
to eliminate the CP for the non-aliased SSA computation.

With this change, I'm able to compute aliased SSA for medium-sized
snapshots.
2018-09-05 08:52:39 +02:00
Jonas Jensen
5541b9fbf1 C++: Split IRBlock index from IRBlock membership
Instead of computing these two things in one predicate, they are
computed in separate predicates and then joined. This splits the
predicate `getInstruction`, which took 81s before, into predicates that
together take 20s on a medium-sized db.
2018-09-05 08:50:36 +02:00
Jonas Jensen
1bcae97447 Merge pull request #114 from geoffw0/samate-realloc
CPP: Handle 'realloc' better in MemoryMayNotBeFreed.ql
2018-09-05 08:35:13 +02:00
Dave Bartolomeo
4a1d04b423 C++: Fix deprecated predicate warnings 2018-09-04 10:30:48 -07:00
Dave Bartolomeo
4086a8909b C++: Fix a couple IR-related tests to handle new directory tree
Also moved those tests under the IR test directory, so I'm less likely to forget them next time.
2018-09-04 09:05:33 -07:00
Dave Bartolomeo
fce7a5fccb C++: Final IR reshuffle
Moved IR flavors into "implementation", with internal files under "implementation/internal". Made `IRBlockConstruction` just a nested module of `IRConstruction`/`SSAConstruction`, so it gets picked up from the `Construction` parameter of the `IR` module, rather than being picked up just from being in the same directory as `IRBlock`.
2018-09-04 09:05:27 -07:00
Dave Bartolomeo
aa4436fa22 C++: More IR reshuffling
Remove redundant "_ir" suffix.
Move non-user-importable modules into "implementation" directory.
2018-09-04 09:05:21 -07:00
Dave Bartolomeo
97cfbd9488 C++: "IR" means "Aliased SSA IR"
This change makes the public IR.qll module resolve to the flavor of the IR that we want queries to use. Today, this is the aliased SSA flavor of the IR. Should we add additional IR iterations in the future, we'll update IR.qll to resolve to whichever one we consider the default.

I moved the PrintIR.ql and IRSanity.ql queries into the internal directories of the corresponding flavors. There's still a PrintIR.ql and an IRSanity.ql in the public IR directory, which use the same IR flavor as the public IR.qll.
2018-09-04 09:05:15 -07:00
Dave Bartolomeo
9fd5f26e2e C++: Remove unnecessary Impl suffix from some files 2018-09-04 09:05:10 -07:00
Dave Bartolomeo
aacee8fecf C++: Reshuffle IR files into a consistent directory structure
There are no real code changes here, other than to fix up `import`s. All tests still hae the same output, as expected.

A future commit will hide the IR flavors other than the one we want queries to use directly.
2018-09-04 09:05:03 -07:00
Jonas Jensen
e0ba2b2251 C++: Fix name of suppressUnusedType 2018-09-04 13:38:28 +02:00
Jonas Jensen
07bacbf389 C++: Follow suppressUnusedThis convention 2018-09-04 09:40:50 +02:00
Jonas Jensen
88f80e4d4b C++: Silence two more QL compiler warnings
One was for an unused parameter (a deliberate CP of `Type` x
`VoidType`), and one was for use of a deprecated predicate.
2018-09-03 13:45:04 +02:00
Jonas Jensen
ab6dc1d70c C++: Add missing override annotations 2018-09-03 13:22:22 +02:00
Geoffrey White
3e18a9b885 CPP: Improve the special case for realloc in MemoryMayNotBeFreed.ql. 2018-09-03 08:30:05 +01:00
Jonas Jensen
98612b9f9a C++: Tidy primitive_basic_block_member calculation
This change gave a slight speed-up by eliminating an unnecessary
intermediate predicate.
2018-09-01 07:46:00 +02:00
Nick Rolfe
0589be1b8a C++: add qldoc comments for aggregate_{field,array}_init 2018-08-30 22:42:31 +01:00
Nick Rolfe
2130622028 C++: use underlyingElement & unresolveElement for get{Element,Field}Expr 2018-08-30 22:42:31 +01:00
Nick Rolfe
d8d3bfd857 C++: expand aggregate literals test to cover ordering of child exprs 2018-08-30 22:42:30 +01:00
Nick Rolfe
7556f22ff1 C++: stats for aggregate_{field,array}_init 2018-08-30 22:42:30 +01:00
Nick Rolfe
23c648904f C++: properly formatted comments for builtin type kinds 2018-08-30 22:42:30 +01:00
Nick Rolfe
afa7505cae C++: expand test for aggregate literals to include more nesting 2018-08-30 22:42:30 +01:00
Nick Rolfe
4abdeda857 C++: update test output to match corrected extractor behaviour 2018-08-30 22:42:30 +01:00
Nick Rolfe
d068d71ccb C++: dbscheme/library changes to support C99 designated initializers 2018-08-30 22:42:30 +01:00
Jonas Jensen
e7234f5cf3 C++: Split index calculation from BB membership
Instead of computing these two things in one predicate, they are
computed in separate predicates and then joined. This splits the
predicate `primitive_basic_block_member`, which took 77s before, into
predicates that together take 18s on a medium-sized db.
2018-08-30 15:04:01 +02:00
Kevin Backhouse
6c5009225c Merge pull request #111 from olehermanse/gmtime
Fixed error in gmtime example
2018-08-29 15:55:52 -04:00
semmle-qlci
d957c151a6 Merge pull request #110 from jbj/fewer-dbtypes
Approved by ian-semmle
2018-08-29 17:26:06 +01:00
Jonas Jensen
4cc27459ca C++: Remove redundant charpred on Element 2018-08-29 14:09:04 +02:00
Jonas Jensen
8b9e4e347c C++: Introduce ElementBase class
By extending this class, a class can define its own `getLocation`
predicate without participating in the dispatch hierarchy of
`getLocation` as defined on `Element`. Classes wanting to override their
location previously had to define `getURL` or `hasLocationInfo` instead
and rely on these predicates not being defined on future versions of
`Element`.
2018-08-29 13:21:10 +02:00
Jonas Jensen
418a16772b Merge pull request #105 from geoffw0/samate-crement
CPP: Support crement operations in CWE-190
2018-08-29 09:03:29 +02:00
Ole Herman Schumacher Elgesem
00c552fe2f Fixed error in gmtime example
gmtime and gmtime_r take a time_t pointer, so have to store the value
of time(NULL) on the stack.

Signed-off-by: Ole Herman Schumacher Elgesem <oleherman93@gmail.com>
2018-08-28 11:10:11 -07:00
Geoffrey White
0d6373924c CPP: De-conflate cause and effect strings. 2018-08-28 16:39:10 +01:00
Geoffrey White
229d0406bb CPP: Add support for += and -=. 2018-08-28 16:39:10 +01:00
Geoffrey White
87fb447c4b CPP: Improve the logic in ArithmeticWithExtremeValues.ql. 2018-08-28 16:39:10 +01:00
Geoffrey White
a125e3ed86 CPP: Fix crement operations on pointers. 2018-08-28 16:39:09 +01:00
Geoffrey White
d2fd986f40 CPP: Support crement operations in CWE-190. 2018-08-28 16:39:09 +01:00
ian-semmle
1d202dd7cd Merge pull request #24 from nickrolfe/declspec_guard
C++: test for __declspec(guard(...))
2018-08-28 16:15:08 +01:00
Jonas Jensen
24567c57db Merge pull request #109 from dave-bartolomeo/dave/Call
C++: `Invoke` -> `Call`
2018-08-28 15:28:22 +02:00
Jonas Jensen
f88dc37218 Merge pull request #99 from aschackmull/java/fieldflow-perf
Java/C: Improve performance when multiple configs use field flow.
2018-08-28 15:27:29 +02:00
Jonas Jensen
4536d75b2f Merge pull request #93 from ian-semmle/underlyingElement
C++: Add a missing underlyingElement call
2018-08-28 15:24:16 +02:00
Jonas Jensen
ea26ac8c22 C++: Remove unneeded CPython toString overrides
These were made redundant when a1e44041e changed their parent class to
extend `Element`.
2018-08-28 14:58:39 +02:00
Jonas Jensen
38fe45ef32 C++: Don't use dbtypes in Declaration.qll 2018-08-28 14:58:39 +02:00
Jonas Jensen
01dc4385cd C++: Don't use dbtypes in TaintTracking.qll 2018-08-28 14:58:39 +02:00
Jonas Jensen
854d0db552 C++: Don't use dbtypes in ClassesWithManyFields.ql
This changes the test output because `VariableDeclarationGroup.toString`
changes to be the one inherited from VariableDeclarationEntry. This
should not affect the output as shown by any front end because
the string to be displayed to the user for a `$@` interpolation comes
from the following column instead.
2018-08-28 14:58:39 +02:00
Jonas Jensen
1d11a13230 C++: Don't use dbtypes in SuppressionScope
This avoids using a raw db type.

It is possible for `SuppressionComment` and `SuppressionScope` to have
different locations because `SuppressionScope` defines `hasLocationInfo`
as a new rootdef whereas `SuppressionComment` only responds to
`getLocation` that it inherited. In interpretation of query results, a
`hasLocationInfo` predicate is preferred over `getLocation` if it
exists.
2018-08-28 14:58:39 +02:00
Jonas Jensen
f005d45c63 C++: Change SuppressionScope.toString
This should have no effect in itself but changes the test output to
correspond with the change coming next.
2018-08-28 14:58:39 +02:00