Commit Graph

5239 Commits

Author SHA1 Message Date
Mathias Vorreiter Pedersen
9de570b300 C++: Use the newly added predicates in field flow. This commit also adds a Class column to the FieldContent branch so FieldContent has a pretty toString implementation again. 2020-09-01 10:54:09 +02:00
Mathias Vorreiter Pedersen
1e13a39932 C++: Add getUpdatedInterval predicate to ChiInstructions, and getUsedInterval predicate to NonPhiMemoryOperands. 2020-09-01 10:53:48 +02:00
Robert Marsh
87b657054f C++: reverse flow for iterator operator qualifiers 2020-08-31 14:53:05 -07:00
Robert Marsh
d4cf92e374 C++: Improve non-member iterator operator detection 2020-08-31 14:52:29 -07:00
Robert Marsh
10005dd199 Merge branch 'main' into rdmarsh2/cpp/input-iterators-1Merge changes to input/output models for functions that return thisand resolve conflicting changes to taint tests. 2020-08-31 14:49:01 -07:00
Jonas Jensen
023f2e97c1 C++: Really accept test results this time 2020-08-28 16:50:23 +02:00
Rasmus Lerchedahl Petersen
750735c70c Dataflow: Update test expectations 2020-08-28 15:00:01 +02:00
Jonas Jensen
2c613a72b9 C++: Autoformat 2020-08-28 14:56:19 +02:00
Jonas Jensen
a25cc2d9c7 C++: Accept range-analysis test results 2020-08-28 14:54:44 +02:00
lcartey@github.com
a4cb774932 C++: Support dereferenced variables in simple range analysis
- Support inference of guards on reference variables
 - Support type bounds for reference variables
 - Support reference variables when widening
 - Support reference variables when determining arithmetic assignment
2020-08-28 14:52:36 +02:00
Jonas Jensen
027f22d8e7 C++: Test that range analysis ignores references 2020-08-28 14:41:57 +02:00
Jonas Jensen
a3a3423db2 C++: Treat reference parameters as non-references 2020-08-28 14:33:01 +02:00
Rasmus Lerchedahl Petersen
6b8d9f2a77 Merge branch 'main' of github.com:github/codeql into SharedDataflow_PostUpdateNodes 2020-08-28 13:01:14 +02:00
Rasmus Lerchedahl Petersen
9503c5d8bb Python: Add post-update nodes 2020-08-28 12:59:11 +02:00
Jonas Jensen
55d7ac88f9 Merge pull request #4148 from geoffw0/vecextra
C++: Improvements to string and vector models.
2020-08-28 10:05:42 +02:00
Mathias Vorreiter Pedersen
ceddc2497a Merge pull request #4151 from geoffw0/reftaint
C++: Taint tests for array and reference assignments.
2020-08-27 20:00:13 +02:00
Robert Marsh
2a6c624407 C++: fix up some iterator taint flows 2020-08-27 10:27:53 -07:00
Geoffrey White
9b3da1f6c7 C++: Autoformat. 2020-08-27 16:55:45 +01:00
Geoffrey White
208cd4c888 C++: Fix assign in the test stl.h. 2020-08-27 16:52:22 +01:00
Geoffrey White
927a4faa58 C++: Remove the non-reference case that we shouldn't need. 2020-08-27 15:42:40 +01:00
Geoffrey White
071b303ea0 C++: Make the other versions consistent with this. 2020-08-27 15:24:48 +01:00
Rasmus Wriedt Larsen
36ac111659 Merge pull request #4152 from tausbn/python-sync-inline-test-expectations-files
Python: Sync InlineExpectationsTest.qll between Python and C++
2020-08-27 16:23:08 +02:00
Geoffrey White
865d91de80 C++: Fix getAValueTypeParameterIndex(). 2020-08-27 15:08:58 +01:00
Jonas Jensen
c507b337f2 Merge pull request #3921 from catenacyber/NullCheckParam
C++: Adds another redundant null check rule
2020-08-27 16:07:13 +02:00
Geoffrey White
816b8abd7c C++: Add a test case using a const int *. 2020-08-27 15:05:23 +01:00
Taus Brock-Nannestad
797e290a67 Python+CPP: Change values to value 2020-08-27 14:12:40 +02:00
Taus Brock-Nannestad
dccbcc15b3 Python: Sync InlineExpectationsTest.qll between Python and C++
Also changes `valuesasas` to `values` in the test example.
2020-08-27 13:37:26 +02:00
Geoffrey White
a5a3078b58 C++: Add a test case using a typedef int. 2020-08-27 12:11:56 +01:00
Geoffrey White
6f62803e1f C++: Taint tests for array and reference assignments. 2020-08-27 11:26:25 +01:00
Geoffrey White
111da4c352 C++: Add a model of std::vector::assign. 2020-08-27 10:22:31 +01:00
Jonas Jensen
e949c167fa C++: Add back getSubBasicBlockStart
It turns out this predicate was used in a test, and that use can't be
replaced with the new `partiallyDefinesVariableAt` predicate since
`partiallyDefinesVariableAt` doesn't hold for a `PartialDefinition` that
defines something other than a variable.
2020-08-27 11:14:47 +02:00
Geoffrey White
0952fb9777 C++: Minor correction in one of the string models. 2020-08-27 10:13:12 +01:00
Geoffrey White
fbac4ce44f C++: Split StdStringCStr and allow reverse flow on data. 2020-08-27 10:11:03 +01:00
Geoffrey White
fbff44ea45 C++: Add reverse taint as well. 2020-08-27 10:09:51 +01:00
Geoffrey White
6ae96baaf6 C++: Model std::vector::data. 2020-08-27 10:08:58 +01:00
Geoffrey White
2235c19593 C++: Add test cases for 'assign' and extra cases for 'data'. 2020-08-27 10:08:42 +01:00
Jonas Jensen
f3e98c3bea C++: Fix join order of FlowVar::definedPartiallyAt
This predicate was very slow on kamailio/kamailio:

    (696s) Tuple counts for FlowVar::FlowVar::definedPartiallyAt_dispred#ff:
    703569     ~3%     {3} r1 = SCAN FlowVar::FlowVar_internal::TBlockVar#fff AS I OUTPUT I.<1>, I.<0>, I.<2>
    7679540588 ~3%     {3} r2 = JOIN r1 WITH FlowVar::PartialDefinitions::PartialDefinition::partiallyDefines_dispred#ff_10#join_rhs AS R ON FIRST 1 OUTPUT R.<1>, r1.<1>, r1.<2>
    567217     ~2%     {2} r3 = JOIN r2 WITH project#FlowVar::PartialDefinitions::PartialDefinition#class#fff#2 AS R ON FIRST 2 OUTPUT r2.<2>, r2.<0>
                       return r3

After this change, the predicate takes no time at all:

    (22s) Tuple counts for FlowVar::FlowVar::definedPartiallyAt_dispred#ff:
    703569  ~3%     {3} r1 = SCAN FlowVar::FlowVar_internal::TBlockVar#fff AS I OUTPUT I.<1>, I.<0>, I.<2>
    567217  ~2%     {2} r2 = JOIN r1 WITH FlowVar::PartialDefinitions::PartialDefinition::partiallyDefinesVariableAt#fff_120#join_rhs AS R ON FIRST 2 OUTPUT r1.<2>, R.<2>
                    return r2

Looking at the code, it turned out that the predicates
`partiallyDefines` and `getSubBasicBlockStart` were almost always used
together and could therefore be merged into a single predicate to get
better join orderings. The predicate `partiallyDefinesThis` was never
used.
2020-08-27 09:52:22 +02:00
Jonas Jensen
2b720b332b C++: Fix join order in reachesWithoutAssignment
The negation in this predicate did not get pulled into an
`#antijoin_rhs` predicate but got materialized as part of each
iteration, which meant that the temporary `ControlFlowNode` column did
not get projected away. The tuple counts looked like this on
kamailio/kamailio (iteration 20):

    5724      ~13%      {3} r9 = JOIN r8 WITH BasicBlocks::Cached::bb_successor_cached#ff@staged_ext AS R ON FIRST 2 OUTPUT r8.<2>, r8.<3>, r8.<1>
    5724      ~12%      {3} r10 = JOIN r8 WITH BasicBlocks::Cached::bb_successor_cached#ff@staged_ext AS R ON FIRST 2 OUTPUT r8.<3>, r8.<2>, r8.<1>
    124717061 ~11%      {4} r11 = JOIN r10 WITH project#FlowVar::FlowVar_internal::assignmentLikeOperation#ffff_10#join_rhs AS R ON FIRST 1 OUTPUT R.<1>, r10.<2>, r10.<1>, r10.<0>
    66        ~0%       {3} r12 = JOIN r11 WITH project#BasicBlocks::Cached::basic_block_member AS R ON FIRST 2 OUTPUT r11.<2>, r11.<3>, r11.<1>
    66                  {3} r13 = MATERIALIZE r12 AS antijoin_rhs
    5658      ~14%      {3} r14 = r9 AND NOT r13(r9.<0>, r9.<1>, r9.<2>)

After manually pulling out the join inside the negation, the time per
iteration drops from ~30 to <1s. The pipeline above is replaced with

    892394  ~0%      {4} r6 = r5 AND NOT FlowVar::FlowVar_internal::assignsToVar#fb AS R(r5.<3>, r5.<2>)
    892394  ~0%      {4} r7 = SCAN r6 OUTPUT r6.<1>, r6.<3>, r6.<0>, r6.<2>
    5658    ~11%     {3} r8 = JOIN r7 WITH BasicBlocks::Cached::bb_successor_cached#ff@staged_ext AS R ON FIRST 2 OUTPUT r7.<2>, r7.<1>, r7.<3>
2020-08-27 09:52:22 +02:00
Robert Marsh
c0edc08315 C++: Simplify non-member iterator operator models 2020-08-26 16:19:03 -07:00
Robert Marsh
994e845ab0 C++: use set literals in iterator models 2020-08-26 16:08:39 -07:00
Robert Marsh
6f0cc16979 C++: remove non-existent operators from model 2020-08-26 15:52:53 -07:00
Mathias Vorreiter Pedersen
1221165792 Merge branch 'main' into mathiasvp/read-step-without-memory-operands 2020-08-26 19:13:54 +02:00
Mathias Vorreiter Pedersen
d900a70738 C++: Accept test changes in query tests 2020-08-26 18:10:21 +02:00
Taus Brock-Nannestad
0f221ccfa2 Merge branch 'main' into python-cpp-make-inline-test-libs-language-agnostic 2020-08-26 17:23:25 +02:00
Mathias Vorreiter Pedersen
dd8984dfc5 C++: Keep ExplicitFieldStoreQualifierNode private 2020-08-26 16:14:58 +02:00
Taus Brock-Nannestad
a824d75e4f C++: Add documentation for the LineComment class 2020-08-26 16:02:26 +02:00
Mathias Vorreiter Pedersen
e4807c0181 C++: Accept test changes 2020-08-26 15:51:09 +02:00
Mathias Vorreiter Pedersen
9d9c78c9f6 C++: Use the information provided by the IR alias analysis to detect dataflow read and store steps. 2020-08-26 15:51:03 +02:00
Mathias Vorreiter Pedersen
2a8ee90828 C++: Demonstrate lack of flow when taking the address of a field and loading it afterwards 2020-08-26 15:50:57 +02:00
Jonas Jensen
f60abd8cf9 Merge pull request #4125 from geoffw0/oparray2
C++: Model operator[]
2020-08-26 13:44:02 +02:00