Commit Graph

148 Commits

Author SHA1 Message Date
Ian Lynagh
fd91374b2f C++: Update test output 2018-09-26 18:22:20 +01:00
Pavel Avgustinov
fa698380e2 C++ definitions: Ignore type mentions of class inatantiations.
We currently erroneously keep mentions of class instantiations, which
can lead to bad performance on template-heavy code bases. We never
want to link those anyway, so we can simply suppress them.
2018-09-24 18:18:30 +01:00
ian-semmle
4b0ab602e7 Merge pull request #202 from jbj/resolveClass-conservative
C++: more conservative resolveClass
2018-09-19 11:35:45 +01:00
Jonas Jensen
a7d897108a C++: Exclude non-toplevel items from resolveClass
Also exclude templates as their names are not canonical.

The test changes in `isfromtemplateinstantiation/` are the inverses of
what we got in 34c9892f7, which should be a good thing.
2018-09-17 15:55:34 +02:00
Jonas Jensen
d7f442b042 C++: Force unique resolveClass results 2018-09-17 15:52:38 +02:00
Jonas Jensen
b633ee1bc4 C++: Add more tests of resolveClass
These tests exercise the problematic cases where a variable can appear
to have multiple types because of how we fail to account for qualified
names when comparing type names.
2018-09-17 15:48:02 +02:00
Pavel Avgustinov
2b4da8d6a7 Parameter.qll: Tweak how effective declaration entries are computed
With the new formulation, we can join on function and index at the
same time, leading to significant performance gains on large code
bases that use templates extensively.
2018-09-14 12:22:01 +01:00
Dave Bartolomeo
c9cb2a0d14 Merge pull request #177 from jbj/ir-array-init-perf
C++: IR: Fix performance of value-init ranges
2018-09-14 00:14:45 -07:00
Jonas Jensen
9fb5fbd995 C++: Restructure UnsafeUseOfStrcat for performance
This query gets optimized badly, and it has started timing out when we
run it on our own code base. Most of the evaluation time is spent in an
RA predicate named `#select#cpe#1#f#antijoin_rhs#1`, which takes 1m36s a
Wireshark snapshot.

This restructuring of the code makes the problematic RA predicate go
away.
2018-09-12 09:37:17 +02:00
Jonas Jensen
df948ecbbc C++: IR: designated initializer test 2018-09-11 19:43:02 +02:00
Jonas Jensen
bb49966395 C++: Fixup getEndOfValueInitializedRange 2018-09-11 15:19:18 +02:00
Jonas Jensen
b2571c8d63 C++: IR: Fix performance of value-init ranges
On a snapshot of Postgres, evaluation of
`getNextExplicitlyInitializedElementAfter#fff#antijoin_rhs#1` took
forever, preventing the computation of the IR. I haven't been able to
reproduce it with a small test case, but the implementation of
`getNextExplicitlyInitializedElementAfter` was fragile because it called
the inline predicate `ArrayAggregateLiteral.isInitialized`. It also
seemed inefficient that `getNextExplicitlyInitializedElementAfter` was
computed for many values of its parameters that were never needed by the
caller.

This commit replaces `getNextExplicitlyInitializedElementAfter` with a
new predicate named `getEndOfValueInitializedRange`, which should have
the same behavior but a more efficient implementation. It uses a helper
predicate `getNextExplicitlyInitializedElementAfter`, which shares its
name with the now-deleted predicate but has behavior that I think
matches the name.
2018-09-11 11:43:46 +02:00
semmle-qlci
10329fa188 Merge pull request #134 from jbj/getOperandMemoryAccess-this
Approved by dave-bartolomeo
2018-09-06 09:18:57 +01:00
semmle-qlci
43e1e62d3a Merge pull request #133 from jbj/IRBlock-number-split
Approved by dave-bartolomeo
2018-09-05 14:58:15 +01:00
semmle-qlci
a70526f79f Merge pull request #123 from jbj/primitive-bb-number-split
Approved by dave-bartolomeo
2018-09-05 13:21:14 +01:00
Jonas Jensen
e0c073360b C++: Remove CP in getOperandMemoryAccess
The overrides of `Instruction.getOperandMemoryAccess` did not relate
`this` to any of its other parameters, which made it attempt to compute
the Cartesian product of `Instruction` and `TPhiOperand`. This happened
only during computation of aliased SSA. Perhaps the optimizer was able
to eliminate the CP for the non-aliased SSA computation.

With this change, I'm able to compute aliased SSA for medium-sized
snapshots.
2018-09-05 08:52:39 +02:00
Jonas Jensen
5541b9fbf1 C++: Split IRBlock index from IRBlock membership
Instead of computing these two things in one predicate, they are
computed in separate predicates and then joined. This splits the
predicate `getInstruction`, which took 81s before, into predicates that
together take 20s on a medium-sized db.
2018-09-05 08:50:36 +02:00
Jonas Jensen
1bcae97447 Merge pull request #114 from geoffw0/samate-realloc
CPP: Handle 'realloc' better in MemoryMayNotBeFreed.ql
2018-09-05 08:35:13 +02:00
Dave Bartolomeo
4a1d04b423 C++: Fix deprecated predicate warnings 2018-09-04 10:30:48 -07:00
Dave Bartolomeo
4086a8909b C++: Fix a couple IR-related tests to handle new directory tree
Also moved those tests under the IR test directory, so I'm less likely to forget them next time.
2018-09-04 09:05:33 -07:00
Dave Bartolomeo
fce7a5fccb C++: Final IR reshuffle
Moved IR flavors into "implementation", with internal files under "implementation/internal". Made `IRBlockConstruction` just a nested module of `IRConstruction`/`SSAConstruction`, so it gets picked up from the `Construction` parameter of the `IR` module, rather than being picked up just from being in the same directory as `IRBlock`.
2018-09-04 09:05:27 -07:00
Dave Bartolomeo
aa4436fa22 C++: More IR reshuffling
Remove redundant "_ir" suffix.
Move non-user-importable modules into "implementation" directory.
2018-09-04 09:05:21 -07:00
Dave Bartolomeo
97cfbd9488 C++: "IR" means "Aliased SSA IR"
This change makes the public IR.qll module resolve to the flavor of the IR that we want queries to use. Today, this is the aliased SSA flavor of the IR. Should we add additional IR iterations in the future, we'll update IR.qll to resolve to whichever one we consider the default.

I moved the PrintIR.ql and IRSanity.ql queries into the internal directories of the corresponding flavors. There's still a PrintIR.ql and an IRSanity.ql in the public IR directory, which use the same IR flavor as the public IR.qll.
2018-09-04 09:05:15 -07:00
Dave Bartolomeo
9fd5f26e2e C++: Remove unnecessary Impl suffix from some files 2018-09-04 09:05:10 -07:00
Dave Bartolomeo
aacee8fecf C++: Reshuffle IR files into a consistent directory structure
There are no real code changes here, other than to fix up `import`s. All tests still hae the same output, as expected.

A future commit will hide the IR flavors other than the one we want queries to use directly.
2018-09-04 09:05:03 -07:00
Jonas Jensen
e0ba2b2251 C++: Fix name of suppressUnusedType 2018-09-04 13:38:28 +02:00
Jonas Jensen
07bacbf389 C++: Follow suppressUnusedThis convention 2018-09-04 09:40:50 +02:00
Jonas Jensen
88f80e4d4b C++: Silence two more QL compiler warnings
One was for an unused parameter (a deliberate CP of `Type` x
`VoidType`), and one was for use of a deprecated predicate.
2018-09-03 13:45:04 +02:00
Jonas Jensen
ab6dc1d70c C++: Add missing override annotations 2018-09-03 13:22:22 +02:00
Geoffrey White
3e18a9b885 CPP: Improve the special case for realloc in MemoryMayNotBeFreed.ql. 2018-09-03 08:30:05 +01:00
Jonas Jensen
98612b9f9a C++: Tidy primitive_basic_block_member calculation
This change gave a slight speed-up by eliminating an unnecessary
intermediate predicate.
2018-09-01 07:46:00 +02:00
Nick Rolfe
0589be1b8a C++: add qldoc comments for aggregate_{field,array}_init 2018-08-30 22:42:31 +01:00
Nick Rolfe
2130622028 C++: use underlyingElement & unresolveElement for get{Element,Field}Expr 2018-08-30 22:42:31 +01:00
Nick Rolfe
d8d3bfd857 C++: expand aggregate literals test to cover ordering of child exprs 2018-08-30 22:42:30 +01:00
Nick Rolfe
7556f22ff1 C++: stats for aggregate_{field,array}_init 2018-08-30 22:42:30 +01:00
Nick Rolfe
23c648904f C++: properly formatted comments for builtin type kinds 2018-08-30 22:42:30 +01:00
Nick Rolfe
afa7505cae C++: expand test for aggregate literals to include more nesting 2018-08-30 22:42:30 +01:00
Nick Rolfe
4abdeda857 C++: update test output to match corrected extractor behaviour 2018-08-30 22:42:30 +01:00
Nick Rolfe
d068d71ccb C++: dbscheme/library changes to support C99 designated initializers 2018-08-30 22:42:30 +01:00
Jonas Jensen
e7234f5cf3 C++: Split index calculation from BB membership
Instead of computing these two things in one predicate, they are
computed in separate predicates and then joined. This splits the
predicate `primitive_basic_block_member`, which took 77s before, into
predicates that together take 18s on a medium-sized db.
2018-08-30 15:04:01 +02:00
Kevin Backhouse
6c5009225c Merge pull request #111 from olehermanse/gmtime
Fixed error in gmtime example
2018-08-29 15:55:52 -04:00
semmle-qlci
d957c151a6 Merge pull request #110 from jbj/fewer-dbtypes
Approved by ian-semmle
2018-08-29 17:26:06 +01:00
Jonas Jensen
4cc27459ca C++: Remove redundant charpred on Element 2018-08-29 14:09:04 +02:00
Jonas Jensen
8b9e4e347c C++: Introduce ElementBase class
By extending this class, a class can define its own `getLocation`
predicate without participating in the dispatch hierarchy of
`getLocation` as defined on `Element`. Classes wanting to override their
location previously had to define `getURL` or `hasLocationInfo` instead
and rely on these predicates not being defined on future versions of
`Element`.
2018-08-29 13:21:10 +02:00
Jonas Jensen
418a16772b Merge pull request #105 from geoffw0/samate-crement
CPP: Support crement operations in CWE-190
2018-08-29 09:03:29 +02:00
Ole Herman Schumacher Elgesem
00c552fe2f Fixed error in gmtime example
gmtime and gmtime_r take a time_t pointer, so have to store the value
of time(NULL) on the stack.

Signed-off-by: Ole Herman Schumacher Elgesem <oleherman93@gmail.com>
2018-08-28 11:10:11 -07:00
Geoffrey White
0d6373924c CPP: De-conflate cause and effect strings. 2018-08-28 16:39:10 +01:00
Geoffrey White
229d0406bb CPP: Add support for += and -=. 2018-08-28 16:39:10 +01:00
Geoffrey White
87fb447c4b CPP: Improve the logic in ArithmeticWithExtremeValues.ql. 2018-08-28 16:39:10 +01:00
Geoffrey White
a125e3ed86 CPP: Fix crement operations on pointers. 2018-08-28 16:39:09 +01:00