codeql/cpp/ql/lib/semmle/code/cpp/dataflow/EscapesTree.qll

/**
 * Provides a local analysis for identifying where a variable address or value
 * may escape an _expression tree_, meaning that it is assigned to a variable,
 * passed to a function, or similar.
 */

/*
 * Maintainer note: this file is one of several files that are similar but not
 * identical. Many changes to this file will also apply to the others:
 * - AddressConstantExpression.qll
 * - AddressFlow.qll
 * - EscapesTree.qll
 */

private import cpp

/**
 * Holds if `f` is an instantiation of the `std::move` or `std::forward`
 * template functions, these functions are essentially casts, so we treat them
 * as such.
 */
private predicate stdIdentityFunction(Function f) { f.hasQualifiedName("std", ["move", "forward"]) }

/**
 * Holds if `f` is an instantiation of `std::addressof`, which effectively
 * converts a reference to a pointer.
 */
private predicate stdAddressOf(Function f) { f.hasQualifiedName("std", "addressof") }

private predicate lvalueToLvalueStepPure(Expr lvalueIn, Expr lvalueOut) {
  lvalueIn = lvalueOut.(DotFieldAccess).getQualifier().getFullyConverted()
  or
  lvalueIn.getConversion() = lvalueOut.(ParenthesisExpr)
  or
  // When an object is implicitly converted to a reference to one of its base
  // classes, it gets two `Conversion`s: there is first an implicit
  // `CStyleCast` to its base class followed by a `ReferenceToExpr` to a
  // reference to its base class. Whereas an explicit cast to the base class
  // would produce an rvalue, which would not be convertible to an lvalue
  // reference, this implicit cast instead produces an lvalue. The following
  // case ensures that we propagate the property of being an lvalue through
  // such casts.
  lvalueIn.getConversion() = lvalueOut and
  lvalueOut.(CStyleCast).isImplicit()
}

private predicate lvalueToLvalueStep(Expr lvalueIn, Expr lvalueOut) {
  lvalueToLvalueStepPure(lvalueIn, lvalueOut)
  or
  // C++ only
  lvalueIn = lvalueOut.(PrefixCrementOperation).getOperand().getFullyConverted()
  or
  // C++ only
  lvalueIn = lvalueOut.(Assignment).getLValue().getFullyConverted()
}

private predicate pointerToLvalueStep(Expr pointerIn, Expr lvalueOut) {
  pointerIn = lvalueOut.(ArrayExpr).getArrayBase().getFullyConverted()
  or
  pointerIn = lvalueOut.(PointerDereferenceExpr).getOperand().getFullyConverted()
  or
  pointerIn = lvalueOut.(PointerFieldAccess).getQualifier().getFullyConverted()
}

private predicate lvalueToPointerStep(Expr lvalueIn, Expr pointerOut) {
  lvalueIn.getConversion() = pointerOut.(ArrayToPointerConversion)
  or
  lvalueIn = pointerOut.(AddressOfExpr).getOperand().getFullyConverted()
}

private predicate pointerToPointerStep(Expr pointerIn, Expr pointerOut) {
  (
    pointerOut instanceof PointerAddExpr
    or
    pointerOut instanceof PointerSubExpr
  ) and
  pointerIn = pointerOut.getAChild().getFullyConverted() and
  pointerIn.getUnspecifiedType() instanceof PointerType
  or
  pointerIn = pointerOut.(UnaryPlusExpr).getOperand().getFullyConverted()
  or
  pointerIn.getConversion() = pointerOut.(Cast)
  or
  pointerIn.getConversion() = pointerOut.(ParenthesisExpr)
  or
  pointerIn.getConversion() = pointerOut.(TemporaryObjectExpr)
  or
  pointerIn = pointerOut.(ConditionalExpr).getThen().getFullyConverted()
  or
  pointerIn = pointerOut.(ConditionalExpr).getElse().getFullyConverted()
  or
  pointerIn = pointerOut.(CommaExpr).getRightOperand().getFullyConverted()
  or
  pointerIn = pointerOut.(StmtExpr).getResultExpr().getFullyConverted()
}

private predicate lvalueToReferenceStep(Expr lvalueIn, Expr referenceOut) {
  lvalueIn.getConversion() = referenceOut.(ReferenceToExpr)
}

private predicate referenceToLvalueStep(Expr referenceIn, Expr lvalueOut) {
  referenceIn.getConversion() = lvalueOut.(ReferenceDereferenceExpr)
}

private predicate referenceToPointerStep(Expr referenceIn, Expr pointerOut) {
  pointerOut =
    any(FunctionCall call |
      stdAddressOf(call.getTarget()) and
      referenceIn = call.getArgument(0).getFullyConverted()
    )
}

private predicate referenceToReferenceStep(Expr referenceIn, Expr referenceOut) {
  referenceOut =
    any(FunctionCall call |
      stdIdentityFunction(call.getTarget()) and
      referenceIn = call.getArgument(0).getFullyConverted()
    )
  or
  referenceIn.getConversion() = referenceOut.(Cast)
  or
  referenceIn.getConversion() = referenceOut.(ParenthesisExpr)
}

private predicate lvalueFromVariableAccess(VariableAccess va, Expr lvalue) {
  // Base case for non-reference types.
  lvalue = va and
  not va.getConversion() instanceof ReferenceDereferenceExpr
  or
  // Base case for reference types where we pretend that they are
  // non-reference types. The type of the target of `va` can be `ReferenceType`
  // or `FunctionReferenceType`.
  lvalue = va.getConversion().(ReferenceDereferenceExpr)
  or
  // lvalue -> lvalue
  exists(Expr prev |
    lvalueFromVariableAccess(va, prev) and
    lvalueToLvalueStep(prev, lvalue)
  )
  or
  // pointer -> lvalue
  exists(Expr prev |
    pointerFromVariableAccess(va, prev) and
    pointerToLvalueStep(prev, lvalue)
  )
  or
  // reference -> lvalue
  exists(Expr prev |
    referenceFromVariableAccess(va, prev) and
    referenceToLvalueStep(prev, lvalue)
  )
}

private predicate pointerFromVariableAccess(VariableAccess va, Expr pointer) {
  // pointer -> pointer
  exists(Expr prev |
    pointerFromVariableAccess(va, prev) and
    pointerToPointerStep(prev, pointer)
  )
  or
  // reference -> pointer
  exists(Expr prev |
    referenceFromVariableAccess(va, prev) and
    referenceToPointerStep(prev, pointer)
  )
  or
  // lvalue -> pointer
  exists(Expr prev |
    lvalueFromVariableAccess(va, prev) and
    lvalueToPointerStep(prev, pointer)
  )
}

private predicate referenceFromVariableAccess(VariableAccess va, Expr reference) {
  // reference -> reference
  exists(Expr prev |
    referenceFromVariableAccess(va, prev) and
    referenceToReferenceStep(prev, reference)
  )
  or
  // lvalue -> reference
  exists(Expr prev |
    lvalueFromVariableAccess(va, prev) and
    lvalueToReferenceStep(prev, reference)
  )
}

private predicate addressMayEscapeAt(Expr e) {
  exists(Call call |
    e = call.getAnArgument().getFullyConverted() and
    not stdIdentityFunction(call.getTarget()) and
    not stdAddressOf(call.getTarget())
    or
    e = call.getQualifier().getFullyConverted() and
    e.getUnderlyingType() instanceof PointerType
  )
  or
  exists(AssignExpr assign | e = assign.getRValue().getFullyConverted())
  or
  exists(Initializer init | e = init.getExpr().getFullyConverted())
  or
  exists(ConstructorFieldInit init | e = init.getExpr().getFullyConverted())
  or
  exists(ReturnStmt ret | e = ret.getExpr().getFullyConverted())
  or
  exists(ThrowExpr throw | e = throw.getExpr().getFullyConverted())
  or
  exists(AggregateLiteral agg | e = agg.getAChild().getFullyConverted())
  or
  exists(AsmStmt asm | e = asm.getAChild().(Expr).getFullyConverted())
}

private predicate addressMayEscapeMutablyAt(Expr e) {
  addressMayEscapeAt(e) and
  exists(Type t | t = e.getType().stripTopLevelSpecifiers() |
    t instanceof PointerType and
    not t.(PointerType).getBaseType().isConst()
    or
    t instanceof ReferenceType and
    not t.(ReferenceType).getBaseType().isConst()
    or
    // If the address has been cast to an integral type, conservatively assume that it may eventually be cast back to a
    // pointer to non-const type.
    t instanceof IntegralType
    or
    // If we go through a temporary object step, we can take a reference to a temporary const pointer
    // object, where the pointer doesn't point to a const value
    exists(TemporaryObjectExpr temp, PointerType pt |
      temp.getConversion() = e.(ReferenceToExpr) and
      pt = temp.getType().stripTopLevelSpecifiers()
    |
      not pt.getBaseType().isConst()
    )
  )
}

private predicate lvalueMayEscapeAt(Expr e) {
  // A call qualifier, like `q` in `q.f()`, is special in that the address of
  // `q` escapes even though `q` is not a pointer or a reference.
  exists(Call call |
    e = call.getQualifier().getFullyConverted() and
    e.getType().getUnspecifiedType() instanceof Class
  )
}

private predicate lvalueMayEscapeMutablyAt(Expr e) {
  lvalueMayEscapeAt(e) and
  // A qualifier of a call to a const member function is converted to a const
  // class type.
  not e.getType().isConst()
}

private predicate addressFromVariableAccess(VariableAccess va, Expr e) {
  pointerFromVariableAccess(va, e)
  or
  referenceFromVariableAccess(va, e)
  or
  // `e` could be a pointer that is converted to a reference as the final step,
  // meaning that we pass a value that is two dereferences away from referring
  // to `va`. This happens, for example, with `void std::vector::push_back(T&&
  // value);` when called as `v.push_back(&x)`, for a variable `x`. It
  // can also happen when taking a reference to a const pointer to a
  // (potentially non-const) value.
  exists(Expr pointerValue |
    pointerFromVariableAccess(va, pointerValue) and
    e = pointerValue.getConversion().(ReferenceToExpr)
  )
}

import EscapesTree_Cached

cached
private module EscapesTree_Cached {
  /**
   * Holds if `e` is a fully-converted expression that evaluates to an address
   * derived from the address of `va` and is stored in a variable or passed
   * across functions. This means `e` is the `Expr.getFullyConverted`-form of:
   *
   * - The right-hand side of an assignment or initialization;
   * - A function argument or return value;
   * - The argument to `throw`.
   * - An entry in an `AggregateLiteral`, including the compiler-generated
   *   `ClassAggregateLiteral` that initializes a `LambdaExpression`; or
   * - An expression in an inline assembly statement.
   *
   * This predicate includes pointers or reference to `const` types. See
   * `variableAddressEscapesTreeNonConst` for a version of this predicate that
   * does not.
   *
   * If `va` has reference type, the escape analysis concerns the value pointed
   * to by the reference rather than the reference itself. The C++ language does
   * not allow taking the address of a reference in any way, so this predicate
   * would never produce any results for the reference itself. Callers that are
   * not interested in the value referred to by references should exclude
   * variable accesses to reference-typed values.
   */
  cached
  predicate variableAddressEscapesTree(VariableAccess va, Expr e) {
    addressMayEscapeAt(e) and
    addressFromVariableAccess(va, e)
    or
    lvalueMayEscapeAt(e) and
    lvalueFromVariableAccess(va, e)
  }

  /**
   * Holds if `e` is a fully-converted expression that evaluates to a non-const
   * address derived from the address of `va` and is stored in a variable or
   * passed across functions. This means `e` is the `Expr.getFullyConverted`-form
   * of:
   *
   * - The right-hand side of an assignment or initialization;
   * - A function argument or return value;
   * - The argument to `throw`.
   * - An entry in an `AggregateLiteral`, including the compiler-generated
   *   `ClassAggregateLiteral` that initializes a `LambdaExpression`; or
   * - An expression in an inline assembly statement.
   *
   * This predicate omits pointers or reference to `const` types. See
   * `variableAddressEscapesTree` for a version of this predicate that includes
   * those.
   *
   * If `va` has reference type, the escape analysis concerns the value pointed
   * to by the reference rather than the reference itself. The C++ language
   * offers no way to take the address of a reference, so this predicate will
   * never produce any results for the reference itself. Callers that are not
   * interested in the value referred to by references should exclude variable
   * accesses to reference-typed values.
   */
  cached
  predicate variableAddressEscapesTreeNonConst(VariableAccess va, Expr e) {
    addressMayEscapeMutablyAt(e) and
    addressFromVariableAccess(va, e)
    or
    lvalueMayEscapeMutablyAt(e) and
    lvalueFromVariableAccess(va, e)
  }

  /**
   * Holds if `e` is a fully-converted expression that evaluates to an lvalue
   * derived from `va` and is used for reading from or assigning to. This is in
   * contrast with a variable access that is used for taking an address (`&x`)
   * or simply discarding its value (`x;`).
   *
   * This analysis does not propagate across assignments or calls. The analysis
   * is also not concerned with whether the lvalue `e` is converted to an rvalue
   * -- to examine that, use the relevant member predicates on `Expr`.
   *
   * If `va` has reference type, the analysis concerns the value pointed to by
   * the reference rather than the reference itself. The expression `e` may be a
   * `Conversion`.
   */
  cached
  predicate variableAccessedAsValue(VariableAccess va, Expr e) {
    lvalueFromVariableAccess(va, e) and
    not lvalueToLvalueStepPure(e, _) and
    not lvalueToPointerStep(e, _) and
    not lvalueToReferenceStep(e, _) and
    not e = any(ExprInVoidContext eivc | e = eivc.getConversion*())
  }
}