mirror of
https://github.com/github/codeql.git
synced 2026-04-30 11:15:13 +02:00
b40fd95b8e
This change fixes a few key problems with the existing SSA implementations: For unaliased SSA, we were incorrectly choosing to model a local variable that had accesses that did not cover the entire variable. This has been changed to ensure that all accesses to the variable are at offset zero and have the same type as the variable itself. This was only possible to fix now that every `MemoryOperand` has its own type. For aliased SSA, we now correctly track the offset and size of each memory access using an interval of bit offsets covered by the access. The offset interval makes the overlap computation more straightforward. Again, this is only possible now that operands have types. The `getXXXMemoryAccess` predicates are now driven by the `MemoryAccessKind` on the operands and results, instead of by specific opcodes. This change does fix an existing false negative in the IR dataflow tests. I added a few simple test cases to the SSA IR tests, covering the various kinds of overlap (MustExcactly, MustTotally, and MayPartially). I added "PrintSSA.qll", which can dump the SSA memory accesses as part of an IR dump.
Semmle QL
This open source repository contains the standard QL libraries and queries that power LGTM, and the other products that Semmle makes available to its customers worldwide.
How do I learn QL and run queries?
LGTM has extensive documentation on getting started with writing QL. You can use the interactive query console or the QL for Eclipse plugin to try out your queries on any open-source project that's currently being analyzed.
Contributing
We welcome contributions to our standard library and standard checks. Do you have an idea for a new check, or how to improve an existing query? Then please go ahead and open a pull request! Before you do, though, please take the time to read our contributing guidelines and QL style guide.
License
The LGTM queries are licensed under Apache License 2.0 by Semmle.