Skip to content

Commit 0a0bcdf

Browse files
geoffw0geoffw0
committed
CPP: Move some code into IncorrectPointerScalingCommon.qll.
1 parent 15fa4f8 commit 0a0bcdf

File tree

4 files changed

+84
-249
lines changed

4 files changed

+84
-249
lines changed

‎cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScaling.ql‎

Lines changed: 0 additions & 83 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,6 @@ import cpp
1313
import semmle.code.cpp.controlflow.SSA
1414
import IncorrectPointerScalingCommon
1515

16-
private predicate isPointerType(Type t) {
17-
t instanceof PointerType or
18-
t instanceof ArrayType
19-
}
20-
2116
private Type baseType(Type t) {
2217
(
2318
exists (PointerType dt
@@ -36,84 +31,6 @@ private Type baseType(Type t) {
3631
and strictcount(result.getSize()) = 1
3732
}
3833

39-
/**
40-
* Holds if there is a pointer expression with type `sourceType` at
41-
* location `sourceLoc` which might be the source expression for `use`.
42-
*
43-
* For example, with
44-
* ```
45-
* int intArray[5] = { 1, 2, 3, 4, 5 };
46-
* char *charPointer = (char *)intArray;
47-
* return *(charPointer + i);
48-
* ```
49-
* the array initializer on the first line is a source expression
50-
* for the use of `charPointer` on the third line.
51-
*
52-
* The source will either be an `Expr` or a `Parameter`.
53-
*/
54-
private
55-
predicate exprSourceType(Expr use, Type sourceType, Location sourceLoc) {
56-
// Reaching definitions.
57-
if exists (SsaDefinition def, LocalScopeVariable v | use = def.getAUse(v)) then
58-
exists (SsaDefinition def, LocalScopeVariable v
59-
| use = def.getAUse(v)
60-
| defSourceType(def, v, sourceType, sourceLoc))
61-
62-
// Pointer arithmetic
63-
else if use instanceof PointerAddExpr then
64-
exprSourceType(use.(PointerAddExpr).getLeftOperand(), sourceType, sourceLoc)
65-
else if use instanceof PointerSubExpr then
66-
exprSourceType(use.(PointerSubExpr).getLeftOperand(), sourceType, sourceLoc)
67-
else if use instanceof AddExpr then
68-
exprSourceType(use.(AddExpr).getAnOperand(), sourceType, sourceLoc)
69-
else if use instanceof SubExpr then
70-
exprSourceType(use.(SubExpr).getAnOperand(), sourceType, sourceLoc)
71-
else if use instanceof CrementOperation then
72-
exprSourceType(use.(CrementOperation).getOperand(), sourceType, sourceLoc)
73-
74-
// Conversions are not in the AST, so ignore them.
75-
else if use instanceof Conversion then
76-
none()
77-
78-
// Source expressions
79-
else
80-
(sourceType = use.getType().getUnspecifiedType() and
81-
isPointerType(sourceType) and
82-
sourceLoc = use.getLocation())
83-
}
84-
85-
/**
86-
* Holds if there is a pointer expression with type `sourceType` at
87-
* location `sourceLoc` which might define the value of `v` at `def`.
88-
*/
89-
private
90-
predicate defSourceType(SsaDefinition def, LocalScopeVariable v,
91-
Type sourceType, Location sourceLoc) {
92-
exprSourceType(def.getDefiningValue(v), sourceType, sourceLoc)
93-
or
94-
defSourceType(def.getAPhiInput(v), v, sourceType, sourceLoc)
95-
or
96-
exists (Parameter p
97-
| p = v and
98-
def.definedByParameter(p) and
99-
sourceType = p.getType().getUnspecifiedType() and
100-
strictcount(p.getType()) = 1 and
101-
isPointerType(sourceType) and
102-
sourceLoc = p.getLocation())
103-
}
104-
105-
/**
106-
* Gets the pointer arithmetic expression that `e` is (directly) used
107-
* in, if any.
108-
*
109-
* For example, in `(char*)(p + 1)`, for `p`, ths result is `p + 1`.
110-
*/
111-
private Expr pointerArithmeticParent(Expr e) {
112-
e = result.(PointerAddExpr).getLeftOperand() or
113-
e = result.(PointerSubExpr).getLeftOperand() or
114-
e = result.(PointerDiffExpr).getAnOperand()
115-
}
116-
11734
from Expr dest, Type destType, Type sourceType, Type sourceBase,
11835
Type destBase, Location sourceLoc
11936
where exists(pointerArithmeticParent(dest))

‎cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScalingChar.ql‎

Lines changed: 0 additions & 83 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,6 @@ import cpp
1313
import semmle.code.cpp.controlflow.SSA
1414
import IncorrectPointerScalingCommon
1515

16-
private predicate isPointerType(Type t) {
17-
t instanceof PointerType or
18-
t instanceof ArrayType
19-
}
20-
2116
private Type baseType(Type t) {
2217
exists (DerivedType dt
2318
| dt = t.getUnspecifiedType() and
@@ -28,84 +23,6 @@ private Type baseType(Type t) {
2823
and strictcount(result.getSize()) = 1
2924
}
3025

31-
/**
32-
* Holds if there is a pointer expression with type `sourceType` at
33-
* location `sourceLoc` which might be the source expression for `use`.
34-
*
35-
* For example, with
36-
* ```
37-
* int intArray[5] = { 1, 2, 3, 4, 5 };
38-
* char *charPointer = (char *)intArray;
39-
* return *(charPointer + i);
40-
* ```
41-
* the array initializer on the first line is a source expression
42-
* for the use of `charPointer` on the third line.
43-
*
44-
* The source will either be an `Expr` or a `Parameter`.
45-
*/
46-
private
47-
predicate exprSourceType(Expr use, Type sourceType, Location sourceLoc) {
48-
// Reaching definitions.
49-
if exists (SsaDefinition def, LocalScopeVariable v | use = def.getAUse(v)) then
50-
exists (SsaDefinition def, LocalScopeVariable v
51-
| use = def.getAUse(v)
52-
| defSourceType(def, v, sourceType, sourceLoc))
53-
54-
// Pointer arithmetic
55-
else if use instanceof PointerAddExpr then
56-
exprSourceType(use.(PointerAddExpr).getLeftOperand(), sourceType, sourceLoc)
57-
else if use instanceof PointerSubExpr then
58-
exprSourceType(use.(PointerSubExpr).getLeftOperand(), sourceType, sourceLoc)
59-
else if use instanceof AddExpr then
60-
exprSourceType(use.(AddExpr).getAnOperand(), sourceType, sourceLoc)
61-
else if use instanceof SubExpr then
62-
exprSourceType(use.(SubExpr).getAnOperand(), sourceType, sourceLoc)
63-
else if use instanceof CrementOperation then
64-
exprSourceType(use.(CrementOperation).getOperand(), sourceType, sourceLoc)
65-
66-
// Conversions are not in the AST, so ignore them.
67-
else if use instanceof Conversion then
68-
none()
69-
70-
// Source expressions
71-
else
72-
(sourceType = use.getType().getUnspecifiedType() and
73-
isPointerType(sourceType) and
74-
sourceLoc = use.getLocation())
75-
}
76-
77-
/**
78-
* Holds if there is a pointer expression with type `sourceType` at
79-
* location `sourceLoc` which might define the value of `v` at `def`.
80-
*/
81-
private
82-
predicate defSourceType(SsaDefinition def, LocalScopeVariable v,
83-
Type sourceType, Location sourceLoc) {
84-
exprSourceType(def.getDefiningValue(v), sourceType, sourceLoc)
85-
or
86-
defSourceType(def.getAPhiInput(v), v, sourceType, sourceLoc)
87-
or
88-
exists (Parameter p
89-
| p = v and
90-
def.definedByParameter(p) and
91-
sourceType = p.getType().getUnspecifiedType() and
92-
strictcount(p.getType()) = 1 and
93-
isPointerType(sourceType) and
94-
sourceLoc = p.getLocation())
95-
}
96-
97-
/**
98-
* Gets the pointer arithmetic expression that `e` is (directly) used
99-
* in, if any.
100-
*
101-
* For example, in `(char*)(p + 1)`, for `p`, ths result is `p + 1`.
102-
*/
103-
private Expr pointerArithmeticParent(Expr e) {
104-
e = result.(PointerAddExpr).getLeftOperand() or
105-
e = result.(PointerSubExpr).getLeftOperand() or
106-
e = result.(PointerDiffExpr).getAnOperand()
107-
}
108-
10926
from Expr dest, Type destType, Type sourceType, Type sourceBase,
11027
Type destBase, Location sourceLoc
11128
where exists(pointerArithmeticParent(dest))

‎cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScalingCommon.qll‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,3 +46,87 @@ predicate addWithSizeof(Expr e, Expr sizeofExpr, Type sizeofParam) {
4646
| e = subExpr.getLeftOperand() and
4747
multiplyWithSizeof(subExpr.getRightOperand(), sizeofExpr, sizeofParam))
4848
}
49+
50+
/**
51+
* Holds if `t` is a pointer or array type.
52+
*/
53+
predicate isPointerType(Type t) {
54+
t instanceof PointerType or
55+
t instanceof ArrayType
56+
}
57+
58+
/**
59+
* Holds if there is a pointer expression with type `sourceType` at
60+
* location `sourceLoc` which might be the source expression for `use`.
61+
*
62+
* For example, with
63+
* ```
64+
* int intArray[5] = { 1, 2, 3, 4, 5 };
65+
* char *charPointer = (char *)intArray;
66+
* return *(charPointer + i);
67+
* ```
68+
* the array initializer on the first line is a source expression
69+
* for the use of `charPointer` on the third line.
70+
*
71+
* The source will either be an `Expr` or a `Parameter`.
72+
*/
73+
predicate exprSourceType(Expr use, Type sourceType, Location sourceLoc) {
74+
// Reaching definitions.
75+
if exists (SsaDefinition def, LocalScopeVariable v | use = def.getAUse(v)) then
76+
exists (SsaDefinition def, LocalScopeVariable v
77+
| use = def.getAUse(v)
78+
| defSourceType(def, v, sourceType, sourceLoc))
79+
80+
// Pointer arithmetic
81+
else if use instanceof PointerAddExpr then
82+
exprSourceType(use.(PointerAddExpr).getLeftOperand(), sourceType, sourceLoc)
83+
else if use instanceof PointerSubExpr then
84+
exprSourceType(use.(PointerSubExpr).getLeftOperand(), sourceType, sourceLoc)
85+
else if use instanceof AddExpr then
86+
exprSourceType(use.(AddExpr).getAnOperand(), sourceType, sourceLoc)
87+
else if use instanceof SubExpr then
88+
exprSourceType(use.(SubExpr).getAnOperand(), sourceType, sourceLoc)
89+
else if use instanceof CrementOperation then
90+
exprSourceType(use.(CrementOperation).getOperand(), sourceType, sourceLoc)
91+
92+
// Conversions are not in the AST, so ignore them.
93+
else if use instanceof Conversion then
94+
none()
95+
96+
// Source expressions
97+
else
98+
(sourceType = use.getType().getUnspecifiedType() and
99+
isPointerType(sourceType) and
100+
sourceLoc = use.getLocation())
101+
}
102+
103+
/**
104+
* Holds if there is a pointer expression with type `sourceType` at
105+
* location `sourceLoc` which might define the value of `v` at `def`.
106+
*/
107+
predicate defSourceType(SsaDefinition def, LocalScopeVariable v,
108+
Type sourceType, Location sourceLoc) {
109+
exprSourceType(def.getDefiningValue(v), sourceType, sourceLoc)
110+
or
111+
defSourceType(def.getAPhiInput(v), v, sourceType, sourceLoc)
112+
or
113+
exists (Parameter p
114+
| p = v and
115+
def.definedByParameter(p) and
116+
sourceType = p.getType().getUnspecifiedType() and
117+
strictcount(p.getType()) = 1 and
118+
isPointerType(sourceType) and
119+
sourceLoc = p.getLocation())
120+
}
121+
122+
/**
123+
* Gets the pointer arithmetic expression that `e` is (directly) used
124+
* in, if any.
125+
*
126+
* For example, in `(char*)(p + 1)`, for `p`, ths result is `p + 1`.
127+
*/
128+
Expr pointerArithmeticParent(Expr e) {
129+
e = result.(PointerAddExpr).getLeftOperand() or
130+
e = result.(PointerSubExpr).getLeftOperand() or
131+
e = result.(PointerDiffExpr).getAnOperand()
132+
}

‎cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScalingVoid.ql‎

Lines changed: 0 additions & 83 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,6 @@ import cpp
1313
import semmle.code.cpp.controlflow.SSA
1414
import IncorrectPointerScalingCommon
1515

16-
private predicate isPointerType(Type t) {
17-
t instanceof PointerType or
18-
t instanceof ArrayType
19-
}
20-
2116
private Type baseType(Type t) {
2217
exists (DerivedType dt
2318
| dt = t.getUnspecifiedType() and
@@ -28,84 +23,6 @@ private Type baseType(Type t) {
2823
and strictcount(result.getSize()) = 1
2924
}
3025

31-
/**
32-
* Holds if there is a pointer expression with type `sourceType` at
33-
* location `sourceLoc` which might be the source expression for `use`.
34-
*
35-
* For example, with
36-
* ```
37-
* int intArray[5] = { 1, 2, 3, 4, 5 };
38-
* char *charPointer = (char *)intArray;
39-
* return *(charPointer + i);
40-
* ```
41-
* the array initializer on the first line is a source expression
42-
* for the use of `charPointer` on the third line.
43-
*
44-
* The source will either be an `Expr` or a `Parameter`.
45-
*/
46-
private
47-
predicate exprSourceType(Expr use, Type sourceType, Location sourceLoc) {
48-
// Reaching definitions.
49-
if exists (SsaDefinition def, LocalScopeVariable v | use = def.getAUse(v)) then
50-
exists (SsaDefinition def, LocalScopeVariable v
51-
| use = def.getAUse(v)
52-
| defSourceType(def, v, sourceType, sourceLoc))
53-
54-
// Pointer arithmetic
55-
else if use instanceof PointerAddExpr then
56-
exprSourceType(use.(PointerAddExpr).getLeftOperand(), sourceType, sourceLoc)
57-
else if use instanceof PointerSubExpr then
58-
exprSourceType(use.(PointerSubExpr).getLeftOperand(), sourceType, sourceLoc)
59-
else if use instanceof AddExpr then
60-
exprSourceType(use.(AddExpr).getAnOperand(), sourceType, sourceLoc)
61-
else if use instanceof SubExpr then
62-
exprSourceType(use.(SubExpr).getAnOperand(), sourceType, sourceLoc)
63-
else if use instanceof CrementOperation then
64-
exprSourceType(use.(CrementOperation).getOperand(), sourceType, sourceLoc)
65-
66-
// Conversions are not in the AST, so ignore them.
67-
else if use instanceof Conversion then
68-
none()
69-
70-
// Source expressions
71-
else
72-
(sourceType = use.getType().getUnspecifiedType() and
73-
isPointerType(sourceType) and
74-
sourceLoc = use.getLocation())
75-
}
76-
77-
/**
78-
* Holds if there is a pointer expression with type `sourceType` at
79-
* location `sourceLoc` which might define the value of `v` at `def`.
80-
*/
81-
private
82-
predicate defSourceType(SsaDefinition def, LocalScopeVariable v,
83-
Type sourceType, Location sourceLoc) {
84-
exprSourceType(def.getDefiningValue(v), sourceType, sourceLoc)
85-
or
86-
defSourceType(def.getAPhiInput(v), v, sourceType, sourceLoc)
87-
or
88-
exists (Parameter p
89-
| p = v and
90-
def.definedByParameter(p) and
91-
sourceType = p.getType().getUnspecifiedType() and
92-
strictcount(p.getType()) = 1 and
93-
isPointerType(sourceType) and
94-
sourceLoc = p.getLocation())
95-
}
96-
97-
/**
98-
* Gets the pointer arithmetic expression that `e` is (directly) used
99-
* in, if any.
100-
*
101-
* For example, in `(char*)(p + 1)`, for `p`, ths result is `p + 1`.
102-
*/
103-
private Expr pointerArithmeticParent(Expr e) {
104-
e = result.(PointerAddExpr).getLeftOperand() or
105-
e = result.(PointerSubExpr).getLeftOperand() or
106-
e = result.(PointerDiffExpr).getAnOperand()
107-
}
108-
10926
from Expr dest, Type destType, Type sourceType, Type sourceBase,
11027
Type destBase, Location sourceLoc
11128
where exists(pointerArithmeticParent(dest))

0 commit comments

Comments
 (0)