Skip to content

Commit 0addce5

Browse files
author
Robert Marsh
authored
Merge pull request #5036 from MathiasVP/memcpy-models
C++: Model aliasing of memcpy-like functions and include more functions
2 parents a4d7bfb + 24f76f9 commit 0addce5

File tree

2 files changed

+64
-50
lines changed

2 files changed

+64
-50
lines changed

‎cpp/ql/src/semmle/code/cpp/models/implementations/Memcpy.qll‎

Lines changed: 25 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,34 +6,37 @@
66
import semmle.code.cpp.Function
77
import semmle.code.cpp.models.interfaces.ArrayFunction
88
import semmle.code.cpp.models.interfaces.DataFlow
9+
import semmle.code.cpp.models.interfaces.Alias
910
import semmle.code.cpp.models.interfaces.SideEffect
1011
import semmle.code.cpp.models.interfaces.Taint
1112

1213
/**
1314
* The standard functions `memcpy`, `memmove` and `bcopy`; and the gcc variant
1415
* `__builtin___memcpy_chk`.
1516
*/
16-
private class MemcpyFunction extends ArrayFunction, DataFlowFunction, SideEffectFunction {
17+
private class MemcpyFunction extends ArrayFunction, DataFlowFunction, SideEffectFunction,
18+
AliasFunction {
1719
MemcpyFunction() {
1820
// memcpy(dest, src, num)
1921
// memmove(dest, src, num)
2022
// memmove(dest, src, num, remaining)
21-
this.hasName(["memcpy", "memmove", "__builtin___memcpy_chk"])
23+
this.hasGlobalOrStdName(["memcpy", "memmove"])
2224
or
2325
// bcopy(src, dest, num)
24-
this.hasGlobalOrStdName("bcopy")
26+
// mempcpy(dest, src, num)
27+
this.hasGlobalName(["bcopy", mempcpy(), "__builtin___memcpy_chk"])
2528
}
2629

2730
/**
2831
* Gets the index of the parameter that is the source buffer for the copy.
2932
*/
30-
int getParamSrc() { if this.hasGlobalOrStdName("bcopy") then result = 0 else result = 1 }
33+
int getParamSrc() { if this.hasGlobalName("bcopy") then result = 0 else result = 1 }
3134

3235
/**
3336
* Gets the index of the parameter that is the destination buffer for the
3437
* copy.
3538
*/
36-
int getParamDest() { if this.hasGlobalOrStdName("bcopy") then result = 1 else result = 0 }
39+
int getParamDest() { if this.hasGlobalName("bcopy") then result = 1 else result = 0 }
3740

3841
/**
3942
* Gets the index of the parameter that is the size of the copy (in bytes).
@@ -82,4 +85,21 @@ private class MemcpyFunction extends ArrayFunction, DataFlowFunction, SideEffect
8285
i = getParamSrc()
8386
)
8487
}
88+
89+
override predicate parameterNeverEscapes(int index) {
90+
index = getParamSrc()
91+
or
92+
this.hasGlobalName("bcopy") and index = getParamDest()
93+
}
94+
95+
override predicate parameterEscapesOnlyViaReturn(int index) {
96+
not this.hasGlobalName("bcopy") and index = getParamDest()
97+
}
98+
99+
override predicate parameterIsAlwaysReturned(int index) {
100+
not this.hasGlobalName(["bcopy", mempcpy()]) and
101+
index = getParamDest()
102+
}
85103
}
104+
105+
private string mempcpy() { result = ["mempcpy", "wmempcpy"] }

‎cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected‎

Lines changed: 39 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -889,10 +889,8 @@ ssa.cpp:
889889
# 207| m207_4(unknown) = Chi : total:m207_2, partial:m207_3
890890
# 207| r207_5(glval<int>) = VariableAddress[x] :
891891
# 207| m207_6(int) = InitializeParameter[x] : &:r207_5
892-
# 207| m207_7(unknown) = Chi : total:m207_4, partial:m207_6
893892
# 208| r208_1(glval<int>) = VariableAddress[y] :
894893
# 208| m208_2(int) = Uninitialized[y] : &:r208_1
895-
# 208| m208_3(unknown) = Chi : total:m207_7, partial:m208_2
896894
# 209| r209_1(glval<unknown>) = FunctionAddress[memcpy] :
897895
# 209| r209_2(glval<int>) = VariableAddress[y] :
898896
# 209| r209_3(int *) = CopyValue : r209_2
@@ -904,15 +902,15 @@ ssa.cpp:
904902
# 209| r209_9(void *) = Call[memcpy] : func:r209_1, 0:r209_4, 1:r209_7, 2:r209_8
905903
# 209| v209_10(void) = ^SizedBufferReadSideEffect[1] : &:r209_7, r209_8, ~m207_6
906904
# 209| m209_11(unknown) = ^SizedBufferMustWriteSideEffect[0] : &:r209_4, r209_8
907-
# 209| m209_12(unknown) = Chi : total:m208_3, partial:m209_11
905+
# 209| m209_12(int) = Chi : total:m208_2, partial:m209_11
908906
# 210| r210_1(glval<int>) = VariableAddress[#return] :
909907
# 210| r210_2(glval<int>) = VariableAddress[y] :
910-
# 210| r210_3(int) = Load[y] : &:r210_2, ~m209_12
908+
# 210| r210_3(int) = Load[y] : &:r210_2, m209_12
911909
# 210| m210_4(int) = Store[#return] : &:r210_1, r210_3
912-
# 207| r207_8(glval<int>) = VariableAddress[#return] :
913-
# 207| v207_9(void) = ReturnValue : &:r207_8, m210_4
914-
# 207| v207_10(void) = AliasedUse : m207_3
915-
# 207| v207_11(void) = ExitFunction :
910+
# 207| r207_7(glval<int>) = VariableAddress[#return] :
911+
# 207| v207_8(void) = ReturnValue : &:r207_7, m210_4
912+
# 207| v207_9(void) = AliasedUse : m207_3
913+
# 207| v207_10(void) = ExitFunction :
916914

917915
# 213| void InitArray()
918916
# 213| Block 0
@@ -1104,51 +1102,49 @@ ssa.cpp:
11041102
# 247| m247_6(char *) = InitializeParameter[src] : &:r247_5
11051103
# 247| r247_7(char *) = Load[src] : &:r247_5, m247_6
11061104
# 247| m247_8(unknown) = InitializeIndirection[src] : &:r247_7
1107-
# 247| m247_9(unknown) = Chi : total:m247_4, partial:m247_8
1108-
# 247| r247_10(glval<int>) = VariableAddress[size] :
1109-
# 247| m247_11(int) = InitializeParameter[size] : &:r247_10
1105+
# 247| r247_9(glval<int>) = VariableAddress[size] :
1106+
# 247| m247_10(int) = InitializeParameter[size] : &:r247_9
11101107
# 248| r248_1(glval<char *>) = VariableAddress[dst] :
11111108
# 248| r248_2(glval<unknown>) = FunctionAddress[operator new[]] :
11121109
# 248| r248_3(glval<int>) = VariableAddress[size] :
1113-
# 248| r248_4(int) = Load[size] : &:r248_3, m247_11
1110+
# 248| r248_4(int) = Load[size] : &:r248_3, m247_10
11141111
# 248| r248_5(unsigned long) = Convert : r248_4
11151112
# 248| r248_6(unsigned long) = Constant[1] :
11161113
# 248| r248_7(unsigned long) = Mul : r248_5, r248_6
11171114
# 248| r248_8(void *) = Call[operator new[]] : func:r248_2, 0:r248_7
1118-
# 248| m248_9(unknown) = ^CallSideEffect : ~m247_9
1119-
# 248| m248_10(unknown) = Chi : total:m247_9, partial:m248_9
1115+
# 248| m248_9(unknown) = ^CallSideEffect : ~m247_4
1116+
# 248| m248_10(unknown) = Chi : total:m247_4, partial:m248_9
11201117
# 248| m248_11(unknown) = ^InitializeDynamicAllocation : &:r248_8
1121-
# 248| m248_12(unknown) = Chi : total:m248_10, partial:m248_11
1122-
# 248| r248_13(char *) = Convert : r248_8
1123-
# 248| m248_14(char *) = Store[dst] : &:r248_1, r248_13
1118+
# 248| r248_12(char *) = Convert : r248_8
1119+
# 248| m248_13(char *) = Store[dst] : &:r248_1, r248_12
11241120
# 249| r249_1(char) = Constant[97] :
11251121
# 249| r249_2(glval<char *>) = VariableAddress[src] :
11261122
# 249| r249_3(char *) = Load[src] : &:r249_2, m247_6
11271123
# 249| r249_4(glval<char>) = CopyValue : r249_3
11281124
# 249| m249_5(char) = Store[?] : &:r249_4, r249_1
1129-
# 249| m249_6(unknown) = Chi : total:m248_12, partial:m249_5
1125+
# 249| m249_6(unknown) = Chi : total:m247_8, partial:m249_5
11301126
# 250| r250_1(glval<unknown>) = FunctionAddress[memcpy] :
11311127
# 250| r250_2(glval<char *>) = VariableAddress[dst] :
1132-
# 250| r250_3(char *) = Load[dst] : &:r250_2, m248_14
1128+
# 250| r250_3(char *) = Load[dst] : &:r250_2, m248_13
11331129
# 250| r250_4(void *) = Convert : r250_3
11341130
# 250| r250_5(glval<char *>) = VariableAddress[src] :
11351131
# 250| r250_6(char *) = Load[src] : &:r250_5, m247_6
11361132
# 250| r250_7(void *) = Convert : r250_6
11371133
# 250| r250_8(glval<int>) = VariableAddress[size] :
1138-
# 250| r250_9(int) = Load[size] : &:r250_8, m247_11
1134+
# 250| r250_9(int) = Load[size] : &:r250_8, m247_10
11391135
# 250| r250_10(void *) = Call[memcpy] : func:r250_1, 0:r250_4, 1:r250_7, 2:r250_9
11401136
# 250| v250_11(void) = ^SizedBufferReadSideEffect[1] : &:r250_7, r250_9, ~m249_6
11411137
# 250| m250_12(unknown) = ^SizedBufferMustWriteSideEffect[0] : &:r250_4, r250_9
1142-
# 250| m250_13(unknown) = Chi : total:m249_6, partial:m250_12
1138+
# 250| m250_13(unknown) = Chi : total:m248_11, partial:m250_12
11431139
# 251| r251_1(glval<char *>) = VariableAddress[#return] :
11441140
# 251| r251_2(glval<char *>) = VariableAddress[dst] :
1145-
# 251| r251_3(char *) = Load[dst] : &:r251_2, m248_14
1141+
# 251| r251_3(char *) = Load[dst] : &:r251_2, m248_13
11461142
# 251| m251_4(char *) = Store[#return] : &:r251_1, r251_3
1147-
# 247| v247_12(void) = ReturnIndirection[src] : &:r247_7, ~m250_13
1148-
# 247| r247_13(glval<char *>) = VariableAddress[#return] :
1149-
# 247| v247_14(void) = ReturnValue : &:r247_13, m251_4
1150-
# 247| v247_15(void) = AliasedUse : ~m250_13
1151-
# 247| v247_16(void) = ExitFunction :
1143+
# 247| v247_11(void) = ReturnIndirection[src] : &:r247_7, m249_6
1144+
# 247| r247_12(glval<char *>) = VariableAddress[#return] :
1145+
# 247| v247_13(void) = ReturnValue : &:r247_12, m251_4
1146+
# 247| v247_14(void) = AliasedUse : ~m248_10
1147+
# 247| v247_15(void) = ExitFunction :
11521148

11531149
# 254| char StringLiteralAliasing2(bool)
11541150
# 254| Block 0
@@ -1206,39 +1202,37 @@ ssa.cpp:
12061202
# 268| m268_6(void *) = InitializeParameter[s] : &:r268_5
12071203
# 268| r268_7(void *) = Load[s] : &:r268_5, m268_6
12081204
# 268| m268_8(unknown) = InitializeIndirection[s] : &:r268_7
1209-
# 268| m268_9(unknown) = Chi : total:m268_4, partial:m268_8
1210-
# 268| r268_10(glval<int>) = VariableAddress[size] :
1211-
# 268| m268_11(int) = InitializeParameter[size] : &:r268_10
1205+
# 268| r268_9(glval<int>) = VariableAddress[size] :
1206+
# 268| m268_10(int) = InitializeParameter[size] : &:r268_9
12121207
# 269| r269_1(glval<void *>) = VariableAddress[buf] :
12131208
# 269| r269_2(glval<unknown>) = FunctionAddress[malloc] :
12141209
# 269| r269_3(glval<int>) = VariableAddress[size] :
1215-
# 269| r269_4(int) = Load[size] : &:r269_3, m268_11
1210+
# 269| r269_4(int) = Load[size] : &:r269_3, m268_10
12161211
# 269| r269_5(void *) = Call[malloc] : func:r269_2, 0:r269_4
1217-
# 269| m269_6(unknown) = ^CallSideEffect : ~m268_9
1218-
# 269| m269_7(unknown) = Chi : total:m268_9, partial:m269_6
1212+
# 269| m269_6(unknown) = ^CallSideEffect : ~m268_4
1213+
# 269| m269_7(unknown) = Chi : total:m268_4, partial:m269_6
12191214
# 269| m269_8(unknown) = ^InitializeDynamicAllocation : &:r269_5
1220-
# 269| m269_9(unknown) = Chi : total:m269_7, partial:m269_8
1221-
# 269| m269_10(void *) = Store[buf] : &:r269_1, r269_5
1215+
# 269| m269_9(void *) = Store[buf] : &:r269_1, r269_5
12221216
# 270| r270_1(glval<unknown>) = FunctionAddress[memcpy] :
12231217
# 270| r270_2(glval<void *>) = VariableAddress[buf] :
1224-
# 270| r270_3(void *) = Load[buf] : &:r270_2, m269_10
1218+
# 270| r270_3(void *) = Load[buf] : &:r270_2, m269_9
12251219
# 270| r270_4(glval<void *>) = VariableAddress[s] :
12261220
# 270| r270_5(void *) = Load[s] : &:r270_4, m268_6
12271221
# 270| r270_6(glval<int>) = VariableAddress[size] :
1228-
# 270| r270_7(int) = Load[size] : &:r270_6, m268_11
1222+
# 270| r270_7(int) = Load[size] : &:r270_6, m268_10
12291223
# 270| r270_8(void *) = Call[memcpy] : func:r270_1, 0:r270_3, 1:r270_5, 2:r270_7
1230-
# 270| v270_9(void) = ^SizedBufferReadSideEffect[1] : &:r270_5, r270_7, ~m269_7
1224+
# 270| v270_9(void) = ^SizedBufferReadSideEffect[1] : &:r270_5, r270_7, ~m268_8
12311225
# 270| m270_10(unknown) = ^SizedBufferMustWriteSideEffect[0] : &:r270_3, r270_7
1232-
# 270| m270_11(unknown) = Chi : total:m269_9, partial:m270_10
1226+
# 270| m270_11(unknown) = Chi : total:m269_8, partial:m270_10
12331227
# 271| r271_1(glval<void *>) = VariableAddress[#return] :
12341228
# 271| r271_2(glval<void *>) = VariableAddress[buf] :
1235-
# 271| r271_3(void *) = Load[buf] : &:r271_2, m269_10
1229+
# 271| r271_3(void *) = Load[buf] : &:r271_2, m269_9
12361230
# 271| m271_4(void *) = Store[#return] : &:r271_1, r271_3
1237-
# 268| v268_12(void) = ReturnIndirection[s] : &:r268_7, ~m270_11
1238-
# 268| r268_13(glval<void *>) = VariableAddress[#return] :
1239-
# 268| v268_14(void) = ReturnValue : &:r268_13, m271_4
1240-
# 268| v268_15(void) = AliasedUse : ~m270_11
1241-
# 268| v268_16(void) = ExitFunction :
1231+
# 268| v268_11(void) = ReturnIndirection[s] : &:r268_7, m268_8
1232+
# 268| r268_12(glval<void *>) = VariableAddress[#return] :
1233+
# 268| v268_13(void) = ReturnValue : &:r268_12, m271_4
1234+
# 268| v268_14(void) = AliasedUse : ~m269_7
1235+
# 268| v268_15(void) = ExitFunction :
12421236

12431237
# 275| void EscapedButNotConflated(bool, Point, int)
12441238
# 275| Block 0

0 commit comments

Comments
 (0)