Skip to content

Commit 0c092e2

Browse files
committed
C++: Autoformat IR SSA files
One autoformat omission had also slipped into `DefaultTaintTracking.qll`.
1 parent 10270cb commit 0c092e2

File tree

7 files changed

+820
-708
lines changed

7 files changed

+820
-708
lines changed

cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -48,9 +48,7 @@ private class DefaultTaintTrackingCfg extends DataFlow::Configuration {
4848
}
4949

5050
private predicate accessesVariable(CopyInstruction copy, Variable var) {
51-
exists(VariableAddressInstruction va |
52-
va.getVariable().getAST() = var
53-
|
51+
exists(VariableAddressInstruction va | va.getVariable().getAST() = var |
5452
copy.(StoreInstruction).getDestinationAddress() = va
5553
or
5654
copy.(LoadInstruction).getSourceAddress() = va

cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasedSSA.qll

Lines changed: 106 additions & 136 deletions
Original file line numberDiff line numberDiff line change
@@ -9,32 +9,31 @@ private import semmle.code.cpp.ir.implementation.internal.OperandTag
99

1010
private class IntValue = Ints::IntValue;
1111

12-
private predicate hasResultMemoryAccess(Instruction instr, IRVariable var, Type type, IntValue startBitOffset,
13-
IntValue endBitOffset) {
12+
private predicate hasResultMemoryAccess(
13+
Instruction instr, IRVariable var, Type type, IntValue startBitOffset, IntValue endBitOffset
14+
) {
1415
resultPointsTo(instr.getResultAddress(), var, startBitOffset) and
1516
type = instr.getResultType() and
16-
if exists(instr.getResultSize()) then
17-
endBitOffset = Ints::add(startBitOffset, Ints::mul(instr.getResultSize(), 8))
18-
else
19-
endBitOffset = Ints::unknown()
17+
if exists(instr.getResultSize())
18+
then endBitOffset = Ints::add(startBitOffset, Ints::mul(instr.getResultSize(), 8))
19+
else endBitOffset = Ints::unknown()
2020
}
2121

22-
private predicate hasOperandMemoryAccess(MemoryOperand operand, IRVariable var, Type type, IntValue startBitOffset,
23-
IntValue endBitOffset) {
22+
private predicate hasOperandMemoryAccess(
23+
MemoryOperand operand, IRVariable var, Type type, IntValue startBitOffset, IntValue endBitOffset
24+
) {
2425
resultPointsTo(operand.getAddressOperand().getAnyDef(), var, startBitOffset) and
2526
type = operand.getType() and
26-
if exists(operand.getSize()) then
27-
endBitOffset = Ints::add(startBitOffset, Ints::mul(operand.getSize(), 8))
28-
else
29-
endBitOffset = Ints::unknown()
27+
if exists(operand.getSize())
28+
then endBitOffset = Ints::add(startBitOffset, Ints::mul(operand.getSize(), 8))
29+
else endBitOffset = Ints::unknown()
3030
}
3131

3232
private newtype TMemoryLocation =
3333
TVariableMemoryLocation(IRVariable var, Type type, IntValue startBitOffset, IntValue endBitOffset) {
3434
hasResultMemoryAccess(_, var, type, startBitOffset, endBitOffset) or
3535
hasOperandMemoryAccess(_, var, type, startBitOffset, endBitOffset)
36-
}
37-
or
36+
} or
3837
TUnknownMemoryLocation(IRFunction irFunc) or
3938
TUnknownVirtualVariable(IRFunction irFunc)
4039

@@ -47,16 +46,15 @@ private newtype TMemoryLocation =
4746
*/
4847
abstract class MemoryLocation extends TMemoryLocation {
4948
abstract string toString();
50-
49+
5150
abstract VirtualVariable getVirtualVariable();
5251

5352
abstract Type getType();
5453

5554
abstract string getUniqueId();
5655
}
5756

58-
abstract class VirtualVariable extends MemoryLocation {
59-
}
57+
abstract class VirtualVariable extends MemoryLocation { }
6058

6159
/**
6260
* An access to memory within a single known `IRVariable`. The variable may be either an unescaped variable
@@ -72,36 +70,28 @@ class VariableMemoryLocation extends TVariableMemoryLocation, MemoryLocation {
7270
this = TVariableMemoryLocation(var, type, startBitOffset, endBitOffset)
7371
}
7472

75-
override final string toString() {
76-
result = var.toString() + Interval::getIntervalString(startBitOffset, endBitOffset) + "<" + type.toString() + ">"
73+
final override string toString() {
74+
result = var.toString() + Interval::getIntervalString(startBitOffset, endBitOffset) + "<" +
75+
type.toString() + ">"
7776
}
7877

79-
override final Type getType() {
80-
result = type
81-
}
78+
final override Type getType() { result = type }
8279

83-
final IntValue getStartBitOffset() {
84-
result = startBitOffset
85-
}
86-
87-
final IntValue getEndBitOffset() {
88-
result = endBitOffset
89-
}
90-
91-
final IRVariable getVariable() {
92-
result = var
93-
}
80+
final IntValue getStartBitOffset() { result = startBitOffset }
81+
82+
final IntValue getEndBitOffset() { result = endBitOffset }
9483

95-
override final string getUniqueId() {
84+
final IRVariable getVariable() { result = var }
85+
86+
final override string getUniqueId() {
9687
result = var.getUniqueId() + Interval::getIntervalString(startBitOffset, endBitOffset) + "<" +
97-
getTypeIdentityString(type) + ">"
88+
getTypeIdentityString(type) + ">"
9889
}
9990

100-
override final VirtualVariable getVirtualVariable() {
101-
if variableAddressEscapes(var) then
102-
result = TUnknownVirtualVariable(var.getEnclosingIRFunction())
103-
else
104-
result = TVariableMemoryLocation(var, var.getType(), 0, var.getType().getSize() * 8)
91+
final override VirtualVariable getVirtualVariable() {
92+
if variableAddressEscapes(var)
93+
then result = TUnknownVirtualVariable(var.getEnclosingIRFunction())
94+
else result = TVariableMemoryLocation(var, var.getType(), 0, var.getType().getSize() * 8)
10595
}
10696

10797
/**
@@ -132,25 +122,15 @@ class VariableVirtualVariable extends VariableMemoryLocation, VirtualVariable {
132122
class UnknownMemoryLocation extends TUnknownMemoryLocation, MemoryLocation {
133123
IRFunction irFunc;
134124

135-
UnknownMemoryLocation() {
136-
this = TUnknownMemoryLocation(irFunc)
137-
}
138-
139-
override final string toString() {
140-
result = "{Unknown}"
141-
}
142-
143-
override final VirtualVariable getVirtualVariable() {
144-
result = TUnknownVirtualVariable(irFunc)
145-
}
125+
UnknownMemoryLocation() { this = TUnknownMemoryLocation(irFunc) }
146126

147-
override final Type getType() {
148-
result instanceof UnknownType
149-
}
127+
final override string toString() { result = "{Unknown}" }
150128

151-
override final string getUniqueId() {
152-
result = "{Unknown}"
153-
}
129+
final override VirtualVariable getVirtualVariable() { result = TUnknownVirtualVariable(irFunc) }
130+
131+
final override Type getType() { result instanceof UnknownType }
132+
133+
final override string getUniqueId() { result = "{Unknown}" }
154134
}
155135

156136
/**
@@ -159,70 +139,60 @@ class UnknownMemoryLocation extends TUnknownMemoryLocation, MemoryLocation {
159139
class UnknownVirtualVariable extends TUnknownVirtualVariable, VirtualVariable {
160140
IRFunction irFunc;
161141

162-
UnknownVirtualVariable() {
163-
this = TUnknownVirtualVariable(irFunc)
164-
}
165-
166-
override final string toString() {
167-
result = "{AllAliased}"
168-
}
142+
UnknownVirtualVariable() { this = TUnknownVirtualVariable(irFunc) }
169143

170-
override final Type getType() {
171-
result instanceof UnknownType
172-
}
144+
final override string toString() { result = "{AllAliased}" }
173145

174-
override final string getUniqueId() {
175-
result = " " + toString()
176-
}
146+
final override Type getType() { result instanceof UnknownType }
177147

178-
override final VirtualVariable getVirtualVariable() {
179-
result = this
180-
}
148+
final override string getUniqueId() { result = " " + toString() }
149+
150+
final override VirtualVariable getVirtualVariable() { result = this }
181151
}
182152

183153
Overlap getOverlap(MemoryLocation def, MemoryLocation use) {
184154
// The def and the use must have the same virtual variable, or no overlap is possible.
185155
(
186156
// An UnknownVirtualVariable must totally overlap any location within the same virtual variable.
187157
def.getVirtualVariable() = use.getVirtualVariable() and
188-
def instanceof UnknownVirtualVariable and result instanceof MustTotallyOverlap
158+
def instanceof UnknownVirtualVariable and
159+
result instanceof MustTotallyOverlap
189160
or
190161
// An UnknownMemoryLocation may partially overlap any Location within the same virtual variable.
191162
def.getVirtualVariable() = use.getVirtualVariable() and
192-
def instanceof UnknownMemoryLocation and result instanceof MayPartiallyOverlap
163+
def instanceof UnknownMemoryLocation and
164+
result instanceof MayPartiallyOverlap
193165
or
194166
exists(VariableMemoryLocation defVariableLocation |
195167
defVariableLocation = def and
196168
(
197-
(
198-
// A VariableMemoryLocation may partially overlap an unknown location within the same virtual variable.
199-
def.getVirtualVariable() = use.getVirtualVariable() and
200-
((use instanceof UnknownMemoryLocation) or (use instanceof UnknownVirtualVariable)) and
201-
result instanceof MayPartiallyOverlap
202-
) or
169+
// A VariableMemoryLocation may partially overlap an unknown location within the same virtual variable.
170+
def.getVirtualVariable() = use.getVirtualVariable() and
171+
(use instanceof UnknownMemoryLocation or use instanceof UnknownVirtualVariable) and
172+
result instanceof MayPartiallyOverlap
173+
or
203174
// A VariableMemoryLocation overlaps another location within the same variable based on the relationship
204175
// of the two offset intervals.
205176
exists(Overlap intervalOverlap |
206177
intervalOverlap = getVariableMemoryLocationOverlap(def, use) and
207-
if intervalOverlap instanceof MustExactlyOverlap then (
208-
if def.getType() = use.getType() then (
178+
if intervalOverlap instanceof MustExactlyOverlap
179+
then
180+
if def.getType() = use.getType()
181+
then
209182
// The def and use types match, so it's an exact overlap.
210183
result instanceof MustExactlyOverlap
211-
)
212-
else (
184+
else
213185
// The def and use types are not the same, so it's just a total overlap.
214186
result instanceof MustTotallyOverlap
215-
)
216-
)
217-
else if defVariableLocation.coversEntireVariable() then (
218-
// The definition covers the entire variable, so assume that it totally overlaps the use, even if the
219-
// interval for the use is unknown or outside the bounds of the variable.
220-
result instanceof MustTotallyOverlap
221-
)
222-
else (
223-
// Just use the overlap relation of the interval.
224-
result = intervalOverlap
225-
)
187+
else
188+
if defVariableLocation.coversEntireVariable()
189+
then
190+
// The definition covers the entire variable, so assume that it totally overlaps the use, even if the
191+
// interval for the use is unknown or outside the bounds of the variable.
192+
result instanceof MustTotallyOverlap
193+
else
194+
// Just use the overlap relation of the interval.
195+
result = intervalOverlap
226196
)
227197
)
228198
)
@@ -245,10 +215,9 @@ Overlap getOverlap(MemoryLocation def, MemoryLocation use) {
245215
* 5. In `getVariableMemoryLocationOverlap`, compute the precise overlap relation for each
246216
* overlapping pair of VMLs (linear in the size of the overlap set)
247217
*/
218+
248219
private predicate isRelevantOffset(VirtualVariable vv, IntValue offset) {
249-
exists(VariableMemoryLocation ml |
250-
ml.getVirtualVariable() = vv
251-
|
220+
exists(VariableMemoryLocation ml | ml.getVirtualVariable() = vv |
252221
ml.getStartBitOffset() = offset
253222
or
254223
ml.getEndBitOffset() = offset
@@ -278,50 +247,55 @@ private predicate hasUnknownOffset(VariableMemoryLocation vml, VirtualVariable v
278247
)
279248
}
280249

281-
private predicate overlappingVariableMemoryLocations(VariableMemoryLocation def, VariableMemoryLocation use) {
282-
exists(VirtualVariable vv, int offsetRank | isCoveredOffset(def, vv, offsetRank) and isCoveredOffset(use, vv, offsetRank))
283-
or
284-
hasUnknownOffset(def, use.getVirtualVariable())
285-
or
286-
hasUnknownOffset(use, def.getVirtualVariable())
250+
private predicate overlappingVariableMemoryLocations(
251+
VariableMemoryLocation def, VariableMemoryLocation use
252+
) {
253+
exists(VirtualVariable vv, int offsetRank |
254+
isCoveredOffset(def, vv, offsetRank) and isCoveredOffset(use, vv, offsetRank)
255+
)
256+
or
257+
hasUnknownOffset(def, use.getVirtualVariable())
258+
or
259+
hasUnknownOffset(use, def.getVirtualVariable())
287260
}
288261

289-
pragma[noopt] // Internal ticket: QL-937
290-
private predicate overlappingIRVariableMemoryLocations(VariableMemoryLocation def, VariableMemoryLocation use) {
262+
// Internal ticket: QL-937
263+
pragma[noopt]
264+
private predicate overlappingIRVariableMemoryLocations(
265+
VariableMemoryLocation def, VariableMemoryLocation use
266+
) {
291267
overlappingVariableMemoryLocations(def, use) and
292268
def.getVariable() = use.getVariable()
293269
}
294270

295-
private Overlap getVariableMemoryLocationOverlap(VariableMemoryLocation def, VariableMemoryLocation use) {
271+
private Overlap getVariableMemoryLocationOverlap(
272+
VariableMemoryLocation def, VariableMemoryLocation use
273+
) {
296274
overlappingIRVariableMemoryLocations(def, use) and
297-
result = Interval::getOverlap(def.getStartBitOffset(), def.getEndBitOffset(), use.getStartBitOffset(), use.getEndBitOffset())
275+
result = Interval::getOverlap(def.getStartBitOffset(), def.getEndBitOffset(),
276+
use.getStartBitOffset(), use.getEndBitOffset())
298277
}
299278

300-
301279
MemoryLocation getResultMemoryLocation(Instruction instr) {
302280
exists(MemoryAccessKind kind |
303281
kind = instr.getResultMemoryAccess() and
304282
(
305283
(
306284
kind.usesAddressOperand() and
307-
if hasResultMemoryAccess(instr, _, _, _, _) then (
285+
if hasResultMemoryAccess(instr, _, _, _, _)
286+
then
308287
exists(IRVariable var, Type type, IntValue startBitOffset, IntValue endBitOffset |
309288
hasResultMemoryAccess(instr, var, type, startBitOffset, endBitOffset) and
310289
result = TVariableMemoryLocation(var, type, startBitOffset, endBitOffset)
311290
)
312-
)
313-
else (
314-
result = TUnknownMemoryLocation(instr.getEnclosingIRFunction())
315-
)
316-
) or
317-
(
318-
kind instanceof EscapedMemoryAccess and
319-
result = TUnknownVirtualVariable(instr.getEnclosingIRFunction())
320-
) or
321-
(
322-
kind instanceof EscapedMayMemoryAccess and
323-
result = TUnknownMemoryLocation(instr.getEnclosingIRFunction())
291+
else result = TUnknownMemoryLocation(instr.getEnclosingIRFunction())
324292
)
293+
or
294+
kind instanceof EscapedMemoryAccess and
295+
result = TUnknownVirtualVariable(instr.getEnclosingIRFunction())
296+
or
297+
kind instanceof EscapedMayMemoryAccess and
298+
result = TUnknownMemoryLocation(instr.getEnclosingIRFunction())
325299
)
326300
)
327301
}
@@ -332,24 +306,20 @@ MemoryLocation getOperandMemoryLocation(MemoryOperand operand) {
332306
(
333307
(
334308
kind.usesAddressOperand() and
335-
if hasOperandMemoryAccess(operand, _, _, _, _) then (
309+
if hasOperandMemoryAccess(operand, _, _, _, _)
310+
then
336311
exists(IRVariable var, Type type, IntValue startBitOffset, IntValue endBitOffset |
337312
hasOperandMemoryAccess(operand, var, type, startBitOffset, endBitOffset) and
338313
result = TVariableMemoryLocation(var, type, startBitOffset, endBitOffset)
339314
)
340-
)
341-
else (
342-
result = TUnknownMemoryLocation(operand.getEnclosingIRFunction())
343-
)
344-
) or
345-
(
346-
kind instanceof EscapedMemoryAccess and
347-
result = TUnknownVirtualVariable(operand.getEnclosingIRFunction())
348-
) or
349-
(
350-
kind instanceof EscapedMayMemoryAccess and
351-
result = TUnknownMemoryLocation(operand.getEnclosingIRFunction())
315+
else result = TUnknownMemoryLocation(operand.getEnclosingIRFunction())
352316
)
317+
or
318+
kind instanceof EscapedMemoryAccess and
319+
result = TUnknownVirtualVariable(operand.getEnclosingIRFunction())
320+
or
321+
kind instanceof EscapedMayMemoryAccess and
322+
result = TUnknownMemoryLocation(operand.getEnclosingIRFunction())
353323
)
354324
)
355325
}

0 commit comments

Comments
 (0)