Skip to content

Commit 2df0509

Browse files
calumgrantcalumgrant
authored
Merge pull request #1685 from hvitved/csharp/dataflow/out-flow-fix
C#: Fix data flow for `out`/`ref` parameters
2 parents 3e98773 + 4d58154 commit 2df0509

File tree

9 files changed

+5440
-5227
lines changed

9 files changed

+5440
-5227
lines changed

‎csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -738,7 +738,8 @@ private module ReturnNodes {
738738

739739
OutRefReturnNode() {
740740
exists(Parameter p |
741-
this.getDefinition().(Ssa::ExplicitDefinition).isLiveOutRefParameterDefinition(p)
741+
this.getDefinition().(Ssa::ExplicitDefinition).isLiveOutRefParameterDefinition(p) and
742+
kind.getPosition() = p.getPosition()
742743
|
743744
p.isOut() and kind instanceof OutReturnKind
744745
or

‎csharp/ql/test/library-tests/dataflow/global/DataFlow.expected‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -17,24 +17,24 @@
1717
| GlobalDataFlow.cs:73:15:73:19 | access to local variable sink1 |
1818
| GlobalDataFlow.cs:76:15:76:19 | access to local variable sink2 |
1919
| GlobalDataFlow.cs:79:15:79:19 | access to local variable sink3 |
20-
| GlobalDataFlow.cs:132:15:132:19 | access to local variable sink4 |
21-
| GlobalDataFlow.cs:140:15:140:19 | access to local variable sink5 |
22-
| GlobalDataFlow.cs:150:15:150:19 | access to local variable sink6 |
23-
| GlobalDataFlow.cs:153:15:153:19 | access to local variable sink7 |
24-
| GlobalDataFlow.cs:156:15:156:19 | access to local variable sink8 |
25-
| GlobalDataFlow.cs:160:15:160:20 | access to local variable sink23 |
26-
| GlobalDataFlow.cs:177:15:177:19 | access to local variable sink9 |
27-
| GlobalDataFlow.cs:186:15:186:20 | access to local variable sink10 |
28-
| GlobalDataFlow.cs:194:15:194:20 | access to local variable sink19 |
29-
| GlobalDataFlow.cs:233:15:233:24 | access to parameter sinkParam0 |
30-
| GlobalDataFlow.cs:238:15:238:24 | access to parameter sinkParam1 |
31-
| GlobalDataFlow.cs:243:15:243:24 | access to parameter sinkParam3 |
32-
| GlobalDataFlow.cs:248:15:248:24 | access to parameter sinkParam4 |
33-
| GlobalDataFlow.cs:253:15:253:24 | access to parameter sinkParam5 |
34-
| GlobalDataFlow.cs:258:15:258:24 | access to parameter sinkParam6 |
35-
| GlobalDataFlow.cs:263:15:263:24 | access to parameter sinkParam7 |
36-
| GlobalDataFlow.cs:376:15:376:20 | access to local variable sink11 |
37-
| GlobalDataFlow.cs:399:41:399:46 | access to local variable sink20 |
20+
| GlobalDataFlow.cs:136:15:136:19 | access to local variable sink4 |
21+
| GlobalDataFlow.cs:144:15:144:19 | access to local variable sink5 |
22+
| GlobalDataFlow.cs:154:15:154:19 | access to local variable sink6 |
23+
| GlobalDataFlow.cs:157:15:157:19 | access to local variable sink7 |
24+
| GlobalDataFlow.cs:160:15:160:19 | access to local variable sink8 |
25+
| GlobalDataFlow.cs:164:15:164:20 | access to local variable sink23 |
26+
| GlobalDataFlow.cs:181:15:181:19 | access to local variable sink9 |
27+
| GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 |
28+
| GlobalDataFlow.cs:198:15:198:20 | access to local variable sink19 |
29+
| GlobalDataFlow.cs:237:15:237:24 | access to parameter sinkParam0 |
30+
| GlobalDataFlow.cs:242:15:242:24 | access to parameter sinkParam1 |
31+
| GlobalDataFlow.cs:247:15:247:24 | access to parameter sinkParam3 |
32+
| GlobalDataFlow.cs:252:15:252:24 | access to parameter sinkParam4 |
33+
| GlobalDataFlow.cs:257:15:257:24 | access to parameter sinkParam5 |
34+
| GlobalDataFlow.cs:262:15:262:24 | access to parameter sinkParam6 |
35+
| GlobalDataFlow.cs:267:15:267:24 | access to parameter sinkParam7 |
36+
| GlobalDataFlow.cs:381:15:381:20 | access to local variable sink11 |
37+
| GlobalDataFlow.cs:404:41:404:46 | access to local variable sink20 |
3838
| Splitting.cs:9:15:9:15 | [b (line 3): false] access to local variable x |
3939
| Splitting.cs:9:15:9:15 | [b (line 3): true] access to local variable x |
4040
| Splitting.cs:11:19:11:19 | access to local variable x |

‎csharp/ql/test/library-tests/dataflow/global/DataFlowEdges.expected‎

Lines changed: 2152 additions & 2059 deletions
Large diffs are not rendered by default.

‎csharp/ql/test/library-tests/dataflow/global/DataFlowPath.expected‎

Lines changed: 71 additions & 71 deletions
Large diffs are not rendered by default.

‎csharp/ql/test/library-tests/dataflow/global/GetAnOutNode.expected‎

Lines changed: 97 additions & 94 deletions
Large diffs are not rendered by default.

‎csharp/ql/test/library-tests/dataflow/global/GlobalDataFlow.cs‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -72,10 +72,10 @@ public void M()
7272
var sink1 = (string)typeof(DataFlow).GetMethod("Return").Invoke(null, new object[] { sink0 });
7373
Check(sink1);
7474
string sink2;
75-
ReturnOut(sink1, out sink2);
75+
ReturnOut(sink1, out sink2, out var _);
7676
Check(sink2);
7777
var sink3 = "";
78-
ReturnRef(sink2, ref sink3);
78+
ReturnRef(sink2, ref sink3, ref sink3);
7979
Check(sink3);
8080
var sink13 = ((IEnumerable<string>)new string[] { sink3 }).SelectEven(x => x);
8181
Check(sink13);
@@ -101,9 +101,13 @@ public void M()
101101
Check(nonSink0);
102102
nonSink0 = (string)typeof(DataFlow).GetMethod("Return").Invoke(null, new object[] { nonSink0 });
103103
Check(nonSink0);
104-
ReturnOut("", out nonSink0);
104+
ReturnOut("", out nonSink0, out var _);
105105
Check(nonSink0);
106-
ReturnRef("", ref nonSink0);
106+
ReturnOut(sink1, out var _, out nonSink0);
107+
Check(nonSink0);
108+
ReturnRef("", ref nonSink0, ref nonSink0);
109+
Check(nonSink0);
110+
ReturnRef(sink1, ref sink1, ref nonSink0);
107111
Check(nonSink0);
108112
var nonSink1 = ((IEnumerable<string>)new string[] { nonSink0 }).SelectEven(x => x);
109113
Check(nonSink1);
@@ -274,12 +278,13 @@ static T Return<T>(T x)
274278
return y == null ? default(T) : y;
275279
}
276280

277-
static void ReturnOut<T>(T x, out T y)
281+
static void ReturnOut<T>(T x, out T y, out T z)
278282
{
279283
y = x;
284+
z = default(T);
280285
}
281286

282-
static void ReturnRef<T>(T x, ref T y)
287+
static void ReturnRef<T>(T x, ref T y, ref T z)
283288
{
284289
y = x;
285290
}

‎csharp/ql/test/library-tests/dataflow/global/TaintTracking.expected‎

Lines changed: 26 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -25,32 +25,32 @@
2525
| GlobalDataFlow.cs:91:15:91:20 | access to local variable sink18 |
2626
| GlobalDataFlow.cs:94:15:94:20 | access to local variable sink21 |
2727
| GlobalDataFlow.cs:97:15:97:20 | access to local variable sink22 |
28-
| GlobalDataFlow.cs:132:15:132:19 | access to local variable sink4 |
29-
| GlobalDataFlow.cs:140:15:140:19 | access to local variable sink5 |
30-
| GlobalDataFlow.cs:150:15:150:19 | access to local variable sink6 |
31-
| GlobalDataFlow.cs:153:15:153:19 | access to local variable sink7 |
32-
| GlobalDataFlow.cs:156:15:156:19 | access to local variable sink8 |
33-
| GlobalDataFlow.cs:158:15:158:20 | access to local variable sink12 |
34-
| GlobalDataFlow.cs:160:15:160:20 | access to local variable sink23 |
35-
| GlobalDataFlow.cs:177:15:177:19 | access to local variable sink9 |
36-
| GlobalDataFlow.cs:186:15:186:20 | access to local variable sink10 |
37-
| GlobalDataFlow.cs:194:15:194:20 | access to local variable sink19 |
38-
| GlobalDataFlow.cs:204:58:204:68 | access to parameter sinkParam10 |
39-
| GlobalDataFlow.cs:207:15:207:20 | access to local variable sink24 |
40-
| GlobalDataFlow.cs:209:15:209:20 | access to local variable sink25 |
41-
| GlobalDataFlow.cs:211:15:211:20 | access to local variable sink26 |
42-
| GlobalDataFlow.cs:233:15:233:24 | access to parameter sinkParam0 |
43-
| GlobalDataFlow.cs:238:15:238:24 | access to parameter sinkParam1 |
44-
| GlobalDataFlow.cs:243:15:243:24 | access to parameter sinkParam3 |
45-
| GlobalDataFlow.cs:248:15:248:24 | access to parameter sinkParam4 |
46-
| GlobalDataFlow.cs:253:15:253:24 | access to parameter sinkParam5 |
47-
| GlobalDataFlow.cs:258:15:258:24 | access to parameter sinkParam6 |
48-
| GlobalDataFlow.cs:263:15:263:24 | access to parameter sinkParam7 |
49-
| GlobalDataFlow.cs:289:15:289:24 | access to parameter sinkParam8 |
50-
| GlobalDataFlow.cs:295:15:295:24 | access to parameter sinkParam9 |
51-
| GlobalDataFlow.cs:301:15:301:25 | access to parameter sinkParam11 |
52-
| GlobalDataFlow.cs:376:15:376:20 | access to local variable sink11 |
53-
| GlobalDataFlow.cs:399:41:399:46 | access to local variable sink20 |
28+
| GlobalDataFlow.cs:136:15:136:19 | access to local variable sink4 |
29+
| GlobalDataFlow.cs:144:15:144:19 | access to local variable sink5 |
30+
| GlobalDataFlow.cs:154:15:154:19 | access to local variable sink6 |
31+
| GlobalDataFlow.cs:157:15:157:19 | access to local variable sink7 |
32+
| GlobalDataFlow.cs:160:15:160:19 | access to local variable sink8 |
33+
| GlobalDataFlow.cs:162:15:162:20 | access to local variable sink12 |
34+
| GlobalDataFlow.cs:164:15:164:20 | access to local variable sink23 |
35+
| GlobalDataFlow.cs:181:15:181:19 | access to local variable sink9 |
36+
| GlobalDataFlow.cs:190:15:190:20 | access to local variable sink10 |
37+
| GlobalDataFlow.cs:198:15:198:20 | access to local variable sink19 |
38+
| GlobalDataFlow.cs:208:58:208:68 | access to parameter sinkParam10 |
39+
| GlobalDataFlow.cs:211:15:211:20 | access to local variable sink24 |
40+
| GlobalDataFlow.cs:213:15:213:20 | access to local variable sink25 |
41+
| GlobalDataFlow.cs:215:15:215:20 | access to local variable sink26 |
42+
| GlobalDataFlow.cs:237:15:237:24 | access to parameter sinkParam0 |
43+
| GlobalDataFlow.cs:242:15:242:24 | access to parameter sinkParam1 |
44+
| GlobalDataFlow.cs:247:15:247:24 | access to parameter sinkParam3 |
45+
| GlobalDataFlow.cs:252:15:252:24 | access to parameter sinkParam4 |
46+
| GlobalDataFlow.cs:257:15:257:24 | access to parameter sinkParam5 |
47+
| GlobalDataFlow.cs:262:15:262:24 | access to parameter sinkParam6 |
48+
| GlobalDataFlow.cs:267:15:267:24 | access to parameter sinkParam7 |
49+
| GlobalDataFlow.cs:294:15:294:24 | access to parameter sinkParam8 |
50+
| GlobalDataFlow.cs:300:15:300:24 | access to parameter sinkParam9 |
51+
| GlobalDataFlow.cs:306:15:306:25 | access to parameter sinkParam11 |
52+
| GlobalDataFlow.cs:381:15:381:20 | access to local variable sink11 |
53+
| GlobalDataFlow.cs:404:41:404:46 | access to local variable sink20 |
5454
| Splitting.cs:9:15:9:15 | [b (line 3): false] access to local variable x |
5555
| Splitting.cs:9:15:9:15 | [b (line 3): true] access to local variable x |
5656
| Splitting.cs:11:19:11:19 | access to local variable x |

0 commit comments

Comments
 (0)