Skip to content

Commit 37ffe82

Browse files
paldepindpaldepind
committed
Rust: Handle functions as lambdas
1 parent 0728692 commit 37ffe82

File tree

4 files changed

+52
-15
lines changed

4 files changed

+52
-15
lines changed

‎rust/ql/lib/codeql/rust/dataflow/internal/DataFlowImpl.qll‎

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -295,13 +295,10 @@ module LocalFlow {
295295
class LambdaCallKind = Unit;
296296

297297
/** Holds if `creation` is an expression that creates a lambda of kind `kind`. */
298-
predicate lambdaCreationExpr(Expr creation, LambdaCallKind kind) {
299-
(
300-
creation instanceof ClosureExpr
301-
or
302-
creation instanceof Scope::AsyncBlockScope
303-
) and
304-
exists(kind)
298+
predicate lambdaCreationExpr(Expr creation) {
299+
creation instanceof ClosureExpr
300+
or
301+
creation instanceof Scope::AsyncBlockScope
305302
}
306303

307304
/**
@@ -810,8 +807,15 @@ module RustDataFlow implements InputSig<Location> {
810807

811808
/** Holds if `creation` is an expression that creates a lambda of kind `kind` for `c`. */
812809
predicate lambdaCreation(Node creation, LambdaCallKind kind, DataFlowCallable c) {
813-
exists(Expr e |
814-
e = creation.asExpr().getExpr() and lambdaCreationExpr(e, kind) and e = c.asCfgScope()
810+
exists(kind) and
811+
exists(Expr e | e = creation.asExpr().getExpr() |
812+
lambdaCreationExpr(e) and e = c.asCfgScope()
813+
or
814+
// A path expression, that resolves to a function, evaluates to a function
815+
// pointer. Except if the path occurs directly in a call, then it's just a
816+
// call to the function and not a function being passed as data.
817+
resolvePath(e.(PathExpr).getPath()) = c.asCfgScope() and
818+
not any(CallExpr call).getFunction() = e
815819
)
816820
}
817821

@@ -931,7 +935,7 @@ module VariableCapture {
931935
}
932936

933937
class ClosureExpr extends Expr instanceof ExprCfgNode {
934-
ClosureExpr() { lambdaCreationExpr(super.getExpr(), _) }
938+
ClosureExpr() { lambdaCreationExpr(super.getExpr()) }
935939

936940
predicate hasBody(Callable body) { body = super.getExpr() }
937941

‎rust/ql/lib/codeql/rust/dataflow/internal/Node.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -454,7 +454,7 @@ newtype TNode =
454454
or
455455
lambdaCallExpr(_, _, e)
456456
or
457-
lambdaCreationExpr(e.getExpr(), _)
457+
lambdaCreationExpr(e.getExpr())
458458
or
459459
// Whenever `&mut e` has a post-update node we also create one for `e`.
460460
// E.g., for `e` in `f(..., &mut e, ...)` or `*(&mut e) = ...`.
@@ -478,5 +478,5 @@ newtype TNode =
478478
} or
479479
TSsaNode(SsaImpl::DataFlowIntegration::SsaNode node) or
480480
TFlowSummaryNode(FlowSummaryImpl::Private::SummaryNode sn) or
481-
TClosureSelfReferenceNode(CfgScope c) { lambdaCreationExpr(c, _) } or
481+
TClosureSelfReferenceNode(CfgScope c) { lambdaCreationExpr(c) } or
482482
TCaptureNode(VariableCapture::Flow::SynthesizedCaptureNode cn)

‎rust/ql/test/library-tests/dataflow/lambdas/inline-flow.expected‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,19 @@ edges
1717
| main.rs:39:5:39:5 | [post] f [captured capt] | main.rs:40:10:40:13 | capt | provenance | |
1818
| main.rs:39:5:39:5 | [post] f [captured capt] | main.rs:44:5:44:5 | g [captured capt] | provenance | |
1919
| main.rs:44:5:44:5 | g [captured capt] | main.rs:42:14:42:17 | capt | provenance | |
20+
| main.rs:47:29:49:1 | { ... } | main.rs:57:10:57:12 | f(...) | provenance | |
21+
| main.rs:48:5:48:14 | source(...) | main.rs:47:29:49:1 | { ... } | provenance | |
22+
| main.rs:51:17:51:25 | ...: i64 | main.rs:52:10:52:13 | data | provenance | |
23+
| main.rs:62:9:62:9 | a | main.rs:63:7:63:7 | a | provenance | |
24+
| main.rs:62:13:62:22 | source(...) | main.rs:62:9:62:9 | a | provenance | |
25+
| main.rs:63:7:63:7 | a | main.rs:51:17:51:25 | ...: i64 | provenance | |
26+
| main.rs:66:24:66:32 | ...: i64 | main.rs:66:42:72:1 | { ... } | provenance | |
27+
| main.rs:76:9:76:9 | a | main.rs:77:21:77:21 | a | provenance | |
28+
| main.rs:76:13:76:22 | source(...) | main.rs:76:9:76:9 | a | provenance | |
29+
| main.rs:77:9:77:9 | b | main.rs:78:10:78:10 | b | provenance | |
30+
| main.rs:77:13:77:22 | f(...) | main.rs:77:9:77:9 | b | provenance | |
31+
| main.rs:77:21:77:21 | a | main.rs:66:24:66:32 | ...: i64 | provenance | |
32+
| main.rs:77:21:77:21 | a | main.rs:77:13:77:22 | f(...) | provenance | |
2033
nodes
2134
| main.rs:10:20:10:52 | if cond {...} else {...} | semmle.label | if cond {...} else {...} |
2235
| main.rs:10:30:10:39 | source(...) | semmle.label | source(...) |
@@ -39,12 +52,32 @@ nodes
3952
| main.rs:40:10:40:13 | capt | semmle.label | capt |
4053
| main.rs:42:14:42:17 | capt | semmle.label | capt |
4154
| main.rs:44:5:44:5 | g [captured capt] | semmle.label | g [captured capt] |
55+
| main.rs:47:29:49:1 | { ... } | semmle.label | { ... } |
56+
| main.rs:48:5:48:14 | source(...) | semmle.label | source(...) |
57+
| main.rs:51:17:51:25 | ...: i64 | semmle.label | ...: i64 |
58+
| main.rs:52:10:52:13 | data | semmle.label | data |
59+
| main.rs:57:10:57:12 | f(...) | semmle.label | f(...) |
60+
| main.rs:62:9:62:9 | a | semmle.label | a |
61+
| main.rs:62:13:62:22 | source(...) | semmle.label | source(...) |
62+
| main.rs:63:7:63:7 | a | semmle.label | a |
63+
| main.rs:66:24:66:32 | ...: i64 | semmle.label | ...: i64 |
64+
| main.rs:66:42:72:1 | { ... } | semmle.label | { ... } |
65+
| main.rs:76:9:76:9 | a | semmle.label | a |
66+
| main.rs:76:13:76:22 | source(...) | semmle.label | source(...) |
67+
| main.rs:77:9:77:9 | b | semmle.label | b |
68+
| main.rs:77:13:77:22 | f(...) | semmle.label | f(...) |
69+
| main.rs:77:21:77:21 | a | semmle.label | a |
70+
| main.rs:78:10:78:10 | b | semmle.label | b |
4271
subpaths
4372
| main.rs:29:21:29:21 | a | main.rs:27:20:27:23 | ... | main.rs:27:26:27:52 | if cond {...} else {...} | main.rs:29:13:29:22 | f(...) |
73+
| main.rs:77:21:77:21 | a | main.rs:66:24:66:32 | ...: i64 | main.rs:66:42:72:1 | { ... } | main.rs:77:13:77:22 | f(...) |
4474
testFailures
4575
#select
4676
| main.rs:11:10:11:16 | f(...) | main.rs:10:30:10:39 | source(...) | main.rs:11:10:11:16 | f(...) | $@ | main.rs:10:30:10:39 | source(...) | source(...) |
4777
| main.rs:17:18:17:21 | data | main.rs:22:13:22:22 | source(...) | main.rs:17:18:17:21 | data | $@ | main.rs:22:13:22:22 | source(...) | source(...) |
4878
| main.rs:30:10:30:10 | b | main.rs:28:13:28:22 | source(...) | main.rs:30:10:30:10 | b | $@ | main.rs:28:13:28:22 | source(...) | source(...) |
4979
| main.rs:40:10:40:13 | capt | main.rs:37:16:37:25 | source(...) | main.rs:40:10:40:13 | capt | $@ | main.rs:37:16:37:25 | source(...) | source(...) |
5080
| main.rs:42:14:42:17 | capt | main.rs:37:16:37:25 | source(...) | main.rs:42:14:42:17 | capt | $@ | main.rs:37:16:37:25 | source(...) | source(...) |
81+
| main.rs:52:10:52:13 | data | main.rs:62:13:62:22 | source(...) | main.rs:52:10:52:13 | data | $@ | main.rs:62:13:62:22 | source(...) | source(...) |
82+
| main.rs:57:10:57:12 | f(...) | main.rs:48:5:48:14 | source(...) | main.rs:57:10:57:12 | f(...) | $@ | main.rs:48:5:48:14 | source(...) | source(...) |
83+
| main.rs:78:10:78:10 | b | main.rs:76:13:76:22 | source(...) | main.rs:78:10:78:10 | b | $@ | main.rs:76:13:76:22 | source(...) | source(...) |

‎rust/ql/test/library-tests/dataflow/lambdas/main.rs‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -49,12 +49,12 @@ fn get_from_source() -> i64 {
4949
}
5050

5151
fn pass_to_sink(data: i64) {
52-
sink(data); // $ MISSING: hasValueFlow=34
52+
sink(data); // $ hasValueFlow=34
5353
}
5454

5555
fn function_flow_out() {
5656
let f = get_from_source;
57-
sink(f()); // $ MISSING: hasValueFlow=93
57+
sink(f()); // $ hasValueFlow=93
5858
}
5959

6060
fn function_flow_in() {
@@ -75,7 +75,7 @@ fn function_flows_through() {
7575
let f = get_arg;
7676
let a = source(56);
7777
let b = f(true, a);
78-
sink(b); // $ MISSING: hasValueFlow=56
78+
sink(b); // $ hasValueFlow=56
7979
}
8080

8181
fn main() {

0 commit comments

Comments
 (0)