Skip to content

Commit 3edadc3

Browse files
committed
C++: Simplify skipInitializer in CFG.qll
The CFG construction code previously contained half of an approximation of which address expressions are constant. Now this this property is properly modelled by `Expr.isConstant`, we can remove this code. This fixes most discrepancies between the QL-based CFG and the extractor-based CFG on Wireshark.
1 parent aaae5be commit 3edadc3

File tree

2 files changed

+6
-25
lines changed
  • cpp/ql
    • src/semmle/code/cpp/controlflow/internal
    • test/library-tests/qlcfg

2 files changed

+6
-25
lines changed

cpp/ql/src/semmle/code/cpp/controlflow/internal/CFG.qll

Lines changed: 3 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -461,38 +461,16 @@ private predicate skipInitializer(Initializer init) {
461461
*/
462462
private predicate runtimeExprInStaticInitializer(Expr e) {
463463
inStaticInitializer(e) and
464-
if
465-
e instanceof AggregateLiteral
466-
or
467-
e instanceof PointerArithmeticOperation
468-
or
469-
// Extractor doesn't populate this specifier at the time of writing, so
470-
// this case has not been tested. See CPP-314.
471-
e.(FunctionCall).getTarget().hasSpecifier("constexpr")
464+
if e instanceof AggregateLiteral
472465
then runtimeExprInStaticInitializer(e.getAChild())
473-
else (
474-
// Not constant
475-
not e.isConstant() and
476-
// Not a function address
477-
not e instanceof FunctionAccess and
478-
// Not a function address-of (same as above)
479-
not e.(AddressOfExpr).getOperand() instanceof FunctionAccess and
480-
// Not the address of a global variable
481-
not exists(Variable v |
482-
v.isStatic()
483-
or
484-
v instanceof GlobalOrNamespaceVariable
485-
|
486-
e.(AddressOfExpr).getOperand() = v.getAnAccess()
487-
)
488-
)
466+
else not e.getFullyConverted().isConstant()
489467
}
490468

491469
/** Holds if `e` is part of the initializer of a local static variable. */
492470
private predicate inStaticInitializer(Expr e) {
493471
exists(LocalVariable local |
494472
local.isStatic() and
495-
e.(Node).getParentNode*() = local.getInitializer()
473+
e.getParent+() = local.getInitializer()
496474
)
497475
}
498476

cpp/ql/test/library-tests/qlcfg/cpp11.cpp

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,9 @@ void skip_init() {
5454
void run_init() {
5555
int nonstatic;
5656
static int x1 = global_int;
57+
58+
// It makes no sense to initialize a static variable to the address of a
59+
// non-static variable, but in principle it can be done:
5760
static int *x2 = &nonstatic;
5861
}
5962

0 commit comments

Comments
 (0)