Skip to content

Commit 45eefdb

Browse files
jbjjbj
committed
C++: Field flow through ConstructorFieldInit
This allows a member initializer list to be seen as a sequence of field assignments. For example, the constructor C() : a(taint()) { } now has data flow similar to C() { this.a = taint(); }
1 parent 1be2380 commit 45eefdb

File tree

8 files changed

+90
-4
lines changed

8 files changed

+90
-4
lines changed

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowPrivate.qll‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -178,6 +178,12 @@ predicate storeStep(Node node1, Content f, PostUpdateNode node2) {
178178
node2.getPreUpdateNode().asExpr() = fa.getQualifier() and
179179
f.(FieldContent).getField() = fa.getTarget()
180180
)
181+
or
182+
exists(ConstructorFieldInit cfi |
183+
node2.getPreUpdateNode().(PreConstructorInitThis).getConstructorFieldInit() = cfi and
184+
f.(FieldContent).getField() = cfi.getTarget() and
185+
node1.asExpr() = cfi.getExpr()
186+
)
181187
}
182188

183189
/**

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ private newtype TNode =
1313
TPreConstructorCallNode(ConstructorCall call) or
1414
TExplicitParameterNode(Parameter p) { exists(p.getFunction().getBlock()) } or
1515
TInstanceParameterNode(MemberFunction f) { exists(f.getBlock()) and not f.isStatic() } or
16+
TPreConstructorInitThis(ConstructorFieldInit cfi) or
17+
TPostConstructorInitThis(ConstructorFieldInit cfi) or
1618
TUninitializedNode(LocalVariable v) { not v.hasInitializer() }
1719

1820
/**
@@ -288,6 +290,44 @@ class PreConstructorCallNode extends Node, TPreConstructorCallNode {
288290
override string toString() { result = getConstructorCall().toString() + " [pre constructor call]" }
289291
}
290292

293+
/**
294+
* A synthetic data-flow node that plays the role of the post-update `this`
295+
* pointer in a `ConstructorFieldInit`. For example, the `x(1)` in
296+
* `C() : x(1) { }` is roughly equivalent to `this.x = 1`, and this node is
297+
* equivalent to the `this` _after_ the field has been assigned.
298+
*/
299+
private class PostConstructorInitThis extends PostUpdateNode, TPostConstructorInitThis {
300+
override PreConstructorInitThis getPreUpdateNode() {
301+
this = TPostConstructorInitThis(result.getConstructorFieldInit())
302+
}
303+
304+
override string toString() {
305+
result = getPreUpdateNode().getConstructorFieldInit().toString() + " [post-this]"
306+
}
307+
}
308+
309+
/**
310+
* INTERNAL: do not use.
311+
*
312+
* A synthetic data-flow node that plays the role of the pre-update `this`
313+
* pointer in a `ConstructorFieldInit`. For example, the `x(1)` in
314+
* `C() : x(1) { }` is roughly equivalent to `this.x = 1`, and this node is
315+
* equivalent to the `this` _before_ the field has been assigned.
316+
*/
317+
class PreConstructorInitThis extends Node, TPreConstructorInitThis {
318+
ConstructorFieldInit getConstructorFieldInit() { this = TPreConstructorInitThis(result) }
319+
320+
override Constructor getFunction() { result = getConstructorFieldInit().getEnclosingFunction() }
321+
322+
override PointerType getType() {
323+
result.getBaseType() = getConstructorFieldInit().getEnclosingFunction().getDeclaringType()
324+
}
325+
326+
override Location getLocation() { result = getConstructorFieldInit().getLocation() }
327+
328+
override string toString() { result = getConstructorFieldInit().toString() + " [pre-this]" }
329+
}
330+
291331
/**
292332
* Gets the `Node` corresponding to `e`.
293333
*/
@@ -313,13 +353,29 @@ DefinitionByReferenceNode definitionByReferenceNodeFromArgument(Expr argument) {
313353
UninitializedNode uninitializedNode(LocalVariable v) { result.getLocalVariable() = v }
314354

315355
private module ThisFlow {
356+
/**
357+
* Gets the 0-based index of `thisNode` in `b`, where `thisNode` is an access
358+
* to `this` that may or may not have an associated `PostUpdateNode`. To make
359+
* room for synthetic nodes that access `this`, the index may not correspond
360+
* to an actual `ControlFlowNode`.
361+
*/
316362
private int basicBlockThisIndex(BasicBlock b, Node thisNode) {
317363
// The implicit `this` parameter node is given a very negative offset to
318364
// make space for any `ConstructorFieldInit`s there may be between it and
319365
// the block contents.
320366
thisNode.(ImplicitParameterNode).getFunction().getBlock() = b and
321367
result = -1000
322368
or
369+
// Place the synthetic `this` node for a `ConstructorFieldInit` at a
370+
// negative offset in the first basic block, between the
371+
// `ImplicitParameterNode` and the first statement.
372+
exists(Constructor constructor, int i |
373+
thisNode.(PreConstructorInitThis).getConstructorFieldInit() =
374+
constructor.getInitializer(i) and
375+
result = -999 + i and
376+
b = thisNode.getFunction().getBlock()
377+
)
378+
or
323379
b.getNode(result) = thisNode.asExpr().(ThisExpr)
324380
}
325381

‎cpp/ql/test/library-tests/dataflow/fields/C.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ class C
2626

2727
void func()
2828
{
29-
sink(s1); // flow [NOT DETECTED] (in either place)
29+
sink(s1); // flow
3030
sink(s2); // flow [NOT DETECTED]
3131
sink(s3); // flow
3232
sink(s4); // flow [NOT DETECTED]

‎cpp/ql/test/library-tests/dataflow/fields/flow.expected‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,12 +75,18 @@ edges
7575
| B.cpp:18:14:18:17 | box1 [elem1, ... (1)] | B.cpp:18:20:18:24 | elem1 |
7676
| B.cpp:19:10:19:11 | b2 [box1, ... (2)] | B.cpp:19:14:19:17 | box1 [elem2, ... (1)] |
7777
| B.cpp:19:14:19:17 | box1 [elem2, ... (1)] | B.cpp:19:20:19:24 | elem2 |
78+
| C.cpp:18:12:18:18 | call to C [s1, ... (1)] | C.cpp:19:5:19:5 | c [s1, ... (1)] |
7879
| C.cpp:18:12:18:18 | call to C [s3, ... (1)] | C.cpp:19:5:19:5 | c [s3, ... (1)] |
80+
| C.cpp:19:5:19:5 | c [s1, ... (1)] | C.cpp:27:8:27:11 | `this` parameter in func [s1, ... (1)] |
7981
| C.cpp:19:5:19:5 | c [s3, ... (1)] | C.cpp:27:8:27:11 | `this` parameter in func [s3, ... (1)] |
82+
| C.cpp:22:9:22:22 | constructor init of field s1 [post-this] [s1, ... (1)] | C.cpp:18:12:18:18 | call to C [s1, ... (1)] |
83+
| C.cpp:22:12:22:21 | new [void] | C.cpp:22:9:22:22 | constructor init of field s1 [post-this] [s1, ... (1)] |
8084
| C.cpp:24:5:24:8 | this [post update] [s3, ... (1)] | C.cpp:18:12:18:18 | call to C [s3, ... (1)] |
8185
| C.cpp:24:5:24:25 | ... = ... [void] | C.cpp:24:5:24:8 | this [post update] [s3, ... (1)] |
8286
| C.cpp:24:16:24:25 | new [void] | C.cpp:24:5:24:25 | ... = ... [void] |
87+
| C.cpp:27:8:27:11 | `this` parameter in func [s1, ... (1)] | file://:0:0:0:0 | this [s1, ... (1)] |
8388
| C.cpp:27:8:27:11 | `this` parameter in func [s3, ... (1)] | file://:0:0:0:0 | this [s3, ... (1)] |
89+
| file://:0:0:0:0 | this [s1, ... (1)] | C.cpp:29:10:29:11 | s1 |
8490
| file://:0:0:0:0 | this [s3, ... (1)] | C.cpp:31:10:31:11 | s3 |
8591
| simple.cpp:26:15:26:15 | f [a_, ... (1)] | simple.cpp:28:10:28:10 | f [a_, ... (1)] |
8692
| simple.cpp:26:15:26:15 | f [b_, ... (1)] | simple.cpp:29:10:29:10 | f [b_, ... (1)] |
@@ -116,6 +122,7 @@ edges
116122
| B.cpp:10:20:10:24 | elem2 | B.cpp:6:15:6:24 | new [void] | B.cpp:10:20:10:24 | elem2 | elem2 flows from $@ | B.cpp:6:15:6:24 | new [void] | new [void] |
117123
| B.cpp:18:20:18:24 | elem1 | B.cpp:15:15:15:27 | new [void] | B.cpp:18:20:18:24 | elem1 | elem1 flows from $@ | B.cpp:15:15:15:27 | new [void] | new [void] |
118124
| B.cpp:19:20:19:24 | elem2 | B.cpp:15:15:15:27 | new [void] | B.cpp:19:20:19:24 | elem2 | elem2 flows from $@ | B.cpp:15:15:15:27 | new [void] | new [void] |
125+
| C.cpp:29:10:29:11 | s1 | C.cpp:22:12:22:21 | new [void] | C.cpp:29:10:29:11 | s1 | s1 flows from $@ | C.cpp:22:12:22:21 | new [void] | new [void] |
119126
| C.cpp:31:10:31:11 | s3 | C.cpp:24:16:24:25 | new [void] | C.cpp:31:10:31:11 | s3 | s3 flows from $@ | C.cpp:24:16:24:25 | new [void] | new [void] |
120127
| simple.cpp:28:12:28:12 | call to a | simple.cpp:39:12:39:21 | call to user_input [void] | simple.cpp:28:12:28:12 | call to a | call to a flows from $@ | simple.cpp:39:12:39:21 | call to user_input [void] | call to user_input [void] |
121128
| simple.cpp:28:12:28:12 | call to a | simple.cpp:41:12:41:21 | call to user_input [void] | simple.cpp:28:12:28:12 | call to a | call to a flows from $@ | simple.cpp:41:12:41:21 | call to user_input [void] | call to user_input [void] |

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,8 +62,12 @@
6262
| taint.cpp:37:12:37:20 | call to increment | taint.cpp:43:7:43:13 | global9 | |
6363
| taint.cpp:38:13:38:16 | call to zero | taint.cpp:38:2:38:26 | ... = ... | |
6464
| taint.cpp:38:13:38:16 | call to zero | taint.cpp:44:7:44:14 | global10 | |
65-
| taint.cpp:71:2:71:8 | `this` parameter in MyClass | file://:0:0:0:0 | this | |
65+
| taint.cpp:71:2:71:8 | `this` parameter in MyClass | taint.cpp:71:14:71:17 | constructor init of field a [pre-this] | |
6666
| taint.cpp:71:14:71:17 | 0 | taint.cpp:71:14:71:17 | constructor init of field a | TAINT |
67+
| taint.cpp:71:14:71:17 | constructor init of field a [post-this] | taint.cpp:71:20:71:30 | constructor init of field b [pre-this] | |
68+
| taint.cpp:71:14:71:17 | constructor init of field a [pre-this] | taint.cpp:71:20:71:30 | constructor init of field b [pre-this] | |
69+
| taint.cpp:71:20:71:30 | constructor init of field b [post-this] | file://:0:0:0:0 | this | |
70+
| taint.cpp:71:20:71:30 | constructor init of field b [pre-this] | file://:0:0:0:0 | this | |
6771
| taint.cpp:71:22:71:27 | call to source | taint.cpp:71:20:71:30 | constructor init of field b | TAINT |
6872
| taint.cpp:72:3:72:3 | this [post update] | file://:0:0:0:0 | this | |
6973
| taint.cpp:72:7:72:12 | call to source | taint.cpp:72:3:72:14 | ... = ... | |
@@ -212,6 +216,8 @@
212216
| taint.cpp:226:9:226:10 | 0 | taint.cpp:261:7:261:7 | w | |
213217
| taint.cpp:228:11:228:11 | Unknown literal | taint.cpp:228:11:228:11 | constructor init of field t | TAINT |
214218
| taint.cpp:228:11:228:11 | Unknown literal | taint.cpp:228:11:228:11 | constructor init of field u | TAINT |
219+
| taint.cpp:228:11:228:11 | `this` parameter in (constructor) | taint.cpp:228:11:228:11 | constructor init of field t [pre-this] | |
220+
| taint.cpp:228:11:228:11 | `this` parameter in (constructor) | taint.cpp:243:11:243:11 | constructor init of field t [pre-this] | |
215221
| taint.cpp:228:11:232:2 | [...](...){...} | taint.cpp:233:7:233:7 | a | |
216222
| taint.cpp:228:11:232:2 | {...} | taint.cpp:228:11:232:2 | [...](...){...} | TAINT |
217223
| taint.cpp:228:12:228:12 | t | taint.cpp:228:11:232:2 | {...} | TAINT |
@@ -221,12 +227,19 @@
221227
| taint.cpp:235:11:235:11 | Unknown literal | taint.cpp:235:11:235:11 | constructor init of field t | TAINT |
222228
| taint.cpp:235:11:235:11 | Unknown literal | taint.cpp:235:11:235:11 | constructor init of field u | TAINT |
223229
| taint.cpp:235:11:235:11 | Unknown literal | taint.cpp:235:11:235:11 | constructor init of field v | TAINT |
230+
| taint.cpp:235:11:235:11 | `this` parameter in (constructor) | taint.cpp:235:11:235:11 | constructor init of field t [pre-this] | |
231+
| taint.cpp:235:11:235:11 | constructor init of field t [post-this] | taint.cpp:235:11:235:11 | constructor init of field u [pre-this] | |
232+
| taint.cpp:235:11:235:11 | constructor init of field t [pre-this] | taint.cpp:235:11:235:11 | constructor init of field u [pre-this] | |
233+
| taint.cpp:235:11:235:11 | constructor init of field u [post-this] | taint.cpp:235:11:235:11 | constructor init of field v [pre-this] | |
234+
| taint.cpp:235:11:235:11 | constructor init of field u [pre-this] | taint.cpp:235:11:235:11 | constructor init of field v [pre-this] | |
224235
| taint.cpp:235:11:239:2 | [...](...){...} | taint.cpp:240:2:240:2 | b | |
225236
| taint.cpp:235:11:239:2 | {...} | taint.cpp:235:11:239:2 | [...](...){...} | TAINT |
226237
| taint.cpp:235:15:235:15 | `this` parameter in operator() | file://:0:0:0:0 | this | |
227238
| taint.cpp:238:7:238:12 | call to source | taint.cpp:238:3:238:14 | ... = ... | |
228239
| taint.cpp:243:11:243:11 | Unknown literal | taint.cpp:243:11:243:11 | constructor init of field t | TAINT |
229240
| taint.cpp:243:11:243:11 | Unknown literal | taint.cpp:243:11:243:11 | constructor init of field u | TAINT |
241+
| taint.cpp:243:11:243:11 | `this` parameter in (constructor) | taint.cpp:228:11:228:11 | constructor init of field t [pre-this] | |
242+
| taint.cpp:243:11:243:11 | `this` parameter in (constructor) | taint.cpp:243:11:243:11 | constructor init of field t [pre-this] | |
230243
| taint.cpp:243:11:246:2 | [...](...){...} | taint.cpp:247:2:247:2 | c | |
231244
| taint.cpp:243:11:246:2 | {...} | taint.cpp:243:11:246:2 | [...](...){...} | TAINT |
232245
| taint.cpp:243:15:243:15 | `this` parameter in operator() | file://:0:0:0:0 | this | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -86,11 +86,11 @@ void class_field_test() {
8686
mc1.myMethod();
8787

8888
sink(mc1.a);
89-
sink(mc1.b); // tainted [NOT DETECTED]
89+
sink(mc1.b); // tainted [NOT DETECTED with IR]
9090
sink(mc1.c); // tainted [NOT DETECTED with IR]
9191
sink(mc1.d); // tainted [NOT DETECTED with IR]
9292
sink(mc2.a);
93-
sink(mc2.b); // tainted [NOT DETECTED]
93+
sink(mc2.b); // tainted [NOT DETECTED with IR]
9494
sink(mc2.c); // tainted [NOT DETECTED with IR]
9595
sink(mc2.d);
9696
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,10 @@
1010
| taint.cpp:41:7:41:13 | global7 | taint.cpp:35:12:35:17 | call to source |
1111
| taint.cpp:42:7:42:13 | global8 | taint.cpp:35:12:35:17 | call to source |
1212
| taint.cpp:43:7:43:13 | global9 | taint.cpp:37:22:37:27 | call to source |
13+
| taint.cpp:89:11:89:11 | b | taint.cpp:71:22:71:27 | call to source |
1314
| taint.cpp:90:11:90:11 | c | taint.cpp:72:7:72:12 | call to source |
1415
| taint.cpp:91:11:91:11 | d | taint.cpp:77:7:77:12 | call to source |
16+
| taint.cpp:93:11:93:11 | b | taint.cpp:71:22:71:27 | call to source |
1517
| taint.cpp:94:11:94:11 | c | taint.cpp:72:7:72:12 | call to source |
1618
| taint.cpp:129:7:129:9 | * ... | taint.cpp:120:11:120:16 | call to source |
1719
| taint.cpp:134:7:134:9 | * ... | taint.cpp:120:11:120:16 | call to source |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,10 @@
22
| taint.cpp:41:7:41:13 | taint.cpp:35:12:35:17 | AST only |
33
| taint.cpp:42:7:42:13 | taint.cpp:35:12:35:17 | AST only |
44
| taint.cpp:43:7:43:13 | taint.cpp:37:22:37:27 | AST only |
5+
| taint.cpp:89:11:89:11 | taint.cpp:71:22:71:27 | AST only |
56
| taint.cpp:90:11:90:11 | taint.cpp:72:7:72:12 | AST only |
67
| taint.cpp:91:11:91:11 | taint.cpp:77:7:77:12 | AST only |
8+
| taint.cpp:93:11:93:11 | taint.cpp:71:22:71:27 | AST only |
79
| taint.cpp:94:11:94:11 | taint.cpp:72:7:72:12 | AST only |
810
| taint.cpp:130:7:130:9 | taint.cpp:127:8:127:13 | IR only |
911
| taint.cpp:137:7:137:9 | taint.cpp:120:11:120:16 | AST only |

0 commit comments

Comments
 (0)