|
1 | | -private import cpp |
2 | | -private import DataFlowPrivate |
3 | | - |
4 | | -Function viableImpl(MethodAccess ma) { |
5 | | - result = ma.getTarget() |
6 | | -} |
7 | | - |
8 | | -Function viableCallable(Call call) { |
9 | | - result = call.getTarget() |
10 | | -} |
11 | | - |
12 | | -/** |
13 | | - * Holds if the call context `ctx` reduces the set of viable dispatch |
14 | | - * targets of `ma` in `c`. |
15 | | - */ |
16 | | -predicate reducedViableImplInCallContext(MethodAccess ma, Callable c, Call ctx) { |
17 | | - none() |
18 | | -} |
19 | | - |
20 | | -/** |
21 | | - * Gets a viable dispatch target of `ma` in the context `ctx`. This is |
22 | | - * restricted to those `ma`s for which a context might make a difference. |
23 | | - */ |
24 | | -private Method viableImplInCallContext(MethodAccess ma, Call ctx) { |
25 | | - // stub implementation |
26 | | - result = viableImpl(ma) and |
27 | | - viableCallable(ctx) = ma.getEnclosingFunction() |
28 | | -} |
29 | | - |
30 | | -/** |
31 | | - * Gets a viable dispatch target of `ma` in the context `ctx`. This is |
32 | | - * restricted to those `ma`s for which the context makes a difference. |
33 | | - */ |
34 | | -Method prunedViableImplInCallContext(MethodAccess ma, Call ctx) { |
35 | | - result = viableImplInCallContext(ma, ctx) and |
36 | | - reducedViableImplInCallContext(ma, _, ctx) |
37 | | -} |
38 | | - |
39 | | -/** |
40 | | - * Holds if data might flow from `ma` to a return statement in some |
41 | | - * configuration. |
42 | | - */ |
43 | | -private predicate maybeChainedReturn(MethodAccess ma) { |
44 | | - exists(ReturnStmt ret | |
45 | | - exists(ret.getExpr()) and |
46 | | - ret.getEnclosingFunction() = ma.getEnclosingFunction() and |
47 | | - not ma.getParent() instanceof ExprStmt |
48 | | - ) |
49 | | -} |
50 | | - |
51 | | -/** |
52 | | - * Holds if flow returning from `m` to `ma` might return further and if |
53 | | - * this path restricts the set of call sites that can be returned to. |
54 | | - */ |
55 | | -predicate reducedViableImplInReturn(Method m, MethodAccess ma) { |
56 | | - exists(int tgts, int ctxtgts | |
57 | | - m = viableImpl(ma) and |
58 | | - ctxtgts = count(Call ctx | m = viableImplInCallContext(ma, ctx)) and |
59 | | - tgts = strictcount(Call ctx | viableCallable(ctx) = ma.getEnclosingFunction()) and |
60 | | - ctxtgts < tgts |
61 | | - ) and |
62 | | - maybeChainedReturn(ma) |
63 | | -} |
64 | | - |
65 | | -/** |
66 | | - * Gets a viable dispatch target of `ma` in the context `ctx`. This is |
67 | | - * restricted to those `ma`s and results for which the return flow from the |
68 | | - * result to `ma` restricts the possible context `ctx`. |
69 | | - */ |
70 | | -Method prunedViableImplInCallContextReverse(MethodAccess ma, Call ctx) { |
71 | | - result = viableImplInCallContext(ma, ctx) and |
72 | | - reducedViableImplInReturn(result, ma) |
73 | | -} |
| 1 | +import semmle.code.cpp.dataflow.internal.DataFlowDispatch |
0 commit comments