@@ -9,32 +9,31 @@ private import semmle.code.cpp.ir.implementation.internal.OperandTag
99
1010private class IntValue = Ints:: IntValue ;
1111
12- private predicate hasResultMemoryAccess ( Instruction instr , IRVariable var , Type type , IntValue startBitOffset ,
13- IntValue endBitOffset ) {
12+ private predicate hasResultMemoryAccess (
13+ Instruction instr , IRVariable var , Type type , IntValue startBitOffset , IntValue endBitOffset
14+ ) {
1415 resultPointsTo ( instr .getResultAddress ( ) , var , startBitOffset ) and
1516 type = instr .getResultType ( ) and
16- if exists ( instr .getResultSize ( ) ) then
17- endBitOffset = Ints:: add ( startBitOffset , Ints:: mul ( instr .getResultSize ( ) , 8 ) )
18- else
19- endBitOffset = Ints:: unknown ( )
17+ if exists ( instr .getResultSize ( ) )
18+ then endBitOffset = Ints:: add ( startBitOffset , Ints:: mul ( instr .getResultSize ( ) , 8 ) )
19+ else endBitOffset = Ints:: unknown ( )
2020}
2121
22- private predicate hasOperandMemoryAccess ( MemoryOperand operand , IRVariable var , Type type , IntValue startBitOffset ,
23- IntValue endBitOffset ) {
22+ private predicate hasOperandMemoryAccess (
23+ MemoryOperand operand , IRVariable var , Type type , IntValue startBitOffset , IntValue endBitOffset
24+ ) {
2425 resultPointsTo ( operand .getAddressOperand ( ) .getAnyDef ( ) , var , startBitOffset ) and
2526 type = operand .getType ( ) and
26- if exists ( operand .getSize ( ) ) then
27- endBitOffset = Ints:: add ( startBitOffset , Ints:: mul ( operand .getSize ( ) , 8 ) )
28- else
29- endBitOffset = Ints:: unknown ( )
27+ if exists ( operand .getSize ( ) )
28+ then endBitOffset = Ints:: add ( startBitOffset , Ints:: mul ( operand .getSize ( ) , 8 ) )
29+ else endBitOffset = Ints:: unknown ( )
3030}
3131
3232private newtype TMemoryLocation =
3333 TVariableMemoryLocation ( IRVariable var , Type type , IntValue startBitOffset , IntValue endBitOffset ) {
3434 hasResultMemoryAccess ( _, var , type , startBitOffset , endBitOffset ) or
3535 hasOperandMemoryAccess ( _, var , type , startBitOffset , endBitOffset )
36- }
37- or
36+ } or
3837 TUnknownMemoryLocation ( IRFunction irFunc ) or
3938 TUnknownVirtualVariable ( IRFunction irFunc )
4039
@@ -47,16 +46,15 @@ private newtype TMemoryLocation =
4746 */
4847abstract class MemoryLocation extends TMemoryLocation {
4948 abstract string toString ( ) ;
50-
49+
5150 abstract VirtualVariable getVirtualVariable ( ) ;
5251
5352 abstract Type getType ( ) ;
5453
5554 abstract string getUniqueId ( ) ;
5655}
5756
58- abstract class VirtualVariable extends MemoryLocation {
59- }
57+ abstract class VirtualVariable extends MemoryLocation { }
6058
6159/**
6260 * An access to memory within a single known `IRVariable`. The variable may be either an unescaped variable
@@ -72,36 +70,28 @@ class VariableMemoryLocation extends TVariableMemoryLocation, MemoryLocation {
7270 this = TVariableMemoryLocation ( var , type , startBitOffset , endBitOffset )
7371 }
7472
75- override final string toString ( ) {
76- result = var .toString ( ) + Interval:: getIntervalString ( startBitOffset , endBitOffset ) + "<" + type .toString ( ) + ">"
73+ final override string toString ( ) {
74+ result = var .toString ( ) + Interval:: getIntervalString ( startBitOffset , endBitOffset ) + "<" +
75+ type .toString ( ) + ">"
7776 }
7877
79- override final Type getType ( ) {
80- result = type
81- }
78+ final override Type getType ( ) { result = type }
8279
83- final IntValue getStartBitOffset ( ) {
84- result = startBitOffset
85- }
86-
87- final IntValue getEndBitOffset ( ) {
88- result = endBitOffset
89- }
90-
91- final IRVariable getVariable ( ) {
92- result = var
93- }
80+ final IntValue getStartBitOffset ( ) { result = startBitOffset }
81+
82+ final IntValue getEndBitOffset ( ) { result = endBitOffset }
9483
95- override final string getUniqueId ( ) {
84+ final IRVariable getVariable ( ) { result = var }
85+
86+ final override string getUniqueId ( ) {
9687 result = var .getUniqueId ( ) + Interval:: getIntervalString ( startBitOffset , endBitOffset ) + "<" +
97- getTypeIdentityString ( type ) + ">"
88+ getTypeIdentityString ( type ) + ">"
9889 }
9990
100- override final VirtualVariable getVirtualVariable ( ) {
101- if variableAddressEscapes ( var ) then
102- result = TUnknownVirtualVariable ( var .getEnclosingIRFunction ( ) )
103- else
104- result = TVariableMemoryLocation ( var , var .getType ( ) , 0 , var .getType ( ) .getSize ( ) * 8 )
91+ final override VirtualVariable getVirtualVariable ( ) {
92+ if variableAddressEscapes ( var )
93+ then result = TUnknownVirtualVariable ( var .getEnclosingIRFunction ( ) )
94+ else result = TVariableMemoryLocation ( var , var .getType ( ) , 0 , var .getType ( ) .getSize ( ) * 8 )
10595 }
10696
10797 /**
@@ -132,25 +122,15 @@ class VariableVirtualVariable extends VariableMemoryLocation, VirtualVariable {
132122class UnknownMemoryLocation extends TUnknownMemoryLocation , MemoryLocation {
133123 IRFunction irFunc ;
134124
135- UnknownMemoryLocation ( ) {
136- this = TUnknownMemoryLocation ( irFunc )
137- }
138-
139- override final string toString ( ) {
140- result = "{Unknown}"
141- }
142-
143- override final VirtualVariable getVirtualVariable ( ) {
144- result = TUnknownVirtualVariable ( irFunc )
145- }
125+ UnknownMemoryLocation ( ) { this = TUnknownMemoryLocation ( irFunc ) }
146126
147- override final Type getType ( ) {
148- result instanceof UnknownType
149- }
127+ final override string toString ( ) { result = "{Unknown}" }
150128
151- override final string getUniqueId ( ) {
152- result = "{Unknown}"
153- }
129+ final override VirtualVariable getVirtualVariable ( ) { result = TUnknownVirtualVariable ( irFunc ) }
130+
131+ final override Type getType ( ) { result instanceof UnknownType }
132+
133+ final override string getUniqueId ( ) { result = "{Unknown}" }
154134}
155135
156136/**
@@ -159,70 +139,60 @@ class UnknownMemoryLocation extends TUnknownMemoryLocation, MemoryLocation {
159139class UnknownVirtualVariable extends TUnknownVirtualVariable , VirtualVariable {
160140 IRFunction irFunc ;
161141
162- UnknownVirtualVariable ( ) {
163- this = TUnknownVirtualVariable ( irFunc )
164- }
165-
166- override final string toString ( ) {
167- result = "{AllAliased}"
168- }
142+ UnknownVirtualVariable ( ) { this = TUnknownVirtualVariable ( irFunc ) }
169143
170- override final Type getType ( ) {
171- result instanceof UnknownType
172- }
144+ final override string toString ( ) { result = "{AllAliased}" }
173145
174- override final string getUniqueId ( ) {
175- result = " " + toString ( )
176- }
146+ final override Type getType ( ) { result instanceof UnknownType }
177147
178- override final VirtualVariable getVirtualVariable ( ) {
179- result = this
180- }
148+ final override string getUniqueId ( ) { result = " " + toString ( ) }
149+
150+ final override VirtualVariable getVirtualVariable ( ) { result = this }
181151}
182152
183153Overlap getOverlap ( MemoryLocation def , MemoryLocation use ) {
184154 // The def and the use must have the same virtual variable, or no overlap is possible.
185155 (
186156 // An UnknownVirtualVariable must totally overlap any location within the same virtual variable.
187157 def .getVirtualVariable ( ) = use .getVirtualVariable ( ) and
188- def instanceof UnknownVirtualVariable and result instanceof MustTotallyOverlap
158+ def instanceof UnknownVirtualVariable and
159+ result instanceof MustTotallyOverlap
189160 or
190161 // An UnknownMemoryLocation may partially overlap any Location within the same virtual variable.
191162 def .getVirtualVariable ( ) = use .getVirtualVariable ( ) and
192- def instanceof UnknownMemoryLocation and result instanceof MayPartiallyOverlap
163+ def instanceof UnknownMemoryLocation and
164+ result instanceof MayPartiallyOverlap
193165 or
194166 exists ( VariableMemoryLocation defVariableLocation |
195167 defVariableLocation = def and
196168 (
197- (
198- // A VariableMemoryLocation may partially overlap an unknown location within the same virtual variable.
199- def .getVirtualVariable ( ) = use .getVirtualVariable ( ) and
200- ( ( use instanceof UnknownMemoryLocation ) or ( use instanceof UnknownVirtualVariable ) ) and
201- result instanceof MayPartiallyOverlap
202- ) or
169+ // A VariableMemoryLocation may partially overlap an unknown location within the same virtual variable.
170+ def .getVirtualVariable ( ) = use .getVirtualVariable ( ) and
171+ ( use instanceof UnknownMemoryLocation or use instanceof UnknownVirtualVariable ) and
172+ result instanceof MayPartiallyOverlap
173+ or
203174 // A VariableMemoryLocation overlaps another location within the same variable based on the relationship
204175 // of the two offset intervals.
205176 exists ( Overlap intervalOverlap |
206177 intervalOverlap = getVariableMemoryLocationOverlap ( def , use ) and
207- if intervalOverlap instanceof MustExactlyOverlap then (
208- if def .getType ( ) = use .getType ( ) then (
178+ if intervalOverlap instanceof MustExactlyOverlap
179+ then
180+ if def .getType ( ) = use .getType ( )
181+ then
209182 // The def and use types match, so it's an exact overlap.
210183 result instanceof MustExactlyOverlap
211- )
212- else (
184+ else
213185 // The def and use types are not the same, so it's just a total overlap.
214186 result instanceof MustTotallyOverlap
215- )
216- )
217- else if defVariableLocation .coversEntireVariable ( ) then (
218- // The definition covers the entire variable, so assume that it totally overlaps the use, even if the
219- // interval for the use is unknown or outside the bounds of the variable.
220- result instanceof MustTotallyOverlap
221- )
222- else (
223- // Just use the overlap relation of the interval.
224- result = intervalOverlap
225- )
187+ else
188+ if defVariableLocation .coversEntireVariable ( )
189+ then
190+ // The definition covers the entire variable, so assume that it totally overlaps the use, even if the
191+ // interval for the use is unknown or outside the bounds of the variable.
192+ result instanceof MustTotallyOverlap
193+ else
194+ // Just use the overlap relation of the interval.
195+ result = intervalOverlap
226196 )
227197 )
228198 )
@@ -245,10 +215,9 @@ Overlap getOverlap(MemoryLocation def, MemoryLocation use) {
245215 * 5. In `getVariableMemoryLocationOverlap`, compute the precise overlap relation for each
246216 * overlapping pair of VMLs (linear in the size of the overlap set)
247217 */
218+
248219private predicate isRelevantOffset ( VirtualVariable vv , IntValue offset ) {
249- exists ( VariableMemoryLocation ml |
250- ml .getVirtualVariable ( ) = vv
251- |
220+ exists ( VariableMemoryLocation ml | ml .getVirtualVariable ( ) = vv |
252221 ml .getStartBitOffset ( ) = offset
253222 or
254223 ml .getEndBitOffset ( ) = offset
@@ -278,50 +247,55 @@ private predicate hasUnknownOffset(VariableMemoryLocation vml, VirtualVariable v
278247 )
279248}
280249
281- private predicate overlappingVariableMemoryLocations ( VariableMemoryLocation def , VariableMemoryLocation use ) {
282- exists ( VirtualVariable vv , int offsetRank | isCoveredOffset ( def , vv , offsetRank ) and isCoveredOffset ( use , vv , offsetRank ) )
283- or
284- hasUnknownOffset ( def , use .getVirtualVariable ( ) )
285- or
286- hasUnknownOffset ( use , def .getVirtualVariable ( ) )
250+ private predicate overlappingVariableMemoryLocations (
251+ VariableMemoryLocation def , VariableMemoryLocation use
252+ ) {
253+ exists ( VirtualVariable vv , int offsetRank |
254+ isCoveredOffset ( def , vv , offsetRank ) and isCoveredOffset ( use , vv , offsetRank )
255+ )
256+ or
257+ hasUnknownOffset ( def , use .getVirtualVariable ( ) )
258+ or
259+ hasUnknownOffset ( use , def .getVirtualVariable ( ) )
287260}
288261
289- pragma [ noopt] // Internal ticket: QL-937
290- private predicate overlappingIRVariableMemoryLocations ( VariableMemoryLocation def , VariableMemoryLocation use ) {
262+ // Internal ticket: QL-937
263+ pragma [ noopt]
264+ private predicate overlappingIRVariableMemoryLocations (
265+ VariableMemoryLocation def , VariableMemoryLocation use
266+ ) {
291267 overlappingVariableMemoryLocations ( def , use ) and
292268 def .getVariable ( ) = use .getVariable ( )
293269}
294270
295- private Overlap getVariableMemoryLocationOverlap ( VariableMemoryLocation def , VariableMemoryLocation use ) {
271+ private Overlap getVariableMemoryLocationOverlap (
272+ VariableMemoryLocation def , VariableMemoryLocation use
273+ ) {
296274 overlappingIRVariableMemoryLocations ( def , use ) and
297- result = Interval:: getOverlap ( def .getStartBitOffset ( ) , def .getEndBitOffset ( ) , use .getStartBitOffset ( ) , use .getEndBitOffset ( ) )
275+ result = Interval:: getOverlap ( def .getStartBitOffset ( ) , def .getEndBitOffset ( ) ,
276+ use .getStartBitOffset ( ) , use .getEndBitOffset ( ) )
298277}
299278
300-
301279MemoryLocation getResultMemoryLocation ( Instruction instr ) {
302280 exists ( MemoryAccessKind kind |
303281 kind = instr .getResultMemoryAccess ( ) and
304282 (
305283 (
306284 kind .usesAddressOperand ( ) and
307- if hasResultMemoryAccess ( instr , _, _, _, _) then (
285+ if hasResultMemoryAccess ( instr , _, _, _, _)
286+ then
308287 exists ( IRVariable var , Type type , IntValue startBitOffset , IntValue endBitOffset |
309288 hasResultMemoryAccess ( instr , var , type , startBitOffset , endBitOffset ) and
310289 result = TVariableMemoryLocation ( var , type , startBitOffset , endBitOffset )
311290 )
312- )
313- else (
314- result = TUnknownMemoryLocation ( instr .getEnclosingIRFunction ( ) )
315- )
316- ) or
317- (
318- kind instanceof EscapedMemoryAccess and
319- result = TUnknownVirtualVariable ( instr .getEnclosingIRFunction ( ) )
320- ) or
321- (
322- kind instanceof EscapedMayMemoryAccess and
323- result = TUnknownMemoryLocation ( instr .getEnclosingIRFunction ( ) )
291+ else result = TUnknownMemoryLocation ( instr .getEnclosingIRFunction ( ) )
324292 )
293+ or
294+ kind instanceof EscapedMemoryAccess and
295+ result = TUnknownVirtualVariable ( instr .getEnclosingIRFunction ( ) )
296+ or
297+ kind instanceof EscapedMayMemoryAccess and
298+ result = TUnknownMemoryLocation ( instr .getEnclosingIRFunction ( ) )
325299 )
326300 )
327301}
@@ -332,24 +306,20 @@ MemoryLocation getOperandMemoryLocation(MemoryOperand operand) {
332306 (
333307 (
334308 kind .usesAddressOperand ( ) and
335- if hasOperandMemoryAccess ( operand , _, _, _, _) then (
309+ if hasOperandMemoryAccess ( operand , _, _, _, _)
310+ then
336311 exists ( IRVariable var , Type type , IntValue startBitOffset , IntValue endBitOffset |
337312 hasOperandMemoryAccess ( operand , var , type , startBitOffset , endBitOffset ) and
338313 result = TVariableMemoryLocation ( var , type , startBitOffset , endBitOffset )
339314 )
340- )
341- else (
342- result = TUnknownMemoryLocation ( operand .getEnclosingIRFunction ( ) )
343- )
344- ) or
345- (
346- kind instanceof EscapedMemoryAccess and
347- result = TUnknownVirtualVariable ( operand .getEnclosingIRFunction ( ) )
348- ) or
349- (
350- kind instanceof EscapedMayMemoryAccess and
351- result = TUnknownMemoryLocation ( operand .getEnclosingIRFunction ( ) )
315+ else result = TUnknownMemoryLocation ( operand .getEnclosingIRFunction ( ) )
352316 )
317+ or
318+ kind instanceof EscapedMemoryAccess and
319+ result = TUnknownVirtualVariable ( operand .getEnclosingIRFunction ( ) )
320+ or
321+ kind instanceof EscapedMayMemoryAccess and
322+ result = TUnknownMemoryLocation ( operand .getEnclosingIRFunction ( ) )
353323 )
354324 )
355325}
0 commit comments