Skip to content

Commit a1511e1

Browse files
hvitvedhvitved
committed
Data flow: Sync files
1 parent 1196d0c commit a1511e1

37 files changed

+1023
-361
lines changed

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll‎

Lines changed: 38 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -252,6 +252,8 @@ private class RetNodeEx extends NodeEx {
252252
ReturnPosition getReturnPosition() { result = getReturnPosition(this.asNode()) }
253253

254254
ReturnKindExt getKind() { result = this.asNode().(ReturnNodeExt).getKind() }
255+
256+
predicate allowFlowThroughParameter() { allowFlowThroughParameterCached(this.asNode()) }
255257
}
256258

257259
private predicate inBarrier(NodeEx node, Configuration config) {
@@ -725,12 +727,16 @@ private module Stage1 {
725727
/** Holds if flow may return from `callable`. */
726728
pragma[nomagic]
727729
private predicate returnFlowCallableNodeCand(
728-
DataFlowCallable callable, ReturnKindExt kind, Configuration config
730+
DataFlowCallable callable, ReturnKindExt kind, boolean allowFlowThroughParameter,
731+
Configuration config
729732
) {
730733
exists(RetNodeEx ret |
731734
throughFlowNodeCand(ret, config) and
732735
callable = ret.getEnclosingCallable() and
733-
kind = ret.getKind()
736+
kind = ret.getKind() and
737+
if ret.allowFlowThroughParameter()
738+
then allowFlowThroughParameter = true
739+
else allowFlowThroughParameter = false
734740
)
735741
}
736742

@@ -739,13 +745,16 @@ private module Stage1 {
739745
* candidate for the origin of a summary.
740746
*/
741747
predicate parameterMayFlowThrough(ParamNodeEx p, DataFlowCallable c, Ap ap, Configuration config) {
742-
exists(ReturnKindExt kind |
748+
exists(ReturnKindExt kind, boolean allowFlowThroughParameter |
743749
throughFlowNodeCand(p, config) and
744-
returnFlowCallableNodeCand(c, kind, config) and
750+
returnFlowCallableNodeCand(c, kind, allowFlowThroughParameter, config) and
745751
p.getEnclosingCallable() = c and
746-
exists(ap) and
747-
// we don't expect a parameter to return stored in itself
748-
not kind.(ParamUpdateReturnKind).getPosition() = p.getPosition()
752+
(
753+
if kind.(ParamUpdateReturnKind).getPosition() = p.getPosition()
754+
then allowFlowThroughParameter = true
755+
else any()
756+
) and
757+
exists(ap)
749758
)
750759
}
751760

@@ -1394,8 +1403,11 @@ private module Stage2 {
13941403
fwdFlow(ret, any(CcCall ccc), apSome(ap), ap0, config) and
13951404
kind = ret.getKind() and
13961405
p.getPosition() = pos and
1397-
// we don't expect a parameter to return stored in itself
1398-
not kind.(ParamUpdateReturnKind).getPosition() = pos
1406+
(
1407+
if kind.(ParamUpdateReturnKind).getPosition() = p.getPosition()
1408+
then ret.allowFlowThroughParameter()
1409+
else any()
1410+
)
13991411
)
14001412
}
14011413

@@ -2083,8 +2095,11 @@ private module Stage3 {
20832095
fwdFlow(ret, any(CcCall ccc), apSome(ap), ap0, config) and
20842096
kind = ret.getKind() and
20852097
p.getPosition() = pos and
2086-
// we don't expect a parameter to return stored in itself
2087-
not kind.(ParamUpdateReturnKind).getPosition() = pos
2098+
(
2099+
if kind.(ParamUpdateReturnKind).getPosition() = p.getPosition()
2100+
then ret.allowFlowThroughParameter()
2101+
else any()
2102+
)
20882103
)
20892104
}
20902105

@@ -2843,8 +2858,11 @@ private module Stage4 {
28432858
fwdFlow(ret, any(CcCall ccc), apSome(ap), ap0, config) and
28442859
kind = ret.getKind() and
28452860
p.getPosition() = pos and
2846-
// we don't expect a parameter to return stored in itself
2847-
not kind.(ParamUpdateReturnKind).getPosition() = pos
2861+
(
2862+
if kind.(ParamUpdateReturnKind).getPosition() = p.getPosition()
2863+
then ret.allowFlowThroughParameter()
2864+
else any()
2865+
)
28482866
)
28492867
}
28502868

@@ -2917,6 +2935,8 @@ private class SummaryCtxSome extends SummaryCtx, TSummaryCtxSome {
29172935

29182936
int getParameterPos() { p.isParameterOf(_, result) }
29192937

2938+
ParameterNode getParameterNode() { result = p.asNode() }
2939+
29202940
override string toString() { result = p + ": " + ap }
29212941

29222942
predicate hasLocationInfo(
@@ -3617,7 +3637,11 @@ private predicate paramFlowsThrough(
36173637
ap = mid.getAp() and
36183638
apa = ap.getApprox() and
36193639
pos = sc.getParameterPos() and
3620-
not kind.(ParamUpdateReturnKind).getPosition() = pos
3640+
(
3641+
if kind.(ParamUpdateReturnKind).getPosition() = pos
3642+
then ret.allowFlowThroughParameter()
3643+
else any()
3644+
)
36213645
)
36223646
}
36233647

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll‎

Lines changed: 38 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -252,6 +252,8 @@ private class RetNodeEx extends NodeEx {
252252
ReturnPosition getReturnPosition() { result = getReturnPosition(this.asNode()) }
253253

254254
ReturnKindExt getKind() { result = this.asNode().(ReturnNodeExt).getKind() }
255+
256+
predicate allowFlowThroughParameter() { allowFlowThroughParameterCached(this.asNode()) }
255257
}
256258

257259
private predicate inBarrier(NodeEx node, Configuration config) {
@@ -725,12 +727,16 @@ private module Stage1 {
725727
/** Holds if flow may return from `callable`. */
726728
pragma[nomagic]
727729
private predicate returnFlowCallableNodeCand(
728-
DataFlowCallable callable, ReturnKindExt kind, Configuration config
730+
DataFlowCallable callable, ReturnKindExt kind, boolean allowFlowThroughParameter,
731+
Configuration config
729732
) {
730733
exists(RetNodeEx ret |
731734
throughFlowNodeCand(ret, config) and
732735
callable = ret.getEnclosingCallable() and
733-
kind = ret.getKind()
736+
kind = ret.getKind() and
737+
if ret.allowFlowThroughParameter()
738+
then allowFlowThroughParameter = true
739+
else allowFlowThroughParameter = false
734740
)
735741
}
736742

@@ -739,13 +745,16 @@ private module Stage1 {
739745
* candidate for the origin of a summary.
740746
*/
741747
predicate parameterMayFlowThrough(ParamNodeEx p, DataFlowCallable c, Ap ap, Configuration config) {
742-
exists(ReturnKindExt kind |
748+
exists(ReturnKindExt kind, boolean allowFlowThroughParameter |
743749
throughFlowNodeCand(p, config) and
744-
returnFlowCallableNodeCand(c, kind, config) and
750+
returnFlowCallableNodeCand(c, kind, allowFlowThroughParameter, config) and
745751
p.getEnclosingCallable() = c and
746-
exists(ap) and
747-
// we don't expect a parameter to return stored in itself
748-
not kind.(ParamUpdateReturnKind).getPosition() = p.getPosition()
752+
(
753+
if kind.(ParamUpdateReturnKind).getPosition() = p.getPosition()
754+
then allowFlowThroughParameter = true
755+
else any()
756+
) and
757+
exists(ap)
749758
)
750759
}
751760

@@ -1394,8 +1403,11 @@ private module Stage2 {
13941403
fwdFlow(ret, any(CcCall ccc), apSome(ap), ap0, config) and
13951404
kind = ret.getKind() and
13961405
p.getPosition() = pos and
1397-
// we don't expect a parameter to return stored in itself
1398-
not kind.(ParamUpdateReturnKind).getPosition() = pos
1406+
(
1407+
if kind.(ParamUpdateReturnKind).getPosition() = p.getPosition()
1408+
then ret.allowFlowThroughParameter()
1409+
else any()
1410+
)
13991411
)
14001412
}
14011413

@@ -2083,8 +2095,11 @@ private module Stage3 {
20832095
fwdFlow(ret, any(CcCall ccc), apSome(ap), ap0, config) and
20842096
kind = ret.getKind() and
20852097
p.getPosition() = pos and
2086-
// we don't expect a parameter to return stored in itself
2087-
not kind.(ParamUpdateReturnKind).getPosition() = pos
2098+
(
2099+
if kind.(ParamUpdateReturnKind).getPosition() = p.getPosition()
2100+
then ret.allowFlowThroughParameter()
2101+
else any()
2102+
)
20882103
)
20892104
}
20902105

@@ -2843,8 +2858,11 @@ private module Stage4 {
28432858
fwdFlow(ret, any(CcCall ccc), apSome(ap), ap0, config) and
28442859
kind = ret.getKind() and
28452860
p.getPosition() = pos and
2846-
// we don't expect a parameter to return stored in itself
2847-
not kind.(ParamUpdateReturnKind).getPosition() = pos
2861+
(
2862+
if kind.(ParamUpdateReturnKind).getPosition() = p.getPosition()
2863+
then ret.allowFlowThroughParameter()
2864+
else any()
2865+
)
28482866
)
28492867
}
28502868

@@ -2917,6 +2935,8 @@ private class SummaryCtxSome extends SummaryCtx, TSummaryCtxSome {
29172935

29182936
int getParameterPos() { p.isParameterOf(_, result) }
29192937

2938+
ParameterNode getParameterNode() { result = p.asNode() }
2939+
29202940
override string toString() { result = p + ": " + ap }
29212941

29222942
predicate hasLocationInfo(
@@ -3617,7 +3637,11 @@ private predicate paramFlowsThrough(
36173637
ap = mid.getAp() and
36183638
apa = ap.getApprox() and
36193639
pos = sc.getParameterPos() and
3620-
not kind.(ParamUpdateReturnKind).getPosition() = pos
3640+
(
3641+
if kind.(ParamUpdateReturnKind).getPosition() = pos
3642+
then ret.allowFlowThroughParameter()
3643+
else any()
3644+
)
36213645
)
36223646
}
36233647

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll‎

Lines changed: 38 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -252,6 +252,8 @@ private class RetNodeEx extends NodeEx {
252252
ReturnPosition getReturnPosition() { result = getReturnPosition(this.asNode()) }
253253

254254
ReturnKindExt getKind() { result = this.asNode().(ReturnNodeExt).getKind() }
255+
256+
predicate allowFlowThroughParameter() { allowFlowThroughParameterCached(this.asNode()) }
255257
}
256258

257259
private predicate inBarrier(NodeEx node, Configuration config) {
@@ -725,12 +727,16 @@ private module Stage1 {
725727
/** Holds if flow may return from `callable`. */
726728
pragma[nomagic]
727729
private predicate returnFlowCallableNodeCand(
728-
DataFlowCallable callable, ReturnKindExt kind, Configuration config
730+
DataFlowCallable callable, ReturnKindExt kind, boolean allowFlowThroughParameter,
731+
Configuration config
729732
) {
730733
exists(RetNodeEx ret |
731734
throughFlowNodeCand(ret, config) and
732735
callable = ret.getEnclosingCallable() and
733-
kind = ret.getKind()
736+
kind = ret.getKind() and
737+
if ret.allowFlowThroughParameter()
738+
then allowFlowThroughParameter = true
739+
else allowFlowThroughParameter = false
734740
)
735741
}
736742

@@ -739,13 +745,16 @@ private module Stage1 {
739745
* candidate for the origin of a summary.
740746
*/
741747
predicate parameterMayFlowThrough(ParamNodeEx p, DataFlowCallable c, Ap ap, Configuration config) {
742-
exists(ReturnKindExt kind |
748+
exists(ReturnKindExt kind, boolean allowFlowThroughParameter |
743749
throughFlowNodeCand(p, config) and
744-
returnFlowCallableNodeCand(c, kind, config) and
750+
returnFlowCallableNodeCand(c, kind, allowFlowThroughParameter, config) and
745751
p.getEnclosingCallable() = c and
746-
exists(ap) and
747-
// we don't expect a parameter to return stored in itself
748-
not kind.(ParamUpdateReturnKind).getPosition() = p.getPosition()
752+
(
753+
if kind.(ParamUpdateReturnKind).getPosition() = p.getPosition()
754+
then allowFlowThroughParameter = true
755+
else any()
756+
) and
757+
exists(ap)
749758
)
750759
}
751760

@@ -1394,8 +1403,11 @@ private module Stage2 {
13941403
fwdFlow(ret, any(CcCall ccc), apSome(ap), ap0, config) and
13951404
kind = ret.getKind() and
13961405
p.getPosition() = pos and
1397-
// we don't expect a parameter to return stored in itself
1398-
not kind.(ParamUpdateReturnKind).getPosition() = pos
1406+
(
1407+
if kind.(ParamUpdateReturnKind).getPosition() = p.getPosition()
1408+
then ret.allowFlowThroughParameter()
1409+
else any()
1410+
)
13991411
)
14001412
}
14011413

@@ -2083,8 +2095,11 @@ private module Stage3 {
20832095
fwdFlow(ret, any(CcCall ccc), apSome(ap), ap0, config) and
20842096
kind = ret.getKind() and
20852097
p.getPosition() = pos and
2086-
// we don't expect a parameter to return stored in itself
2087-
not kind.(ParamUpdateReturnKind).getPosition() = pos
2098+
(
2099+
if kind.(ParamUpdateReturnKind).getPosition() = p.getPosition()
2100+
then ret.allowFlowThroughParameter()
2101+
else any()
2102+
)
20882103
)
20892104
}
20902105

@@ -2843,8 +2858,11 @@ private module Stage4 {
28432858
fwdFlow(ret, any(CcCall ccc), apSome(ap), ap0, config) and
28442859
kind = ret.getKind() and
28452860
p.getPosition() = pos and
2846-
// we don't expect a parameter to return stored in itself
2847-
not kind.(ParamUpdateReturnKind).getPosition() = pos
2861+
(
2862+
if kind.(ParamUpdateReturnKind).getPosition() = p.getPosition()
2863+
then ret.allowFlowThroughParameter()
2864+
else any()
2865+
)
28482866
)
28492867
}
28502868

@@ -2917,6 +2935,8 @@ private class SummaryCtxSome extends SummaryCtx, TSummaryCtxSome {
29172935

29182936
int getParameterPos() { p.isParameterOf(_, result) }
29192937

2938+
ParameterNode getParameterNode() { result = p.asNode() }
2939+
29202940
override string toString() { result = p + ": " + ap }
29212941

29222942
predicate hasLocationInfo(
@@ -3617,7 +3637,11 @@ private predicate paramFlowsThrough(
36173637
ap = mid.getAp() and
36183638
apa = ap.getApprox() and
36193639
pos = sc.getParameterPos() and
3620-
not kind.(ParamUpdateReturnKind).getPosition() = pos
3640+
(
3641+
if kind.(ParamUpdateReturnKind).getPosition() = pos
3642+
then ret.allowFlowThroughParameter()
3643+
else any()
3644+
)
36213645
)
36223646
}
36233647

0 commit comments

Comments
 (0)