Skip to content

Commit bb158f1

Browse files
MathiasVPMathiasVP
committed
C++: Add dataflow testcases that need flow through conflated memory.
1 parent 2bb9636 commit bb158f1

File tree

7 files changed

+161
-0
lines changed

7 files changed

+161
-0
lines changed

‎cpp/ql/test/library-tests/dataflow/fields/conflated.cpp‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
int user_input();
2+
void sink(int);
3+
4+
struct A {
5+
int* p;
6+
int x;
7+
};
8+
9+
void pointer_without_allocation(const A& ra) {
10+
*ra.p = user_input();
11+
sink(*ra.p); // $ MISSING: ast,ir
12+
}
13+
14+
void argument_source(void*);
15+
void sink(void*);
16+
17+
void pointer_without_allocation_2() {
18+
char *raw;
19+
argument_source(raw);
20+
sink(raw); // $ ast MISSING: ir
21+
}
22+
23+
A* makeA() {
24+
return new A;
25+
}
26+
27+
void no_InitializeDynamicAllocation_instruction() {
28+
A* pa = makeA();
29+
pa->x = user_input();
30+
sink(pa->x); // $ ast MISSING: ir
31+
}
32+
33+
void fresh_or_arg(A* arg, bool unknown) {
34+
A* pa;
35+
pa = unknown ? arg : new A;
36+
pa->x = user_input();
37+
sink(pa->x); // $ ast MISSING: ir
38+
}
39+
40+
struct LinkedList {
41+
LinkedList* next;
42+
int y;
43+
44+
LinkedList() = default;
45+
LinkedList(LinkedList* next) : next(next) {}
46+
};
47+
48+
// Note: This example also suffers from #113: there is no ChiInstruction that merges the result of the
49+
// InitializeDynamicAllocation instruction into {AllAliasedMemory}. But even when that's fixed there's
50+
// still no dataflow because `ll->next->y = user_input()` writes to {AllAliasedMemory}.
51+
void too_many_indirections() {
52+
LinkedList* ll = new LinkedList;
53+
ll->next = new LinkedList;
54+
ll->next->y = user_input();
55+
sink(ll->next->y); // $ ast MISSING: ir
56+
}
57+
58+
void too_many_indirections_2(LinkedList* next) {
59+
LinkedList* ll = new LinkedList(next);
60+
ll->next->y = user_input();
61+
sink(ll->next->y); // $ ast MISSING: ir
62+
}

‎cpp/ql/test/library-tests/dataflow/fields/dataflow-consistency.expected‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,13 @@ postWithInFlow
121121
| by_reference.cpp:127:30:127:38 | inner_ptr [inner post update] | PostUpdateNode should not be the target of local flow. |
122122
| complex.cpp:11:22:11:23 | a_ [post update] | PostUpdateNode should not be the target of local flow. |
123123
| complex.cpp:12:22:12:23 | b_ [post update] | PostUpdateNode should not be the target of local flow. |
124+
| conflated.cpp:10:3:10:7 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
125+
| conflated.cpp:10:7:10:7 | p [inner post update] | PostUpdateNode should not be the target of local flow. |
126+
| conflated.cpp:29:7:29:7 | x [post update] | PostUpdateNode should not be the target of local flow. |
127+
| conflated.cpp:36:7:36:7 | x [post update] | PostUpdateNode should not be the target of local flow. |
128+
| conflated.cpp:53:7:53:10 | next [post update] | PostUpdateNode should not be the target of local flow. |
129+
| conflated.cpp:54:13:54:13 | y [post update] | PostUpdateNode should not be the target of local flow. |
130+
| conflated.cpp:60:13:60:13 | y [post update] | PostUpdateNode should not be the target of local flow. |
124131
| constructors.cpp:20:24:20:25 | a_ [post update] | PostUpdateNode should not be the target of local flow. |
125132
| constructors.cpp:21:24:21:25 | b_ [post update] | PostUpdateNode should not be the target of local flow. |
126133
| qualifiers.cpp:9:36:9:36 | a [post update] | PostUpdateNode should not be the target of local flow. |

‎cpp/ql/test/library-tests/dataflow/fields/dataflow-ir-consistency.expected‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,10 @@
11
uniqueEnclosingCallable
22
uniqueType
33
uniqueNodeLocation
4+
| E.cpp:15:31:15:33 | buf | Node should have one location but has 2. |
5+
| aliasing.cpp:2:11:2:13 | (unnamed parameter 0) | Node should have one location but has 2. |
6+
| conflated.cpp:2:11:2:13 | (unnamed parameter 0) | Node should have one location but has 2. |
7+
| conflated.cpp:14:22:14:25 | buf | Node should have one location but has 2. |
48
| file://:0:0:0:0 | (unnamed parameter 0) | Node should have one location but has 0. |
59
| file://:0:0:0:0 | (unnamed parameter 0) | Node should have one location but has 0. |
610
| file://:0:0:0:0 | (unnamed parameter 0) | Node should have one location but has 0. |
@@ -129,6 +133,8 @@ postWithInFlow
129133
| complex.cpp:54:12:54:12 | Chi | PostUpdateNode should not be the target of local flow. |
130134
| complex.cpp:55:12:55:12 | Chi | PostUpdateNode should not be the target of local flow. |
131135
| complex.cpp:56:12:56:12 | Chi | PostUpdateNode should not be the target of local flow. |
136+
| conflated.cpp:45:39:45:42 | Chi | PostUpdateNode should not be the target of local flow. |
137+
| conflated.cpp:53:3:53:27 | Chi | PostUpdateNode should not be the target of local flow. |
132138
| constructors.cpp:20:24:20:29 | Chi | PostUpdateNode should not be the target of local flow. |
133139
| constructors.cpp:21:24:21:29 | Chi | PostUpdateNode should not be the target of local flow. |
134140
| constructors.cpp:23:28:23:28 | Chi | PostUpdateNode should not be the target of local flow. |

‎cpp/ql/test/library-tests/dataflow/fields/partial-definition-diff.expected‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -309,6 +309,22 @@
309309
| complex.cpp:62:7:62:8 | b2 | AST only |
310310
| complex.cpp:65:7:65:8 | b3 | AST only |
311311
| complex.cpp:68:7:68:8 | b4 | AST only |
312+
| conflated.cpp:10:3:10:7 | * ... | AST only |
313+
| conflated.cpp:10:4:10:5 | ra | AST only |
314+
| conflated.cpp:19:19:19:21 | raw | AST only |
315+
| conflated.cpp:20:8:20:10 | raw | AST only |
316+
| conflated.cpp:29:3:29:4 | pa | AST only |
317+
| conflated.cpp:29:7:29:7 | x | AST only |
318+
| conflated.cpp:36:3:36:4 | pa | AST only |
319+
| conflated.cpp:36:7:36:7 | x | AST only |
320+
| conflated.cpp:53:7:53:10 | next | AST only |
321+
| conflated.cpp:54:3:54:4 | ll | AST only |
322+
| conflated.cpp:54:7:54:10 | next | AST only |
323+
| conflated.cpp:54:13:54:13 | y | AST only |
324+
| conflated.cpp:59:35:59:38 | next | AST only |
325+
| conflated.cpp:60:3:60:4 | ll | AST only |
326+
| conflated.cpp:60:7:60:10 | next | AST only |
327+
| conflated.cpp:60:13:60:13 | y | AST only |
312328
| constructors.cpp:20:24:20:25 | a_ | AST only |
313329
| constructors.cpp:21:24:21:25 | b_ | AST only |
314330
| constructors.cpp:28:10:28:10 | f | AST only |

‎cpp/ql/test/library-tests/dataflow/fields/partial-definition-ir.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,7 @@
5757
| complex.cpp:54:6:54:10 | inner |
5858
| complex.cpp:55:6:55:10 | inner |
5959
| complex.cpp:56:6:56:10 | inner |
60+
| conflated.cpp:53:3:53:4 | ll |
6061
| constructors.cpp:20:24:20:25 | this |
6162
| constructors.cpp:21:24:21:25 | this |
6263
| qualifiers.cpp:9:30:9:33 | this |

‎cpp/ql/test/library-tests/dataflow/fields/partial-definition.expected‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -366,6 +366,23 @@
366366
| complex.cpp:62:7:62:8 | b2 |
367367
| complex.cpp:65:7:65:8 | b3 |
368368
| complex.cpp:68:7:68:8 | b4 |
369+
| conflated.cpp:10:3:10:7 | * ... |
370+
| conflated.cpp:10:4:10:5 | ra |
371+
| conflated.cpp:19:19:19:21 | raw |
372+
| conflated.cpp:20:8:20:10 | raw |
373+
| conflated.cpp:29:3:29:4 | pa |
374+
| conflated.cpp:29:7:29:7 | x |
375+
| conflated.cpp:36:3:36:4 | pa |
376+
| conflated.cpp:36:7:36:7 | x |
377+
| conflated.cpp:53:3:53:4 | ll |
378+
| conflated.cpp:53:7:53:10 | next |
379+
| conflated.cpp:54:3:54:4 | ll |
380+
| conflated.cpp:54:7:54:10 | next |
381+
| conflated.cpp:54:13:54:13 | y |
382+
| conflated.cpp:59:35:59:38 | next |
383+
| conflated.cpp:60:3:60:4 | ll |
384+
| conflated.cpp:60:7:60:10 | next |
385+
| conflated.cpp:60:13:60:13 | y |
369386
| constructors.cpp:20:24:20:25 | a_ |
370387
| constructors.cpp:20:24:20:25 | this |
371388
| constructors.cpp:21:24:21:25 | b_ |

‎cpp/ql/test/library-tests/dataflow/fields/path-flow.expected‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -336,6 +336,27 @@ edges
336336
| complex.cpp:62:7:62:8 | b2 [inner, f, b_] | complex.cpp:40:17:40:17 | b [inner, f, b_] |
337337
| complex.cpp:65:7:65:8 | b3 [inner, f, a_] | complex.cpp:40:17:40:17 | b [inner, f, a_] |
338338
| complex.cpp:65:7:65:8 | b3 [inner, f, b_] | complex.cpp:40:17:40:17 | b [inner, f, b_] |
339+
| conflated.cpp:19:19:19:21 | ref arg raw | conflated.cpp:20:8:20:10 | raw |
340+
| conflated.cpp:29:3:29:4 | pa [post update] [x] | conflated.cpp:30:8:30:9 | pa [x] |
341+
| conflated.cpp:29:3:29:22 | ... = ... | conflated.cpp:29:3:29:4 | pa [post update] [x] |
342+
| conflated.cpp:29:11:29:20 | call to user_input | conflated.cpp:29:3:29:22 | ... = ... |
343+
| conflated.cpp:30:8:30:9 | pa [x] | conflated.cpp:30:12:30:12 | x |
344+
| conflated.cpp:36:3:36:4 | pa [post update] [x] | conflated.cpp:37:8:37:9 | pa [x] |
345+
| conflated.cpp:36:3:36:22 | ... = ... | conflated.cpp:36:3:36:4 | pa [post update] [x] |
346+
| conflated.cpp:36:11:36:20 | call to user_input | conflated.cpp:36:3:36:22 | ... = ... |
347+
| conflated.cpp:37:8:37:9 | pa [x] | conflated.cpp:37:12:37:12 | x |
348+
| conflated.cpp:54:3:54:4 | ll [post update] [next, y] | conflated.cpp:55:8:55:9 | ll [next, y] |
349+
| conflated.cpp:54:3:54:28 | ... = ... | conflated.cpp:54:7:54:10 | next [post update] [y] |
350+
| conflated.cpp:54:7:54:10 | next [post update] [y] | conflated.cpp:54:3:54:4 | ll [post update] [next, y] |
351+
| conflated.cpp:54:17:54:26 | call to user_input | conflated.cpp:54:3:54:28 | ... = ... |
352+
| conflated.cpp:55:8:55:9 | ll [next, y] | conflated.cpp:55:12:55:15 | next [y] |
353+
| conflated.cpp:55:12:55:15 | next [y] | conflated.cpp:55:18:55:18 | y |
354+
| conflated.cpp:60:3:60:4 | ll [post update] [next, y] | conflated.cpp:61:8:61:9 | ll [next, y] |
355+
| conflated.cpp:60:3:60:28 | ... = ... | conflated.cpp:60:7:60:10 | next [post update] [y] |
356+
| conflated.cpp:60:7:60:10 | next [post update] [y] | conflated.cpp:60:3:60:4 | ll [post update] [next, y] |
357+
| conflated.cpp:60:17:60:26 | call to user_input | conflated.cpp:60:3:60:28 | ... = ... |
358+
| conflated.cpp:61:8:61:9 | ll [next, y] | conflated.cpp:61:12:61:15 | next [y] |
359+
| conflated.cpp:61:12:61:15 | next [y] | conflated.cpp:61:18:61:18 | y |
339360
| constructors.cpp:26:15:26:15 | f [a_] | constructors.cpp:28:10:28:10 | f [a_] |
340361
| constructors.cpp:26:15:26:15 | f [b_] | constructors.cpp:29:10:29:10 | f [b_] |
341362
| constructors.cpp:28:10:28:10 | f [a_] | constructors.cpp:28:12:28:12 | call to a |
@@ -827,6 +848,32 @@ nodes
827848
| complex.cpp:62:7:62:8 | b2 [inner, f, b_] | semmle.label | b2 [inner, f, b_] |
828849
| complex.cpp:65:7:65:8 | b3 [inner, f, a_] | semmle.label | b3 [inner, f, a_] |
829850
| complex.cpp:65:7:65:8 | b3 [inner, f, b_] | semmle.label | b3 [inner, f, b_] |
851+
| conflated.cpp:19:19:19:21 | ref arg raw | semmle.label | ref arg raw |
852+
| conflated.cpp:20:8:20:10 | raw | semmle.label | raw |
853+
| conflated.cpp:29:3:29:4 | pa [post update] [x] | semmle.label | pa [post update] [x] |
854+
| conflated.cpp:29:3:29:22 | ... = ... | semmle.label | ... = ... |
855+
| conflated.cpp:29:11:29:20 | call to user_input | semmle.label | call to user_input |
856+
| conflated.cpp:30:8:30:9 | pa [x] | semmle.label | pa [x] |
857+
| conflated.cpp:30:12:30:12 | x | semmle.label | x |
858+
| conflated.cpp:36:3:36:4 | pa [post update] [x] | semmle.label | pa [post update] [x] |
859+
| conflated.cpp:36:3:36:22 | ... = ... | semmle.label | ... = ... |
860+
| conflated.cpp:36:11:36:20 | call to user_input | semmle.label | call to user_input |
861+
| conflated.cpp:37:8:37:9 | pa [x] | semmle.label | pa [x] |
862+
| conflated.cpp:37:12:37:12 | x | semmle.label | x |
863+
| conflated.cpp:54:3:54:4 | ll [post update] [next, y] | semmle.label | ll [post update] [next, y] |
864+
| conflated.cpp:54:3:54:28 | ... = ... | semmle.label | ... = ... |
865+
| conflated.cpp:54:7:54:10 | next [post update] [y] | semmle.label | next [post update] [y] |
866+
| conflated.cpp:54:17:54:26 | call to user_input | semmle.label | call to user_input |
867+
| conflated.cpp:55:8:55:9 | ll [next, y] | semmle.label | ll [next, y] |
868+
| conflated.cpp:55:12:55:15 | next [y] | semmle.label | next [y] |
869+
| conflated.cpp:55:18:55:18 | y | semmle.label | y |
870+
| conflated.cpp:60:3:60:4 | ll [post update] [next, y] | semmle.label | ll [post update] [next, y] |
871+
| conflated.cpp:60:3:60:28 | ... = ... | semmle.label | ... = ... |
872+
| conflated.cpp:60:7:60:10 | next [post update] [y] | semmle.label | next [post update] [y] |
873+
| conflated.cpp:60:17:60:26 | call to user_input | semmle.label | call to user_input |
874+
| conflated.cpp:61:8:61:9 | ll [next, y] | semmle.label | ll [next, y] |
875+
| conflated.cpp:61:12:61:15 | next [y] | semmle.label | next [y] |
876+
| conflated.cpp:61:18:61:18 | y | semmle.label | y |
830877
| constructors.cpp:26:15:26:15 | f [a_] | semmle.label | f [a_] |
831878
| constructors.cpp:26:15:26:15 | f [b_] | semmle.label | f [b_] |
832879
| constructors.cpp:28:10:28:10 | f [a_] | semmle.label | f [a_] |
@@ -1028,6 +1075,11 @@ nodes
10281075
| complex.cpp:42:18:42:18 | call to a | complex.cpp:55:19:55:28 | call to user_input | complex.cpp:42:18:42:18 | call to a | call to a flows from $@ | complex.cpp:55:19:55:28 | call to user_input | call to user_input |
10291076
| complex.cpp:43:18:43:18 | call to b | complex.cpp:54:19:54:28 | call to user_input | complex.cpp:43:18:43:18 | call to b | call to b flows from $@ | complex.cpp:54:19:54:28 | call to user_input | call to user_input |
10301077
| complex.cpp:43:18:43:18 | call to b | complex.cpp:56:19:56:28 | call to user_input | complex.cpp:43:18:43:18 | call to b | call to b flows from $@ | complex.cpp:56:19:56:28 | call to user_input | call to user_input |
1078+
| conflated.cpp:20:8:20:10 | raw | conflated.cpp:19:19:19:21 | ref arg raw | conflated.cpp:20:8:20:10 | raw | raw flows from $@ | conflated.cpp:19:19:19:21 | ref arg raw | ref arg raw |
1079+
| conflated.cpp:30:12:30:12 | x | conflated.cpp:29:11:29:20 | call to user_input | conflated.cpp:30:12:30:12 | x | x flows from $@ | conflated.cpp:29:11:29:20 | call to user_input | call to user_input |
1080+
| conflated.cpp:37:12:37:12 | x | conflated.cpp:36:11:36:20 | call to user_input | conflated.cpp:37:12:37:12 | x | x flows from $@ | conflated.cpp:36:11:36:20 | call to user_input | call to user_input |
1081+
| conflated.cpp:55:18:55:18 | y | conflated.cpp:54:17:54:26 | call to user_input | conflated.cpp:55:18:55:18 | y | y flows from $@ | conflated.cpp:54:17:54:26 | call to user_input | call to user_input |
1082+
| conflated.cpp:61:18:61:18 | y | conflated.cpp:60:17:60:26 | call to user_input | conflated.cpp:61:18:61:18 | y | y flows from $@ | conflated.cpp:60:17:60:26 | call to user_input | call to user_input |
10311083
| constructors.cpp:28:12:28:12 | call to a | constructors.cpp:34:11:34:20 | call to user_input | constructors.cpp:28:12:28:12 | call to a | call to a flows from $@ | constructors.cpp:34:11:34:20 | call to user_input | call to user_input |
10321084
| constructors.cpp:28:12:28:12 | call to a | constructors.cpp:36:11:36:20 | call to user_input | constructors.cpp:28:12:28:12 | call to a | call to a flows from $@ | constructors.cpp:36:11:36:20 | call to user_input | call to user_input |
10331085
| constructors.cpp:29:12:29:12 | call to b | constructors.cpp:35:14:35:23 | call to user_input | constructors.cpp:29:12:29:12 | call to b | call to b flows from $@ | constructors.cpp:35:14:35:23 | call to user_input | call to user_input |

0 commit comments

Comments
 (0)