Skip to content

Commit c14dcfb

Browse files
hvitvedhvitved
committed
Data flow: Sync
1 parent 5be7a97 commit c14dcfb

File tree

24 files changed

+576
-528
lines changed

24 files changed

+576
-528
lines changed

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll‎

Lines changed: 24 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -3460,7 +3460,7 @@ private predicate pathStep(
34603460
exists(TypedContent tc | pathReadStep(mid, node, ap.push(tc), tc, cc)) and
34613461
sc = mid.getSummaryCtx()
34623462
or
3463-
pathIntoCallable(mid, node, _, cc, sc, _) and ap = mid.getAp()
3463+
pathIntoCallable(mid, node, _, cc, sc, _, _) and ap = mid.getAp()
34643464
or
34653465
pathOutOfCallable(mid, node, cc) and ap = mid.getAp() and sc instanceof SummaryCtxNone
34663466
or
@@ -3537,14 +3537,16 @@ private predicate pathOutOfCallable(PathNodeMid mid, NodeEx out, CallContext cc)
35373537
*/
35383538
pragma[noinline]
35393539
private predicate pathIntoArg(
3540-
PathNodeMid mid, int i, CallContext cc, DataFlowCall call, AccessPath ap, AccessPathApprox apa
3540+
PathNodeMid mid, int i, CallContext cc, DataFlowCall call, AccessPath ap, AccessPathApprox apa,
3541+
Configuration config
35413542
) {
35423543
exists(ArgNode arg |
35433544
arg = mid.getNodeEx().asNode() and
35443545
cc = mid.getCallContext() and
35453546
arg.argumentOf(call, i) and
35463547
ap = mid.getAp() and
3547-
apa = ap.getApprox()
3548+
apa = ap.getApprox() and
3549+
config = mid.getConfiguration()
35483550
)
35493551
}
35503552

@@ -3561,26 +3563,25 @@ private predicate parameterCand(
35613563
pragma[nomagic]
35623564
private predicate pathIntoCallable0(
35633565
PathNodeMid mid, DataFlowCallable callable, int i, CallContext outercc, DataFlowCall call,
3564-
AccessPath ap
3566+
AccessPath ap, AccessPathApprox apa, Configuration config
35653567
) {
3566-
exists(AccessPathApprox apa |
3567-
pathIntoArg(mid, i, outercc, call, ap, apa) and
3568-
callable = resolveCall(call, outercc) and
3569-
parameterCand(callable, any(int j | j <= i and j >= i), apa, mid.getConfiguration())
3570-
)
3568+
pathIntoArg(mid, i, outercc, call, ap, apa, config) and
3569+
callable = resolveCall(call, outercc)
35713570
}
35723571

35733572
/**
35743573
* Holds if data may flow from `mid` to `p` through `call`. The contexts
35753574
* before and after entering the callable are `outercc` and `innercc`,
35763575
* respectively.
35773576
*/
3577+
pragma[nomagic]
35783578
private predicate pathIntoCallable(
35793579
PathNodeMid mid, ParamNodeEx p, CallContext outercc, CallContextCall innercc, SummaryCtx sc,
3580-
DataFlowCall call
3580+
DataFlowCall call, Configuration config
35813581
) {
3582-
exists(int i, DataFlowCallable callable, AccessPath ap |
3583-
pathIntoCallable0(mid, callable, i, outercc, call, ap) and
3582+
exists(int i, DataFlowCallable callable, AccessPath ap, AccessPathApprox apa |
3583+
pathIntoCallable0(mid, callable, i, outercc, call, ap, apa, config) and
3584+
parameterCand(callable, i, apa, config) and
35843585
p.isParameterOf(callable, i) and
35853586
(
35863587
sc = TSummaryCtxSome(p, ap)
@@ -3617,11 +3618,11 @@ private predicate paramFlowsThrough(
36173618
pragma[nomagic]
36183619
private predicate pathThroughCallable0(
36193620
DataFlowCall call, PathNodeMid mid, ReturnKindExt kind, CallContext cc, AccessPath ap,
3620-
AccessPathApprox apa
3621+
AccessPathApprox apa, Configuration config
36213622
) {
36223623
exists(CallContext innercc, SummaryCtx sc |
3623-
pathIntoCallable(mid, _, cc, innercc, sc, call) and
3624-
paramFlowsThrough(kind, innercc, sc, ap, apa, unbindConf(mid.getConfiguration()))
3624+
pathIntoCallable(mid, _, cc, innercc, sc, call, config) and
3625+
paramFlowsThrough(kind, innercc, sc, ap, apa, config)
36253626
)
36263627
}
36273628

@@ -3631,9 +3632,9 @@ private predicate pathThroughCallable0(
36313632
*/
36323633
pragma[noinline]
36333634
private predicate pathThroughCallable(PathNodeMid mid, NodeEx out, CallContext cc, AccessPath ap) {
3634-
exists(DataFlowCall call, ReturnKindExt kind, AccessPathApprox apa |
3635-
pathThroughCallable0(call, mid, kind, cc, ap, apa) and
3636-
out = getAnOutNodeFlow(kind, call, apa, unbindConf(mid.getConfiguration()))
3635+
exists(DataFlowCall call, ReturnKindExt kind, AccessPathApprox apa, Configuration config |
3636+
pathThroughCallable0(call, mid, kind, cc, ap, apa, config) and
3637+
out = getAnOutNodeFlow(kind, call, apa, config)
36373638
)
36383639
}
36393640

@@ -3647,10 +3648,11 @@ private module Subpaths {
36473648
PathNode arg, ParamNodeEx par, SummaryCtxSome sc, CallContext innercc, ReturnKindExt kind,
36483649
NodeEx out, AccessPath apout
36493650
) {
3650-
pathThroughCallable(arg, out, _, pragma[only_bind_into](apout)) and
3651-
pathIntoCallable(arg, par, _, innercc, sc, _) and
3652-
paramFlowsThrough(kind, innercc, sc, pragma[only_bind_into](apout), _,
3653-
unbindConf(arg.getConfiguration()))
3651+
exists(Configuration config |
3652+
pathThroughCallable(arg, out, _, pragma[only_bind_into](apout)) and
3653+
pathIntoCallable(arg, par, _, innercc, sc, _, config) and
3654+
paramFlowsThrough(kind, innercc, sc, pragma[only_bind_into](apout), _, unbindConf(config))
3655+
)
36543656
}
36553657

36563658
/**

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll‎

Lines changed: 24 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -3460,7 +3460,7 @@ private predicate pathStep(
34603460
exists(TypedContent tc | pathReadStep(mid, node, ap.push(tc), tc, cc)) and
34613461
sc = mid.getSummaryCtx()
34623462
or
3463-
pathIntoCallable(mid, node, _, cc, sc, _) and ap = mid.getAp()
3463+
pathIntoCallable(mid, node, _, cc, sc, _, _) and ap = mid.getAp()
34643464
or
34653465
pathOutOfCallable(mid, node, cc) and ap = mid.getAp() and sc instanceof SummaryCtxNone
34663466
or
@@ -3537,14 +3537,16 @@ private predicate pathOutOfCallable(PathNodeMid mid, NodeEx out, CallContext cc)
35373537
*/
35383538
pragma[noinline]
35393539
private predicate pathIntoArg(
3540-
PathNodeMid mid, int i, CallContext cc, DataFlowCall call, AccessPath ap, AccessPathApprox apa
3540+
PathNodeMid mid, int i, CallContext cc, DataFlowCall call, AccessPath ap, AccessPathApprox apa,
3541+
Configuration config
35413542
) {
35423543
exists(ArgNode arg |
35433544
arg = mid.getNodeEx().asNode() and
35443545
cc = mid.getCallContext() and
35453546
arg.argumentOf(call, i) and
35463547
ap = mid.getAp() and
3547-
apa = ap.getApprox()
3548+
apa = ap.getApprox() and
3549+
config = mid.getConfiguration()
35483550
)
35493551
}
35503552

@@ -3561,26 +3563,25 @@ private predicate parameterCand(
35613563
pragma[nomagic]
35623564
private predicate pathIntoCallable0(
35633565
PathNodeMid mid, DataFlowCallable callable, int i, CallContext outercc, DataFlowCall call,
3564-
AccessPath ap
3566+
AccessPath ap, AccessPathApprox apa, Configuration config
35653567
) {
3566-
exists(AccessPathApprox apa |
3567-
pathIntoArg(mid, i, outercc, call, ap, apa) and
3568-
callable = resolveCall(call, outercc) and
3569-
parameterCand(callable, any(int j | j <= i and j >= i), apa, mid.getConfiguration())
3570-
)
3568+
pathIntoArg(mid, i, outercc, call, ap, apa, config) and
3569+
callable = resolveCall(call, outercc)
35713570
}
35723571

35733572
/**
35743573
* Holds if data may flow from `mid` to `p` through `call`. The contexts
35753574
* before and after entering the callable are `outercc` and `innercc`,
35763575
* respectively.
35773576
*/
3577+
pragma[nomagic]
35783578
private predicate pathIntoCallable(
35793579
PathNodeMid mid, ParamNodeEx p, CallContext outercc, CallContextCall innercc, SummaryCtx sc,
3580-
DataFlowCall call
3580+
DataFlowCall call, Configuration config
35813581
) {
3582-
exists(int i, DataFlowCallable callable, AccessPath ap |
3583-
pathIntoCallable0(mid, callable, i, outercc, call, ap) and
3582+
exists(int i, DataFlowCallable callable, AccessPath ap, AccessPathApprox apa |
3583+
pathIntoCallable0(mid, callable, i, outercc, call, ap, apa, config) and
3584+
parameterCand(callable, i, apa, config) and
35843585
p.isParameterOf(callable, i) and
35853586
(
35863587
sc = TSummaryCtxSome(p, ap)
@@ -3617,11 +3618,11 @@ private predicate paramFlowsThrough(
36173618
pragma[nomagic]
36183619
private predicate pathThroughCallable0(
36193620
DataFlowCall call, PathNodeMid mid, ReturnKindExt kind, CallContext cc, AccessPath ap,
3620-
AccessPathApprox apa
3621+
AccessPathApprox apa, Configuration config
36213622
) {
36223623
exists(CallContext innercc, SummaryCtx sc |
3623-
pathIntoCallable(mid, _, cc, innercc, sc, call) and
3624-
paramFlowsThrough(kind, innercc, sc, ap, apa, unbindConf(mid.getConfiguration()))
3624+
pathIntoCallable(mid, _, cc, innercc, sc, call, config) and
3625+
paramFlowsThrough(kind, innercc, sc, ap, apa, config)
36253626
)
36263627
}
36273628

@@ -3631,9 +3632,9 @@ private predicate pathThroughCallable0(
36313632
*/
36323633
pragma[noinline]
36333634
private predicate pathThroughCallable(PathNodeMid mid, NodeEx out, CallContext cc, AccessPath ap) {
3634-
exists(DataFlowCall call, ReturnKindExt kind, AccessPathApprox apa |
3635-
pathThroughCallable0(call, mid, kind, cc, ap, apa) and
3636-
out = getAnOutNodeFlow(kind, call, apa, unbindConf(mid.getConfiguration()))
3635+
exists(DataFlowCall call, ReturnKindExt kind, AccessPathApprox apa, Configuration config |
3636+
pathThroughCallable0(call, mid, kind, cc, ap, apa, config) and
3637+
out = getAnOutNodeFlow(kind, call, apa, config)
36373638
)
36383639
}
36393640

@@ -3647,10 +3648,11 @@ private module Subpaths {
36473648
PathNode arg, ParamNodeEx par, SummaryCtxSome sc, CallContext innercc, ReturnKindExt kind,
36483649
NodeEx out, AccessPath apout
36493650
) {
3650-
pathThroughCallable(arg, out, _, pragma[only_bind_into](apout)) and
3651-
pathIntoCallable(arg, par, _, innercc, sc, _) and
3652-
paramFlowsThrough(kind, innercc, sc, pragma[only_bind_into](apout), _,
3653-
unbindConf(arg.getConfiguration()))
3651+
exists(Configuration config |
3652+
pathThroughCallable(arg, out, _, pragma[only_bind_into](apout)) and
3653+
pathIntoCallable(arg, par, _, innercc, sc, _, config) and
3654+
paramFlowsThrough(kind, innercc, sc, pragma[only_bind_into](apout), _, unbindConf(config))
3655+
)
36543656
}
36553657

36563658
/**

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll‎

Lines changed: 24 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -3460,7 +3460,7 @@ private predicate pathStep(
34603460
exists(TypedContent tc | pathReadStep(mid, node, ap.push(tc), tc, cc)) and
34613461
sc = mid.getSummaryCtx()
34623462
or
3463-
pathIntoCallable(mid, node, _, cc, sc, _) and ap = mid.getAp()
3463+
pathIntoCallable(mid, node, _, cc, sc, _, _) and ap = mid.getAp()
34643464
or
34653465
pathOutOfCallable(mid, node, cc) and ap = mid.getAp() and sc instanceof SummaryCtxNone
34663466
or
@@ -3537,14 +3537,16 @@ private predicate pathOutOfCallable(PathNodeMid mid, NodeEx out, CallContext cc)
35373537
*/
35383538
pragma[noinline]
35393539
private predicate pathIntoArg(
3540-
PathNodeMid mid, int i, CallContext cc, DataFlowCall call, AccessPath ap, AccessPathApprox apa
3540+
PathNodeMid mid, int i, CallContext cc, DataFlowCall call, AccessPath ap, AccessPathApprox apa,
3541+
Configuration config
35413542
) {
35423543
exists(ArgNode arg |
35433544
arg = mid.getNodeEx().asNode() and
35443545
cc = mid.getCallContext() and
35453546
arg.argumentOf(call, i) and
35463547
ap = mid.getAp() and
3547-
apa = ap.getApprox()
3548+
apa = ap.getApprox() and
3549+
config = mid.getConfiguration()
35483550
)
35493551
}
35503552

@@ -3561,26 +3563,25 @@ private predicate parameterCand(
35613563
pragma[nomagic]
35623564
private predicate pathIntoCallable0(
35633565
PathNodeMid mid, DataFlowCallable callable, int i, CallContext outercc, DataFlowCall call,
3564-
AccessPath ap
3566+
AccessPath ap, AccessPathApprox apa, Configuration config
35653567
) {
3566-
exists(AccessPathApprox apa |
3567-
pathIntoArg(mid, i, outercc, call, ap, apa) and
3568-
callable = resolveCall(call, outercc) and
3569-
parameterCand(callable, any(int j | j <= i and j >= i), apa, mid.getConfiguration())
3570-
)
3568+
pathIntoArg(mid, i, outercc, call, ap, apa, config) and
3569+
callable = resolveCall(call, outercc)
35713570
}
35723571

35733572
/**
35743573
* Holds if data may flow from `mid` to `p` through `call`. The contexts
35753574
* before and after entering the callable are `outercc` and `innercc`,
35763575
* respectively.
35773576
*/
3577+
pragma[nomagic]
35783578
private predicate pathIntoCallable(
35793579
PathNodeMid mid, ParamNodeEx p, CallContext outercc, CallContextCall innercc, SummaryCtx sc,
3580-
DataFlowCall call
3580+
DataFlowCall call, Configuration config
35813581
) {
3582-
exists(int i, DataFlowCallable callable, AccessPath ap |
3583-
pathIntoCallable0(mid, callable, i, outercc, call, ap) and
3582+
exists(int i, DataFlowCallable callable, AccessPath ap, AccessPathApprox apa |
3583+
pathIntoCallable0(mid, callable, i, outercc, call, ap, apa, config) and
3584+
parameterCand(callable, i, apa, config) and
35843585
p.isParameterOf(callable, i) and
35853586
(
35863587
sc = TSummaryCtxSome(p, ap)
@@ -3617,11 +3618,11 @@ private predicate paramFlowsThrough(
36173618
pragma[nomagic]
36183619
private predicate pathThroughCallable0(
36193620
DataFlowCall call, PathNodeMid mid, ReturnKindExt kind, CallContext cc, AccessPath ap,
3620-
AccessPathApprox apa
3621+
AccessPathApprox apa, Configuration config
36213622
) {
36223623
exists(CallContext innercc, SummaryCtx sc |
3623-
pathIntoCallable(mid, _, cc, innercc, sc, call) and
3624-
paramFlowsThrough(kind, innercc, sc, ap, apa, unbindConf(mid.getConfiguration()))
3624+
pathIntoCallable(mid, _, cc, innercc, sc, call, config) and
3625+
paramFlowsThrough(kind, innercc, sc, ap, apa, config)
36253626
)
36263627
}
36273628

@@ -3631,9 +3632,9 @@ private predicate pathThroughCallable0(
36313632
*/
36323633
pragma[noinline]
36333634
private predicate pathThroughCallable(PathNodeMid mid, NodeEx out, CallContext cc, AccessPath ap) {
3634-
exists(DataFlowCall call, ReturnKindExt kind, AccessPathApprox apa |
3635-
pathThroughCallable0(call, mid, kind, cc, ap, apa) and
3636-
out = getAnOutNodeFlow(kind, call, apa, unbindConf(mid.getConfiguration()))
3635+
exists(DataFlowCall call, ReturnKindExt kind, AccessPathApprox apa, Configuration config |
3636+
pathThroughCallable0(call, mid, kind, cc, ap, apa, config) and
3637+
out = getAnOutNodeFlow(kind, call, apa, config)
36373638
)
36383639
}
36393640

@@ -3647,10 +3648,11 @@ private module Subpaths {
36473648
PathNode arg, ParamNodeEx par, SummaryCtxSome sc, CallContext innercc, ReturnKindExt kind,
36483649
NodeEx out, AccessPath apout
36493650
) {
3650-
pathThroughCallable(arg, out, _, pragma[only_bind_into](apout)) and
3651-
pathIntoCallable(arg, par, _, innercc, sc, _) and
3652-
paramFlowsThrough(kind, innercc, sc, pragma[only_bind_into](apout), _,
3653-
unbindConf(arg.getConfiguration()))
3651+
exists(Configuration config |
3652+
pathThroughCallable(arg, out, _, pragma[only_bind_into](apout)) and
3653+
pathIntoCallable(arg, par, _, innercc, sc, _, config) and
3654+
paramFlowsThrough(kind, innercc, sc, pragma[only_bind_into](apout), _, unbindConf(config))
3655+
)
36543656
}
36553657

36563658
/**

0 commit comments

Comments
 (0)