Skip to content

Commit c195420

Browse files
author
Robert Marsh
committed
C++: respond to PR comments
1 parent 72f9add commit c195420

File tree

4 files changed

+113
-91
lines changed

4 files changed

+113
-91
lines changed

‎cpp/ql/src/semmle/code/cpp/models/implementations/Pure.qll‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ import semmle.code.cpp.models.interfaces.SideEffect
66
class PureStrFunction extends AliasFunction, ArrayFunction, TaintFunction, SideEffectFunction {
77
PureStrFunction() {
88
exists(string name |
9-
hasName(name) and
9+
hasGlobalName(name) and
1010
(
1111
name = "atof"
1212
or name = "atoi"
@@ -41,29 +41,28 @@ class PureStrFunction extends AliasFunction, ArrayFunction, TaintFunction, Side
4141

4242
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
4343
exists (ParameterIndex i |
44-
input.isInParameter(i) or
45-
(
46-
input.isInParameterPointer(i) and
47-
getParameter(i).getUnspecifiedType() instanceof PointerType
48-
)
44+
input.isInParameter(i) and
45+
exists(getParameter(i))
46+
or
47+
input.isInParameterPointer(i) and
48+
getParameter(i).getUnspecifiedType() instanceof PointerType
4949
) and
5050
(
51-
output.isOutReturnValue() or
52-
output.isOutReturnPointer()
51+
output.isOutReturnPointer() and
52+
getUnspecifiedType() instanceof PointerType
53+
or
54+
output.isOutReturnValue()
5355
)
5456
}
5557

5658
override predicate parameterNeverEscapes(int i) {
5759
getParameter(i).getUnspecifiedType() instanceof PointerType and
58-
not (
59-
i = 0 and
60-
getType().getUnspecifiedType() instanceof PointerType
61-
)
60+
not parameterEscapesOnlyViaReturn(i)
6261
}
6362

6463
override predicate parameterEscapesOnlyViaReturn(int i) {
6564
i = 0 and
66-
getType().getUnspecifiedType() instanceof PointerType
65+
getUnspecifiedType() instanceof PointerType
6766
}
6867

6968
override predicate parameterIsAlwaysReturned(int i) {
@@ -82,7 +81,7 @@ class PureStrFunction extends AliasFunction, ArrayFunction, TaintFunction, Side
8281
class PureFunction extends TaintFunction, SideEffectFunction {
8382
PureFunction() {
8483
exists(string name |
85-
hasName(name) and
84+
hasGlobalName(name) and
8685
(
8786
name = "abs" or
8887
name = "labs"
@@ -92,7 +91,8 @@ class PureFunction extends TaintFunction, SideEffectFunction {
9291

9392
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
9493
exists (ParameterIndex i |
95-
input.isInParameter(i)
94+
input.isInParameter(i) and
95+
exists(getParameter(i))
9696
) and
9797
output.isOutReturnValue()
9898
}

‎cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected‎

Lines changed: 48 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -759,41 +759,51 @@ ssa.cpp:
759759
# 184| v0_23(void) = UnmodeledUse : mu*
760760
# 184| v0_24(void) = ExitFunction :
761761

762-
# 197| int PureFunctions(char*, char*, int)
763-
# 197| Block 0
764-
# 197| v0_0(void) = EnterFunction :
765-
# 197| m0_1(unknown) = AliasedDefinition :
766-
# 197| mu0_2(unknown) = UnmodeledDefinition :
767-
# 197| r0_3(glval<char *>) = VariableAddress[str1] :
768-
# 197| m0_4(char *) = InitializeParameter[str1] : &:r0_3
769-
# 197| r0_5(glval<char *>) = VariableAddress[str2] :
770-
# 197| m0_6(char *) = InitializeParameter[str2] : &:r0_5
771-
# 197| r0_7(glval<int>) = VariableAddress[x] :
772-
# 197| m0_8(int) = InitializeParameter[x] : &:r0_7
773-
# 198| r0_9(glval<int>) = VariableAddress[ret] :
774-
# 198| r0_10(glval<unknown>) = FunctionAddress[strcmp] :
775-
# 198| r0_11(glval<char *>) = VariableAddress[str1] :
776-
# 198| r0_12(char *) = Load : &:r0_11, m0_4
777-
# 198| r0_13(char *) = Convert : r0_12
778-
# 198| r0_14(glval<char *>) = VariableAddress[str2] :
779-
# 198| r0_15(char *) = Load : &:r0_14, m0_6
780-
# 198| r0_16(char *) = Convert : r0_15
781-
# 198| r0_17(int) = Call : func:r0_10, 0:r0_13, 1:r0_16
782-
# 198| v0_18(void) = ^CallReadSideEffect : ~m0_1
783-
# 198| m0_19(int) = Store : &:r0_9, r0_17
784-
# 199| r0_20(glval<unknown>) = FunctionAddress[abs] :
785-
# 199| r0_21(glval<int>) = VariableAddress[x] :
786-
# 199| r0_22(int) = Load : &:r0_21, m0_8
787-
# 199| r0_23(int) = Call : func:r0_20, 0:r0_22
788-
# 199| r0_24(glval<int>) = VariableAddress[ret] :
789-
# 199| r0_25(int) = Load : &:r0_24, m0_19
790-
# 199| r0_26(int) = Add : r0_25, r0_23
791-
# 199| m0_27(int) = Store : &:r0_24, r0_26
792-
# 200| r0_28(glval<int>) = VariableAddress[#return] :
793-
# 200| r0_29(glval<int>) = VariableAddress[ret] :
794-
# 200| r0_30(int) = Load : &:r0_29, m0_27
795-
# 200| m0_31(int) = Store : &:r0_28, r0_30
796-
# 197| r0_32(glval<int>) = VariableAddress[#return] :
797-
# 197| v0_33(void) = ReturnValue : &:r0_32, m0_31
798-
# 197| v0_34(void) = UnmodeledUse : mu*
799-
# 197| v0_35(void) = ExitFunction :
762+
# 198| int PureFunctions(char*, char*, int)
763+
# 198| Block 0
764+
# 198| v0_0(void) = EnterFunction :
765+
# 198| m0_1(unknown) = AliasedDefinition :
766+
# 198| mu0_2(unknown) = UnmodeledDefinition :
767+
# 198| r0_3(glval<char *>) = VariableAddress[str1] :
768+
# 198| m0_4(char *) = InitializeParameter[str1] : &:r0_3
769+
# 198| r0_5(glval<char *>) = VariableAddress[str2] :
770+
# 198| m0_6(char *) = InitializeParameter[str2] : &:r0_5
771+
# 198| r0_7(glval<int>) = VariableAddress[x] :
772+
# 198| m0_8(int) = InitializeParameter[x] : &:r0_7
773+
# 199| r0_9(glval<int>) = VariableAddress[ret] :
774+
# 199| r0_10(glval<unknown>) = FunctionAddress[strcmp] :
775+
# 199| r0_11(glval<char *>) = VariableAddress[str1] :
776+
# 199| r0_12(char *) = Load : &:r0_11, m0_4
777+
# 199| r0_13(char *) = Convert : r0_12
778+
# 199| r0_14(glval<char *>) = VariableAddress[str2] :
779+
# 199| r0_15(char *) = Load : &:r0_14, m0_6
780+
# 199| r0_16(char *) = Convert : r0_15
781+
# 199| r0_17(int) = Call : func:r0_10, 0:r0_13, 1:r0_16
782+
# 199| v0_18(void) = ^CallReadSideEffect : ~m0_1
783+
# 199| m0_19(int) = Store : &:r0_9, r0_17
784+
# 200| r0_20(glval<unknown>) = FunctionAddress[strlen] :
785+
# 200| r0_21(glval<char *>) = VariableAddress[str1] :
786+
# 200| r0_22(char *) = Load : &:r0_21, m0_4
787+
# 200| r0_23(char *) = Convert : r0_22
788+
# 200| r0_24(int) = Call : func:r0_20, 0:r0_23
789+
# 200| v0_25(void) = ^CallReadSideEffect : ~m0_1
790+
# 200| r0_26(glval<int>) = VariableAddress[ret] :
791+
# 200| r0_27(int) = Load : &:r0_26, m0_19
792+
# 200| r0_28(int) = Add : r0_27, r0_24
793+
# 200| m0_29(int) = Store : &:r0_26, r0_28
794+
# 201| r0_30(glval<unknown>) = FunctionAddress[abs] :
795+
# 201| r0_31(glval<int>) = VariableAddress[x] :
796+
# 201| r0_32(int) = Load : &:r0_31, m0_8
797+
# 201| r0_33(int) = Call : func:r0_30, 0:r0_32
798+
# 201| r0_34(glval<int>) = VariableAddress[ret] :
799+
# 201| r0_35(int) = Load : &:r0_34, m0_29
800+
# 201| r0_36(int) = Add : r0_35, r0_33
801+
# 201| m0_37(int) = Store : &:r0_34, r0_36
802+
# 202| r0_38(glval<int>) = VariableAddress[#return] :
803+
# 202| r0_39(glval<int>) = VariableAddress[ret] :
804+
# 202| r0_40(int) = Load : &:r0_39, m0_37
805+
# 202| m0_41(int) = Store : &:r0_38, r0_40
806+
# 198| r0_42(glval<int>) = VariableAddress[#return] :
807+
# 198| v0_43(void) = ReturnValue : &:r0_42, m0_41
808+
# 198| v0_44(void) = UnmodeledUse : mu*
809+
# 198| v0_45(void) = ExitFunction :

‎cpp/ql/test/library-tests/ir/ssa/ssa.cpp‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -192,10 +192,12 @@ static void AsmStmtWithOutputs(unsigned int& a, unsigned int& b, unsigned int& c
192192
}
193193

194194
int strcmp(const char *, const char *);
195+
int strlen(const char *);
195196
int abs(int);
196197

197198
int PureFunctions(char *str1, char *str2, int x) {
198199
int ret = strcmp(str1, str2);
200+
ret += strlen(str1);
199201
ret += abs(x);
200202
return ret;
201203
}

‎cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected‎

Lines changed: 48 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -725,41 +725,51 @@ ssa.cpp:
725725
# 184| v0_18(void) = UnmodeledUse : mu*
726726
# 184| v0_19(void) = ExitFunction :
727727

728-
# 197| int PureFunctions(char*, char*, int)
729-
# 197| Block 0
730-
# 197| v0_0(void) = EnterFunction :
731-
# 197| mu0_1(unknown) = AliasedDefinition :
732-
# 197| mu0_2(unknown) = UnmodeledDefinition :
733-
# 197| r0_3(glval<char *>) = VariableAddress[str1] :
734-
# 197| m0_4(char *) = InitializeParameter[str1] : &:r0_3
735-
# 197| r0_5(glval<char *>) = VariableAddress[str2] :
736-
# 197| m0_6(char *) = InitializeParameter[str2] : &:r0_5
737-
# 197| r0_7(glval<int>) = VariableAddress[x] :
738-
# 197| m0_8(int) = InitializeParameter[x] : &:r0_7
739-
# 198| r0_9(glval<int>) = VariableAddress[ret] :
740-
# 198| r0_10(glval<unknown>) = FunctionAddress[strcmp] :
741-
# 198| r0_11(glval<char *>) = VariableAddress[str1] :
742-
# 198| r0_12(char *) = Load : &:r0_11, m0_4
743-
# 198| r0_13(char *) = Convert : r0_12
744-
# 198| r0_14(glval<char *>) = VariableAddress[str2] :
745-
# 198| r0_15(char *) = Load : &:r0_14, m0_6
746-
# 198| r0_16(char *) = Convert : r0_15
747-
# 198| r0_17(int) = Call : func:r0_10, 0:r0_13, 1:r0_16
748-
# 198| v0_18(void) = ^CallReadSideEffect : ~mu0_2
749-
# 198| m0_19(int) = Store : &:r0_9, r0_17
750-
# 199| r0_20(glval<unknown>) = FunctionAddress[abs] :
751-
# 199| r0_21(glval<int>) = VariableAddress[x] :
752-
# 199| r0_22(int) = Load : &:r0_21, m0_8
753-
# 199| r0_23(int) = Call : func:r0_20, 0:r0_22
754-
# 199| r0_24(glval<int>) = VariableAddress[ret] :
755-
# 199| r0_25(int) = Load : &:r0_24, m0_19
756-
# 199| r0_26(int) = Add : r0_25, r0_23
757-
# 199| m0_27(int) = Store : &:r0_24, r0_26
758-
# 200| r0_28(glval<int>) = VariableAddress[#return] :
759-
# 200| r0_29(glval<int>) = VariableAddress[ret] :
760-
# 200| r0_30(int) = Load : &:r0_29, m0_27
761-
# 200| m0_31(int) = Store : &:r0_28, r0_30
762-
# 197| r0_32(glval<int>) = VariableAddress[#return] :
763-
# 197| v0_33(void) = ReturnValue : &:r0_32, m0_31
764-
# 197| v0_34(void) = UnmodeledUse : mu*
765-
# 197| v0_35(void) = ExitFunction :
728+
# 198| int PureFunctions(char*, char*, int)
729+
# 198| Block 0
730+
# 198| v0_0(void) = EnterFunction :
731+
# 198| mu0_1(unknown) = AliasedDefinition :
732+
# 198| mu0_2(unknown) = UnmodeledDefinition :
733+
# 198| r0_3(glval<char *>) = VariableAddress[str1] :
734+
# 198| m0_4(char *) = InitializeParameter[str1] : &:r0_3
735+
# 198| r0_5(glval<char *>) = VariableAddress[str2] :
736+
# 198| m0_6(char *) = InitializeParameter[str2] : &:r0_5
737+
# 198| r0_7(glval<int>) = VariableAddress[x] :
738+
# 198| m0_8(int) = InitializeParameter[x] : &:r0_7
739+
# 199| r0_9(glval<int>) = VariableAddress[ret] :
740+
# 199| r0_10(glval<unknown>) = FunctionAddress[strcmp] :
741+
# 199| r0_11(glval<char *>) = VariableAddress[str1] :
742+
# 199| r0_12(char *) = Load : &:r0_11, m0_4
743+
# 199| r0_13(char *) = Convert : r0_12
744+
# 199| r0_14(glval<char *>) = VariableAddress[str2] :
745+
# 199| r0_15(char *) = Load : &:r0_14, m0_6
746+
# 199| r0_16(char *) = Convert : r0_15
747+
# 199| r0_17(int) = Call : func:r0_10, 0:r0_13, 1:r0_16
748+
# 199| v0_18(void) = ^CallReadSideEffect : ~mu0_2
749+
# 199| m0_19(int) = Store : &:r0_9, r0_17
750+
# 200| r0_20(glval<unknown>) = FunctionAddress[strlen] :
751+
# 200| r0_21(glval<char *>) = VariableAddress[str1] :
752+
# 200| r0_22(char *) = Load : &:r0_21, m0_4
753+
# 200| r0_23(char *) = Convert : r0_22
754+
# 200| r0_24(int) = Call : func:r0_20, 0:r0_23
755+
# 200| v0_25(void) = ^CallReadSideEffect : ~mu0_2
756+
# 200| r0_26(glval<int>) = VariableAddress[ret] :
757+
# 200| r0_27(int) = Load : &:r0_26, m0_19
758+
# 200| r0_28(int) = Add : r0_27, r0_24
759+
# 200| m0_29(int) = Store : &:r0_26, r0_28
760+
# 201| r0_30(glval<unknown>) = FunctionAddress[abs] :
761+
# 201| r0_31(glval<int>) = VariableAddress[x] :
762+
# 201| r0_32(int) = Load : &:r0_31, m0_8
763+
# 201| r0_33(int) = Call : func:r0_30, 0:r0_32
764+
# 201| r0_34(glval<int>) = VariableAddress[ret] :
765+
# 201| r0_35(int) = Load : &:r0_34, m0_29
766+
# 201| r0_36(int) = Add : r0_35, r0_33
767+
# 201| m0_37(int) = Store : &:r0_34, r0_36
768+
# 202| r0_38(glval<int>) = VariableAddress[#return] :
769+
# 202| r0_39(glval<int>) = VariableAddress[ret] :
770+
# 202| r0_40(int) = Load : &:r0_39, m0_37
771+
# 202| m0_41(int) = Store : &:r0_38, r0_40
772+
# 198| r0_42(glval<int>) = VariableAddress[#return] :
773+
# 198| v0_43(void) = ReturnValue : &:r0_42, m0_41
774+
# 198| v0_44(void) = UnmodeledUse : mu*
775+
# 198| v0_45(void) = ExitFunction :

0 commit comments

Comments
 (0)