Skip to content

Commit f3843b8

Browse files
author
Robert Marsh
committed
Revert "C++: output iterator flow with user-defined operators"
This reverts commit 28fa266.
1 parent 28fa266 commit f3843b8

File tree

7 files changed

+51
-200
lines changed

7 files changed

+51
-200
lines changed

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/AddressFlow.qll‎

Lines changed: 0 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -52,17 +52,6 @@ private predicate lvalueToLvalueStep(Expr lvalueIn, Expr lvalueOut) {
5252
or
5353
// C++ only
5454
lvalueIn = lvalueOut.(Assignment).getLValue().getFullyConverted()
55-
or
56-
// C++ only
57-
exists(Call c |
58-
lvalueOut = c and
59-
c.getTarget().hasName(["operator*", "operator++"]) and
60-
(
61-
c.getQualifier() = lvalueIn or
62-
not c.getTarget() instanceof MemberFunction and
63-
c.getArgument(0) = lvalueIn
64-
)
65-
)
6655
}
6756

6857
private predicate pointerToLvalueStep(Expr pointerIn, Expr lvalueOut) {
@@ -103,17 +92,6 @@ private predicate pointerToPointerStep(Expr pointerIn, Expr pointerOut) {
10392

10493
private predicate lvalueToReferenceStep(Expr lvalueIn, Expr referenceOut) {
10594
lvalueIn.getConversion() = referenceOut.(ReferenceToExpr)
106-
or
107-
// C++ only
108-
exists(Call c |
109-
referenceOut = c and
110-
c.getTarget().hasName(["operator*", "operator++"]) and
111-
(
112-
c.getQualifier() = lvalueIn or
113-
not c.getTarget() instanceof MemberFunction and
114-
c.getArgument(0) = lvalueIn
115-
)
116-
)
11795
}
11896

11997
private predicate referenceToLvalueStep(Expr referenceIn, Expr lvalueOut) {

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll‎

Lines changed: 0 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -585,23 +585,6 @@ predicate simpleLocalFlowStep(Node nodeFrom, Node nodeTo) {
585585
nodeFrom.(PostUpdateNode).getPreUpdateNode().asExpr() = call and
586586
nodeTo.asDefiningArgument() = call.getQualifier()
587587
)
588-
or
589-
// Iterators that have a user-defined `operator=`. Take flow from the RHS to
590-
// the post-update node for the iterator.
591-
// The built-in `=` case is handled by FlowVar, other user-defined `operator=`
592-
// will be handled by interprocedural flow.
593-
exists(IteratorPartialDefinitionNode postUpdate, Call opEquals |
594-
postUpdate = nodeTo and
595-
opEquals.getTarget().hasName("operator=") and
596-
if opEquals.getTarget() instanceof MemberFunction
597-
then
598-
opEquals.getQualifier() = postUpdate.getPreUpdateNode().asExpr() and
599-
opEquals.getArgument(0) = nodeFrom.asExpr()
600-
else (
601-
opEquals.getArgument(0) = postUpdate.getPreUpdateNode().asExpr() and
602-
opEquals.getArgument(1) = nodeFrom.asExpr()
603-
)
604-
)
605588
}
606589

607590
/**

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/FlowVar.qll‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -163,9 +163,9 @@ private module PartialDefinitions {
163163
valueToUpdate(convertedInner, this.getFullyConverted(), node) and
164164
innerDefinedExpr = convertedInner.getUnconverted() and
165165
(
166-
innerDefinedExpr.(Call).getQualifier() = getCrementedExpr*(getAnIteratorAccess(collection))
166+
innerDefinedExpr.(Call).getQualifier() = getAnIteratorAccess(collection)
167167
or
168-
innerDefinedExpr.(Call).getQualifier() = getCrementedExpr*(collection.getAnAccess()) and
168+
innerDefinedExpr.(Call).getQualifier() = collection.getAnAccess() and
169169
collection instanceof IteratorParameter
170170
) and
171171
innerDefinedExpr.(Call).getTarget() instanceof IteratorPointerDereferenceMemberOperator
@@ -823,12 +823,10 @@ module FlowVar_internal {
823823
def.getAnUltimateDefiningValue(iterator) = c and
824824
result = def.getAUse(iterator)
825825
)
826-
}
827-
828-
Expr getCrementedExpr(Expr e) {
826+
or
829827
exists(Call crement |
830828
crement = result and
831-
[crement.getQualifier(), crement.getArgument(0)] = e and
829+
[crement.getQualifier(), crement.getArgument(0)] = getAnIteratorAccess(collection) and
832830
crement.getTarget().getName() = ["operator++", "operator--"]
833831
)
834832
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 47 additions & 130 deletions
Large diffs are not rendered by default.

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -250,10 +250,6 @@
250250
| smart_pointer.cpp:13:10:13:10 | p | smart_pointer.cpp:11:52:11:57 | call to source |
251251
| smart_pointer.cpp:24:10:24:10 | call to operator* | smart_pointer.cpp:23:52:23:57 | call to source |
252252
| smart_pointer.cpp:25:10:25:10 | p | smart_pointer.cpp:23:52:23:57 | call to source |
253-
| smart_pointer.cpp:38:10:38:10 | p | smart_pointer.cpp:37:10:37:15 | call to source |
254-
| smart_pointer.cpp:39:10:39:10 | call to operator* | smart_pointer.cpp:37:10:37:15 | call to source |
255-
| smart_pointer.cpp:46:10:46:10 | p | smart_pointer.cpp:45:10:45:15 | call to source |
256-
| smart_pointer.cpp:47:10:47:10 | call to operator* | smart_pointer.cpp:45:10:45:15 | call to source |
257253
| smart_pointer.cpp:52:12:52:14 | call to get | smart_pointer.cpp:51:52:51:57 | call to source |
258254
| smart_pointer.cpp:57:12:57:14 | call to get | smart_pointer.cpp:56:52:56:57 | call to source |
259255
| standalone_iterators.cpp:40:10:40:10 | call to operator* | standalone_iterators.cpp:39:45:39:51 | source1 |
@@ -262,9 +258,6 @@
262258
| standalone_iterators.cpp:46:10:46:10 | call to operator* | standalone_iterators.cpp:45:39:45:45 | source1 |
263259
| standalone_iterators.cpp:47:10:47:10 | call to operator* | standalone_iterators.cpp:45:39:45:45 | source1 |
264260
| standalone_iterators.cpp:48:10:48:10 | call to operator* | standalone_iterators.cpp:45:39:45:45 | source1 |
265-
| standalone_iterators.cpp:52:10:52:10 | call to operator* | standalone_iterators.cpp:51:37:51:43 | source1 |
266-
| standalone_iterators.cpp:53:10:53:10 | call to operator* | standalone_iterators.cpp:51:37:51:43 | source1 |
267-
| standalone_iterators.cpp:54:10:54:10 | call to operator* | standalone_iterators.cpp:51:37:51:43 | source1 |
268261
| string.cpp:29:7:29:7 | a | string.cpp:25:12:25:17 | call to source |
269262
| string.cpp:31:7:31:7 | c | string.cpp:27:16:27:21 | call to source |
270263
| string.cpp:33:9:33:13 | call to c_str | string.cpp:27:16:27:21 | call to source |
@@ -664,5 +657,3 @@
664657
| vector.cpp:409:7:409:9 | v13 | vector.cpp:408:11:408:16 | call to source |
665658
| vector.cpp:414:7:414:9 | v14 | vector.cpp:413:11:413:16 | call to source |
666659
| vector.cpp:422:8:422:10 | out | vector.cpp:417:33:417:45 | source_string |
667-
| vector.cpp:429:8:429:10 | out | vector.cpp:417:33:417:45 | source_string |
668-
| vector.cpp:436:8:436:10 | out | vector.cpp:435:11:435:16 | call to source |

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint_paths.ql‎

Lines changed: 0 additions & 7 deletions
This file was deleted.

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -200,17 +200,10 @@
200200
| set.cpp:237:7:237:9 | set.cpp:236:37:236:42 | AST only |
201201
| smart_pointer.cpp:12:10:12:10 | smart_pointer.cpp:11:52:11:57 | AST only |
202202
| smart_pointer.cpp:24:10:24:10 | smart_pointer.cpp:23:52:23:57 | AST only |
203-
| smart_pointer.cpp:38:10:38:10 | smart_pointer.cpp:37:10:37:15 | AST only |
204-
| smart_pointer.cpp:39:10:39:10 | smart_pointer.cpp:37:10:37:15 | AST only |
205-
| smart_pointer.cpp:46:10:46:10 | smart_pointer.cpp:45:10:45:15 | AST only |
206-
| smart_pointer.cpp:47:10:47:10 | smart_pointer.cpp:45:10:45:15 | AST only |
207203
| standalone_iterators.cpp:41:10:41:10 | standalone_iterators.cpp:39:45:39:51 | AST only |
208204
| standalone_iterators.cpp:42:10:42:10 | standalone_iterators.cpp:39:45:39:51 | AST only |
209205
| standalone_iterators.cpp:47:10:47:10 | standalone_iterators.cpp:45:39:45:45 | AST only |
210206
| standalone_iterators.cpp:48:10:48:10 | standalone_iterators.cpp:45:39:45:45 | AST only |
211-
| standalone_iterators.cpp:52:10:52:10 | standalone_iterators.cpp:51:37:51:43 | AST only |
212-
| standalone_iterators.cpp:53:10:53:10 | standalone_iterators.cpp:51:37:51:43 | AST only |
213-
| standalone_iterators.cpp:54:10:54:10 | standalone_iterators.cpp:51:37:51:43 | AST only |
214207
| string.cpp:33:9:33:13 | string.cpp:27:16:27:21 | AST only |
215208
| string.cpp:39:13:39:17 | string.cpp:14:10:14:15 | AST only |
216209
| string.cpp:43:13:43:17 | string.cpp:14:10:14:15 | AST only |
@@ -390,5 +383,3 @@
390383
| vector.cpp:409:7:409:9 | vector.cpp:408:11:408:16 | AST only |
391384
| vector.cpp:414:7:414:9 | vector.cpp:413:11:413:16 | AST only |
392385
| vector.cpp:422:8:422:10 | vector.cpp:417:33:417:45 | AST only |
393-
| vector.cpp:429:8:429:10 | vector.cpp:417:33:417:45 | AST only |
394-
| vector.cpp:436:8:436:10 | vector.cpp:435:11:435:16 | AST only |

0 commit comments

Comments
 (0)