Skip to content

Commit 19589be

Browse files
hvitvedhvitved
authored
Merge pull request #6777 from hvitved/dataflow/summary-clear-modelling
Data flow: Rework `SummarizedCallable::clearsContent/2`
2 parents ed73d9b + f9fb046 commit 19589be

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

49 files changed

+1174
-297
lines changed

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll

Lines changed: 34 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -244,6 +244,8 @@ private class ParamNodeEx extends NodeEx {
244244
}
245245

246246
int getPosition() { this.isParameterOf(_, result) }
247+
248+
predicate allowParameterReturnInSelf() { allowParameterReturnInSelfCached(this.asNode()) }
247249
}
248250

249251
private class RetNodeEx extends NodeEx {
@@ -744,8 +746,12 @@ private module Stage1 {
744746
returnFlowCallableNodeCand(c, kind, config) and
745747
p.getEnclosingCallable() = c and
746748
exists(ap) and
747-
// we don't expect a parameter to return stored in itself
748-
not kind.(ParamUpdateReturnKind).getPosition() = p.getPosition()
749+
// we don't expect a parameter to return stored in itself, unless explicitly allowed
750+
(
751+
not kind.(ParamUpdateReturnKind).getPosition() = p.getPosition()
752+
or
753+
p.allowParameterReturnInSelf()
754+
)
749755
)
750756
}
751757

@@ -1394,8 +1400,12 @@ private module Stage2 {
13941400
fwdFlow(ret, any(CcCall ccc), apSome(ap), ap0, config) and
13951401
kind = ret.getKind() and
13961402
p.getPosition() = pos and
1397-
// we don't expect a parameter to return stored in itself
1398-
not kind.(ParamUpdateReturnKind).getPosition() = pos
1403+
// we don't expect a parameter to return stored in itself, unless explicitly allowed
1404+
(
1405+
not kind.(ParamUpdateReturnKind).getPosition() = pos
1406+
or
1407+
p.allowParameterReturnInSelf()
1408+
)
13991409
)
14001410
}
14011411

@@ -2083,8 +2093,12 @@ private module Stage3 {
20832093
fwdFlow(ret, any(CcCall ccc), apSome(ap), ap0, config) and
20842094
kind = ret.getKind() and
20852095
p.getPosition() = pos and
2086-
// we don't expect a parameter to return stored in itself
2087-
not kind.(ParamUpdateReturnKind).getPosition() = pos
2096+
// we don't expect a parameter to return stored in itself, unless explicitly allowed
2097+
(
2098+
not kind.(ParamUpdateReturnKind).getPosition() = pos
2099+
or
2100+
p.allowParameterReturnInSelf()
2101+
)
20882102
)
20892103
}
20902104

@@ -2843,8 +2857,12 @@ private module Stage4 {
28432857
fwdFlow(ret, any(CcCall ccc), apSome(ap), ap0, config) and
28442858
kind = ret.getKind() and
28452859
p.getPosition() = pos and
2846-
// we don't expect a parameter to return stored in itself
2847-
not kind.(ParamUpdateReturnKind).getPosition() = pos
2860+
// we don't expect a parameter to return stored in itself, unless explicitly allowed
2861+
(
2862+
not kind.(ParamUpdateReturnKind).getPosition() = pos
2863+
or
2864+
p.allowParameterReturnInSelf()
2865+
)
28482866
)
28492867
}
28502868

@@ -2917,6 +2935,8 @@ private class SummaryCtxSome extends SummaryCtx, TSummaryCtxSome {
29172935

29182936
int getParameterPos() { p.isParameterOf(_, result) }
29192937

2938+
ParamNodeEx getParamNode() { result = p }
2939+
29202940
override string toString() { result = p + ": " + ap }
29212941

29222942
predicate hasLocationInfo(
@@ -3617,7 +3637,12 @@ private predicate paramFlowsThrough(
36173637
ap = mid.getAp() and
36183638
apa = ap.getApprox() and
36193639
pos = sc.getParameterPos() and
3620-
not kind.(ParamUpdateReturnKind).getPosition() = pos
3640+
// we don't expect a parameter to return stored in itself, unless explicitly allowed
3641+
(
3642+
not kind.(ParamUpdateReturnKind).getPosition() = pos
3643+
or
3644+
sc.getParamNode().allowParameterReturnInSelf()
3645+
)
36213646
)
36223647
}
36233648

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll

Lines changed: 34 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -244,6 +244,8 @@ private class ParamNodeEx extends NodeEx {
244244
}
245245

246246
int getPosition() { this.isParameterOf(_, result) }
247+
248+
predicate allowParameterReturnInSelf() { allowParameterReturnInSelfCached(this.asNode()) }
247249
}
248250

249251
private class RetNodeEx extends NodeEx {
@@ -744,8 +746,12 @@ private module Stage1 {
744746
returnFlowCallableNodeCand(c, kind, config) and
745747
p.getEnclosingCallable() = c and
746748
exists(ap) and
747-
// we don't expect a parameter to return stored in itself
748-
not kind.(ParamUpdateReturnKind).getPosition() = p.getPosition()
749+
// we don't expect a parameter to return stored in itself, unless explicitly allowed
750+
(
751+
not kind.(ParamUpdateReturnKind).getPosition() = p.getPosition()
752+
or
753+
p.allowParameterReturnInSelf()
754+
)
749755
)
750756
}
751757

@@ -1394,8 +1400,12 @@ private module Stage2 {
13941400
fwdFlow(ret, any(CcCall ccc), apSome(ap), ap0, config) and
13951401
kind = ret.getKind() and
13961402
p.getPosition() = pos and
1397-
// we don't expect a parameter to return stored in itself
1398-
not kind.(ParamUpdateReturnKind).getPosition() = pos
1403+
// we don't expect a parameter to return stored in itself, unless explicitly allowed
1404+
(
1405+
not kind.(ParamUpdateReturnKind).getPosition() = pos
1406+
or
1407+
p.allowParameterReturnInSelf()
1408+
)
13991409
)
14001410
}
14011411

@@ -2083,8 +2093,12 @@ private module Stage3 {
20832093
fwdFlow(ret, any(CcCall ccc), apSome(ap), ap0, config) and
20842094
kind = ret.getKind() and
20852095
p.getPosition() = pos and
2086-
// we don't expect a parameter to return stored in itself
2087-
not kind.(ParamUpdateReturnKind).getPosition() = pos
2096+
// we don't expect a parameter to return stored in itself, unless explicitly allowed
2097+
(
2098+
not kind.(ParamUpdateReturnKind).getPosition() = pos
2099+
or
2100+
p.allowParameterReturnInSelf()
2101+
)
20882102
)
20892103
}
20902104

@@ -2843,8 +2857,12 @@ private module Stage4 {
28432857
fwdFlow(ret, any(CcCall ccc), apSome(ap), ap0, config) and
28442858
kind = ret.getKind() and
28452859
p.getPosition() = pos and
2846-
// we don't expect a parameter to return stored in itself
2847-
not kind.(ParamUpdateReturnKind).getPosition() = pos
2860+
// we don't expect a parameter to return stored in itself, unless explicitly allowed
2861+
(
2862+
not kind.(ParamUpdateReturnKind).getPosition() = pos
2863+
or
2864+
p.allowParameterReturnInSelf()
2865+
)
28482866
)
28492867
}
28502868

@@ -2917,6 +2935,8 @@ private class SummaryCtxSome extends SummaryCtx, TSummaryCtxSome {
29172935

29182936
int getParameterPos() { p.isParameterOf(_, result) }
29192937

2938+
ParamNodeEx getParamNode() { result = p }
2939+
29202940
override string toString() { result = p + ": " + ap }
29212941

29222942
predicate hasLocationInfo(
@@ -3617,7 +3637,12 @@ private predicate paramFlowsThrough(
36173637
ap = mid.getAp() and
36183638
apa = ap.getApprox() and
36193639
pos = sc.getParameterPos() and
3620-
not kind.(ParamUpdateReturnKind).getPosition() = pos
3640+
// we don't expect a parameter to return stored in itself, unless explicitly allowed
3641+
(
3642+
not kind.(ParamUpdateReturnKind).getPosition() = pos
3643+
or
3644+
sc.getParamNode().allowParameterReturnInSelf()
3645+
)
36213646
)
36223647
}
36233648

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll

Lines changed: 34 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -244,6 +244,8 @@ private class ParamNodeEx extends NodeEx {
244244
}
245245

246246
int getPosition() { this.isParameterOf(_, result) }
247+
248+
predicate allowParameterReturnInSelf() { allowParameterReturnInSelfCached(this.asNode()) }
247249
}
248250

249251
private class RetNodeEx extends NodeEx {
@@ -744,8 +746,12 @@ private module Stage1 {
744746
returnFlowCallableNodeCand(c, kind, config) and
745747
p.getEnclosingCallable() = c and
746748
exists(ap) and
747-
// we don't expect a parameter to return stored in itself
748-
not kind.(ParamUpdateReturnKind).getPosition() = p.getPosition()
749+
// we don't expect a parameter to return stored in itself, unless explicitly allowed
750+
(
751+
not kind.(ParamUpdateReturnKind).getPosition() = p.getPosition()
752+
or
753+
p.allowParameterReturnInSelf()
754+
)
749755
)
750756
}
751757

@@ -1394,8 +1400,12 @@ private module Stage2 {
13941400
fwdFlow(ret, any(CcCall ccc), apSome(ap), ap0, config) and
13951401
kind = ret.getKind() and
13961402
p.getPosition() = pos and
1397-
// we don't expect a parameter to return stored in itself
1398-
not kind.(ParamUpdateReturnKind).getPosition() = pos
1403+
// we don't expect a parameter to return stored in itself, unless explicitly allowed
1404+
(
1405+
not kind.(ParamUpdateReturnKind).getPosition() = pos
1406+
or
1407+
p.allowParameterReturnInSelf()
1408+
)
13991409
)
14001410
}
14011411

@@ -2083,8 +2093,12 @@ private module Stage3 {
20832093
fwdFlow(ret, any(CcCall ccc), apSome(ap), ap0, config) and
20842094
kind = ret.getKind() and
20852095
p.getPosition() = pos and
2086-
// we don't expect a parameter to return stored in itself
2087-
not kind.(ParamUpdateReturnKind).getPosition() = pos
2096+
// we don't expect a parameter to return stored in itself, unless explicitly allowed
2097+
(
2098+
not kind.(ParamUpdateReturnKind).getPosition() = pos
2099+
or
2100+
p.allowParameterReturnInSelf()
2101+
)
20882102
)
20892103
}
20902104

@@ -2843,8 +2857,12 @@ private module Stage4 {
28432857
fwdFlow(ret, any(CcCall ccc), apSome(ap), ap0, config) and
28442858
kind = ret.getKind() and
28452859
p.getPosition() = pos and
2846-
// we don't expect a parameter to return stored in itself
2847-
not kind.(ParamUpdateReturnKind).getPosition() = pos
2860+
// we don't expect a parameter to return stored in itself, unless explicitly allowed
2861+
(
2862+
not kind.(ParamUpdateReturnKind).getPosition() = pos
2863+
or
2864+
p.allowParameterReturnInSelf()
2865+
)
28482866
)
28492867
}
28502868

@@ -2917,6 +2935,8 @@ private class SummaryCtxSome extends SummaryCtx, TSummaryCtxSome {
29172935

29182936
int getParameterPos() { p.isParameterOf(_, result) }
29192937

2938+
ParamNodeEx getParamNode() { result = p }
2939+
29202940
override string toString() { result = p + ": " + ap }
29212941

29222942
predicate hasLocationInfo(
@@ -3617,7 +3637,12 @@ private predicate paramFlowsThrough(
36173637
ap = mid.getAp() and
36183638
apa = ap.getApprox() and
36193639
pos = sc.getParameterPos() and
3620-
not kind.(ParamUpdateReturnKind).getPosition() = pos
3640+
// we don't expect a parameter to return stored in itself, unless explicitly allowed
3641+
(
3642+
not kind.(ParamUpdateReturnKind).getPosition() = pos
3643+
or
3644+
sc.getParamNode().allowParameterReturnInSelf()
3645+
)
36213646
)
36223647
}
36233648

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll

Lines changed: 34 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -244,6 +244,8 @@ private class ParamNodeEx extends NodeEx {
244244
}
245245

246246
int getPosition() { this.isParameterOf(_, result) }
247+
248+
predicate allowParameterReturnInSelf() { allowParameterReturnInSelfCached(this.asNode()) }
247249
}
248250

249251
private class RetNodeEx extends NodeEx {
@@ -744,8 +746,12 @@ private module Stage1 {
744746
returnFlowCallableNodeCand(c, kind, config) and
745747
p.getEnclosingCallable() = c and
746748
exists(ap) and
747-
// we don't expect a parameter to return stored in itself
748-
not kind.(ParamUpdateReturnKind).getPosition() = p.getPosition()
749+
// we don't expect a parameter to return stored in itself, unless explicitly allowed
750+
(
751+
not kind.(ParamUpdateReturnKind).getPosition() = p.getPosition()
752+
or
753+
p.allowParameterReturnInSelf()
754+
)
749755
)
750756
}
751757

@@ -1394,8 +1400,12 @@ private module Stage2 {
13941400
fwdFlow(ret, any(CcCall ccc), apSome(ap), ap0, config) and
13951401
kind = ret.getKind() and
13961402
p.getPosition() = pos and
1397-
// we don't expect a parameter to return stored in itself
1398-
not kind.(ParamUpdateReturnKind).getPosition() = pos
1403+
// we don't expect a parameter to return stored in itself, unless explicitly allowed
1404+
(
1405+
not kind.(ParamUpdateReturnKind).getPosition() = pos
1406+
or
1407+
p.allowParameterReturnInSelf()
1408+
)
13991409
)
14001410
}
14011411

@@ -2083,8 +2093,12 @@ private module Stage3 {
20832093
fwdFlow(ret, any(CcCall ccc), apSome(ap), ap0, config) and
20842094
kind = ret.getKind() and
20852095
p.getPosition() = pos and
2086-
// we don't expect a parameter to return stored in itself
2087-
not kind.(ParamUpdateReturnKind).getPosition() = pos
2096+
// we don't expect a parameter to return stored in itself, unless explicitly allowed
2097+
(
2098+
not kind.(ParamUpdateReturnKind).getPosition() = pos
2099+
or
2100+
p.allowParameterReturnInSelf()
2101+
)
20882102
)
20892103
}
20902104

@@ -2843,8 +2857,12 @@ private module Stage4 {
28432857
fwdFlow(ret, any(CcCall ccc), apSome(ap), ap0, config) and
28442858
kind = ret.getKind() and
28452859
p.getPosition() = pos and
2846-
// we don't expect a parameter to return stored in itself
2847-
not kind.(ParamUpdateReturnKind).getPosition() = pos
2860+
// we don't expect a parameter to return stored in itself, unless explicitly allowed
2861+
(
2862+
not kind.(ParamUpdateReturnKind).getPosition() = pos
2863+
or
2864+
p.allowParameterReturnInSelf()
2865+
)
28482866
)
28492867
}
28502868

@@ -2917,6 +2935,8 @@ private class SummaryCtxSome extends SummaryCtx, TSummaryCtxSome {
29172935

29182936
int getParameterPos() { p.isParameterOf(_, result) }
29192937

2938+
ParamNodeEx getParamNode() { result = p }
2939+
29202940
override string toString() { result = p + ": " + ap }
29212941

29222942
predicate hasLocationInfo(
@@ -3617,7 +3637,12 @@ private predicate paramFlowsThrough(
36173637
ap = mid.getAp() and
36183638
apa = ap.getApprox() and
36193639
pos = sc.getParameterPos() and
3620-
not kind.(ParamUpdateReturnKind).getPosition() = pos
3640+
// we don't expect a parameter to return stored in itself, unless explicitly allowed
3641+
(
3642+
not kind.(ParamUpdateReturnKind).getPosition() = pos
3643+
or
3644+
sc.getParamNode().allowParameterReturnInSelf()
3645+
)
36213646
)
36223647
}
36233648

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -801,6 +801,9 @@ private module Cached {
801801
exists(Node n | getNodeEnclosingCallable(n) = callable | isUnreachableInCallCached(n, call))
802802
}
803803

804+
cached
805+
predicate allowParameterReturnInSelfCached(ParamNode p) { allowParameterReturnInSelf(p) }
806+
804807
cached
805808
newtype TCallContext =
806809
TAnyCallContext() or

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplConsistency.qll

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -175,6 +175,7 @@ module Consistency {
175175

176176
query predicate postWithInFlow(Node n, string msg) {
177177
isPostUpdateNode(n) and
178+
not clearsContent(n, _) and
178179
simpleLocalFlowStep(_, n) and
179180
msg = "PostUpdateNode should not be the target of local flow."
180181
}

0 commit comments

Comments
 (0)