Skip to content

Commit 677c436

Browse files
aschackmullaschackmull
authored
Merge pull request #8703 from aschackmull/dataflow/revert-state-in-out-barriers
Dataflow: Revert support for flow-state based in-/out-barriers
2 parents 3d109a4 + 48fbbf2 commit 677c436

File tree

52 files changed

+310
-1810
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

52 files changed

+310
-1810
lines changed

‎cpp/ql/lib/change-notes/2022-04-08-flow-state-barriers.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: breaking
3+
---
4+
The recently added flow-state versions of `isBarrierIn`, `isBarrierOut`, `isSanitizerIn`, and `isSanitizerOut` in the data flow and taint tracking libraries have been removed.

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll

Lines changed: 10 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -87,21 +87,9 @@ abstract class Configuration extends string {
8787
/** Holds if data flow into `node` is prohibited. */
8888
predicate isBarrierIn(Node node) { none() }
8989

90-
/**
91-
* Holds if data flow into `node` is prohibited when the flow state is
92-
* `state`
93-
*/
94-
predicate isBarrierIn(Node node, FlowState state) { none() }
95-
9690
/** Holds if data flow out of `node` is prohibited. */
9791
predicate isBarrierOut(Node node) { none() }
9892

99-
/**
100-
* Holds if data flow out of `node` is prohibited when the flow state is
101-
* `state`
102-
*/
103-
predicate isBarrierOut(Node node, FlowState state) { none() }
104-
10593
/** Holds if data flow through nodes guarded by `guard` is prohibited. */
10694
predicate isBarrierGuard(BarrierGuard guard) { none() }
10795

@@ -321,7 +309,7 @@ private class RetNodeEx extends NodeEx {
321309
ReturnKindExt getKind() { result = this.asNode().(ReturnNodeExt).getKind() }
322310
}
323311

324-
private predicate fullInBarrier(NodeEx node, Configuration config) {
312+
private predicate inBarrier(NodeEx node, Configuration config) {
325313
exists(Node n |
326314
node.asNode() = n and
327315
config.isBarrierIn(n)
@@ -330,16 +318,7 @@ private predicate fullInBarrier(NodeEx node, Configuration config) {
330318
)
331319
}
332320

333-
private predicate stateInBarrier(NodeEx node, FlowState state, Configuration config) {
334-
exists(Node n |
335-
node.asNode() = n and
336-
config.isBarrierIn(n, state)
337-
|
338-
config.isSource(n, state)
339-
)
340-
}
341-
342-
private predicate fullOutBarrier(NodeEx node, Configuration config) {
321+
private predicate outBarrier(NodeEx node, Configuration config) {
343322
exists(Node n |
344323
node.asNode() = n and
345324
config.isBarrierOut(n)
@@ -348,15 +327,6 @@ private predicate fullOutBarrier(NodeEx node, Configuration config) {
348327
)
349328
}
350329

351-
private predicate stateOutBarrier(NodeEx node, FlowState state, Configuration config) {
352-
exists(Node n |
353-
node.asNode() = n and
354-
config.isBarrierOut(n, state)
355-
|
356-
config.isSink(n, state)
357-
)
358-
}
359-
360330
pragma[nomagic]
361331
private predicate fullBarrier(NodeEx node, Configuration config) {
362332
exists(Node n | node.asNode() = n |
@@ -382,12 +352,6 @@ private predicate stateBarrier(NodeEx node, FlowState state, Configuration confi
382352
exists(Node n | node.asNode() = n |
383353
config.isBarrier(n, state)
384354
or
385-
config.isBarrierIn(n, state) and
386-
not config.isSource(n, state)
387-
or
388-
config.isBarrierOut(n, state) and
389-
not config.isSink(n, state)
390-
or
391355
exists(BarrierGuard g |
392356
config.isBarrierGuard(g, state) and
393357
n = g.getAGuardedNode()
@@ -420,8 +384,8 @@ private predicate sinkNode(NodeEx node, FlowState state, Configuration config) {
420384
/** Provides the relevant barriers for a step from `node1` to `node2`. */
421385
pragma[inline]
422386
private predicate stepFilter(NodeEx node1, NodeEx node2, Configuration config) {
423-
not fullOutBarrier(node1, config) and
424-
not fullInBarrier(node2, config) and
387+
not outBarrier(node1, config) and
388+
not inBarrier(node2, config) and
425389
not fullBarrier(node1, config) and
426390
not fullBarrier(node2, config)
427391
}
@@ -474,8 +438,6 @@ private predicate additionalLocalStateStep(
474438
config.isAdditionalFlowStep(n1, s1, n2, s2) and
475439
getNodeEnclosingCallable(n1) = getNodeEnclosingCallable(n2) and
476440
stepFilter(node1, node2, config) and
477-
not stateOutBarrier(node1, s1, config) and
478-
not stateInBarrier(node2, s2, config) and
479441
not stateBarrier(node1, s1, config) and
480442
not stateBarrier(node2, s2, config)
481443
)
@@ -517,8 +479,6 @@ private predicate additionalJumpStateStep(
517479
config.isAdditionalFlowStep(n1, s1, n2, s2) and
518480
getNodeEnclosingCallable(n1) != getNodeEnclosingCallable(n2) and
519481
stepFilter(node1, node2, config) and
520-
not stateOutBarrier(node1, s1, config) and
521-
not stateInBarrier(node2, s2, config) and
522482
not stateBarrier(node1, s1, config) and
523483
not stateBarrier(node2, s2, config) and
524484
not config.getAFeature() instanceof FeatureEqualSourceSinkCallContext
@@ -918,8 +878,8 @@ private module Stage1 {
918878
private predicate throughFlowNodeCand(NodeEx node, Configuration config) {
919879
revFlow(node, true, config) and
920880
fwdFlow(node, true, config) and
921-
not fullInBarrier(node, config) and
922-
not fullOutBarrier(node, config)
881+
not inBarrier(node, config) and
882+
not outBarrier(node, config)
923883
}
924884

925885
/** Holds if flow may return from `callable`. */
@@ -1014,8 +974,8 @@ private predicate flowOutOfCallNodeCand1(
1014974
) {
1015975
viableReturnPosOutNodeCand1(call, ret.getReturnPosition(), out, config) and
1016976
Stage1::revFlow(ret, config) and
1017-
not fullOutBarrier(ret, config) and
1018-
not fullInBarrier(out, config)
977+
not outBarrier(ret, config) and
978+
not inBarrier(out, config)
1019979
}
1020980

1021981
pragma[nomagic]
@@ -1036,8 +996,8 @@ private predicate flowIntoCallNodeCand1(
1036996
) {
1037997
viableParamArgNodeCand1(call, p, arg, config) and
1038998
Stage1::revFlow(p, config) and
1039-
not fullOutBarrier(arg, config) and
1040-
not fullInBarrier(p, config)
999+
not outBarrier(arg, config) and
1000+
not inBarrier(p, config)
10411001
}
10421002

10431003
/**

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll

Lines changed: 10 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -87,21 +87,9 @@ abstract class Configuration extends string {
8787
/** Holds if data flow into `node` is prohibited. */
8888
predicate isBarrierIn(Node node) { none() }
8989

90-
/**
91-
* Holds if data flow into `node` is prohibited when the flow state is
92-
* `state`
93-
*/
94-
predicate isBarrierIn(Node node, FlowState state) { none() }
95-
9690
/** Holds if data flow out of `node` is prohibited. */
9791
predicate isBarrierOut(Node node) { none() }
9892

99-
/**
100-
* Holds if data flow out of `node` is prohibited when the flow state is
101-
* `state`
102-
*/
103-
predicate isBarrierOut(Node node, FlowState state) { none() }
104-
10593
/** Holds if data flow through nodes guarded by `guard` is prohibited. */
10694
predicate isBarrierGuard(BarrierGuard guard) { none() }
10795

@@ -321,7 +309,7 @@ private class RetNodeEx extends NodeEx {
321309
ReturnKindExt getKind() { result = this.asNode().(ReturnNodeExt).getKind() }
322310
}
323311

324-
private predicate fullInBarrier(NodeEx node, Configuration config) {
312+
private predicate inBarrier(NodeEx node, Configuration config) {
325313
exists(Node n |
326314
node.asNode() = n and
327315
config.isBarrierIn(n)
@@ -330,16 +318,7 @@ private predicate fullInBarrier(NodeEx node, Configuration config) {
330318
)
331319
}
332320

333-
private predicate stateInBarrier(NodeEx node, FlowState state, Configuration config) {
334-
exists(Node n |
335-
node.asNode() = n and
336-
config.isBarrierIn(n, state)
337-
|
338-
config.isSource(n, state)
339-
)
340-
}
341-
342-
private predicate fullOutBarrier(NodeEx node, Configuration config) {
321+
private predicate outBarrier(NodeEx node, Configuration config) {
343322
exists(Node n |
344323
node.asNode() = n and
345324
config.isBarrierOut(n)
@@ -348,15 +327,6 @@ private predicate fullOutBarrier(NodeEx node, Configuration config) {
348327
)
349328
}
350329

351-
private predicate stateOutBarrier(NodeEx node, FlowState state, Configuration config) {
352-
exists(Node n |
353-
node.asNode() = n and
354-
config.isBarrierOut(n, state)
355-
|
356-
config.isSink(n, state)
357-
)
358-
}
359-
360330
pragma[nomagic]
361331
private predicate fullBarrier(NodeEx node, Configuration config) {
362332
exists(Node n | node.asNode() = n |
@@ -382,12 +352,6 @@ private predicate stateBarrier(NodeEx node, FlowState state, Configuration confi
382352
exists(Node n | node.asNode() = n |
383353
config.isBarrier(n, state)
384354
or
385-
config.isBarrierIn(n, state) and
386-
not config.isSource(n, state)
387-
or
388-
config.isBarrierOut(n, state) and
389-
not config.isSink(n, state)
390-
or
391355
exists(BarrierGuard g |
392356
config.isBarrierGuard(g, state) and
393357
n = g.getAGuardedNode()
@@ -420,8 +384,8 @@ private predicate sinkNode(NodeEx node, FlowState state, Configuration config) {
420384
/** Provides the relevant barriers for a step from `node1` to `node2`. */
421385
pragma[inline]
422386
private predicate stepFilter(NodeEx node1, NodeEx node2, Configuration config) {
423-
not fullOutBarrier(node1, config) and
424-
not fullInBarrier(node2, config) and
387+
not outBarrier(node1, config) and
388+
not inBarrier(node2, config) and
425389
not fullBarrier(node1, config) and
426390
not fullBarrier(node2, config)
427391
}
@@ -474,8 +438,6 @@ private predicate additionalLocalStateStep(
474438
config.isAdditionalFlowStep(n1, s1, n2, s2) and
475439
getNodeEnclosingCallable(n1) = getNodeEnclosingCallable(n2) and
476440
stepFilter(node1, node2, config) and
477-
not stateOutBarrier(node1, s1, config) and
478-
not stateInBarrier(node2, s2, config) and
479441
not stateBarrier(node1, s1, config) and
480442
not stateBarrier(node2, s2, config)
481443
)
@@ -517,8 +479,6 @@ private predicate additionalJumpStateStep(
517479
config.isAdditionalFlowStep(n1, s1, n2, s2) and
518480
getNodeEnclosingCallable(n1) != getNodeEnclosingCallable(n2) and
519481
stepFilter(node1, node2, config) and
520-
not stateOutBarrier(node1, s1, config) and
521-
not stateInBarrier(node2, s2, config) and
522482
not stateBarrier(node1, s1, config) and
523483
not stateBarrier(node2, s2, config) and
524484
not config.getAFeature() instanceof FeatureEqualSourceSinkCallContext
@@ -918,8 +878,8 @@ private module Stage1 {
918878
private predicate throughFlowNodeCand(NodeEx node, Configuration config) {
919879
revFlow(node, true, config) and
920880
fwdFlow(node, true, config) and
921-
not fullInBarrier(node, config) and
922-
not fullOutBarrier(node, config)
881+
not inBarrier(node, config) and
882+
not outBarrier(node, config)
923883
}
924884

925885
/** Holds if flow may return from `callable`. */
@@ -1014,8 +974,8 @@ private predicate flowOutOfCallNodeCand1(
1014974
) {
1015975
viableReturnPosOutNodeCand1(call, ret.getReturnPosition(), out, config) and
1016976
Stage1::revFlow(ret, config) and
1017-
not fullOutBarrier(ret, config) and
1018-
not fullInBarrier(out, config)
977+
not outBarrier(ret, config) and
978+
not inBarrier(out, config)
1019979
}
1020980

1021981
pragma[nomagic]
@@ -1036,8 +996,8 @@ private predicate flowIntoCallNodeCand1(
1036996
) {
1037997
viableParamArgNodeCand1(call, p, arg, config) and
1038998
Stage1::revFlow(p, config) and
1039-
not fullOutBarrier(arg, config) and
1040-
not fullInBarrier(p, config)
999+
not outBarrier(arg, config) and
1000+
not inBarrier(p, config)
10411001
}
10421002

10431003
/**

0 commit comments

Comments
 (0)