Skip to content

Commit 6d5de66

Browse files
committed
C++: Add QLDoc to the parameterized module components in 'Allocation.qll'.
1 parent 2a514d6 commit 6d5de66

File tree

1 file changed

+52
-0
lines changed

1 file changed

+52
-0
lines changed

cpp/ql/lib/semmle/code/cpp/models/implementations/Allocation.qll

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -205,17 +205,53 @@ private predicate deconstructSizeExpr(Expr sizeExpr, Expr lengthExpr, int sizeof
205205
sizeof = 1
206206
}
207207

208+
/** A `Function` that is a call target of an allocation. */
208209
private signature class CallAllocationExprTarget extends Function;
209210

211+
/**
212+
* This module abstracts over the type of allocation call-targets and provides a
213+
* class `CallAllocationExprImpl` which contains the implementation of the various
214+
* predicates required by the `Allocation` class.
215+
*
216+
* This module is then instantiated for two types of allocation call-targets:
217+
* - `AllocationFunction`: Functions that we've explicitly modeled as functions that
218+
* perform allocations (i.e., `malloc`).
219+
* - `HeuristicAllocationFunction`: Functions that we deduce as behaving like an allocation
220+
* function using various heuristics.
221+
*/
210222
private module CallAllocationExprBase<CallAllocationExprTarget Target> {
223+
/**
224+
* A signature for a predicate that gets the index of the input pointer argument to
225+
* be reallocated, if this is a `realloc` function.
226+
*/
211227
signature int getReallocPtrArgSig(Target target);
212228

229+
/**
230+
* A signature for a predicate that gets the index of the argument for the allocation
231+
* size, if any. The actual allocation size is the value of this argument multiplied
232+
* by the result of `getSizeMult()`, in bytes.
233+
*/
213234
signature int getSizeArgSig(Target target);
214235

236+
/**
237+
* A signature for a predicate that gets the index of an argument that multiplies the
238+
* allocation size given by `getSizeArg`, if any.
239+
*/
215240
signature int getSizeMultSig(Target target);
216241

242+
/**
243+
* A signature for a predicate that determines whether or not this allocation requires a
244+
* corresponding deallocation of some sort (most do, but `alloca` for example does not).
245+
* If it is unclear, we default to no (for example a placement `new` allocation may or
246+
* may not require a corresponding `delete`).
247+
*/
217248
signature predicate requiresDeallocSig(Target target);
218249

250+
/**
251+
* A module that abstracts over the various predicates in a that should really be
252+
* member-predicates of `CallAllocationExprTarget` (which which we cannot yet write in
253+
* QL).
254+
*/
219255
module With<
220256
getReallocPtrArgSig/1 getReallocPtrArg, getSizeArgSig/1 getSizeArg, getSizeMultSig/1 getSizeMult,
221257
requiresDeallocSig/1 requiresDealloc> {
@@ -285,6 +321,10 @@ private module CallAllocationExpr {
285321

286322
private predicate requiresDealloc(AllocationFunction f) { f.requiresDealloc() }
287323

324+
/**
325+
* A class that provides the implementation of `AllocationExpr` for an allocation
326+
* that calls an `AllocationFunction`.
327+
*/
288328
private class Base =
289329
CallAllocationExprBase<AllocationFunction>::With<getReallocPtrArg/1, getSizeArg/1, getSizeMult/1, requiresDealloc/1>::CallAllocationExprImpl;
290330

@@ -343,6 +383,7 @@ private class NewArrayAllocationExpr extends AllocationExpr, NewArrayExpr {
343383
}
344384

345385
private module HeuristicAllocation {
386+
/** A class that maps an `AllocationExpr` to an `HeuristicAllocationExpr`. */
346387
private class HeuristicAllocationModeled extends HeuristicAllocationExpr instanceof AllocationExpr {
347388
override Expr getSizeExpr() { result = AllocationExpr.super.getSizeExpr() }
348389

@@ -359,6 +400,7 @@ private module HeuristicAllocation {
359400
override predicate requiresDealloc() { AllocationExpr.super.requiresDealloc() }
360401
}
361402

403+
/** A class that maps an `AllocationFunction` to an `HeuristicAllocationFunction`. */
362404
private class HeuristicAllocationFunctionModeled extends HeuristicAllocationFunction instanceof AllocationFunction {
363405
override int getSizeArg() { result = AllocationFunction.super.getSizeArg() }
364406

@@ -377,6 +419,12 @@ private module HeuristicAllocation {
377419
f.getParameter(result).getUnspecifiedType() instanceof PointerType
378420
}
379421

422+
/**
423+
* A class that uses heuristics to find additional allocation functions. The required are as follows:
424+
* 1. The word `alloc` must appear in the function name
425+
* 2. The function must return a pointer type
426+
* 3. There must be a unique parameter of unsigned integral type.
427+
*/
380428
private class HeuristicAllocationFunctionByName extends HeuristicAllocationFunction instanceof Function {
381429
int sizeArg;
382430

@@ -404,6 +452,10 @@ private module HeuristicAllocation {
404452

405453
private predicate requiresDealloc(HeuristicAllocationFunction f) { f.requiresDealloc() }
406454

455+
/**
456+
* A class that provides the implementation of `AllocationExpr` for an allocation
457+
* that calls an `HeuristicAllocationFunction`.
458+
*/
407459
private class Base =
408460
CallAllocationExprBase<HeuristicAllocationFunction>::With<getReallocPtrArg/1, getSizeArg/1, getSizeMult/1, requiresDealloc/1>::CallAllocationExprImpl;
409461

0 commit comments

Comments
 (0)