@@ -205,17 +205,53 @@ private predicate deconstructSizeExpr(Expr sizeExpr, Expr lengthExpr, int sizeof
205
205
sizeof = 1
206
206
}
207
207
208
+ /** A `Function` that is a call target of an allocation. */
208
209
private signature class CallAllocationExprTarget extends Function ;
209
210
211
+ /**
212
+ * This module abstracts over the type of allocation call-targets and provides a
213
+ * class `CallAllocationExprImpl` which contains the implementation of the various
214
+ * predicates required by the `Allocation` class.
215
+ *
216
+ * This module is then instantiated for two types of allocation call-targets:
217
+ * - `AllocationFunction`: Functions that we've explicitly modeled as functions that
218
+ * perform allocations (i.e., `malloc`).
219
+ * - `HeuristicAllocationFunction`: Functions that we deduce as behaving like an allocation
220
+ * function using various heuristics.
221
+ */
210
222
private module CallAllocationExprBase< CallAllocationExprTarget Target> {
223
+ /**
224
+ * A signature for a predicate that gets the index of the input pointer argument to
225
+ * be reallocated, if this is a `realloc` function.
226
+ */
211
227
signature int getReallocPtrArgSig ( Target target ) ;
212
228
229
+ /**
230
+ * A signature for a predicate that gets the index of the argument for the allocation
231
+ * size, if any. The actual allocation size is the value of this argument multiplied
232
+ * by the result of `getSizeMult()`, in bytes.
233
+ */
213
234
signature int getSizeArgSig ( Target target ) ;
214
235
236
+ /**
237
+ * A signature for a predicate that gets the index of an argument that multiplies the
238
+ * allocation size given by `getSizeArg`, if any.
239
+ */
215
240
signature int getSizeMultSig ( Target target ) ;
216
241
242
+ /**
243
+ * A signature for a predicate that determines whether or not this allocation requires a
244
+ * corresponding deallocation of some sort (most do, but `alloca` for example does not).
245
+ * If it is unclear, we default to no (for example a placement `new` allocation may or
246
+ * may not require a corresponding `delete`).
247
+ */
217
248
signature predicate requiresDeallocSig ( Target target ) ;
218
249
250
+ /**
251
+ * A module that abstracts over the various predicates in a that should really be
252
+ * member-predicates of `CallAllocationExprTarget` (which which we cannot yet write in
253
+ * QL).
254
+ */
219
255
module With<
220
256
getReallocPtrArgSig / 1 getReallocPtrArg, getSizeArgSig / 1 getSizeArg, getSizeMultSig / 1 getSizeMult,
221
257
requiresDeallocSig / 1 requiresDealloc> {
@@ -285,6 +321,10 @@ private module CallAllocationExpr {
285
321
286
322
private predicate requiresDealloc ( AllocationFunction f ) { f .requiresDealloc ( ) }
287
323
324
+ /**
325
+ * A class that provides the implementation of `AllocationExpr` for an allocation
326
+ * that calls an `AllocationFunction`.
327
+ */
288
328
private class Base =
289
329
CallAllocationExprBase< AllocationFunction > :: With< getReallocPtrArg / 1 , getSizeArg / 1 , getSizeMult / 1 , requiresDealloc / 1 > :: CallAllocationExprImpl ;
290
330
@@ -343,6 +383,7 @@ private class NewArrayAllocationExpr extends AllocationExpr, NewArrayExpr {
343
383
}
344
384
345
385
private module HeuristicAllocation {
386
+ /** A class that maps an `AllocationExpr` to an `HeuristicAllocationExpr`. */
346
387
private class HeuristicAllocationModeled extends HeuristicAllocationExpr instanceof AllocationExpr {
347
388
override Expr getSizeExpr ( ) { result = AllocationExpr .super .getSizeExpr ( ) }
348
389
@@ -359,6 +400,7 @@ private module HeuristicAllocation {
359
400
override predicate requiresDealloc ( ) { AllocationExpr .super .requiresDealloc ( ) }
360
401
}
361
402
403
+ /** A class that maps an `AllocationFunction` to an `HeuristicAllocationFunction`. */
362
404
private class HeuristicAllocationFunctionModeled extends HeuristicAllocationFunction instanceof AllocationFunction {
363
405
override int getSizeArg ( ) { result = AllocationFunction .super .getSizeArg ( ) }
364
406
@@ -377,6 +419,12 @@ private module HeuristicAllocation {
377
419
f .getParameter ( result ) .getUnspecifiedType ( ) instanceof PointerType
378
420
}
379
421
422
+ /**
423
+ * A class that uses heuristics to find additional allocation functions. The required are as follows:
424
+ * 1. The word `alloc` must appear in the function name
425
+ * 2. The function must return a pointer type
426
+ * 3. There must be a unique parameter of unsigned integral type.
427
+ */
380
428
private class HeuristicAllocationFunctionByName extends HeuristicAllocationFunction instanceof Function {
381
429
int sizeArg ;
382
430
@@ -404,6 +452,10 @@ private module HeuristicAllocation {
404
452
405
453
private predicate requiresDealloc ( HeuristicAllocationFunction f ) { f .requiresDealloc ( ) }
406
454
455
+ /**
456
+ * A class that provides the implementation of `AllocationExpr` for an allocation
457
+ * that calls an `HeuristicAllocationFunction`.
458
+ */
407
459
private class Base =
408
460
CallAllocationExprBase< HeuristicAllocationFunction > :: With< getReallocPtrArg / 1 , getSizeArg / 1 , getSizeMult / 1 , requiresDealloc / 1 > :: CallAllocationExprImpl ;
409
461
0 commit comments