Skip to content

Commit 8900f6c

Browse files
committed
C++: Add comment about ir re-evaluation.
1 parent 033edc2 commit 8900f6c

File tree

1 file changed

+21
-19
lines changed

1 file changed

+21
-19
lines changed

cpp/ql/src/Likely Bugs/Memory Management/UsingExpiredStackAddress.ql

Lines changed: 21 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,9 @@
1313
*/
1414

1515
import cpp
16-
import semmle.code.cpp.ir.ValueNumbering
16+
// We don't actually use the global value numbering library in this query, but without it we end up
17+
// recomputing the IR.
18+
import semmle.code.cpp.valuenumbering.GlobalValueNumbering
1719
import semmle.code.cpp.ir.IR
1820

1921
predicate instructionHasVariable(VariableAddressInstruction vai, StackVariable var, Function f) {
@@ -56,31 +58,31 @@ newtype TGlobalAddress =
5658
not v.getUnspecifiedType() instanceof PointerToMemberType
5759
} or
5860
TLoad(TGlobalAddress address) {
59-
address = globalValueNumber(any(LoadInstruction load).getSourceAddress())
61+
address = globalAddress(any(LoadInstruction load).getSourceAddress())
6062
} or
6163
TConversion(string kind, TGlobalAddress address, Type fromType, Type toType) {
6264
kind = "unchecked" and
6365
exists(ConvertInstruction convert |
6466
uncheckedConversionTypes(convert, fromType, toType) and
65-
address = globalValueNumber(convert.getUnary())
67+
address = globalAddress(convert.getUnary())
6668
)
6769
or
6870
kind = "checked" and
6971
exists(CheckedConvertOrNullInstruction convert |
7072
checkedConversionTypes(convert, fromType, toType) and
71-
address = globalValueNumber(convert.getUnary())
73+
address = globalAddress(convert.getUnary())
7274
)
7375
or
7476
kind = "inheritance" and
7577
exists(InheritanceConversionInstruction convert |
7678
inheritanceConversionTypes(convert, fromType, toType) and
77-
address = globalValueNumber(convert.getUnary())
79+
address = globalAddress(convert.getUnary())
7880
)
7981
} or
8082
TFieldAddress(TGlobalAddress address, Field f) {
8183
exists(FieldAddressInstruction fai |
8284
fai.getField() = f and
83-
address = globalValueNumber(fai.getObjectAddress())
85+
address = globalAddress(fai.getObjectAddress())
8486
)
8587
}
8688

@@ -105,36 +107,36 @@ predicate inheritanceConversionTypes(
105107
}
106108

107109
/** Gets the HashCons value of an address computed by `instr`, if any. */
108-
TGlobalAddress globalValueNumber(Instruction instr) {
110+
TGlobalAddress globalAddress(Instruction instr) {
109111
result = TGlobalVariable(instr.(VariableAddressInstruction).getASTVariable())
110112
or
111113
not instr instanceof LoadInstruction and
112-
result = globalValueNumber(instr.(CopyInstruction).getSourceValue())
114+
result = globalAddress(instr.(CopyInstruction).getSourceValue())
113115
or
114116
exists(LoadInstruction load | instr = load |
115-
result = TLoad(globalValueNumber(load.getSourceAddress()))
117+
result = TLoad(globalAddress(load.getSourceAddress()))
116118
)
117119
or
118120
exists(ConvertInstruction convert, Type fromType, Type toType | instr = convert |
119121
uncheckedConversionTypes(convert, fromType, toType) and
120-
result = TConversion("unchecked", globalValueNumber(convert.getUnary()), fromType, toType)
122+
result = TConversion("unchecked", globalAddress(convert.getUnary()), fromType, toType)
121123
)
122124
or
123125
exists(CheckedConvertOrNullInstruction convert, Type fromType, Type toType | instr = convert |
124126
checkedConversionTypes(convert, fromType, toType) and
125-
result = TConversion("checked", globalValueNumber(convert.getUnary()), fromType, toType)
127+
result = TConversion("checked", globalAddress(convert.getUnary()), fromType, toType)
126128
)
127129
or
128130
exists(InheritanceConversionInstruction convert, Type fromType, Type toType | instr = convert |
129131
inheritanceConversionTypes(convert, fromType, toType) and
130-
result = TConversion("inheritance", globalValueNumber(convert.getUnary()), fromType, toType)
132+
result = TConversion("inheritance", globalAddress(convert.getUnary()), fromType, toType)
131133
)
132134
or
133135
exists(FieldAddressInstruction fai | instr = fai |
134-
result = TFieldAddress(globalValueNumber(fai.getObjectAddress()), fai.getField())
136+
result = TFieldAddress(globalAddress(fai.getObjectAddress()), fai.getField())
135137
)
136138
or
137-
result = globalValueNumber(instr.(PointerOffsetInstruction).getLeft())
139+
result = globalAddress(instr.(PointerOffsetInstruction).getLeft())
138140
}
139141

140142
/** Gets a `StoreInstruction` that may be executed after executing `store`. */
@@ -160,27 +162,27 @@ StoreInstruction getAStoreStrictlyAfter(StoreInstruction store) {
160162
predicate stackAddressEscapes(
161163
StoreInstruction store, StackVariable var, TGlobalAddress globalAddress, Function f
162164
) {
163-
globalAddress = globalValueNumber(store.getDestinationAddress()) and
165+
globalAddress = globalAddress(store.getDestinationAddress()) and
164166
exists(VariableAddressInstruction vai |
165167
instructionHasVariable(pragma[only_bind_into](vai), var, f) and
166168
stackPointerFlowsToUse(store.getSourceValue(), vai)
167169
) and
168170
// Ensure there's no subsequent store that overrides the global address.
169-
not globalAddress = globalValueNumber(getAStoreStrictlyAfter(store).getDestinationAddress())
171+
not globalAddress = globalAddress(getAStoreStrictlyAfter(store).getDestinationAddress())
170172
}
171173

172174
predicate blockStoresToAddress(
173175
IRBlock block, int index, StoreInstruction store, TGlobalAddress globalAddress
174176
) {
175177
block.getInstruction(index) = store and
176-
globalAddress = globalValueNumber(store.getDestinationAddress())
178+
globalAddress = globalAddress(store.getDestinationAddress())
177179
}
178180

179181
predicate blockLoadsFromAddress(
180182
IRBlock block, int index, LoadInstruction load, TGlobalAddress globalAddress
181183
) {
182184
block.getInstruction(index) = load and
183-
globalAddress = globalValueNumber(load.getSourceAddress())
185+
globalAddress = globalAddress(load.getSourceAddress())
184186
}
185187

186188
predicate globalAddressPointsToStack(
@@ -215,7 +217,7 @@ from
215217
where
216218
globalAddressPointsToStack(store, var, call, block, address, isCallBlock, isStoreBlock) and
217219
block.getAnInstruction() = load and
218-
globalValueNumber(load.getSourceAddress()) = address and
220+
globalAddress(load.getSourceAddress()) = address and
219221
(
220222
// We know that we have a sequence:
221223
// (1) store to `address` -> (2) return from `f` -> (3) load from `address`.

0 commit comments

Comments
 (0)