Skip to content

Commit 7a7e033

Browse files
MathiasVPMathiasVP
authored
Merge pull request #15601 from MathiasVP/revert-new-barrier-interface
C++: Revert #15528
2 parents ac001c3 + fb4bd53 commit 7a7e033

File tree

10 files changed

+22
-84
lines changed

10 files changed

+22
-84
lines changed

‎cpp/ql/lib/change-notes/2024-02-06-flow-out-barrier-function.md

Lines changed: 0 additions & 4 deletions
This file was deleted.

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll

Lines changed: 1 addition & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,8 @@ private import codeql.ssa.Ssa as SsaImplCommon
22
private import semmle.code.cpp.ir.IR
33
private import DataFlowUtil
44
private import DataFlowImplCommon as DataFlowImplCommon
5-
private import semmle.code.cpp.ir.dataflow.internal.ModelUtil
65
private import semmle.code.cpp.models.interfaces.Allocation as Alloc
76
private import semmle.code.cpp.models.interfaces.DataFlow as DataFlow
8-
private import semmle.code.cpp.models.interfaces.FlowOutBarrier as FOB
9-
private import semmle.code.cpp.models.interfaces.FunctionInputsAndOutputs as FIO
107
private import semmle.code.cpp.ir.internal.IRCppLanguage
118
private import DataFlowPrivate
129
private import ssa0.SsaInternals as SsaInternals0
@@ -797,30 +794,10 @@ private Node getAPriorDefinition(SsaDefOrUse defOrUse) {
797794
)
798795
}
799796

800-
/**
801-
* Holds if there should not be use-use flow out of `n` (or a conversion that
802-
* flows to `n`).
803-
*/
804-
private predicate modeledFlowBarrier(Node n) {
805-
exists(FIO::FunctionInput input, CallInstruction call |
806-
call.getStaticCallTarget().(FOB::FlowOutBarrierFunction).isFlowOutBarrier(input) and
807-
n = callInput(call, input)
808-
)
809-
or
810-
exists(Operand operand, Instruction instr, Node n0, int indirectionIndex |
811-
modeledFlowBarrier(n0) and
812-
nodeHasInstruction(n0, instr, indirectionIndex) and
813-
conversionFlow(operand, instr, false, _) and
814-
nodeHasOperand(n, operand, indirectionIndex)
815-
)
816-
}
817-
818797
/** Holds if there is def-use or use-use flow from `nodeFrom` to `nodeTo`. */
819798
predicate ssaFlow(Node nodeFrom, Node nodeTo) {
820799
exists(Node nFrom, boolean uncertain, SsaDefOrUse defOrUse |
821-
ssaFlowImpl(defOrUse, nFrom, nodeTo, uncertain) and
822-
not modeledFlowBarrier(nFrom) and
823-
nodeFrom != nodeTo
800+
ssaFlowImpl(defOrUse, nFrom, nodeTo, uncertain) and nodeFrom != nodeTo
824801
|
825802
if uncertain = true then nodeFrom = [nFrom, getAPriorDefinition(defOrUse)] else nodeFrom = nFrom
826803
)

‎cpp/ql/lib/semmle/code/cpp/models/implementations/Swap.qll

Lines changed: 2 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,14 @@
11
import semmle.code.cpp.models.interfaces.DataFlow
22
import semmle.code.cpp.models.interfaces.Taint
33
import semmle.code.cpp.models.interfaces.Alias
4-
import semmle.code.cpp.models.interfaces.FlowOutBarrier
54

65
/**
76
* The standard function `swap`. A use of `swap` looks like this:
87
* ```
98
* std::swap(obj1, obj2)
109
* ```
1110
*/
12-
private class Swap extends DataFlowFunction, FlowOutBarrierFunction {
11+
private class Swap extends DataFlowFunction {
1312
Swap() { this.hasQualifiedName(["std", "bsl"], "swap") }
1413

1514
override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
@@ -19,8 +18,6 @@ private class Swap extends DataFlowFunction, FlowOutBarrierFunction {
1918
input.isParameterDeref(1) and
2019
output.isParameterDeref(0)
2120
}
22-
23-
override predicate isFlowOutBarrier(FunctionInput input) { input.isParameterDeref([0, 1]) }
2421
}
2522

2623
/**
@@ -29,9 +26,7 @@ private class Swap extends DataFlowFunction, FlowOutBarrierFunction {
2926
* obj1.swap(obj2)
3027
* ```
3128
*/
32-
private class MemberSwap extends TaintFunction, MemberFunction, AliasFunction,
33-
FlowOutBarrierFunction
34-
{
29+
private class MemberSwap extends TaintFunction, MemberFunction, AliasFunction {
3530
MemberSwap() {
3631
this.hasName("swap") and
3732
this.getNumberOfParameters() = 1 and
@@ -52,8 +47,4 @@ private class MemberSwap extends TaintFunction, MemberFunction, AliasFunction,
5247
override predicate parameterEscapesOnlyViaReturn(int index) { index = 0 }
5348

5449
override predicate parameterIsAlwaysReturned(int index) { index = 0 }
55-
56-
override predicate isFlowOutBarrier(FunctionInput input) {
57-
input.isQualifierObject() or input.isParameterDeref(0)
58-
}
5950
}

‎cpp/ql/lib/semmle/code/cpp/models/interfaces/FlowOutBarrier.qll

Lines changed: 0 additions & 26 deletions
This file was deleted.

‎cpp/ql/test/library-tests/dataflow/taint-tests/map.cpp

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -71,11 +71,11 @@ void test_pair()
7171
sink(i.second); // $ MISSING: ast,ir
7272
sink(i); // $ ast,ir
7373
sink(j.first);
74-
sink(j.second); // $ SPURIOUS: ast
75-
sink(j); // $ SPURIOUS: ast
74+
sink(j.second); // $ SPURIOUS: ast,ir
75+
sink(j); // $ SPURIOUS: ast,ir
7676
sink(k.first);
77-
sink(k.second); // $ SPURIOUS: ast
78-
sink(k); // $ SPURIOUS: ast
77+
sink(k.second); // $ SPURIOUS: ast,ir
78+
sink(k); // $ SPURIOUS: ast,ir
7979
sink(l.first);
8080
sink(l.second); // $ MISSING: ast,ir
8181
sink(l); // $ ast,ir
@@ -196,10 +196,10 @@ void test_map()
196196
sink(m18); // $ ast,ir
197197
m15.swap(m16);
198198
m17.swap(m18);
199-
sink(m15); // $ SPURIOUS: ast
199+
sink(m15); // $ SPURIOUS: ast,ir
200200
sink(m16); // $ ast,ir
201201
sink(m17); // $ ast,ir
202-
sink(m18); // $ SPURIOUS: ast
202+
sink(m18); // $ SPURIOUS: ast,ir
203203

204204
// merge
205205
std::map<char *, char *> m19, m20, m21, m22;
@@ -345,10 +345,10 @@ void test_unordered_map()
345345
sink(m18); // $ ast,ir
346346
m15.swap(m16);
347347
m17.swap(m18);
348-
sink(m15); // $ SPURIOUS: ast
348+
sink(m15); // $ SPURIOUS: ast,ir
349349
sink(m16); // $ ast,ir
350350
sink(m17); // $ ast,ir
351-
sink(m18); // $ SPURIOUS: ast
351+
sink(m18); // $ SPURIOUS: ast,ir
352352

353353
// merge
354354
std::unordered_map<char *, char *> m19, m20, m21, m22;

‎cpp/ql/test/library-tests/dataflow/taint-tests/set.cpp

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -81,10 +81,10 @@ void test_set()
8181
sink(s15); // $ ast,ir
8282
s12.swap(s13);
8383
s14.swap(s15);
84-
sink(s12); // $ SPURIOUS: ast
84+
sink(s12); // $ SPURIOUS: ast,ir
8585
sink(s13); // $ ast,ir
8686
sink(s14); // $ ast,ir
87-
sink(s15); // $ SPURIOUS: ast
87+
sink(s15); // $ SPURIOUS: ast,ir
8888

8989
// merge
9090
std::set<char *> s16, s17, s18, s19;
@@ -193,10 +193,10 @@ void test_unordered_set()
193193
sink(s15); // $ ast,ir
194194
s12.swap(s13);
195195
s14.swap(s15);
196-
sink(s12); // $ SPURIOUS: ast
196+
sink(s12); // $ SPURIOUS: ast,ir
197197
sink(s13); // $ ast,ir
198198
sink(s14); // $ ast,ir
199-
sink(s15); // $ SPURIOUS: ast
199+
sink(s15); // $ SPURIOUS: ast,ir
200200

201201
// merge
202202
std::unordered_set<char *> s16, s17, s18, s19;

‎cpp/ql/test/library-tests/dataflow/taint-tests/string.cpp

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -280,9 +280,9 @@ void test_string_swap() {
280280
s4.swap(s3);
281281

282282
sink(s1); // $ ast,ir
283-
sink(s2); // $ SPURIOUS: ast
283+
sink(s2); // $ SPURIOUS: ast,ir
284284
sink(s3); // $ ast,ir
285-
sink(s4); // $ SPURIOUS: ast
285+
sink(s4); // $ SPURIOUS: ast,ir
286286
}
287287

288288
void test_string_clear() {

‎cpp/ql/test/library-tests/dataflow/taint-tests/stringstream.cpp

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -118,9 +118,9 @@ void test_stringstream_swap()
118118
ss4.swap(ss3);
119119

120120
sink(ss1); // $ ast,ir
121-
sink(ss2); // $ SPURIOUS: ast
121+
sink(ss2); // $ SPURIOUS: ast,ir
122122
sink(ss3); // $ ast,ir
123-
sink(ss4); // $ SPURIOUS: ast
123+
sink(ss4); // $ SPURIOUS: ast,ir
124124
}
125125

126126
void test_stringstream_in()

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -212,7 +212,7 @@ void test_swap() {
212212

213213
std::swap(x, y);
214214

215-
sink(x); // $ SPURIOUS: ast
215+
sink(x); // $ SPURIOUS: ast,ir
216216
sink(y); // $ ast,ir
217217
}
218218

‎cpp/ql/test/library-tests/dataflow/taint-tests/vector.cpp

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -114,10 +114,10 @@ void test_vector_swap() {
114114
v1.swap(v2);
115115
v3.swap(v4);
116116

117-
sink(v1); // $ SPURIOUS: ast
117+
sink(v1); // $ SPURIOUS: ast,ir
118118
sink(v2); // $ ast,ir
119119
sink(v3); // $ ast,ir
120-
sink(v4); // $ SPURIOUS: ast
120+
sink(v4); // $ SPURIOUS: ast,ir
121121
}
122122

123123
void test_vector_clear() {

0 commit comments

Comments
 (0)