Skip to content

Commit db0d203

Browse files
committed
Merge branch 'main' into solve-modify-copy-problem
2 parents 911f154 + 71d09b7 commit db0d203

File tree

355 files changed

+27943
-2288
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

355 files changed

+27943
-2288
lines changed

cpp/downgrades/0a9eb01d3650642e013eb86be45d952289537f91/old.dbscheme

Lines changed: 2233 additions & 0 deletions
Large diffs are not rendered by default.

cpp/downgrades/0a9eb01d3650642e013eb86be45d952289537f91/semmlecode.cpp.dbscheme

Lines changed: 2231 additions & 0 deletions
Large diffs are not rendered by default.
Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
description: Expose whether a function was prototyped or not
2+
compatibility: backwards
3+
function_prototyped.rel: delete
Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: feature
3+
---
4+
* Added an `isPrototyped` predicate to `Function` that holds when the function has a prototype.

cpp/ql/lib/semmle/code/cpp/Function.qll

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,16 @@ class Function extends Declaration, ControlFlowNode, AccessHolder, @function {
112112
*/
113113
predicate isDeleted() { function_deleted(underlyingElement(this)) }
114114

115+
/**
116+
* Holds if this function has a prototyped interface.
117+
*
118+
* Functions generally have a prototyped interface, unless they are
119+
* K&R-style functions either without any forward function declaration,
120+
* or with all the forward declarations omitting the parameters of the
121+
* function.
122+
*/
123+
predicate isPrototyped() { function_prototyped(underlyingElement(this)) }
124+
115125
/**
116126
* Holds if this function is explicitly defaulted with the `= default`
117127
* specifier.

cpp/ql/lib/semmle/code/cpp/ir/implementation/internal/TOperand.qll

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,9 +23,8 @@ private module Internal {
2323
newtype TOperand =
2424
// RAW
2525
TRegisterOperand(TRawInstruction useInstr, RegisterOperandTag tag, TRawInstruction defInstr) {
26-
defInstr = RawConstruction::getRegisterOperandDefinition(useInstr, tag) and
27-
not RawConstruction::isInCycle(useInstr) and
28-
strictcount(RawConstruction::getRegisterOperandDefinition(useInstr, tag)) = 1
26+
defInstr = unique( | | RawConstruction::getRegisterOperandDefinition(useInstr, tag)) and
27+
not RawConstruction::isInCycle(useInstr)
2928
} or
3029
// Placeholder for Phi and Chi operands in stages that don't have the corresponding instructions
3130
TNoOperand() { none() } or

cpp/ql/lib/semmle/code/cpp/models/implementations/StdContainer.qll

Lines changed: 68 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -123,14 +123,25 @@ private class StdSequenceContainerData extends TaintFunction {
123123
/**
124124
* The standard container functions `push_back` and `push_front`.
125125
*/
126-
private class StdSequenceContainerPush extends TaintFunction {
126+
class StdSequenceContainerPush extends MemberFunction {
127127
StdSequenceContainerPush() {
128128
this.getClassAndName("push_back") instanceof Vector or
129129
this.getClassAndName(["push_back", "push_front"]) instanceof Deque or
130130
this.getClassAndName("push_front") instanceof ForwardList or
131131
this.getClassAndName(["push_back", "push_front"]) instanceof List
132132
}
133133

134+
/**
135+
* Gets the index of a parameter to this function that is a reference to the
136+
* value type of the container.
137+
*/
138+
int getAValueTypeParameterIndex() {
139+
this.getParameter(result).getUnspecifiedType().(ReferenceType).getBaseType() =
140+
this.getDeclaringType().getTemplateArgument(0).(Type).getUnspecifiedType() // i.e. the `T` of this `std::vector<T>`
141+
}
142+
}
143+
144+
private class StdSequenceContainerPushModel extends StdSequenceContainerPush, TaintFunction {
134145
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
135146
// flow from parameter to qualifier
136147
input.isParameterDeref(0) and
@@ -160,7 +171,7 @@ private class StdSequenceContainerFrontBack extends TaintFunction {
160171
/**
161172
* The standard container functions `insert` and `insert_after`.
162173
*/
163-
private class StdSequenceContainerInsert extends TaintFunction {
174+
class StdSequenceContainerInsert extends MemberFunction {
164175
StdSequenceContainerInsert() {
165176
this.getClassAndName("insert") instanceof Deque or
166177
this.getClassAndName("insert") instanceof List or
@@ -181,7 +192,9 @@ private class StdSequenceContainerInsert extends TaintFunction {
181192
* Gets the index of a parameter to this function that is an iterator.
182193
*/
183194
int getAnIteratorParameterIndex() { this.getParameter(result).getType() instanceof Iterator }
195+
}
184196

197+
private class StdSequenceContainerInsertModel extends StdSequenceContainerInsert, TaintFunction {
185198
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
186199
// flow from parameter to container itself (qualifier) and return value
187200
(
@@ -253,11 +266,28 @@ private class StdSequenceContainerAt extends TaintFunction {
253266
}
254267

255268
/**
256-
* The standard vector `emplace` function.
269+
* The standard `emplace` function.
257270
*/
258-
class StdVectorEmplace extends TaintFunction {
259-
StdVectorEmplace() { this.getClassAndName("emplace") instanceof Vector }
271+
class StdSequenceEmplace extends MemberFunction {
272+
StdSequenceEmplace() {
273+
this.getClassAndName("emplace") instanceof Vector
274+
or
275+
this.getClassAndName("emplace") instanceof List
276+
or
277+
this.getClassAndName("emplace") instanceof Deque
278+
}
279+
280+
/**
281+
* Gets the index of a parameter to this function that is a reference to the
282+
* value type of the container.
283+
*/
284+
int getAValueTypeParameterIndex() {
285+
this.getParameter(result).getUnspecifiedType().(ReferenceType).getBaseType() =
286+
this.getDeclaringType().getTemplateArgument(0).(Type).getUnspecifiedType() // i.e. the `T` of this `std::vector<T>`
287+
}
288+
}
260289

290+
private class StdSequenceEmplaceModel extends StdSequenceEmplace, TaintFunction {
261291
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
262292
// flow from any parameter except the position iterator to qualifier and return value
263293
// (here we assume taint flow from any constructor parameter to the constructed object)
@@ -269,16 +299,47 @@ class StdVectorEmplace extends TaintFunction {
269299
}
270300
}
271301

302+
/**
303+
* The standard vector `emplace` function.
304+
*/
305+
class StdVectorEmplace extends StdSequenceEmplace {
306+
StdVectorEmplace() { this.getDeclaringType() instanceof Vector }
307+
}
308+
272309
/**
273310
* The standard vector `emplace_back` function.
274311
*/
275-
class StdVectorEmplaceBack extends TaintFunction {
276-
StdVectorEmplaceBack() { this.getClassAndName("emplace_back") instanceof Vector }
312+
class StdSequenceEmplaceBack extends MemberFunction {
313+
StdSequenceEmplaceBack() {
314+
this.getClassAndName("emplace_back") instanceof Vector
315+
or
316+
this.getClassAndName("emplace_back") instanceof List
317+
or
318+
this.getClassAndName("emplace_back") instanceof Deque
319+
}
320+
321+
/**
322+
* Gets the index of a parameter to this function that is a reference to the
323+
* value type of the container.
324+
*/
325+
int getAValueTypeParameterIndex() {
326+
this.getParameter(result).getUnspecifiedType().(ReferenceType).getBaseType() =
327+
this.getDeclaringType().getTemplateArgument(0).(Type).getUnspecifiedType() // i.e. the `T` of this `std::vector<T>`
328+
}
329+
}
277330

331+
private class StdSequenceEmplaceBackModel extends StdSequenceEmplaceBack, TaintFunction {
278332
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
279333
// flow from any parameter to qualifier
280334
// (here we assume taint flow from any constructor parameter to the constructed object)
281335
input.isParameterDeref([0 .. this.getNumberOfParameters() - 1]) and
282336
output.isQualifierObject()
283337
}
284338
}
339+
340+
/**
341+
* The standard vector `emplace_back` function.
342+
*/
343+
class StdVectorEmplaceBack extends StdSequenceEmplaceBack {
344+
StdVectorEmplaceBack() { this.getDeclaringType() instanceof Vector }
345+
}

cpp/ql/lib/semmle/code/cpp/models/implementations/StdString.qll

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -99,9 +99,11 @@ private class StdStringConstructor extends Constructor, StdStringTaintFunction {
9999
/**
100100
* The `std::string` function `c_str`.
101101
*/
102-
private class StdStringCStr extends StdStringTaintFunction {
102+
class StdStringCStr extends MemberFunction {
103103
StdStringCStr() { this.getClassAndName("c_str") instanceof StdBasicString }
104+
}
104105

106+
private class StdStringCStrModel extends StdStringCStr, StdStringTaintFunction {
105107
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
106108
// flow from string itself (qualifier) to return value
107109
input.isQualifierObject() and
@@ -112,9 +114,11 @@ private class StdStringCStr extends StdStringTaintFunction {
112114
/**
113115
* The `std::string` function `data`.
114116
*/
115-
private class StdStringData extends StdStringTaintFunction {
117+
class StdStringData extends MemberFunction {
116118
StdStringData() { this.getClassAndName("data") instanceof StdBasicString }
119+
}
117120

121+
private class StdStringDataModel extends StdStringData, StdStringTaintFunction {
118122
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
119123
// flow from string itself (qualifier) to return value
120124
input.isQualifierObject() and

cpp/ql/lib/semmlecode.cpp.dbscheme

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -405,6 +405,8 @@ function_deleted(unique int id: @function ref);
405405

406406
function_defaulted(unique int id: @function ref);
407407

408+
function_prototyped(unique int id: @function ref)
409+
408410
member_function_this_type(
409411
unique int id: @function ref,
410412
int this_type: @type ref

0 commit comments

Comments
 (0)