C++: Use-use flow in experimental
#10366
Conversation
as tainted (instead of the pointee), or vice versa. Because of existing dataflow pointer/pointee conflation we never noticed that, but since this PR removes those imprecisions we now need to update these models.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
Found 21 potential problems in the proposed changes. Check the Files changed tab for more details.
MathiasVP
force-pushed
the
use-use-flow-in-experimental
branch
from
1d8d042 to
6dcfe03
Compare
There was a problem hiding this comment.
Found 22 potential problems in the proposed changes. Check the Files changed tab for more details.
There was a problem hiding this comment.
Found 22 potential problems in the proposed changes. Check the Files changed tab for more details.
cpp/ql/lib/semmle/code/cpp/models/implementations/StdString.qll
Outdated
Show resolved
Hide resolved
cpp/ql/lib/semmle/code/cpp/models/interfaces/FunctionInputsAndOutputs.qll
Show resolved
Hide resolved
There was a problem hiding this comment.
Found 22 potential problems in the proposed changes. Check the Files changed tab for more details.
There was a problem hiding this comment.
I'm happy with the changes to models / everything outside of experimental now. I haven't reviewed the changes within experimental in any detail, but I understand it to be a modified version of the dataflow library that's been reviewed elsewhere, and will be under examination in experimental. I can't see anything scary in the DCA run.
👍
Thanks a lot! Yeah, all of the code in experimental has already been thoroughly reviewed in the initial PR. So this should be pretty safe |
Due to the performance regressions on #10190 we've decided to put the new use-use dataflow code in the experimental directory so that we can use it while we're working on experimental buffer-overflow queries.
The first commit just copies over all the already-reviewed code from #10190 (along with a couple of copies of the dataflow library). So it doesn't really require any deep reviewing (since it's already received a lot of awesome 👀s!).
The last two commits are required changes to non-experimental code that should hopefully be semantically equivalent from the point of view of the existing non-experimental dataflow library.