Skip to content

Commit ad56f17

Browse files
hvitvedhvitved
authored
Merge pull request #2 from aschackmull/dataflow/content-type-tracking
Dataflow: Record content types
2 parents cd9538d + 74eab3c commit ad56f17

File tree

24 files changed

+947
-841
lines changed

24 files changed

+947
-841
lines changed

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll‎

Lines changed: 30 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -289,7 +289,7 @@ private predicate nodeCandFwd1(Node node, boolean fromArg, Configuration config)
289289
exists(Node mid |
290290
useFieldFlow(config) and
291291
nodeCandFwd1(mid, fromArg, config) and
292-
store(mid, _, node) and
292+
store(mid, _, node, _) and
293293
not outBarrier(mid, config)
294294
)
295295
or
@@ -337,7 +337,7 @@ private predicate nodeCandFwd1IsStored(Content c, Configuration config) {
337337
not fullBarrier(node, config) and
338338
useFieldFlow(config) and
339339
nodeCandFwd1(mid, config) and
340-
store(mid, tc, node) and
340+
store(mid, tc, node, _) and
341341
c = tc.getContent()
342342
)
343343
}
@@ -469,7 +469,7 @@ private predicate nodeCand1Store(Content c, Node node, boolean toReturn, Configu
469469
exists(Node mid, TypedContent tc |
470470
nodeCand1(mid, toReturn, config) and
471471
nodeCandFwd1IsStored(c, unbind(config)) and
472-
store(node, tc, mid) and
472+
store(node, tc, mid, _) and
473473
c = tc.getContent()
474474
)
475475
}
@@ -571,11 +571,11 @@ private predicate parameterThroughFlowNodeCand1(ParameterNode p, Configuration c
571571
}
572572

573573
pragma[nomagic]
574-
private predicate store(Node n1, Content c, Node n2, Configuration config) {
574+
private predicate storeCand1(Node n1, Content c, Node n2, Configuration config) {
575575
exists(TypedContent tc |
576576
nodeCand1IsReadAndStored(c, config) and
577577
nodeCand1(n2, unbind(config)) and
578-
store(n1, tc, n2) and
578+
store(n1, tc, n2, _) and
579579
c = tc.getContent()
580580
)
581581
}
@@ -758,7 +758,7 @@ private predicate nodeCandFwd2(
758758
// store
759759
exists(Node mid |
760760
nodeCandFwd2(mid, fromArg, argStored, _, config) and
761-
store(mid, _, node, config) and
761+
storeCand1(mid, _, node, config) and
762762
stored = true
763763
)
764764
or
@@ -797,7 +797,7 @@ private predicate nodeCandFwd2IsStored(Content c, boolean stored, Configuration
797797
useFieldFlow(config) and
798798
nodeCand1(node, unbind(config)) and
799799
nodeCandFwd2(mid, _, _, stored, config) and
800-
store(mid, c, node, config)
800+
storeCand1(mid, c, node, config)
801801
)
802802
}
803803

@@ -957,7 +957,7 @@ private predicate nodeCand2Store(
957957
Configuration config
958958
) {
959959
exists(Node mid |
960-
store(node, c, mid, config) and
960+
storeCand1(node, c, mid, config) and
961961
nodeCand2(mid, toReturn, returnRead, true, config) and
962962
nodeCandFwd2(node, _, _, stored, unbind(config))
963963
)
@@ -1066,7 +1066,7 @@ private module LocalFlowBigStep {
10661066
additionalJumpStep(_, node, config) or
10671067
node instanceof ParameterNode or
10681068
node instanceof OutNodeExt or
1069-
store(_, _, node) or
1069+
store(_, _, node, _) or
10701070
read(_, _, node) or
10711071
node instanceof CastNode
10721072
)
@@ -1082,7 +1082,7 @@ private module LocalFlowBigStep {
10821082
additionalJumpStep(node, next, config) or
10831083
flowIntoCallNodeCand1(_, node, next, config) or
10841084
flowOutOfCallNodeCand1(_, node, next, config) or
1085-
store(node, _, next) or
1085+
store(node, _, next, _) or
10861086
read(node, _, next)
10871087
)
10881088
or
@@ -1170,8 +1170,10 @@ private predicate readCand2(Node node1, Content c, Node node2, Configuration con
11701170
}
11711171

11721172
pragma[nomagic]
1173-
private predicate storeCand2(Node node1, TypedContent tc, Node node2, Configuration config) {
1174-
store(node1, tc, node2) and
1173+
private predicate storeCand2(
1174+
Node node1, TypedContent tc, Node node2, DataFlowType contentType, Configuration config
1175+
) {
1176+
store(node1, tc, node2, contentType) and
11751177
nodeCand2(node1, config) and
11761178
nodeCand2(node2, _, _, true, unbind(config)) and
11771179
nodeCand2IsReadAndStored(tc.getContent(), unbind(config))
@@ -1235,11 +1237,12 @@ private predicate flowCandFwd0(
12351237
)
12361238
or
12371239
// store
1238-
exists(Node mid, TypedContent tc |
1239-
flowCandFwd(mid, fromArg, argApf, _, config) and
1240-
storeCand2(mid, tc, node, config) and
1240+
exists(Node mid, TypedContent tc, AccessPathFront apf0, DataFlowType contentType |
1241+
flowCandFwd(mid, fromArg, argApf, apf0, config) and
1242+
storeCand2(mid, tc, node, contentType, config) and
12411243
nodeCand2(node, _, _, true, unbind(config)) and
1242-
apf.headUsesContent(tc)
1244+
apf.headUsesContent(tc) and
1245+
compatibleTypes(apf0.getType(), contentType)
12431246
)
12441247
or
12451248
// read
@@ -1270,11 +1273,11 @@ private predicate flowCandFwd0(
12701273

12711274
pragma[nomagic]
12721275
private predicate flowCandFwdConsCand(TypedContent tc, AccessPathFront apf, Configuration config) {
1273-
exists(Node mid, Node n |
1276+
exists(Node mid, Node n, DataFlowType contentType |
12741277
flowCandFwd(mid, _, _, apf, config) and
1275-
storeCand2(mid, tc, n, config) and
1278+
storeCand2(mid, tc, n, contentType, config) and
12761279
nodeCand2(n, _, _, true, unbind(config)) and
1277-
compatibleTypes(apf.getType(), mid.getTypeBound())
1280+
compatibleTypes(apf.getType(), contentType)
12781281
)
12791282
}
12801283

@@ -1454,7 +1457,7 @@ private predicate flowCandStore(
14541457
) {
14551458
exists(Node mid |
14561459
flowCandFwd(node, _, _, apf, config) and
1457-
storeCand2(node, tc, mid, unbind(config)) and
1460+
storeCand2(node, tc, mid, _, unbind(config)) and
14581461
flowCand(mid, toReturn, returnApf, TFrontHead(tc), unbind(config))
14591462
)
14601463
}
@@ -1737,7 +1740,7 @@ private predicate storeCand(
17371740
Node mid, TypedContent tc, Node node, AccessPathFront apf0, AccessPathFront apf,
17381741
Configuration config
17391742
) {
1740-
storeCand2(mid, tc, node, config) and
1743+
storeCand2(mid, tc, node, _, config) and
17411744
flowCand(mid, _, _, apf0, config) and
17421745
apf.headUsesContent(tc)
17431746
}
@@ -1919,7 +1922,7 @@ pragma[nomagic]
19191922
private predicate storeFlowFwd(
19201923
Node node1, TypedContent tc, Node node2, AccessPath ap, AccessPath ap0, Configuration config
19211924
) {
1922-
storeCand2(node1, tc, node2, config) and
1925+
storeCand2(node1, tc, node2, _, config) and
19231926
flowFwdStore(node2, tc, ap, _, _, _, config) and
19241927
ap0 = push(tc, ap)
19251928
}
@@ -2307,7 +2310,7 @@ private predicate pathReadStep(
23072310

23082311
pragma[nomagic]
23092312
private predicate storeCand(Node node1, TypedContent tc, Node node2, Configuration config) {
2310-
storeCand2(node1, tc, node2, config) and
2313+
storeCand2(node1, tc, node2, _, config) and
23112314
flow(node2, config)
23122315
}
23132316

@@ -2799,13 +2802,13 @@ private module FlowExploration {
27992802
PartialPathNodePriv mid, PartialAccessPath ap1, TypedContent tc, Node node,
28002803
PartialAccessPath ap2
28012804
) {
2802-
exists(Node midNode |
2805+
exists(Node midNode, DataFlowType contentType |
28032806
midNode = mid.getNode() and
28042807
ap1 = mid.getAp() and
2805-
store(midNode, tc, node) and
2808+
store(midNode, tc, node, contentType) and
28062809
ap2.getHead() = tc and
28072810
ap2.len() = unbindInt(ap1.len() + 1) and
2808-
compatibleTypes(ap1.getType(), getErasedNodeTypeBound(midNode))
2811+
compatibleTypes(ap1.getType(), contentType)
28092812
)
28102813
}
28112814

@@ -2830,8 +2833,7 @@ private module FlowExploration {
28302833
read(midNode, tc.getContent(), node) and
28312834
ap.getHead() = tc and
28322835
config = mid.getConfiguration() and
2833-
cc = mid.getCallContext() and
2834-
compatibleTypes(tc.getContainerType(), getErasedNodeTypeBound(midNode))
2836+
cc = mid.getCallContext()
28352837
)
28362838
}
28372839

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll‎

Lines changed: 30 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -289,7 +289,7 @@ private predicate nodeCandFwd1(Node node, boolean fromArg, Configuration config)
289289
exists(Node mid |
290290
useFieldFlow(config) and
291291
nodeCandFwd1(mid, fromArg, config) and
292-
store(mid, _, node) and
292+
store(mid, _, node, _) and
293293
not outBarrier(mid, config)
294294
)
295295
or
@@ -337,7 +337,7 @@ private predicate nodeCandFwd1IsStored(Content c, Configuration config) {
337337
not fullBarrier(node, config) and
338338
useFieldFlow(config) and
339339
nodeCandFwd1(mid, config) and
340-
store(mid, tc, node) and
340+
store(mid, tc, node, _) and
341341
c = tc.getContent()
342342
)
343343
}
@@ -469,7 +469,7 @@ private predicate nodeCand1Store(Content c, Node node, boolean toReturn, Configu
469469
exists(Node mid, TypedContent tc |
470470
nodeCand1(mid, toReturn, config) and
471471
nodeCandFwd1IsStored(c, unbind(config)) and
472-
store(node, tc, mid) and
472+
store(node, tc, mid, _) and
473473
c = tc.getContent()
474474
)
475475
}
@@ -571,11 +571,11 @@ private predicate parameterThroughFlowNodeCand1(ParameterNode p, Configuration c
571571
}
572572

573573
pragma[nomagic]
574-
private predicate store(Node n1, Content c, Node n2, Configuration config) {
574+
private predicate storeCand1(Node n1, Content c, Node n2, Configuration config) {
575575
exists(TypedContent tc |
576576
nodeCand1IsReadAndStored(c, config) and
577577
nodeCand1(n2, unbind(config)) and
578-
store(n1, tc, n2) and
578+
store(n1, tc, n2, _) and
579579
c = tc.getContent()
580580
)
581581
}
@@ -758,7 +758,7 @@ private predicate nodeCandFwd2(
758758
// store
759759
exists(Node mid |
760760
nodeCandFwd2(mid, fromArg, argStored, _, config) and
761-
store(mid, _, node, config) and
761+
storeCand1(mid, _, node, config) and
762762
stored = true
763763
)
764764
or
@@ -797,7 +797,7 @@ private predicate nodeCandFwd2IsStored(Content c, boolean stored, Configuration
797797
useFieldFlow(config) and
798798
nodeCand1(node, unbind(config)) and
799799
nodeCandFwd2(mid, _, _, stored, config) and
800-
store(mid, c, node, config)
800+
storeCand1(mid, c, node, config)
801801
)
802802
}
803803

@@ -957,7 +957,7 @@ private predicate nodeCand2Store(
957957
Configuration config
958958
) {
959959
exists(Node mid |
960-
store(node, c, mid, config) and
960+
storeCand1(node, c, mid, config) and
961961
nodeCand2(mid, toReturn, returnRead, true, config) and
962962
nodeCandFwd2(node, _, _, stored, unbind(config))
963963
)
@@ -1066,7 +1066,7 @@ private module LocalFlowBigStep {
10661066
additionalJumpStep(_, node, config) or
10671067
node instanceof ParameterNode or
10681068
node instanceof OutNodeExt or
1069-
store(_, _, node) or
1069+
store(_, _, node, _) or
10701070
read(_, _, node) or
10711071
node instanceof CastNode
10721072
)
@@ -1082,7 +1082,7 @@ private module LocalFlowBigStep {
10821082
additionalJumpStep(node, next, config) or
10831083
flowIntoCallNodeCand1(_, node, next, config) or
10841084
flowOutOfCallNodeCand1(_, node, next, config) or
1085-
store(node, _, next) or
1085+
store(node, _, next, _) or
10861086
read(node, _, next)
10871087
)
10881088
or
@@ -1170,8 +1170,10 @@ private predicate readCand2(Node node1, Content c, Node node2, Configuration con
11701170
}
11711171

11721172
pragma[nomagic]
1173-
private predicate storeCand2(Node node1, TypedContent tc, Node node2, Configuration config) {
1174-
store(node1, tc, node2) and
1173+
private predicate storeCand2(
1174+
Node node1, TypedContent tc, Node node2, DataFlowType contentType, Configuration config
1175+
) {
1176+
store(node1, tc, node2, contentType) and
11751177
nodeCand2(node1, config) and
11761178
nodeCand2(node2, _, _, true, unbind(config)) and
11771179
nodeCand2IsReadAndStored(tc.getContent(), unbind(config))
@@ -1235,11 +1237,12 @@ private predicate flowCandFwd0(
12351237
)
12361238
or
12371239
// store
1238-
exists(Node mid, TypedContent tc |
1239-
flowCandFwd(mid, fromArg, argApf, _, config) and
1240-
storeCand2(mid, tc, node, config) and
1240+
exists(Node mid, TypedContent tc, AccessPathFront apf0, DataFlowType contentType |
1241+
flowCandFwd(mid, fromArg, argApf, apf0, config) and
1242+
storeCand2(mid, tc, node, contentType, config) and
12411243
nodeCand2(node, _, _, true, unbind(config)) and
1242-
apf.headUsesContent(tc)
1244+
apf.headUsesContent(tc) and
1245+
compatibleTypes(apf0.getType(), contentType)
12431246
)
12441247
or
12451248
// read
@@ -1270,11 +1273,11 @@ private predicate flowCandFwd0(
12701273

12711274
pragma[nomagic]
12721275
private predicate flowCandFwdConsCand(TypedContent tc, AccessPathFront apf, Configuration config) {
1273-
exists(Node mid, Node n |
1276+
exists(Node mid, Node n, DataFlowType contentType |
12741277
flowCandFwd(mid, _, _, apf, config) and
1275-
storeCand2(mid, tc, n, config) and
1278+
storeCand2(mid, tc, n, contentType, config) and
12761279
nodeCand2(n, _, _, true, unbind(config)) and
1277-
compatibleTypes(apf.getType(), mid.getTypeBound())
1280+
compatibleTypes(apf.getType(), contentType)
12781281
)
12791282
}
12801283

@@ -1454,7 +1457,7 @@ private predicate flowCandStore(
14541457
) {
14551458
exists(Node mid |
14561459
flowCandFwd(node, _, _, apf, config) and
1457-
storeCand2(node, tc, mid, unbind(config)) and
1460+
storeCand2(node, tc, mid, _, unbind(config)) and
14581461
flowCand(mid, toReturn, returnApf, TFrontHead(tc), unbind(config))
14591462
)
14601463
}
@@ -1737,7 +1740,7 @@ private predicate storeCand(
17371740
Node mid, TypedContent tc, Node node, AccessPathFront apf0, AccessPathFront apf,
17381741
Configuration config
17391742
) {
1740-
storeCand2(mid, tc, node, config) and
1743+
storeCand2(mid, tc, node, _, config) and
17411744
flowCand(mid, _, _, apf0, config) and
17421745
apf.headUsesContent(tc)
17431746
}
@@ -1919,7 +1922,7 @@ pragma[nomagic]
19191922
private predicate storeFlowFwd(
19201923
Node node1, TypedContent tc, Node node2, AccessPath ap, AccessPath ap0, Configuration config
19211924
) {
1922-
storeCand2(node1, tc, node2, config) and
1925+
storeCand2(node1, tc, node2, _, config) and
19231926
flowFwdStore(node2, tc, ap, _, _, _, config) and
19241927
ap0 = push(tc, ap)
19251928
}
@@ -2307,7 +2310,7 @@ private predicate pathReadStep(
23072310

23082311
pragma[nomagic]
23092312
private predicate storeCand(Node node1, TypedContent tc, Node node2, Configuration config) {
2310-
storeCand2(node1, tc, node2, config) and
2313+
storeCand2(node1, tc, node2, _, config) and
23112314
flow(node2, config)
23122315
}
23132316

@@ -2799,13 +2802,13 @@ private module FlowExploration {
27992802
PartialPathNodePriv mid, PartialAccessPath ap1, TypedContent tc, Node node,
28002803
PartialAccessPath ap2
28012804
) {
2802-
exists(Node midNode |
2805+
exists(Node midNode, DataFlowType contentType |
28032806
midNode = mid.getNode() and
28042807
ap1 = mid.getAp() and
2805-
store(midNode, tc, node) and
2808+
store(midNode, tc, node, contentType) and
28062809
ap2.getHead() = tc and
28072810
ap2.len() = unbindInt(ap1.len() + 1) and
2808-
compatibleTypes(ap1.getType(), getErasedNodeTypeBound(midNode))
2811+
compatibleTypes(ap1.getType(), contentType)
28092812
)
28102813
}
28112814

@@ -2830,8 +2833,7 @@ private module FlowExploration {
28302833
read(midNode, tc.getContent(), node) and
28312834
ap.getHead() = tc and
28322835
config = mid.getConfiguration() and
2833-
cc = mid.getCallContext() and
2834-
compatibleTypes(tc.getContainerType(), getErasedNodeTypeBound(midNode))
2836+
cc = mid.getCallContext()
28352837
)
28362838
}
28372839

0 commit comments

Comments
 (0)