Skip to content

Commit 2e8bd5c

Browse files
hvitvedhvitved
committed
Data flow: Sync files
1 parent 0645940 commit 2e8bd5c

18 files changed

Lines changed: 342 additions & 396 deletions

File tree

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll‎

Lines changed: 19 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -724,18 +724,16 @@ private predicate readStoreNode(
724724

725725
private newtype TNodeExt =
726726
TNormalNode(Node node) { nodeCand1(node, _) } or
727-
TReadStoreNode(DataFlowCall call, ArgumentNode arg, Content f1) {
728-
exists(Configuration config |
729-
nodeCand1(arg, config) and
730-
readStoreNode(call, arg, f1, config) and
731-
readStoreCand1(f1, unbind(config))
732-
)
727+
TReadStoreNode(DataFlowCall call, ArgumentNode arg, Content f1, Configuration config) {
728+
nodeCand1(arg, config) and
729+
readStoreNode(call, arg, f1, config) and
730+
readStoreCand1(f1, unbind(config))
733731
} or
734732
TReadTaintNode(ArgumentNode arg, Content f, Configuration config) {
735733
argumentFlowsThrough(arg, _, _, _, TSummaryReadTaint(f), config)
736734
} or
737-
TTaintStoreNode(ArgumentNode arg, Content f, DataFlowType t, Configuration config) {
738-
argumentFlowsThrough(arg, _, t, _, TSummaryTaintStore(f), config)
735+
TTaintStoreNode(ArgumentNode arg, DataFlowType t, Configuration config) {
736+
argumentFlowsThrough(arg, _, t, _, TSummaryTaintStore(_), config)
739737
}
740738

741739
/**
@@ -794,23 +792,24 @@ private class ReadStoreNodeExt extends CastingNodeExt, TReadStoreNode {
794792
private DataFlowCall call;
795793
private ArgumentNode arg;
796794
private Content f1;
795+
private Configuration config0;
797796

798-
ReadStoreNodeExt() { this = TReadStoreNode(call, arg, f1) }
797+
ReadStoreNodeExt() { this = TReadStoreNode(call, arg, f1, config0) }
799798

800799
override Node getNode() { none() }
801800

802801
override DataFlowType getErasedNodeTypeBound() { result = f1.getType() }
803802

804803
override DataFlowCallable getEnclosingCallable() { result = arg.getEnclosingCallable() }
805804

806-
override predicate isCand1(Configuration config) { nodeCand1(arg, config) }
805+
override predicate isCand1(Configuration config) { config = config0 }
807806

808807
override string toString() { result = "(inside) " + call.toString() + " [read " + f1 + "]" }
809808

810809
override predicate hasLocationInfo(
811810
string filepath, int startline, int startcolumn, int endline, int endcolumn
812811
) {
813-
call.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
812+
arg.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
814813
}
815814
}
816815

@@ -840,11 +839,10 @@ private class ReadTaintNode extends NodeExt, TReadTaintNode {
840839

841840
private class TaintStoreNode extends NodeExt, TTaintStoreNode {
842841
private ArgumentNode arg;
843-
private Content f;
844842
private DataFlowType t;
845843
private Configuration config0;
846844

847-
TaintStoreNode() { this = TTaintStoreNode(arg, f, t, config0) }
845+
TaintStoreNode() { this = TTaintStoreNode(arg, t, config0) }
848846

849847
override Node getNode() { none() }
850848

@@ -854,7 +852,7 @@ private class TaintStoreNode extends NodeExt, TTaintStoreNode {
854852

855853
override predicate isCand1(Configuration config) { config = config0 }
856854

857-
override string toString() { result = arg.toString() + " [taint store " + f + "]" }
855+
override string toString() { result = arg.toString() + " [taint store]" }
858856

859857
override predicate hasLocationInfo(
860858
string filepath, int startline, int startcolumn, int endline, int endcolumn
@@ -871,15 +869,14 @@ private predicate additionalLocalFlowStepExt(
871869
argumentFlowsThrough(arg, node2.getNode(), _, t, TSummaryReadTaint(f), config)
872870
)
873871
or
874-
node2 = TTaintStoreNode(node1.getNode(), _, t, config)
872+
node2 = TTaintStoreNode(node1.getNode(), t, config)
875873
}
876874

877875
pragma[nomagic]
878876
private predicate readExt(NodeExt node1, Content f, NodeExt node2, Configuration config) {
879877
read(node1.getNode(), f, node2.getNode(), config)
880878
or
881-
node2 = TReadStoreNode(_, node1.getNode(), f) and
882-
node2.isCand1(config)
879+
node2 = TReadStoreNode(_, node1.getNode(), f, config)
883880
or
884881
node2 = TReadTaintNode(node1.getNode(), f, config)
885882
}
@@ -889,15 +886,15 @@ private predicate storeExt(NodeExt node1, Content f, NodeExt node2, Configuratio
889886
store(node1.getNode(), f, node2.getNode(), config)
890887
or
891888
exists(DataFlowCall call, ArgumentNode arg, Content f1, Node n2 |
892-
node1 = TReadStoreNode(call, arg, f1) and
889+
node1 = TReadStoreNode(call, arg, f1, config) and
893890
n2 = node2.getNode() and
894891
argumentValueFlowsThrough(call, arg, TContentSome(f1), TContentSome(f), n2) and
895-
nodeCand1(n2, config) and
892+
nodeCand1(n2, unbind(config)) and
896893
readStoreCand1(f, unbind(config))
897894
)
898895
or
899896
exists(ArgumentNode arg, DataFlowType t |
900-
node1 = TTaintStoreNode(arg, f, t, config) and
897+
node1 = TTaintStoreNode(arg, t, config) and
901898
argumentFlowsThrough(arg, node2.getNode(), t, _, TSummaryTaintStore(f), config)
902899
)
903900
}
@@ -1266,7 +1263,7 @@ private predicate flowOutOfCallableNodeCand2(
12661263
NodeExt node1, NodeExt node2, boolean allowsFieldFlow, Configuration config
12671264
) {
12681265
flowOutOfCallableNodeCand1(node1, node2, allowsFieldFlow, config) and
1269-
nodeCand2(node2, _, _, config) and
1266+
nodeCand2(node2, config) and
12701267
nodeCand2(node1, unbind(config))
12711268
}
12721269

@@ -1275,7 +1272,7 @@ private predicate flowIntoCallableNodeCand2(
12751272
NodeExt node1, NodeExt node2, boolean allowsFieldFlow, Configuration config
12761273
) {
12771274
flowIntoCallableNodeCand1(node1, node2, allowsFieldFlow, config) and
1278-
nodeCand2(node2, _, _, config) and
1275+
nodeCand2(node2, config) and
12791276
nodeCand2(node1, unbind(config))
12801277
}
12811278

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll‎

Lines changed: 19 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -724,18 +724,16 @@ private predicate readStoreNode(
724724

725725
private newtype TNodeExt =
726726
TNormalNode(Node node) { nodeCand1(node, _) } or
727-
TReadStoreNode(DataFlowCall call, ArgumentNode arg, Content f1) {
728-
exists(Configuration config |
729-
nodeCand1(arg, config) and
730-
readStoreNode(call, arg, f1, config) and
731-
readStoreCand1(f1, unbind(config))
732-
)
727+
TReadStoreNode(DataFlowCall call, ArgumentNode arg, Content f1, Configuration config) {
728+
nodeCand1(arg, config) and
729+
readStoreNode(call, arg, f1, config) and
730+
readStoreCand1(f1, unbind(config))
733731
} or
734732
TReadTaintNode(ArgumentNode arg, Content f, Configuration config) {
735733
argumentFlowsThrough(arg, _, _, _, TSummaryReadTaint(f), config)
736734
} or
737-
TTaintStoreNode(ArgumentNode arg, Content f, DataFlowType t, Configuration config) {
738-
argumentFlowsThrough(arg, _, t, _, TSummaryTaintStore(f), config)
735+
TTaintStoreNode(ArgumentNode arg, DataFlowType t, Configuration config) {
736+
argumentFlowsThrough(arg, _, t, _, TSummaryTaintStore(_), config)
739737
}
740738

741739
/**
@@ -794,23 +792,24 @@ private class ReadStoreNodeExt extends CastingNodeExt, TReadStoreNode {
794792
private DataFlowCall call;
795793
private ArgumentNode arg;
796794
private Content f1;
795+
private Configuration config0;
797796

798-
ReadStoreNodeExt() { this = TReadStoreNode(call, arg, f1) }
797+
ReadStoreNodeExt() { this = TReadStoreNode(call, arg, f1, config0) }
799798

800799
override Node getNode() { none() }
801800

802801
override DataFlowType getErasedNodeTypeBound() { result = f1.getType() }
803802

804803
override DataFlowCallable getEnclosingCallable() { result = arg.getEnclosingCallable() }
805804

806-
override predicate isCand1(Configuration config) { nodeCand1(arg, config) }
805+
override predicate isCand1(Configuration config) { config = config0 }
807806

808807
override string toString() { result = "(inside) " + call.toString() + " [read " + f1 + "]" }
809808

810809
override predicate hasLocationInfo(
811810
string filepath, int startline, int startcolumn, int endline, int endcolumn
812811
) {
813-
call.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
812+
arg.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
814813
}
815814
}
816815

@@ -840,11 +839,10 @@ private class ReadTaintNode extends NodeExt, TReadTaintNode {
840839

841840
private class TaintStoreNode extends NodeExt, TTaintStoreNode {
842841
private ArgumentNode arg;
843-
private Content f;
844842
private DataFlowType t;
845843
private Configuration config0;
846844

847-
TaintStoreNode() { this = TTaintStoreNode(arg, f, t, config0) }
845+
TaintStoreNode() { this = TTaintStoreNode(arg, t, config0) }
848846

849847
override Node getNode() { none() }
850848

@@ -854,7 +852,7 @@ private class TaintStoreNode extends NodeExt, TTaintStoreNode {
854852

855853
override predicate isCand1(Configuration config) { config = config0 }
856854

857-
override string toString() { result = arg.toString() + " [taint store " + f + "]" }
855+
override string toString() { result = arg.toString() + " [taint store]" }
858856

859857
override predicate hasLocationInfo(
860858
string filepath, int startline, int startcolumn, int endline, int endcolumn
@@ -871,15 +869,14 @@ private predicate additionalLocalFlowStepExt(
871869
argumentFlowsThrough(arg, node2.getNode(), _, t, TSummaryReadTaint(f), config)
872870
)
873871
or
874-
node2 = TTaintStoreNode(node1.getNode(), _, t, config)
872+
node2 = TTaintStoreNode(node1.getNode(), t, config)
875873
}
876874

877875
pragma[nomagic]
878876
private predicate readExt(NodeExt node1, Content f, NodeExt node2, Configuration config) {
879877
read(node1.getNode(), f, node2.getNode(), config)
880878
or
881-
node2 = TReadStoreNode(_, node1.getNode(), f) and
882-
node2.isCand1(config)
879+
node2 = TReadStoreNode(_, node1.getNode(), f, config)
883880
or
884881
node2 = TReadTaintNode(node1.getNode(), f, config)
885882
}
@@ -889,15 +886,15 @@ private predicate storeExt(NodeExt node1, Content f, NodeExt node2, Configuratio
889886
store(node1.getNode(), f, node2.getNode(), config)
890887
or
891888
exists(DataFlowCall call, ArgumentNode arg, Content f1, Node n2 |
892-
node1 = TReadStoreNode(call, arg, f1) and
889+
node1 = TReadStoreNode(call, arg, f1, config) and
893890
n2 = node2.getNode() and
894891
argumentValueFlowsThrough(call, arg, TContentSome(f1), TContentSome(f), n2) and
895-
nodeCand1(n2, config) and
892+
nodeCand1(n2, unbind(config)) and
896893
readStoreCand1(f, unbind(config))
897894
)
898895
or
899896
exists(ArgumentNode arg, DataFlowType t |
900-
node1 = TTaintStoreNode(arg, f, t, config) and
897+
node1 = TTaintStoreNode(arg, t, config) and
901898
argumentFlowsThrough(arg, node2.getNode(), t, _, TSummaryTaintStore(f), config)
902899
)
903900
}
@@ -1266,7 +1263,7 @@ private predicate flowOutOfCallableNodeCand2(
12661263
NodeExt node1, NodeExt node2, boolean allowsFieldFlow, Configuration config
12671264
) {
12681265
flowOutOfCallableNodeCand1(node1, node2, allowsFieldFlow, config) and
1269-
nodeCand2(node2, _, _, config) and
1266+
nodeCand2(node2, config) and
12701267
nodeCand2(node1, unbind(config))
12711268
}
12721269

@@ -1275,7 +1272,7 @@ private predicate flowIntoCallableNodeCand2(
12751272
NodeExt node1, NodeExt node2, boolean allowsFieldFlow, Configuration config
12761273
) {
12771274
flowIntoCallableNodeCand1(node1, node2, allowsFieldFlow, config) and
1278-
nodeCand2(node2, _, _, config) and
1275+
nodeCand2(node2, config) and
12791276
nodeCand2(node1, unbind(config))
12801277
}
12811278

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll‎

Lines changed: 19 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -724,18 +724,16 @@ private predicate readStoreNode(
724724

725725
private newtype TNodeExt =
726726
TNormalNode(Node node) { nodeCand1(node, _) } or
727-
TReadStoreNode(DataFlowCall call, ArgumentNode arg, Content f1) {
728-
exists(Configuration config |
729-
nodeCand1(arg, config) and
730-
readStoreNode(call, arg, f1, config) and
731-
readStoreCand1(f1, unbind(config))
732-
)
727+
TReadStoreNode(DataFlowCall call, ArgumentNode arg, Content f1, Configuration config) {
728+
nodeCand1(arg, config) and
729+
readStoreNode(call, arg, f1, config) and
730+
readStoreCand1(f1, unbind(config))
733731
} or
734732
TReadTaintNode(ArgumentNode arg, Content f, Configuration config) {
735733
argumentFlowsThrough(arg, _, _, _, TSummaryReadTaint(f), config)
736734
} or
737-
TTaintStoreNode(ArgumentNode arg, Content f, DataFlowType t, Configuration config) {
738-
argumentFlowsThrough(arg, _, t, _, TSummaryTaintStore(f), config)
735+
TTaintStoreNode(ArgumentNode arg, DataFlowType t, Configuration config) {
736+
argumentFlowsThrough(arg, _, t, _, TSummaryTaintStore(_), config)
739737
}
740738

741739
/**
@@ -794,23 +792,24 @@ private class ReadStoreNodeExt extends CastingNodeExt, TReadStoreNode {
794792
private DataFlowCall call;
795793
private ArgumentNode arg;
796794
private Content f1;
795+
private Configuration config0;
797796

798-
ReadStoreNodeExt() { this = TReadStoreNode(call, arg, f1) }
797+
ReadStoreNodeExt() { this = TReadStoreNode(call, arg, f1, config0) }
799798

800799
override Node getNode() { none() }
801800

802801
override DataFlowType getErasedNodeTypeBound() { result = f1.getType() }
803802

804803
override DataFlowCallable getEnclosingCallable() { result = arg.getEnclosingCallable() }
805804

806-
override predicate isCand1(Configuration config) { nodeCand1(arg, config) }
805+
override predicate isCand1(Configuration config) { config = config0 }
807806

808807
override string toString() { result = "(inside) " + call.toString() + " [read " + f1 + "]" }
809808

810809
override predicate hasLocationInfo(
811810
string filepath, int startline, int startcolumn, int endline, int endcolumn
812811
) {
813-
call.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
812+
arg.getLocation().hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
814813
}
815814
}
816815

@@ -840,11 +839,10 @@ private class ReadTaintNode extends NodeExt, TReadTaintNode {
840839

841840
private class TaintStoreNode extends NodeExt, TTaintStoreNode {
842841
private ArgumentNode arg;
843-
private Content f;
844842
private DataFlowType t;
845843
private Configuration config0;
846844

847-
TaintStoreNode() { this = TTaintStoreNode(arg, f, t, config0) }
845+
TaintStoreNode() { this = TTaintStoreNode(arg, t, config0) }
848846

849847
override Node getNode() { none() }
850848

@@ -854,7 +852,7 @@ private class TaintStoreNode extends NodeExt, TTaintStoreNode {
854852

855853
override predicate isCand1(Configuration config) { config = config0 }
856854

857-
override string toString() { result = arg.toString() + " [taint store " + f + "]" }
855+
override string toString() { result = arg.toString() + " [taint store]" }
858856

859857
override predicate hasLocationInfo(
860858
string filepath, int startline, int startcolumn, int endline, int endcolumn
@@ -871,15 +869,14 @@ private predicate additionalLocalFlowStepExt(
871869
argumentFlowsThrough(arg, node2.getNode(), _, t, TSummaryReadTaint(f), config)
872870
)
873871
or
874-
node2 = TTaintStoreNode(node1.getNode(), _, t, config)
872+
node2 = TTaintStoreNode(node1.getNode(), t, config)
875873
}
876874

877875
pragma[nomagic]
878876
private predicate readExt(NodeExt node1, Content f, NodeExt node2, Configuration config) {
879877
read(node1.getNode(), f, node2.getNode(), config)
880878
or
881-
node2 = TReadStoreNode(_, node1.getNode(), f) and
882-
node2.isCand1(config)
879+
node2 = TReadStoreNode(_, node1.getNode(), f, config)
883880
or
884881
node2 = TReadTaintNode(node1.getNode(), f, config)
885882
}
@@ -889,15 +886,15 @@ private predicate storeExt(NodeExt node1, Content f, NodeExt node2, Configuratio
889886
store(node1.getNode(), f, node2.getNode(), config)
890887
or
891888
exists(DataFlowCall call, ArgumentNode arg, Content f1, Node n2 |
892-
node1 = TReadStoreNode(call, arg, f1) and
889+
node1 = TReadStoreNode(call, arg, f1, config) and
893890
n2 = node2.getNode() and
894891
argumentValueFlowsThrough(call, arg, TContentSome(f1), TContentSome(f), n2) and
895-
nodeCand1(n2, config) and
892+
nodeCand1(n2, unbind(config)) and
896893
readStoreCand1(f, unbind(config))
897894
)
898895
or
899896
exists(ArgumentNode arg, DataFlowType t |
900-
node1 = TTaintStoreNode(arg, f, t, config) and
897+
node1 = TTaintStoreNode(arg, t, config) and
901898
argumentFlowsThrough(arg, node2.getNode(), t, _, TSummaryTaintStore(f), config)
902899
)
903900
}
@@ -1266,7 +1263,7 @@ private predicate flowOutOfCallableNodeCand2(
12661263
NodeExt node1, NodeExt node2, boolean allowsFieldFlow, Configuration config
12671264
) {
12681265
flowOutOfCallableNodeCand1(node1, node2, allowsFieldFlow, config) and
1269-
nodeCand2(node2, _, _, config) and
1266+
nodeCand2(node2, config) and
12701267
nodeCand2(node1, unbind(config))
12711268
}
12721269

@@ -1275,7 +1272,7 @@ private predicate flowIntoCallableNodeCand2(
12751272
NodeExt node1, NodeExt node2, boolean allowsFieldFlow, Configuration config
12761273
) {
12771274
flowIntoCallableNodeCand1(node1, node2, allowsFieldFlow, config) and
1278-
nodeCand2(node2, _, _, config) and
1275+
nodeCand2(node2, config) and
12791276
nodeCand2(node1, unbind(config))
12801277
}
12811278

0 commit comments

Comments
 (0)