Skip to content

Commit 3457551

Browse files
MathiasVPMathiasVP
committed
C++: Replace deallocation models with models from extensible predicates.
1 parent e5c20b1 commit 3457551

5 files changed

Lines changed: 95 additions & 58 deletions

File tree

‎cpp/ql/lib/ext/deallocation/Bsd.deallocation.model.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/cpp-all
4+
extensible: deallocationFunctionModel
5+
data:
6+
- ["", "", False, "pool_put", "1"]
7+
- ["", "", False, "pool_cache_put", "1"]
8+
- ["", "", False, "kmem_free", "0"]

‎cpp/ql/lib/ext/deallocation/Std.deallocation.model.yml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/cpp-all
4+
extensible: deallocationFunctionModel
5+
data:
6+
- ["", "", False, "free", "0"]
7+
- ["std", "", False, "free", "0"]
8+
- ["", "", False, "realloc", "0"]
9+
- ["std", "", False, "realloc", "0"]
10+
- ["bsl", "", False, "realloc", "0"]
11+
- ["", "", False, "CRYPTO_free", "0"]
12+
- ["", "", False, "CRYPTO_secure_free", "0"]
13+
- ["", "", False, "g_free", "0"]
14+
- ["", "", False, "ExFreePool", "0"]
15+
- ["", "", False, "ExFreePoolWithTag", "0"]
16+
- ["", "", False, "ExDeleteTimer", "0"]
17+
- ["", "", False, "IoFreeIrp", "0"]
18+
- ["", "", False, "IoFreeMdl", "0"]
19+
- ["", "", False, "IoFreeErrorLogEntry", "0"]
20+
- ["", "", False, "IoFreeWorkItem", "0"]
21+
- ["", "", False, "MmFreeContiguousMemory", "0"]
22+
- ["", "", False, "MmFreeContiguousMemorySpecifyCache", "0"]
23+
- ["", "", False, "MmFreeNonCachedMemory", "0"]
24+
- ["", "", False, "MmFreeMappingAddress", "0"]
25+
- ["", "", False, "MmFreePagesFromMdl", "0"]
26+
- ["", "", False, "MmUnmapReservedMapping", "0"]
27+
- ["", "", False, "MmUnmapLockedPages", "0"]
28+
- ["", "", False, "NdisFreeGenericObject", "0"]
29+
- ["", "", False, "NdisFreeMemory", "0"]
30+
- ["", "", False, "NdisFreeMemoryWithTag", "0"]
31+
- ["", "", False, "NdisFreeMdl", "0"]
32+
- ["", "", False, "NdisFreeNetBufferListPool", "0"]
33+
- ["", "", False, "NdisFreeNetBufferPool", "0"]
34+
- ["", "", False, "LocalFree", "0"]
35+
- ["", "", False, "GlobalFree", "0"]
36+
- ["", "", False, "LocalReAlloc", "0"]
37+
- ["", "", False, "GlobalReAlloc", "0"]
38+
- ["", "", False, "VirtualFree", "0"]
39+
- ["", "", False, "CoTaskMemFree", "0"]
40+
- ["", "", False, "CoTaskMemRealloc", "0"]
41+
- ["", "", False, "SysFreeString", "0"]

‎cpp/ql/lib/ext/deallocation/Windows.deallocation.model.yml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/cpp-all
4+
extensible: deallocationFunctionModel
5+
data:
6+
- ["", "", False, "ExFreePool", "0"]
7+
- ["", "", False, "ExFreePoolWithTag", "0"]
8+
- ["", "", False, "ExDeleteTimer", "0"]
9+
- ["", "", False, "IoFreeIrp", "0"]
10+
- ["", "", False, "IoFreeMdl", "0"]
11+
- ["", "", False, "IoFreeErrorLogEntry", "0"]
12+
- ["", "", False, "IoFreeWorkItem", "0"]
13+
- ["", "", False, "MmFreeContiguousMemory", "0"]
14+
- ["", "", False, "MmFreeContiguousMemorySpecifyCache", "0"]
15+
- ["", "", False, "MmFreeNonCachedMemory", "0"]
16+
- ["", "", False, "MmFreeMappingAddress", "0"]
17+
- ["", "", False, "MmFreePagesFromMdl", "0"]
18+
- ["", "", False, "MmUnmapReservedMapping", "0"]
19+
- ["", "", False, "MmUnmapLockedPages", "0"]
20+
- ["", "", False, "NdisFreeGenericObject", "0"]
21+
- ["", "", False, "NdisFreeMemory", "0"]
22+
- ["", "", False, "NdisFreeMemoryWithTag", "0"]
23+
- ["", "", False, "NdisFreeMdl", "0"]
24+
- ["", "", False, "NdisFreeNetBufferListPool", "0"]
25+
- ["", "", False, "NdisFreeNetBufferPool", "0"]
26+
- ["", "", False, "LocalFree", "0"]
27+
- ["", "", False, "GlobalFree", "0"]
28+
- ["", "", False, "LocalReAlloc", "0"]
29+
- ["", "", False, "GlobalReAlloc", "0"]
30+
- ["", "", False, "VirtualFree", "0"]
31+
- ["", "", False, "CoTaskMemFree", "0"]
32+
- ["", "", False, "CoTaskMemRealloc", "0"]
33+
- ["", "", False, "SysFreeString", "0"]
34+
- ["", "", False, "ExFreeToLookasideListEx", "1"]
35+
- ["", "", False, "ExFreeToPagedLookasideList", "1"]
36+
- ["", "", False, "ExFreeToNPagedLookasideList", "1"]
37+
- ["", "", False, "NdisFreeMemoryWithTagPriority", "1"]
38+
- ["", "", False, "StorPortFreeMdl", "1"]
39+
- ["", "", False, "StorPortFreePool", "1"]
40+
- ["", "", False, "HeapFree", "2"]
41+
- ["", "", False, "HeapReAlloc", "2"]

‎cpp/ql/lib/ext/deallocation/empty.deallocation.model.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/cpp-all
4+
extensible: deallocationFunctionModel
5+
data: []

‎cpp/ql/lib/semmle/code/cpp/models/implementations/Deallocation.qll‎

Lines changed: 0 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -6,64 +6,6 @@
66

77
import semmle.code.cpp.models.interfaces.Deallocation
88

9-
/**
10-
* A deallocation function such as `free`.
11-
*/
12-
private class StandardDeallocationFunction extends DeallocationFunction {
13-
int freedArg;
14-
15-
StandardDeallocationFunction() {
16-
this.hasGlobalOrStdOrBslName([
17-
// --- C library allocation
18-
"free", "realloc"
19-
]) and
20-
freedArg = 0
21-
or
22-
this.hasGlobalName([
23-
// --- OpenSSL memory deallocation
24-
"CRYPTO_free", "CRYPTO_secure_free",
25-
// --- glib memory deallocation
26-
"g_free"
27-
]) and
28-
freedArg = 0
29-
or
30-
this.hasGlobalOrStdName([
31-
// --- Windows Memory Management for Windows Drivers
32-
"ExFreePool", "ExFreePoolWithTag", "ExDeleteTimer", "IoFreeIrp", "IoFreeMdl",
33-
"IoFreeErrorLogEntry", "IoFreeWorkItem", "MmFreeContiguousMemory",
34-
"MmFreeContiguousMemorySpecifyCache", "MmFreeNonCachedMemory", "MmFreeMappingAddress",
35-
"MmFreePagesFromMdl", "MmUnmapReservedMapping", "MmUnmapLockedPages",
36-
"NdisFreeGenericObject", "NdisFreeMemory", "NdisFreeMemoryWithTag", "NdisFreeMdl",
37-
"NdisFreeNetBufferListPool", "NdisFreeNetBufferPool",
38-
// --- Windows Global / Local legacy allocation
39-
"LocalFree", "GlobalFree", "LocalReAlloc", "GlobalReAlloc",
40-
// --- Windows System Services allocation
41-
"VirtualFree",
42-
// --- Windows COM allocation
43-
"CoTaskMemFree", "CoTaskMemRealloc",
44-
// --- Windows Automation
45-
"SysFreeString",
46-
// --- Solaris/BSD kernel memory allocator
47-
"kmem_free"
48-
]) and
49-
freedArg = 0
50-
or
51-
this.hasGlobalOrStdName([
52-
// --- Windows Memory Management for Windows Drivers
53-
"ExFreeToLookasideListEx", "ExFreeToPagedLookasideList", "ExFreeToNPagedLookasideList",
54-
"NdisFreeMemoryWithTagPriority", "StorPortFreeMdl", "StorPortFreePool",
55-
// --- NetBSD pool manager
56-
"pool_put", "pool_cache_put"
57-
]) and
58-
freedArg = 1
59-
or
60-
this.hasGlobalOrStdName(["HeapFree", "HeapReAlloc"]) and
61-
freedArg = 2
62-
}
63-
64-
override int getFreedArg() { result = freedArg }
65-
}
66-
679
/**
6810
* Holds if `f` is an deallocation function according to the
6911
* extensible `deallocationFunctionModel` predicate.

0 commit comments

Comments
 (0)