55import cpp
66import semmle.code.cpp.dataflow.new.TaintTracking
77import semmle.code.cpp.commons.DateTime
8- import semmle.code.cpp.valuenumbering.HashCons
98
109/**
1110 * Get the top-level `BinaryOperation` enclosing the expression e.
@@ -42,7 +41,6 @@ class CheckForLeapYearOperation extends Expr {
4241 }
4342}
4443
45- bindingset [ modVal]
4644Expr moduloCheckEQ_0 ( EQExpr eq , int modVal ) {
4745 exists ( RemExpr rem | rem = eq .getLeftOperand ( ) |
4846 result = rem .getLeftOperand ( ) and
@@ -51,7 +49,6 @@ Expr moduloCheckEQ_0(EQExpr eq, int modVal) {
5149 eq .getRightOperand ( ) .getValue ( ) .toInt ( ) = 0
5250}
5351
54- bindingset [ modVal]
5552Expr moduloCheckNEQ_0 ( NEExpr neq , int modVal ) {
5653 exists ( RemExpr rem | rem = neq .getLeftOperand ( ) |
5754 result = rem .getLeftOperand ( ) and
@@ -60,17 +57,6 @@ Expr moduloCheckNEQ_0(NEExpr neq, int modVal) {
6057 neq .getRightOperand ( ) .getValue ( ) .toInt ( ) = 0
6158}
6259
63- /**
64- * Returns if the two expressions resolve to the same value, albeit it is a fuzzy attempt.
65- * SSA is not fit for purpose here as calls break SSA equivalence.
66- */
67- bindingset [ e1, e2]
68- pragma [ inline_late]
69- predicate exprEq_propertyPermissive ( Expr e1 , Expr e2 ) {
70- not e1 = e2 and
71- hashCons ( e1 ) = hashCons ( e2 )
72- }
73-
7460/**
7561 * An expression that is the subject of a mod-4 check.
7662 * ie `expr % 4 == 0`
@@ -196,8 +182,7 @@ class ExprCheckCenturyComponent extends LogicalOrExpr {
196182 ExprCheckCenturyComponent ( ) {
197183 exists ( ExprCheckCenturyComponentDiv400 exprDiv400 , ExprCheckCenturyComponentDiv100 exprDiv100 |
198184 this .getAnOperand ( ) = exprDiv100 and
199- this .getAnOperand ( ) = exprDiv400 and
200- exprEq_propertyPermissive ( exprDiv100 .getYearExpr ( ) , exprDiv400 .getYearExpr ( ) )
185+ this .getAnOperand ( ) = exprDiv400
201186 )
202187 }
203188
@@ -222,8 +207,7 @@ final class ExprCheckLeapYearFormA extends ExprCheckLeapYear, LogicalAndExpr {
222207 ExprCheckLeapYearFormA ( ) {
223208 exists ( Expr e , ExprCheckCenturyComponent centuryCheck |
224209 e = moduloCheckEQ_0 ( this .getLeftOperand ( ) , 4 ) and
225- centuryCheck = this .getAnOperand ( ) .getAChild * ( ) and
226- exprEq_propertyPermissive ( e , centuryCheck .getYearExpr ( ) )
210+ centuryCheck = this .getAnOperand ( ) .getAChild * ( )
227211 )
228212 }
229213}
@@ -238,12 +222,7 @@ final class ExprCheckLeapYearFormB extends ExprCheckLeapYear, LogicalOrExpr {
238222 exists ( VariableAccess va1 , VariableAccess va2 , VariableAccess va3 |
239223 va1 = moduloCheckEQ_0 ( this .getAnOperand ( ) , 400 ) and
240224 va2 = moduloCheckNEQ_0 ( this .getAnOperand ( ) .( LogicalAndExpr ) .getAnOperand ( ) , 100 ) and
241- va3 = moduloCheckEQ_0 ( this .getAnOperand ( ) .( LogicalAndExpr ) .getAnOperand ( ) , 4 ) and
242- // The 400-leap year check may be offset by [1900,1970,2000].
243- exists ( Expr va1_subExpr | va1_subExpr = va1 .getAChild * ( ) |
244- exprEq_propertyPermissive ( va1_subExpr , va2 ) and
245- exprEq_propertyPermissive ( va2 , va3 )
246- )
225+ va3 = moduloCheckEQ_0 ( this .getAnOperand ( ) .( LogicalAndExpr ) .getAnOperand ( ) , 4 )
247226 )
248227 }
249228}
@@ -384,47 +363,44 @@ class StructTmLeapYearFieldAccess extends LeapYearFieldAccess {
384363 * `stDate.wMonth == 2`
385364 */
386365class DateCheckMonthFebruary extends Operation {
387- DateCheckMonthFebruary ( ) {
366+ DateCheckMonthFebruary ( ) {
388367 this .getOperator ( ) = "==" and
389368 this .getAnOperand ( ) instanceof MonthFieldAccess and
390369 this .getAnOperand ( ) .( Literal ) .getValue ( ) = "2"
391370 }
392371
393- Expr getDateQualifier ( ) {
394- result = this .getAnOperand ( ) .( MonthFieldAccess ) .getQualifier ( )
395- }
372+ Expr getDateQualifier ( ) { result = this .getAnOperand ( ) .( MonthFieldAccess ) .getQualifier ( ) }
396373}
397374
398375/**
399376 * `stDate.wDay == 29`
400377 */
401378class DateCheckDay29 extends Operation {
402- DateCheckDay29 ( ) {
379+ DateCheckDay29 ( ) {
403380 this .getOperator ( ) = "==" and
404381 this .getAnOperand ( ) instanceof DayFieldAccess and
405382 this .getAnOperand ( ) .( Literal ) .getValue ( ) = "29"
406383 }
407384
408- Expr getDateQualifier ( ) {
409- result = this .getAnOperand ( ) .( DayFieldAccess ) .getQualifier ( )
410- }
385+ Expr getDateQualifier ( ) { result = this .getAnOperand ( ) .( DayFieldAccess ) .getQualifier ( ) }
411386}
412387
413388/**
414389 * The combination of a February and Day 29 verification
415390 * `stDate.wMonth == 2 && stDate.wDay == 29`
416391 */
417392class DateFebruary29Check extends Operation {
418- DateFebruary29Check ( ) {
393+ DateFebruary29Check ( ) {
419394 this .getOperator ( ) = "&&" and
420395 exists ( DateCheckMonthFebruary checkFeb , DateCheckDay29 check29 |
421396 checkFeb = this .getAnOperand ( ) and
422- check29 = this .getAnOperand ( ) and
423- hashCons ( checkFeb .getDateQualifier ( ) ) = hashCons ( check29 .getDateQualifier ( ) )
397+ check29 = this .getAnOperand ( )
398+ // and
399+ // hashCons(checkFeb.getDateQualifier()) = hashCons(check29.getDateQualifier())
424400 )
425401 }
426402
427- Expr getDateQualifier ( ) {
403+ Expr getDateQualifier ( ) {
428404 result = this .getAnOperand ( ) .( DateCheckMonthFebruary ) .getDateQualifier ( )
429405 }
430406}
0 commit comments