Skip to content

Commit 29e59e6

Browse files
hvitvedhvitved
committed
Address review comments
1 parent 813dfc6 commit 29e59e6

21 files changed

+357
-292
lines changed

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll‎

Lines changed: 16 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -206,7 +206,7 @@ private predicate nodeCandFwd1(Node node, boolean stored, Configuration config)
206206
// flow out of a callable
207207
exists(ReturnNode ret |
208208
nodeCandFwd1(ret, stored, config) and
209-
node = getAnOutputAtCall(_, ret.getPosition())
209+
node = getAViableOutNode(ret.getPosition())
210210
)
211211
)
212212
}
@@ -282,7 +282,7 @@ private predicate nodeCand1(Node node, boolean stored, Configuration config) {
282282
// flow out of a callable
283283
exists(Node out |
284284
nodeCand1(out, stored, config) and
285-
out = getAnOutputAtCall(_, node.(ReturnNode).getPosition())
285+
out = getAViableOutNode(node.(ReturnNode).getPosition())
286286
)
287287
)
288288
}
@@ -366,9 +366,8 @@ private predicate simpleArgumentFlowsThrough(
366366
exists(ParameterNode param, ReturnNode ret |
367367
nodeCand1(arg, false, unbind(config)) and
368368
nodeCand1(out, false, unbind(config)) and
369-
viableParamArg(param, arg) and
370-
simpleParameterFlow(param, ret, t, config) and
371-
out = getAnOutputAtCall(arg.getCall(), ret.getPosition())
369+
viableParamArgOut(param, arg, ret.getPosition(), out) and
370+
simpleParameterFlow(param, ret, t, config)
372371
)
373372
}
374373

@@ -410,7 +409,7 @@ private predicate flowOutOfCallableCand1(Node node1, Node node2, Configuration c
410409
)
411410
or
412411
// flow out of a callable
413-
node2 = getAnOutputAtCall(_, node1.(ReturnNode).getPosition())
412+
node2 = getAViableOutNode(node1.(ReturnNode).getPosition())
414413
)
415414
}
416415

@@ -1439,7 +1438,7 @@ private predicate flowStep(PathNodeMid mid, Node node, CallContext cc, AccessPat
14391438
or
14401439
flowOutOfCallable(mid, node, cc) and ap = mid.getAp()
14411440
or
1442-
flowThroughCallable(mid, node, cc) and ap = mid.getAp()
1441+
flowThroughCallable(mid, node, ap, cc)
14431442
}
14441443

14451444
private predicate contentReadStep(PathNodeMid mid, Node node, AccessPath ap) {
@@ -1474,11 +1473,12 @@ private predicate flowOutOfCallable0(PathNodeMid mid, ReturnPosition pos, CallCo
14741473
* is a return from a callable and is recorded by `cc`, if needed.
14751474
*/
14761475
pragma[noinline]
1477-
private predicate flowOutOfCallable(PathNodeMid mid, Node out, CallContext cc) {
1476+
private predicate flowOutOfCallable(PathNodeMid mid, OutNode out, CallContext cc) {
14781477
exists(ReturnPosition pos, DataFlowCallable c, DataFlowCall call, CallContext innercc |
14791478
flowOutOfCallable0(mid, pos, innercc) and
1480-
out = getAnOutputAtCall(call, pos) and
1479+
out = getAViableOutNode(pos) and
14811480
c = pos.getCallable() and
1481+
call = out.getCall() and
14821482
resolveReturn(innercc, c, call)
14831483
|
14841484
if reducedViableImplInReturn(c, call) then cc = TReturn(c, call) else cc = TAnyCallContext()
@@ -1563,11 +1563,12 @@ private predicate flowIntoCallable(
15631563
/** Holds if data may flow from `p` to a return at position `pos`. */
15641564
pragma[nomagic]
15651565
private predicate paramFlowsThrough(
1566-
ParameterNode p, ReturnPosition pos, CallContextCall cc, Configuration config
1566+
ParameterNode p, ReturnPosition pos, AccessPath ap, CallContextCall cc, Configuration config
15671567
) {
15681568
exists(PathNodeMid mid |
15691569
mid.getNode() = pos.getAReturnNode() and
15701570
cc = mid.getCallContext() and
1571+
ap = mid.getAp() and
15711572
config = mid.getConfiguration()
15721573
|
15731574
cc = TSomeCall(p, true)
@@ -1581,11 +1582,11 @@ private predicate paramFlowsThrough(
15811582
* The context `cc` is restored to its value prior to entering the callable.
15821583
*/
15831584
pragma[noinline]
1584-
private predicate flowThroughCallable(PathNodeMid mid, Node out, CallContext cc) {
1585-
exists(DataFlowCall call, ParameterNode p, ReturnPosition pos, CallContext innercc |
1586-
flowIntoCallable(mid, p, cc, innercc, call) and
1587-
paramFlowsThrough(p, pos, innercc, unbind(mid.getConfiguration())) and
1588-
out = getAnOutputAtCall(call, pos)
1585+
private predicate flowThroughCallable(PathNodeMid mid, OutNode out, AccessPath ap, CallContext cc) {
1586+
exists(ParameterNode p, ReturnPosition pos, CallContext innercc |
1587+
flowIntoCallable(mid, p, cc, innercc, out.getCall()) and
1588+
paramFlowsThrough(p, pos, ap, innercc, unbind(mid.getConfiguration())) and
1589+
out = getAViableOutNode(pos)
15891590
)
15901591
}
15911592

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll‎

Lines changed: 16 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -206,7 +206,7 @@ private predicate nodeCandFwd1(Node node, boolean stored, Configuration config)
206206
// flow out of a callable
207207
exists(ReturnNode ret |
208208
nodeCandFwd1(ret, stored, config) and
209-
node = getAnOutputAtCall(_, ret.getPosition())
209+
node = getAViableOutNode(ret.getPosition())
210210
)
211211
)
212212
}
@@ -282,7 +282,7 @@ private predicate nodeCand1(Node node, boolean stored, Configuration config) {
282282
// flow out of a callable
283283
exists(Node out |
284284
nodeCand1(out, stored, config) and
285-
out = getAnOutputAtCall(_, node.(ReturnNode).getPosition())
285+
out = getAViableOutNode(node.(ReturnNode).getPosition())
286286
)
287287
)
288288
}
@@ -366,9 +366,8 @@ private predicate simpleArgumentFlowsThrough(
366366
exists(ParameterNode param, ReturnNode ret |
367367
nodeCand1(arg, false, unbind(config)) and
368368
nodeCand1(out, false, unbind(config)) and
369-
viableParamArg(param, arg) and
370-
simpleParameterFlow(param, ret, t, config) and
371-
out = getAnOutputAtCall(arg.getCall(), ret.getPosition())
369+
viableParamArgOut(param, arg, ret.getPosition(), out) and
370+
simpleParameterFlow(param, ret, t, config)
372371
)
373372
}
374373

@@ -410,7 +409,7 @@ private predicate flowOutOfCallableCand1(Node node1, Node node2, Configuration c
410409
)
411410
or
412411
// flow out of a callable
413-
node2 = getAnOutputAtCall(_, node1.(ReturnNode).getPosition())
412+
node2 = getAViableOutNode(node1.(ReturnNode).getPosition())
414413
)
415414
}
416415

@@ -1439,7 +1438,7 @@ private predicate flowStep(PathNodeMid mid, Node node, CallContext cc, AccessPat
14391438
or
14401439
flowOutOfCallable(mid, node, cc) and ap = mid.getAp()
14411440
or
1442-
flowThroughCallable(mid, node, cc) and ap = mid.getAp()
1441+
flowThroughCallable(mid, node, ap, cc)
14431442
}
14441443

14451444
private predicate contentReadStep(PathNodeMid mid, Node node, AccessPath ap) {
@@ -1474,11 +1473,12 @@ private predicate flowOutOfCallable0(PathNodeMid mid, ReturnPosition pos, CallCo
14741473
* is a return from a callable and is recorded by `cc`, if needed.
14751474
*/
14761475
pragma[noinline]
1477-
private predicate flowOutOfCallable(PathNodeMid mid, Node out, CallContext cc) {
1476+
private predicate flowOutOfCallable(PathNodeMid mid, OutNode out, CallContext cc) {
14781477
exists(ReturnPosition pos, DataFlowCallable c, DataFlowCall call, CallContext innercc |
14791478
flowOutOfCallable0(mid, pos, innercc) and
1480-
out = getAnOutputAtCall(call, pos) and
1479+
out = getAViableOutNode(pos) and
14811480
c = pos.getCallable() and
1481+
call = out.getCall() and
14821482
resolveReturn(innercc, c, call)
14831483
|
14841484
if reducedViableImplInReturn(c, call) then cc = TReturn(c, call) else cc = TAnyCallContext()
@@ -1563,11 +1563,12 @@ private predicate flowIntoCallable(
15631563
/** Holds if data may flow from `p` to a return at position `pos`. */
15641564
pragma[nomagic]
15651565
private predicate paramFlowsThrough(
1566-
ParameterNode p, ReturnPosition pos, CallContextCall cc, Configuration config
1566+
ParameterNode p, ReturnPosition pos, AccessPath ap, CallContextCall cc, Configuration config
15671567
) {
15681568
exists(PathNodeMid mid |
15691569
mid.getNode() = pos.getAReturnNode() and
15701570
cc = mid.getCallContext() and
1571+
ap = mid.getAp() and
15711572
config = mid.getConfiguration()
15721573
|
15731574
cc = TSomeCall(p, true)
@@ -1581,11 +1582,11 @@ private predicate paramFlowsThrough(
15811582
* The context `cc` is restored to its value prior to entering the callable.
15821583
*/
15831584
pragma[noinline]
1584-
private predicate flowThroughCallable(PathNodeMid mid, Node out, CallContext cc) {
1585-
exists(DataFlowCall call, ParameterNode p, ReturnPosition pos, CallContext innercc |
1586-
flowIntoCallable(mid, p, cc, innercc, call) and
1587-
paramFlowsThrough(p, pos, innercc, unbind(mid.getConfiguration())) and
1588-
out = getAnOutputAtCall(call, pos)
1585+
private predicate flowThroughCallable(PathNodeMid mid, OutNode out, AccessPath ap, CallContext cc) {
1586+
exists(ParameterNode p, ReturnPosition pos, CallContext innercc |
1587+
flowIntoCallable(mid, p, cc, innercc, out.getCall()) and
1588+
paramFlowsThrough(p, pos, ap, innercc, unbind(mid.getConfiguration())) and
1589+
out = getAViableOutNode(pos)
15891590
)
15901591
}
15911592

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll‎

Lines changed: 16 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -206,7 +206,7 @@ private predicate nodeCandFwd1(Node node, boolean stored, Configuration config)
206206
// flow out of a callable
207207
exists(ReturnNode ret |
208208
nodeCandFwd1(ret, stored, config) and
209-
node = getAnOutputAtCall(_, ret.getPosition())
209+
node = getAViableOutNode(ret.getPosition())
210210
)
211211
)
212212
}
@@ -282,7 +282,7 @@ private predicate nodeCand1(Node node, boolean stored, Configuration config) {
282282
// flow out of a callable
283283
exists(Node out |
284284
nodeCand1(out, stored, config) and
285-
out = getAnOutputAtCall(_, node.(ReturnNode).getPosition())
285+
out = getAViableOutNode(node.(ReturnNode).getPosition())
286286
)
287287
)
288288
}
@@ -366,9 +366,8 @@ private predicate simpleArgumentFlowsThrough(
366366
exists(ParameterNode param, ReturnNode ret |
367367
nodeCand1(arg, false, unbind(config)) and
368368
nodeCand1(out, false, unbind(config)) and
369-
viableParamArg(param, arg) and
370-
simpleParameterFlow(param, ret, t, config) and
371-
out = getAnOutputAtCall(arg.getCall(), ret.getPosition())
369+
viableParamArgOut(param, arg, ret.getPosition(), out) and
370+
simpleParameterFlow(param, ret, t, config)
372371
)
373372
}
374373

@@ -410,7 +409,7 @@ private predicate flowOutOfCallableCand1(Node node1, Node node2, Configuration c
410409
)
411410
or
412411
// flow out of a callable
413-
node2 = getAnOutputAtCall(_, node1.(ReturnNode).getPosition())
412+
node2 = getAViableOutNode(node1.(ReturnNode).getPosition())
414413
)
415414
}
416415

@@ -1439,7 +1438,7 @@ private predicate flowStep(PathNodeMid mid, Node node, CallContext cc, AccessPat
14391438
or
14401439
flowOutOfCallable(mid, node, cc) and ap = mid.getAp()
14411440
or
1442-
flowThroughCallable(mid, node, cc) and ap = mid.getAp()
1441+
flowThroughCallable(mid, node, ap, cc)
14431442
}
14441443

14451444
private predicate contentReadStep(PathNodeMid mid, Node node, AccessPath ap) {
@@ -1474,11 +1473,12 @@ private predicate flowOutOfCallable0(PathNodeMid mid, ReturnPosition pos, CallCo
14741473
* is a return from a callable and is recorded by `cc`, if needed.
14751474
*/
14761475
pragma[noinline]
1477-
private predicate flowOutOfCallable(PathNodeMid mid, Node out, CallContext cc) {
1476+
private predicate flowOutOfCallable(PathNodeMid mid, OutNode out, CallContext cc) {
14781477
exists(ReturnPosition pos, DataFlowCallable c, DataFlowCall call, CallContext innercc |
14791478
flowOutOfCallable0(mid, pos, innercc) and
1480-
out = getAnOutputAtCall(call, pos) and
1479+
out = getAViableOutNode(pos) and
14811480
c = pos.getCallable() and
1481+
call = out.getCall() and
14821482
resolveReturn(innercc, c, call)
14831483
|
14841484
if reducedViableImplInReturn(c, call) then cc = TReturn(c, call) else cc = TAnyCallContext()
@@ -1563,11 +1563,12 @@ private predicate flowIntoCallable(
15631563
/** Holds if data may flow from `p` to a return at position `pos`. */
15641564
pragma[nomagic]
15651565
private predicate paramFlowsThrough(
1566-
ParameterNode p, ReturnPosition pos, CallContextCall cc, Configuration config
1566+
ParameterNode p, ReturnPosition pos, AccessPath ap, CallContextCall cc, Configuration config
15671567
) {
15681568
exists(PathNodeMid mid |
15691569
mid.getNode() = pos.getAReturnNode() and
15701570
cc = mid.getCallContext() and
1571+
ap = mid.getAp() and
15711572
config = mid.getConfiguration()
15721573
|
15731574
cc = TSomeCall(p, true)
@@ -1581,11 +1582,11 @@ private predicate paramFlowsThrough(
15811582
* The context `cc` is restored to its value prior to entering the callable.
15821583
*/
15831584
pragma[noinline]
1584-
private predicate flowThroughCallable(PathNodeMid mid, Node out, CallContext cc) {
1585-
exists(DataFlowCall call, ParameterNode p, ReturnPosition pos, CallContext innercc |
1586-
flowIntoCallable(mid, p, cc, innercc, call) and
1587-
paramFlowsThrough(p, pos, innercc, unbind(mid.getConfiguration())) and
1588-
out = getAnOutputAtCall(call, pos)
1585+
private predicate flowThroughCallable(PathNodeMid mid, OutNode out, AccessPath ap, CallContext cc) {
1586+
exists(ParameterNode p, ReturnPosition pos, CallContext innercc |
1587+
flowIntoCallable(mid, p, cc, innercc, out.getCall()) and
1588+
paramFlowsThrough(p, pos, ap, innercc, unbind(mid.getConfiguration())) and
1589+
out = getAViableOutNode(pos)
15891590
)
15901591
}
15911592

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll‎

Lines changed: 16 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -206,7 +206,7 @@ private predicate nodeCandFwd1(Node node, boolean stored, Configuration config)
206206
// flow out of a callable
207207
exists(ReturnNode ret |
208208
nodeCandFwd1(ret, stored, config) and
209-
node = getAnOutputAtCall(_, ret.getPosition())
209+
node = getAViableOutNode(ret.getPosition())
210210
)
211211
)
212212
}
@@ -282,7 +282,7 @@ private predicate nodeCand1(Node node, boolean stored, Configuration config) {
282282
// flow out of a callable
283283
exists(Node out |
284284
nodeCand1(out, stored, config) and
285-
out = getAnOutputAtCall(_, node.(ReturnNode).getPosition())
285+
out = getAViableOutNode(node.(ReturnNode).getPosition())
286286
)
287287
)
288288
}
@@ -366,9 +366,8 @@ private predicate simpleArgumentFlowsThrough(
366366
exists(ParameterNode param, ReturnNode ret |
367367
nodeCand1(arg, false, unbind(config)) and
368368
nodeCand1(out, false, unbind(config)) and
369-
viableParamArg(param, arg) and
370-
simpleParameterFlow(param, ret, t, config) and
371-
out = getAnOutputAtCall(arg.getCall(), ret.getPosition())
369+
viableParamArgOut(param, arg, ret.getPosition(), out) and
370+
simpleParameterFlow(param, ret, t, config)
372371
)
373372
}
374373

@@ -410,7 +409,7 @@ private predicate flowOutOfCallableCand1(Node node1, Node node2, Configuration c
410409
)
411410
or
412411
// flow out of a callable
413-
node2 = getAnOutputAtCall(_, node1.(ReturnNode).getPosition())
412+
node2 = getAViableOutNode(node1.(ReturnNode).getPosition())
414413
)
415414
}
416415

@@ -1439,7 +1438,7 @@ private predicate flowStep(PathNodeMid mid, Node node, CallContext cc, AccessPat
14391438
or
14401439
flowOutOfCallable(mid, node, cc) and ap = mid.getAp()
14411440
or
1442-
flowThroughCallable(mid, node, cc) and ap = mid.getAp()
1441+
flowThroughCallable(mid, node, ap, cc)
14431442
}
14441443

14451444
private predicate contentReadStep(PathNodeMid mid, Node node, AccessPath ap) {
@@ -1474,11 +1473,12 @@ private predicate flowOutOfCallable0(PathNodeMid mid, ReturnPosition pos, CallCo
14741473
* is a return from a callable and is recorded by `cc`, if needed.
14751474
*/
14761475
pragma[noinline]
1477-
private predicate flowOutOfCallable(PathNodeMid mid, Node out, CallContext cc) {
1476+
private predicate flowOutOfCallable(PathNodeMid mid, OutNode out, CallContext cc) {
14781477
exists(ReturnPosition pos, DataFlowCallable c, DataFlowCall call, CallContext innercc |
14791478
flowOutOfCallable0(mid, pos, innercc) and
1480-
out = getAnOutputAtCall(call, pos) and
1479+
out = getAViableOutNode(pos) and
14811480
c = pos.getCallable() and
1481+
call = out.getCall() and
14821482
resolveReturn(innercc, c, call)
14831483
|
14841484
if reducedViableImplInReturn(c, call) then cc = TReturn(c, call) else cc = TAnyCallContext()
@@ -1563,11 +1563,12 @@ private predicate flowIntoCallable(
15631563
/** Holds if data may flow from `p` to a return at position `pos`. */
15641564
pragma[nomagic]
15651565
private predicate paramFlowsThrough(
1566-
ParameterNode p, ReturnPosition pos, CallContextCall cc, Configuration config
1566+
ParameterNode p, ReturnPosition pos, AccessPath ap, CallContextCall cc, Configuration config
15671567
) {
15681568
exists(PathNodeMid mid |
15691569
mid.getNode() = pos.getAReturnNode() and
15701570
cc = mid.getCallContext() and
1571+
ap = mid.getAp() and
15711572
config = mid.getConfiguration()
15721573
|
15731574
cc = TSomeCall(p, true)
@@ -1581,11 +1582,11 @@ private predicate paramFlowsThrough(
15811582
* The context `cc` is restored to its value prior to entering the callable.
15821583
*/
15831584
pragma[noinline]
1584-
private predicate flowThroughCallable(PathNodeMid mid, Node out, CallContext cc) {
1585-
exists(DataFlowCall call, ParameterNode p, ReturnPosition pos, CallContext innercc |
1586-
flowIntoCallable(mid, p, cc, innercc, call) and
1587-
paramFlowsThrough(p, pos, innercc, unbind(mid.getConfiguration())) and
1588-
out = getAnOutputAtCall(call, pos)
1585+
private predicate flowThroughCallable(PathNodeMid mid, OutNode out, AccessPath ap, CallContext cc) {
1586+
exists(ParameterNode p, ReturnPosition pos, CallContext innercc |
1587+
flowIntoCallable(mid, p, cc, innercc, out.getCall()) and
1588+
paramFlowsThrough(p, pos, ap, innercc, unbind(mid.getConfiguration())) and
1589+
out = getAViableOutNode(pos)
15891590
)
15901591
}
15911592

0 commit comments

Comments
 (0)