Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit67ab0aa

Browse files
committed
Modernize dataflow configurations
1 parentd74222a commit67ab0aa

File tree

21 files changed

+209
-203
lines changed

21 files changed

+209
-203
lines changed

‎c/cert/src/rules/ARR37-C/DoNotUsePointerArithmeticOnNonArrayObjectPointers.ql‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -14,16 +14,14 @@
1414
import cpp
1515
import codingstandards.c.cert
1616
import codingstandards.cpp.dataflow.DataFlow
17-
importDataFlow::PathGraph
17+
importNonArrayPointerToArrayIndexingExprFlow::PathGraph
1818

1919
/**
2020
* A data-flow configuration that tracks flow from an `AddressOfExpr` of a variable
2121
* of `PointerType` that is not also an `ArrayType` to a `PointerArithmeticOrArrayExpr`
2222
*/
23-
classNonArrayPointerToArrayIndexingExprConfigextends DataFlow::Configuration{
24-
NonArrayPointerToArrayIndexingExprConfig(){this="ArrayToArrayIndexConfig"}
25-
26-
overridepredicateisSource(DataFlow::Nodesource){
23+
module NonArrayPointerToArrayIndexingExprConfigimplements DataFlow::ConfigSig{
24+
predicateisSource(DataFlow::Nodesource){
2725
exists(AddressOfExprao,Typet|
2826
source.asExpr()=aoand
2927
notao.getOperand()instanceofArrayExprand
@@ -35,15 +33,15 @@ class NonArrayPointerToArrayIndexingExprConfig extends DataFlow::Configuration {
3533
)
3634
}
3735

38-
overridepredicateisSink(DataFlow::Nodesink){
36+
predicateisSink(DataFlow::Nodesink){
3937
exists(PointerArithmeticOrArrayExprae|
4038
sink.asExpr()=ae.getPointerOperand()and
4139
notsink.asExpr()instanceofLiteraland
4240
notae.isNonPointerOperandZero()
4341
)
4442
}
4543

46-
overridepredicateisBarrierOut(DataFlow::Nodenode){
44+
predicateisBarrierOut(DataFlow::Nodenode){
4745
// the default interprocedural data-flow model flows through any field or array assignment
4846
// expressions to the qualifier (array base, pointer dereferenced, or qualifier) instead of the
4947
// individual element or field that the assignment modifies. this default behaviour causes
@@ -63,6 +61,9 @@ class NonArrayPointerToArrayIndexingExprConfig extends DataFlow::Configuration {
6361
}
6462
}
6563

64+
module NonArrayPointerToArrayIndexingExprFlow=
65+
DataFlow::Global<NonArrayPointerToArrayIndexingExprConfig>;
66+
6667
classPointerArithmeticOrArrayExprextendsExpr{
6768
Exproperand;
6869

@@ -101,9 +102,11 @@ class PointerArithmeticOrArrayExpr extends Expr {
101102
predicateisNonPointerOperandZero(){operand.(Literal).getValue().toInt()=0}
102103
}
103104

104-
from DataFlow::PathNodesource, DataFlow::PathNodesink
105+
from
106+
NonArrayPointerToArrayIndexingExprFlow::PathNodesource,
107+
NonArrayPointerToArrayIndexingExprFlow::PathNodesink
105108
where
106109
notisExcluded(sink.getNode().asExpr(),
107110
InvalidMemory2Package::doNotUsePointerArithmeticOnNonArrayObjectPointersQuery())and
108-
any(NonArrayPointerToArrayIndexingExprConfigcfg).hasFlowPath(source,sink)
111+
NonArrayPointerToArrayIndexingExprFlow::flowPath(source,sink)
109112
selectsink,source,sink,"Pointer arithmetic on non-array object pointer."

‎c/cert/src/rules/ARR39-C/DoNotAddOrSubtractAScaledIntegerToAPointer.ql‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ import cpp
1515
import codingstandards.c.cert
1616
import codingstandards.c.Pointers
1717
import codingstandards.cpp.dataflow.TaintTracking
18-
importDataFlow::PathGraph
18+
importScaledIntegerPointerArithmeticFlow::PathGraph
1919

2020
/**
2121
* An expression which invokes the `offsetof` macro or `__builtin_offsetof` operation.
@@ -69,12 +69,10 @@ class ScaledIntegerExpr extends Expr {
6969
* A data-flow configuration modeling data-flow from a `ScaledIntegerExpr` to a
7070
* `PointerArithmeticExpr` where the pointer does not point to a 1-byte type.
7171
*/
72-
classScaledIntegerPointerArithmeticConfigextends DataFlow::Configuration{
73-
ScaledIntegerPointerArithmeticConfig(){this="ScaledIntegerPointerArithmeticConfig"}
72+
module ScaledIntegerPointerArithmeticConfigimplements DataFlow::ConfigSig{
73+
predicateisSource(DataFlow::Nodesrc){src.asExpr()instanceofScaledIntegerExpr}
7474

75-
overridepredicateisSource(DataFlow::Nodesrc){src.asExpr()instanceofScaledIntegerExpr}
76-
77-
overridepredicateisSink(DataFlow::Nodesink){
75+
predicateisSink(DataFlow::Nodesink){
7876
exists(PointerArithmeticExprpa|
7977
// exclude pointers to 1-byte types as they do not scale
8078
pa.getPointer().getFullyConverted().getType().(DerivedType).getBaseType().getSize()!=1and
@@ -83,9 +81,13 @@ class ScaledIntegerPointerArithmeticConfig extends DataFlow::Configuration {
8381
}
8482
}
8583

86-
fromScaledIntegerPointerArithmeticConfigconfig, DataFlow::PathNodesrc, DataFlow::PathNodesink
84+
module ScaledIntegerPointerArithmeticFlow= DataFlow::Global<ScaledIntegerPointerArithmeticConfig>;
85+
86+
from
87+
ScaledIntegerPointerArithmeticFlow::PathNodesrc,
88+
ScaledIntegerPointerArithmeticFlow::PathNodesink
8789
where
8890
notisExcluded(sink.getNode().asExpr(),
8991
Pointers2Package::doNotAddOrSubtractAScaledIntegerToAPointerQuery())and
90-
config.hasFlowPath(src,sink)
92+
ScaledIntegerPointerArithmeticFlow::flowPath(src,sink)
9193
selectsink,src,sink,"Scaled integer used in pointer arithmetic."

‎c/cert/src/rules/CON30-C/CleanUpThreadSpecificStorage.ql‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,8 @@ import codingstandards.cpp.Concurrency
1818
import codingstandards.cpp.dataflow.TaintTracking
1919
import codingstandards.cpp.dataflow.DataFlow
2020

21-
classTssCreateToTssDeleteDataFlowConfigurationextends DataFlow::Configuration{
22-
TssCreateToTssDeleteDataFlowConfiguration(){this="TssCreateToTssDeleteDataFlowConfiguration"}
23-
24-
overridepredicateisSource(DataFlow::Nodenode){
21+
module TssCreateToTssDeleteConfigimplements DataFlow::ConfigSig{
22+
predicateisSource(DataFlow::Nodenode){
2523
exists(TSSCreateFunctionCalltsc,Expre|
2624
// the only requirement of the source is that at some point
2725
// it refers to the key of a create statement
@@ -30,7 +28,7 @@ class TssCreateToTssDeleteDataFlowConfiguration extends DataFlow::Configuration
3028
)
3129
}
3230

33-
overridepredicateisSink(DataFlow::Nodenode){
31+
predicateisSink(DataFlow::Nodenode){
3432
exists(TSSDeleteFunctionCalltsd,Expre|
3533
// the only requirement of a sink is that at some point
3634
// it references the key of a delete call.
@@ -40,15 +38,17 @@ class TssCreateToTssDeleteDataFlowConfiguration extends DataFlow::Configuration
4038
}
4139
}
4240

41+
module TssCreateToTssDeleteFlow= DataFlow::Global<TssCreateToTssDeleteConfig>;
42+
4343
fromTSSCreateFunctionCalltcfc
4444
where
4545
notisExcluded(tcfc, Concurrency4Package::cleanUpThreadSpecificStorageQuery())and
4646
// all calls to `tss_create` must be bookended by calls to tss_delete
4747
// even if a thread is not created.
48-
notexists(TssCreateToTssDeleteDataFlowConfigurationconfig|
49-
config.hasFlow(DataFlow::definitionByReferenceNodeFromArgument(tcfc.getKey()), _)
48+
not(
49+
TssCreateToTssDeleteFlow::flow(DataFlow::definitionByReferenceNodeFromArgument(tcfc.getKey()), _)
5050
or
51-
config.hasFlow(DataFlow::exprNode(tcfc.getKey()), _)
51+
TssCreateToTssDeleteFlow::flow(DataFlow::exprNode(tcfc.getKey()), _)
5252
)
5353
or
5454
// if a thread is created, we must check additional items

‎c/cert/src/rules/EXP36-C/DoNotCastPointerToMoreStrictlyAlignedPointerType.ql‎

Lines changed: 18 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ import codingstandards.cpp.Alignment
1717
import codingstandards.cpp.dataflow.DataFlow
1818
import codingstandards.cpp.dataflow.DataFlow2
1919
import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
20-
importDataFlow::PathGraph
20+
importExprWithAlignmentToCStyleCastFlow::PathGraph
2121

2222
/**
2323
* An expression with a type that has defined alignment requirements
@@ -96,8 +96,7 @@ class UnconvertedCastFromNonVoidPointerExpr extends Expr {
9696
*/
9797
classDefaultAlignedPointerExprextendsUnconvertedCastFromNonVoidPointerExpr,ExprWithAlignment{
9898
DefaultAlignedPointerExpr(){
99-
notany(AllocationOrAddressOfExprToUnconvertedCastFromNonVoidPointerExprConfigconfig)
100-
.hasFlowTo(DataFlow::exprNode(this))
99+
not AllocationOrAddressOfExprToUnconvertedCastFromNonVoidPointerExprFlow::flowTo(DataFlow::exprNode(this))
101100
}
102101

103102
overrideintgetAlignment(){result=this.getType().(PointerType).getBaseType().getAlignment()}
@@ -118,43 +117,37 @@ class DefaultAlignedPointerExpr extends UnconvertedCastFromNonVoidPointerExpr, E
118117
* to exclude an `DefaultAlignedPointerAccessExpr` as a source if a preceding source
119118
* defined by this configuration provides more accurate alignment information.
120119
*/
121-
classAllocationOrAddressOfExprToUnconvertedCastFromNonVoidPointerExprConfigextends DataFlow2::Configuration
120+
module AllocationOrAddressOfExprToUnconvertedCastFromNonVoidPointerExprConfigimplements
121+
DataFlow::ConfigSig
122122
{
123-
AllocationOrAddressOfExprToUnconvertedCastFromNonVoidPointerExprConfig(){
124-
this="AllocationOrAddressOfExprToUnconvertedCastFromNonVoidPointerExprConfig"
125-
}
126-
127-
overridepredicateisSource(DataFlow::Nodesource){
123+
predicateisSource(DataFlow::Nodesource){
128124
source.asExpr()instanceofAddressOfAlignedVariableExpror
129125
source.asExpr()instanceofDefinedAlignmentAllocationExpr
130126
}
131127

132-
overridepredicateisSink(DataFlow::Nodesink){
128+
predicateisSink(DataFlow::Nodesink){
133129
sink.asExpr()instanceofUnconvertedCastFromNonVoidPointerExpr
134130
}
135131
}
136132

133+
module AllocationOrAddressOfExprToUnconvertedCastFromNonVoidPointerExprFlow=
134+
DataFlow::Global<AllocationOrAddressOfExprToUnconvertedCastFromNonVoidPointerExprConfig>;
135+
137136
/**
138137
* A data-flow configuration for analysing the flow of `ExprWithAlignment` pointer expressions
139138
* to casts which perform pointer type conversions and potentially create pointer alignment issues.
140139
*/
141-
classExprWithAlignmentToCStyleCastConfigurationextends DataFlow::Configuration{
142-
ExprWithAlignmentToCStyleCastConfiguration(){
143-
this="ExprWithAlignmentToCStyleCastConfiguration"
144-
}
140+
module ExprWithAlignmentToCStyleCastConfigimplements DataFlow::ConfigSig{
141+
predicateisSource(DataFlow::Nodesource){source.asExpr()instanceofExprWithAlignment}
145142

146-
overridepredicateisSource(DataFlow::Nodesource){
147-
source.asExpr()instanceofExprWithAlignment
148-
}
149-
150-
overridepredicateisSink(DataFlow::Nodesink){
143+
predicateisSink(DataFlow::Nodesink){
151144
exists(CStyleCastcast|
152145
cast.getUnderlyingType()instanceofPointerTypeand
153146
cast.getUnconverted()=sink.asExpr()
154147
)
155148
}
156149

157-
overridepredicateisBarrierOut(DataFlow::Nodenode){
150+
predicateisBarrierOut(DataFlow::Nodenode){
158151
// the default interprocedural data-flow model flows through any array assignment expressions
159152
// to the qualifier (array base or pointer dereferenced) instead of the individual element
160153
// that the assignment modifies. this default behaviour causes false positives for any future
@@ -169,12 +162,15 @@ class ExprWithAlignmentToCStyleCastConfiguration extends DataFlow::Configuration
169162
}
170163
}
171164

165+
module ExprWithAlignmentToCStyleCastFlow= DataFlow::Global<ExprWithAlignmentToCStyleCastConfig>;
166+
172167
from
173-
DataFlow::PathNodesource, DataFlow::PathNodesink,ExprWithAlignmentexpr,CStyleCastcast,
168+
ExprWithAlignmentToCStyleCastFlow::PathNodesource,
169+
ExprWithAlignmentToCStyleCastFlow::PathNodesink,ExprWithAlignmentexpr,CStyleCastcast,
174170
TypetoBaseType,intalignmentFrom,intalignmentTo
175171
where
176172
notisExcluded(cast, Pointers3Package::doNotCastPointerToMoreStrictlyAlignedPointerTypeQuery())and
177-
any(ExprWithAlignmentToCStyleCastConfigurationconfig).hasFlowPath(source,sink)and
173+
ExprWithAlignmentToCStyleCastFlow::flowPath(source,sink)and
178174
source.getNode().asExpr()=exprand
179175
sink.getNode().asExpr()=cast.getUnconverted()and
180176
toBaseType=cast.getActualType().(PointerType).getBaseType()and

‎c/cert/src/rules/EXP37-C/DoNotCallFunctionPointerWithIncompatibleType.ql‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
import cpp
1515
import codingstandards.c.cert
1616
import codingstandards.cpp.dataflow.DataFlow
17-
importDataFlow::PathGraph
17+
importSuspectFunctionPointerToCallFlow::PathGraph
1818

1919
/**
2020
* An expression of type `FunctionPointer` which is the unconverted expression of a cast
@@ -37,26 +37,26 @@ class SuspiciousFunctionPointerCastExpr extends Expr {
3737
* Data-flow configuration for flow from a `SuspiciousFunctionPointerCastExpr`
3838
* to a call of the function pointer resulting from the function pointer cast
3939
*/
40-
classSuspectFunctionPointerToCallConfigextends DataFlow::Configuration{
41-
SuspectFunctionPointerToCallConfig(){this="SuspectFunctionPointerToCallConfig"}
42-
43-
overridepredicateisSource(DataFlow::Nodesrc){
40+
module SuspectFunctionPointerToCallConfigimplements DataFlow::ConfigSig{
41+
predicateisSource(DataFlow::Nodesrc){
4442
src.asExpr()instanceofSuspiciousFunctionPointerCastExpr
4543
}
4644

47-
overridepredicateisSink(DataFlow::Nodesink){
45+
predicateisSink(DataFlow::Nodesink){
4846
exists(VariableCallcall|sink.asExpr()=call.getExpr().(VariableAccess))
4947
}
5048
}
5149

50+
module SuspectFunctionPointerToCallFlow= DataFlow::Global<SuspectFunctionPointerToCallConfig>;
51+
5252
from
53-
SuspectFunctionPointerToCallConfigconfig, DataFlow::PathNodesrc,DataFlow::PathNodesink,
53+
SuspectFunctionPointerToCallFlow::PathNodesrc,SuspectFunctionPointerToCallFlow::PathNodesink,
5454
Accessaccess
5555
where
5656
notisExcluded(src.getNode().asExpr(),
5757
ExpressionsPackage::doNotCallFunctionPointerWithIncompatibleTypeQuery())and
5858
access=src.getNode().asExpr()and
59-
config.hasFlowPath(src,sink)
59+
SuspectFunctionPointerToCallFlow::flowPath(src,sink)
6060
selectsrc,src,sink,
6161
"Incompatible function $@ assigned to function pointer is eventually called through the pointer.",
6262
access.getTarget(),access.getTarget().getName()

‎c/cert/src/rules/EXP39-C/DoNotAccessVariableViaPointerOfIncompatibleType.ql‎

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ import cpp
1515
import codingstandards.c.cert
1616
import codingstandards.cpp.dataflow.DataFlow
1717
import semmle.code.cpp.controlflow.Dominance
18-
importDataFlow::PathGraph
18+
importIndirectCastFlow::PathGraph
1919

2020
/**
2121
* The standard function `memset` and its assorted variants
@@ -62,15 +62,15 @@ class IndirectCastReallocatedFlowState extends DataFlow::FlowState {
6262
* other cast expressions or to dereferences of pointers reallocated with a call
6363
* to `realloc` but not cleared via a function call to `memset`.
6464
*/
65-
classIndirectCastConfigurationextends DataFlow::Configuration{
66-
IndirectCastConfiguration(){this="CastToIncompatibleTypeConfiguration"}
65+
module IndirectCastConfigimplements DataFlow::StateConfigSig{
66+
classFlowState= DataFlow::FlowState;
6767

68-
overridepredicateisSource(DataFlow::Nodesource,DataFlow::FlowStatestate){
68+
predicateisSource(DataFlow::Nodesource,FlowStatestate){
6969
stateinstanceofIndirectCastDefaultFlowStateand
7070
source.asExpr()instanceofIndirectCastAnalysisUnconvertedCastExpr
7171
}
7272

73-
overridepredicateisSink(DataFlow::Nodesink,DataFlow::FlowStatestate){
73+
predicateisSink(DataFlow::Nodesink,FlowStatestate){
7474
sink.asExpr()instanceofIndirectCastAnalysisUnconvertedCastExprand
7575
stateinstanceofIndirectCastDefaultFlowState
7676
or
@@ -103,17 +103,16 @@ class IndirectCastConfiguration extends DataFlow::Configuration {
103103
)
104104
}
105105

106-
overridepredicateisBarrier(DataFlow::Nodenode,DataFlow::FlowStatestate){
106+
predicateisBarrier(DataFlow::Nodenode,FlowStatestate){
107107
stateinstanceofIndirectCastReallocatedFlowStateand
108108
exists(FunctionCallfc|
109109
fc.getTarget()instanceofMemsetFunctionand
110110
fc.getArgument(0)=node.asExpr()
111111
)
112112
}
113113

114-
overridepredicateisAdditionalFlowStep(
115-
DataFlow::Nodenode1, DataFlow::FlowStatestate1, DataFlow::Nodenode2,
116-
DataFlow::FlowStatestate2
114+
predicateisAdditionalFlowStep(
115+
DataFlow::Nodenode1,FlowStatestate1, DataFlow::Nodenode2,FlowStatestate2
117116
){
118117
// track pointer flow through realloc calls and update state to `IndirectCastReallocatedFlowState`
119118
state1instanceofIndirectCastDefaultFlowStateand
@@ -135,6 +134,8 @@ class IndirectCastConfiguration extends DataFlow::Configuration {
135134
}
136135
}
137136

137+
module IndirectCastFlow= DataFlow::GlobalWithState<IndirectCastConfig>;
138+
138139
pragma[inline]
139140
predicateareTypesSameExceptForConstSpecifiers(Typea,Typeb){
140141
a.stripType()=b.stripType()and
@@ -190,12 +191,14 @@ Type compatibleTypes(Type type) {
190191
)
191192
}
192193

193-
from DataFlow::PathNodesource, DataFlow::PathNodesink,Castcast,TypefromType,TypetoType
194+
from
195+
IndirectCastFlow::PathNodesource, IndirectCastFlow::PathNodesink,Castcast,TypefromType,
196+
TypetoType
194197
where
195198
notisExcluded(sink.getNode().asExpr(),
196199
Pointers3Package::doNotAccessVariableViaPointerOfIncompatibleTypeQuery())and
197200
cast.getFile().compiledAsC()and
198-
any(IndirectCastConfigurationconfig).hasFlowPath(source,sink)and
201+
IndirectCastFlow::flowPath(source,sink)and
199202
// include only sinks which are not a compatible type to the associated source
200203
source.getNode().asExpr()=cast.getUnconverted()and
201204
fromType=cast.getUnconverted().getType().(PointerType).getBaseType()and

‎c/cert/src/rules/EXP40-C/DoNotModifyConstantObjects.ql‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
import cpp
1414
import codingstandards.c.cert
1515
import codingstandards.cpp.dataflow.DataFlow
16-
importDataFlow::PathGraph
16+
importCastFlow::PathGraph
1717
import codingstandards.cpp.SideEffect
1818

1919
classConstRemovingCastextendsCast{
@@ -32,23 +32,23 @@ class MaybeReturnsStringLiteralFunctionCall extends FunctionCall {
3232
}
3333
}
3434

35-
classMyDataFlowConfCastextends DataFlow::Configuration{
36-
MyDataFlowConfCast(){this="MyDataFlowConfCast"}
37-
38-
overridepredicateisSource(DataFlow::Nodesource){
35+
module CastConfigimplements DataFlow::ConfigSig{
36+
predicateisSource(DataFlow::Nodesource){
3937
source.asExpr().getFullyConverted()instanceofConstRemovingCast
4038
or
4139
source.asExpr().getFullyConverted()=any(MaybeReturnsStringLiteralFunctionCallc)
4240
}
4341

44-
overridepredicateisSink(DataFlow::Nodesink){
42+
predicateisSink(DataFlow::Nodesink){
4543
sink.asExpr()=any(Assignmenta).getLValue().(PointerDereferenceExpr).getOperand()
4644
}
4745
}
4846

49-
fromMyDataFlowConfCastconf, DataFlow::PathNodesrc, DataFlow::PathNodesink
47+
module CastFlow= DataFlow::Global<CastConfig>;
48+
49+
from CastFlow::PathNodesrc, CastFlow::PathNodesink
5050
where
51-
conf.hasFlowPath(src,sink)
51+
CastFlow::flowPath(src,sink)
5252
or
5353
sink.getNode()
5454
.asExpr()

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp