Skip to content

Commit cde853c

Browse files
aschackmullaschackmull
authored
Merge pull request #7270 from aschackmull/dataflow/stage2-refactor
Dataflow: Stage 2 refactor
2 parents b40c77d + 3e914ef commit cde853c

File tree

27 files changed

+513
-54
lines changed

27 files changed

+513
-54
lines changed

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1012,6 +1012,9 @@ private module Stage2 {
10121012

10131013
private predicate flowIntoCall = flowIntoCallNodeCand1/5;
10141014

1015+
bindingset[node, ap]
1016+
private predicate filter(NodeEx node, Ap ap) { any() }
1017+
10151018
bindingset[ap, contentType]
10161019
private predicate typecheckStore(Ap ap, DataFlowType contentType) { any() }
10171020

@@ -1020,6 +1023,13 @@ private module Stage2 {
10201023
PrevStage::revFlow(node, _, _, apa, config)
10211024
}
10221025

1026+
bindingset[result, apa]
1027+
private ApApprox unbindApa(ApApprox apa) {
1028+
exists(ApApprox apa0 |
1029+
apa = pragma[only_bind_into](apa0) and result = pragma[only_bind_into](apa0)
1030+
)
1031+
}
1032+
10231033
pragma[nomagic]
10241034
private predicate flowThroughOutOfCall(
10251035
DataFlowCall call, CcCall ccc, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow,
@@ -1042,6 +1052,13 @@ private module Stage2 {
10421052
*/
10431053
pragma[nomagic]
10441054
predicate fwdFlow(NodeEx node, Cc cc, ApOption argAp, Ap ap, Configuration config) {
1055+
fwdFlow0(node, cc, argAp, ap, config) and
1056+
flowCand(node, unbindApa(getApprox(ap)), config) and
1057+
filter(node, ap)
1058+
}
1059+
1060+
pragma[nomagic]
1061+
private predicate fwdFlow0(NodeEx node, Cc cc, ApOption argAp, Ap ap, Configuration config) {
10451062
flowCand(node, _, config) and
10461063
sourceNode(node, config) and
10471064
(if hasSourceCallCtx(config) then cc = ccSomeCall() else cc = ccNone()) and
@@ -1112,7 +1129,7 @@ private module Stage2 {
11121129
) {
11131130
exists(DataFlowType contentType |
11141131
fwdFlow(node1, cc, argAp, ap1, config) and
1115-
PrevStage::storeStepCand(node1, getApprox(ap1), tc, node2, contentType, config) and
1132+
PrevStage::storeStepCand(node1, unbindApa(getApprox(ap1)), tc, node2, contentType, config) and
11161133
typecheckStore(ap1, contentType)
11171134
)
11181135
}
@@ -1189,7 +1206,7 @@ private module Stage2 {
11891206
) {
11901207
exists(ParamNodeEx p |
11911208
fwdFlowIn(call, p, cc, _, argAp, ap, config) and
1192-
PrevStage::parameterMayFlowThrough(p, _, getApprox(ap), config)
1209+
PrevStage::parameterMayFlowThrough(p, _, unbindApa(getApprox(ap)), config)
11931210
)
11941211
}
11951212

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1012,6 +1012,9 @@ private module Stage2 {
10121012

10131013
private predicate flowIntoCall = flowIntoCallNodeCand1/5;
10141014

1015+
bindingset[node, ap]
1016+
private predicate filter(NodeEx node, Ap ap) { any() }
1017+
10151018
bindingset[ap, contentType]
10161019
private predicate typecheckStore(Ap ap, DataFlowType contentType) { any() }
10171020

@@ -1020,6 +1023,13 @@ private module Stage2 {
10201023
PrevStage::revFlow(node, _, _, apa, config)
10211024
}
10221025

1026+
bindingset[result, apa]
1027+
private ApApprox unbindApa(ApApprox apa) {
1028+
exists(ApApprox apa0 |
1029+
apa = pragma[only_bind_into](apa0) and result = pragma[only_bind_into](apa0)
1030+
)
1031+
}
1032+
10231033
pragma[nomagic]
10241034
private predicate flowThroughOutOfCall(
10251035
DataFlowCall call, CcCall ccc, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow,
@@ -1042,6 +1052,13 @@ private module Stage2 {
10421052
*/
10431053
pragma[nomagic]
10441054
predicate fwdFlow(NodeEx node, Cc cc, ApOption argAp, Ap ap, Configuration config) {
1055+
fwdFlow0(node, cc, argAp, ap, config) and
1056+
flowCand(node, unbindApa(getApprox(ap)), config) and
1057+
filter(node, ap)
1058+
}
1059+
1060+
pragma[nomagic]
1061+
private predicate fwdFlow0(NodeEx node, Cc cc, ApOption argAp, Ap ap, Configuration config) {
10451062
flowCand(node, _, config) and
10461063
sourceNode(node, config) and
10471064
(if hasSourceCallCtx(config) then cc = ccSomeCall() else cc = ccNone()) and
@@ -1112,7 +1129,7 @@ private module Stage2 {
11121129
) {
11131130
exists(DataFlowType contentType |
11141131
fwdFlow(node1, cc, argAp, ap1, config) and
1115-
PrevStage::storeStepCand(node1, getApprox(ap1), tc, node2, contentType, config) and
1132+
PrevStage::storeStepCand(node1, unbindApa(getApprox(ap1)), tc, node2, contentType, config) and
11161133
typecheckStore(ap1, contentType)
11171134
)
11181135
}
@@ -1189,7 +1206,7 @@ private module Stage2 {
11891206
) {
11901207
exists(ParamNodeEx p |
11911208
fwdFlowIn(call, p, cc, _, argAp, ap, config) and
1192-
PrevStage::parameterMayFlowThrough(p, _, getApprox(ap), config)
1209+
PrevStage::parameterMayFlowThrough(p, _, unbindApa(getApprox(ap)), config)
11931210
)
11941211
}
11951212

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1012,6 +1012,9 @@ private module Stage2 {
10121012

10131013
private predicate flowIntoCall = flowIntoCallNodeCand1/5;
10141014

1015+
bindingset[node, ap]
1016+
private predicate filter(NodeEx node, Ap ap) { any() }
1017+
10151018
bindingset[ap, contentType]
10161019
private predicate typecheckStore(Ap ap, DataFlowType contentType) { any() }
10171020

@@ -1020,6 +1023,13 @@ private module Stage2 {
10201023
PrevStage::revFlow(node, _, _, apa, config)
10211024
}
10221025

1026+
bindingset[result, apa]
1027+
private ApApprox unbindApa(ApApprox apa) {
1028+
exists(ApApprox apa0 |
1029+
apa = pragma[only_bind_into](apa0) and result = pragma[only_bind_into](apa0)
1030+
)
1031+
}
1032+
10231033
pragma[nomagic]
10241034
private predicate flowThroughOutOfCall(
10251035
DataFlowCall call, CcCall ccc, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow,
@@ -1042,6 +1052,13 @@ private module Stage2 {
10421052
*/
10431053
pragma[nomagic]
10441054
predicate fwdFlow(NodeEx node, Cc cc, ApOption argAp, Ap ap, Configuration config) {
1055+
fwdFlow0(node, cc, argAp, ap, config) and
1056+
flowCand(node, unbindApa(getApprox(ap)), config) and
1057+
filter(node, ap)
1058+
}
1059+
1060+
pragma[nomagic]
1061+
private predicate fwdFlow0(NodeEx node, Cc cc, ApOption argAp, Ap ap, Configuration config) {
10451062
flowCand(node, _, config) and
10461063
sourceNode(node, config) and
10471064
(if hasSourceCallCtx(config) then cc = ccSomeCall() else cc = ccNone()) and
@@ -1112,7 +1129,7 @@ private module Stage2 {
11121129
) {
11131130
exists(DataFlowType contentType |
11141131
fwdFlow(node1, cc, argAp, ap1, config) and
1115-
PrevStage::storeStepCand(node1, getApprox(ap1), tc, node2, contentType, config) and
1132+
PrevStage::storeStepCand(node1, unbindApa(getApprox(ap1)), tc, node2, contentType, config) and
11161133
typecheckStore(ap1, contentType)
11171134
)
11181135
}
@@ -1189,7 +1206,7 @@ private module Stage2 {
11891206
) {
11901207
exists(ParamNodeEx p |
11911208
fwdFlowIn(call, p, cc, _, argAp, ap, config) and
1192-
PrevStage::parameterMayFlowThrough(p, _, getApprox(ap), config)
1209+
PrevStage::parameterMayFlowThrough(p, _, unbindApa(getApprox(ap)), config)
11931210
)
11941211
}
11951212

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1012,6 +1012,9 @@ private module Stage2 {
10121012

10131013
private predicate flowIntoCall = flowIntoCallNodeCand1/5;
10141014

1015+
bindingset[node, ap]
1016+
private predicate filter(NodeEx node, Ap ap) { any() }
1017+
10151018
bindingset[ap, contentType]
10161019
private predicate typecheckStore(Ap ap, DataFlowType contentType) { any() }
10171020

@@ -1020,6 +1023,13 @@ private module Stage2 {
10201023
PrevStage::revFlow(node, _, _, apa, config)
10211024
}
10221025

1026+
bindingset[result, apa]
1027+
private ApApprox unbindApa(ApApprox apa) {
1028+
exists(ApApprox apa0 |
1029+
apa = pragma[only_bind_into](apa0) and result = pragma[only_bind_into](apa0)
1030+
)
1031+
}
1032+
10231033
pragma[nomagic]
10241034
private predicate flowThroughOutOfCall(
10251035
DataFlowCall call, CcCall ccc, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow,
@@ -1042,6 +1052,13 @@ private module Stage2 {
10421052
*/
10431053
pragma[nomagic]
10441054
predicate fwdFlow(NodeEx node, Cc cc, ApOption argAp, Ap ap, Configuration config) {
1055+
fwdFlow0(node, cc, argAp, ap, config) and
1056+
flowCand(node, unbindApa(getApprox(ap)), config) and
1057+
filter(node, ap)
1058+
}
1059+
1060+
pragma[nomagic]
1061+
private predicate fwdFlow0(NodeEx node, Cc cc, ApOption argAp, Ap ap, Configuration config) {
10451062
flowCand(node, _, config) and
10461063
sourceNode(node, config) and
10471064
(if hasSourceCallCtx(config) then cc = ccSomeCall() else cc = ccNone()) and
@@ -1112,7 +1129,7 @@ private module Stage2 {
11121129
) {
11131130
exists(DataFlowType contentType |
11141131
fwdFlow(node1, cc, argAp, ap1, config) and
1115-
PrevStage::storeStepCand(node1, getApprox(ap1), tc, node2, contentType, config) and
1132+
PrevStage::storeStepCand(node1, unbindApa(getApprox(ap1)), tc, node2, contentType, config) and
11161133
typecheckStore(ap1, contentType)
11171134
)
11181135
}
@@ -1189,7 +1206,7 @@ private module Stage2 {
11891206
) {
11901207
exists(ParamNodeEx p |
11911208
fwdFlowIn(call, p, cc, _, argAp, ap, config) and
1192-
PrevStage::parameterMayFlowThrough(p, _, getApprox(ap), config)
1209+
PrevStage::parameterMayFlowThrough(p, _, unbindApa(getApprox(ap)), config)
11931210
)
11941211
}
11951212

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1012,6 +1012,9 @@ private module Stage2 {
10121012

10131013
private predicate flowIntoCall = flowIntoCallNodeCand1/5;
10141014

1015+
bindingset[node, ap]
1016+
private predicate filter(NodeEx node, Ap ap) { any() }
1017+
10151018
bindingset[ap, contentType]
10161019
private predicate typecheckStore(Ap ap, DataFlowType contentType) { any() }
10171020

@@ -1020,6 +1023,13 @@ private module Stage2 {
10201023
PrevStage::revFlow(node, _, _, apa, config)
10211024
}
10221025

1026+
bindingset[result, apa]
1027+
private ApApprox unbindApa(ApApprox apa) {
1028+
exists(ApApprox apa0 |
1029+
apa = pragma[only_bind_into](apa0) and result = pragma[only_bind_into](apa0)
1030+
)
1031+
}
1032+
10231033
pragma[nomagic]
10241034
private predicate flowThroughOutOfCall(
10251035
DataFlowCall call, CcCall ccc, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow,
@@ -1042,6 +1052,13 @@ private module Stage2 {
10421052
*/
10431053
pragma[nomagic]
10441054
predicate fwdFlow(NodeEx node, Cc cc, ApOption argAp, Ap ap, Configuration config) {
1055+
fwdFlow0(node, cc, argAp, ap, config) and
1056+
flowCand(node, unbindApa(getApprox(ap)), config) and
1057+
filter(node, ap)
1058+
}
1059+
1060+
pragma[nomagic]
1061+
private predicate fwdFlow0(NodeEx node, Cc cc, ApOption argAp, Ap ap, Configuration config) {
10451062
flowCand(node, _, config) and
10461063
sourceNode(node, config) and
10471064
(if hasSourceCallCtx(config) then cc = ccSomeCall() else cc = ccNone()) and
@@ -1112,7 +1129,7 @@ private module Stage2 {
11121129
) {
11131130
exists(DataFlowType contentType |
11141131
fwdFlow(node1, cc, argAp, ap1, config) and
1115-
PrevStage::storeStepCand(node1, getApprox(ap1), tc, node2, contentType, config) and
1132+
PrevStage::storeStepCand(node1, unbindApa(getApprox(ap1)), tc, node2, contentType, config) and
11161133
typecheckStore(ap1, contentType)
11171134
)
11181135
}
@@ -1189,7 +1206,7 @@ private module Stage2 {
11891206
) {
11901207
exists(ParamNodeEx p |
11911208
fwdFlowIn(call, p, cc, _, argAp, ap, config) and
1192-
PrevStage::parameterMayFlowThrough(p, _, getApprox(ap), config)
1209+
PrevStage::parameterMayFlowThrough(p, _, unbindApa(getApprox(ap)), config)
11931210
)
11941211
}
11951212

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1012,6 +1012,9 @@ private module Stage2 {
10121012

10131013
private predicate flowIntoCall = flowIntoCallNodeCand1/5;
10141014

1015+
bindingset[node, ap]
1016+
private predicate filter(NodeEx node, Ap ap) { any() }
1017+
10151018
bindingset[ap, contentType]
10161019
private predicate typecheckStore(Ap ap, DataFlowType contentType) { any() }
10171020

@@ -1020,6 +1023,13 @@ private module Stage2 {
10201023
PrevStage::revFlow(node, _, _, apa, config)
10211024
}
10221025

1026+
bindingset[result, apa]
1027+
private ApApprox unbindApa(ApApprox apa) {
1028+
exists(ApApprox apa0 |
1029+
apa = pragma[only_bind_into](apa0) and result = pragma[only_bind_into](apa0)
1030+
)
1031+
}
1032+
10231033
pragma[nomagic]
10241034
private predicate flowThroughOutOfCall(
10251035
DataFlowCall call, CcCall ccc, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow,
@@ -1042,6 +1052,13 @@ private module Stage2 {
10421052
*/
10431053
pragma[nomagic]
10441054
predicate fwdFlow(NodeEx node, Cc cc, ApOption argAp, Ap ap, Configuration config) {
1055+
fwdFlow0(node, cc, argAp, ap, config) and
1056+
flowCand(node, unbindApa(getApprox(ap)), config) and
1057+
filter(node, ap)
1058+
}
1059+
1060+
pragma[nomagic]
1061+
private predicate fwdFlow0(NodeEx node, Cc cc, ApOption argAp, Ap ap, Configuration config) {
10451062
flowCand(node, _, config) and
10461063
sourceNode(node, config) and
10471064
(if hasSourceCallCtx(config) then cc = ccSomeCall() else cc = ccNone()) and
@@ -1112,7 +1129,7 @@ private module Stage2 {
11121129
) {
11131130
exists(DataFlowType contentType |
11141131
fwdFlow(node1, cc, argAp, ap1, config) and
1115-
PrevStage::storeStepCand(node1, getApprox(ap1), tc, node2, contentType, config) and
1132+
PrevStage::storeStepCand(node1, unbindApa(getApprox(ap1)), tc, node2, contentType, config) and
11161133
typecheckStore(ap1, contentType)
11171134
)
11181135
}
@@ -1189,7 +1206,7 @@ private module Stage2 {
11891206
) {
11901207
exists(ParamNodeEx p |
11911208
fwdFlowIn(call, p, cc, _, argAp, ap, config) and
1192-
PrevStage::parameterMayFlowThrough(p, _, getApprox(ap), config)
1209+
PrevStage::parameterMayFlowThrough(p, _, unbindApa(getApprox(ap)), config)
11931210
)
11941211
}
11951212

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1012,6 +1012,9 @@ private module Stage2 {
10121012

10131013
private predicate flowIntoCall = flowIntoCallNodeCand1/5;
10141014

1015+
bindingset[node, ap]
1016+
private predicate filter(NodeEx node, Ap ap) { any() }
1017+
10151018
bindingset[ap, contentType]
10161019
private predicate typecheckStore(Ap ap, DataFlowType contentType) { any() }
10171020

@@ -1020,6 +1023,13 @@ private module Stage2 {
10201023
PrevStage::revFlow(node, _, _, apa, config)
10211024
}
10221025

1026+
bindingset[result, apa]
1027+
private ApApprox unbindApa(ApApprox apa) {
1028+
exists(ApApprox apa0 |
1029+
apa = pragma[only_bind_into](apa0) and result = pragma[only_bind_into](apa0)
1030+
)
1031+
}
1032+
10231033
pragma[nomagic]
10241034
private predicate flowThroughOutOfCall(
10251035
DataFlowCall call, CcCall ccc, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow,
@@ -1042,6 +1052,13 @@ private module Stage2 {
10421052
*/
10431053
pragma[nomagic]
10441054
predicate fwdFlow(NodeEx node, Cc cc, ApOption argAp, Ap ap, Configuration config) {
1055+
fwdFlow0(node, cc, argAp, ap, config) and
1056+
flowCand(node, unbindApa(getApprox(ap)), config) and
1057+
filter(node, ap)
1058+
}
1059+
1060+
pragma[nomagic]
1061+
private predicate fwdFlow0(NodeEx node, Cc cc, ApOption argAp, Ap ap, Configuration config) {
10451062
flowCand(node, _, config) and
10461063
sourceNode(node, config) and
10471064
(if hasSourceCallCtx(config) then cc = ccSomeCall() else cc = ccNone()) and
@@ -1112,7 +1129,7 @@ private module Stage2 {
11121129
) {
11131130
exists(DataFlowType contentType |
11141131
fwdFlow(node1, cc, argAp, ap1, config) and
1115-
PrevStage::storeStepCand(node1, getApprox(ap1), tc, node2, contentType, config) and
1132+
PrevStage::storeStepCand(node1, unbindApa(getApprox(ap1)), tc, node2, contentType, config) and
11161133
typecheckStore(ap1, contentType)
11171134
)
11181135
}
@@ -1189,7 +1206,7 @@ private module Stage2 {
11891206
) {
11901207
exists(ParamNodeEx p |
11911208
fwdFlowIn(call, p, cc, _, argAp, ap, config) and
1192-
PrevStage::parameterMayFlowThrough(p, _, getApprox(ap), config)
1209+
PrevStage::parameterMayFlowThrough(p, _, unbindApa(getApprox(ap)), config)
11931210
)
11941211
}
11951212

0 commit comments

Comments
 (0)