FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Merge pull request #14367 from github/henrymercer/rc-3.11-mergeback · github/codeql@99646ba · GitHub

Merge pull request #14367 from github/henrymercer/rc-3.11-mergeback · github/codeql@99646ba · GitHub
Skip to content

Navigation Menu

Sign in
Sign in
Sign up

Commit 99646ba

Browse files
henrymercer
authored
Merge pull request #14367 from github/henrymercer/rc-3.11-mergeback
Merge `rc/3.11` into `main`
2 parents d258f69 + ecd8561 commit 99646ba

196 files changed

Lines changed: 1394 additions & 662 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎cpp/ql/lib/CHANGELOG.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,22 @@
1+
## 0.9.3
2+
3+
No user-facing changes.
4+
5+
## 0.9.2
6+
7+
### Deprecated APIs
8+
9+
* `getAllocatorCall` on `DeleteExpr` and `DeleteArrayExpr` has been deprecated. `getDeallocatorCall` should be used instead.
10+
11+
### New Features
12+
13+
* Added `DeleteOrDeleteArrayExpr` as a super type of `DeleteExpr` and `DeleteArrayExpr`
14+
15+
### Minor Analysis Improvements
16+
17+
* `delete` and `delete[]` are now modeled as calls to the relevant `operator delete` in the IR. In the case of a dynamic delete call a new instruction `VirtualDeleteFunctionAddress` is used to represent a function that dispatches to the correct delete implementation.
18+
* Only the 2 level indirection of `argv` (corresponding to `**argv`) is consided for `FlowSource`.
19+
120
## 0.9.1
221

322
No user-facing changes.

‎cpp/ql/lib/change-notes/2023-08-24-no-taint-argv-indirections.md‎

Lines changed: 0 additions & 4 deletions
This file was deleted.

‎cpp/ql/lib/change-notes/2023-08-25-delete-or-delete-array.md‎

Lines changed: 0 additions & 4 deletions
This file was deleted.

‎cpp/ql/lib/change-notes/2023-08-25-getAllocatorCall-deprecated.md‎

Lines changed: 0 additions & 4 deletions
This file was deleted.

‎cpp/ql/lib/change-notes/2023-08-29-delete-ir.md‎

Lines changed: 0 additions & 4 deletions
This file was deleted.

‎cpp/ql/lib/change-notes/released/0.9.2.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
## 0.9.2
2+
3+
### Deprecated APIs
4+
5+
* `getAllocatorCall` on `DeleteExpr` and `DeleteArrayExpr` has been deprecated. `getDeallocatorCall` should be used instead.
6+
7+
### New Features
8+
9+
* Added `DeleteOrDeleteArrayExpr` as a super type of `DeleteExpr` and `DeleteArrayExpr`
10+
11+
### Minor Analysis Improvements
12+
13+
* `delete` and `delete[]` are now modeled as calls to the relevant `operator delete` in the IR. In the case of a dynamic delete call a new instruction `VirtualDeleteFunctionAddress` is used to represent a function that dispatches to the correct delete implementation.
14+
* Only the 2 level indirection of `argv` (corresponding to `**argv`) is consided for `FlowSource`.

‎cpp/ql/lib/change-notes/released/0.9.3.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
## 0.9.3
2+
3+
No user-facing changes.

‎cpp/ql/lib/codeql-pack.release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
---
2-
lastReleaseVersion: 0.9.1
2+
lastReleaseVersion: 0.9.3

‎cpp/ql/lib/qlpack.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: codeql/cpp-all
2-
version: 0.9.2-dev
2+
version: 0.10.0-dev
33
groups: cpp
44
dbscheme: semmlecode.cpp.dbscheme
55
extractor: cpp

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll‎

Lines changed: 69 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -645,12 +645,24 @@ private predicate adjustForPointerArith(PostUpdateNode pun, UseOrPhi use) {
645645
)
646646
}
647647

648+
/**
649+
* Holds if `nodeFrom` flows to `nodeTo` because there is `def-use` or
650+
* `use-use` flow from `defOrUse` to `use`.
651+
*
652+
* `uncertain` is `true` if the `defOrUse` is an uncertain definition.
653+
*/
654+
private predicate localSsaFlow(
655+
SsaDefOrUse defOrUse, Node nodeFrom, UseOrPhi use, Node nodeTo, boolean uncertain
656+
) {
657+
nodeToDefOrUse(nodeFrom, defOrUse, uncertain) and
658+
adjacentDefRead(defOrUse, use) and
659+
useToNode(use, nodeTo) and
660+
nodeFrom != nodeTo
661+
}
662+
648663
private predicate ssaFlowImpl(SsaDefOrUse defOrUse, Node nodeFrom, Node nodeTo, boolean uncertain) {
649664
exists(UseOrPhi use |
650-
nodeToDefOrUse(nodeFrom, defOrUse, uncertain) and
651-
adjacentDefRead(defOrUse, use) and
652-
useToNode(use, nodeTo) and
653-
nodeFrom != nodeTo
665+
localSsaFlow(defOrUse, nodeFrom, use, nodeTo, uncertain)
654666
or
655667
// Initial global variable value to a first use
656668
nodeFrom.(InitialGlobalValue).getGlobalDef() = defOrUse and
@@ -728,15 +740,62 @@ private predicate isArgumentOfCallable(DataFlowCall call, Node n) {
728740
)
729741
}
730742

731-
/** Holds if there is def-use or use-use flow from `pun` to `nodeTo`. */
732-
predicate postUpdateFlow(PostUpdateNode pun, Node nodeTo) {
733-
exists(UseOrPhi use, Node preUpdate |
743+
/**
744+
* Holds if there is use-use flow from `pun`'s pre-update node to `n`.
745+
*/
746+
private predicate postUpdateNodeToFirstUse(PostUpdateNode pun, Node n) {
747+
exists(UseOrPhi use |
734748
adjustForPointerArith(pun, use) and
735-
useToNode(use, nodeTo) and
749+
useToNode(use, n)
750+
)
751+
}
752+
753+
private predicate stepUntilNotInCall(DataFlowCall call, Node n1, Node n2) {
754+
isArgumentOfCallable(call, n1) and
755+
exists(Node mid | localSsaFlow(_, n1, _, mid, _) |
756+
isArgumentOfCallable(call, mid) and
757+
stepUntilNotInCall(call, mid, n2)
758+
or
759+
not isArgumentOfCallable(call, mid) and
760+
mid = n2
761+
)
762+
}
763+
764+
bindingset[n1, n2]
765+
pragma[inline_late]
766+
private predicate isArgumentOfSameCall(DataFlowCall call, Node n1, Node n2) {
767+
isArgumentOfCallable(call, n1) and isArgumentOfCallable(call, n2)
768+
}
769+
770+
/**
771+
* Holds if there is def-use or use-use flow from `pun` to `nodeTo`.
772+
*
773+
* Note: This is more complex than it sounds. Consider a call such as:
774+
* ```cpp
775+
* write_first_argument(x, x);
776+
* sink(x);
777+
* ```
778+
* Assume flow comes out of the first argument to `write_first_argument`. We
779+
* don't want flow to go to the `x` that's also an argument to
780+
* `write_first_argument` (because we just flowed out of that function, and we
781+
* don't want to flow back into it again).
782+
*
783+
* We do, however, want flow from the output argument to `x` on the next line, and
784+
* similarly we want flow from the second argument of `write_first_argument` to `x`
785+
* on the next line.
786+
*/
787+
predicate postUpdateFlow(PostUpdateNode pun, Node nodeTo) {
788+
exists(Node preUpdate, Node mid |
736789
preUpdate = pun.getPreUpdateNode() and
737-
not exists(DataFlowCall call |
738-
isArgumentOfCallable(call, preUpdate) and isArgumentOfCallable(call, nodeTo)
790+
postUpdateNodeToFirstUse(pun, mid)
791+
|
792+
exists(DataFlowCall call |
793+
isArgumentOfSameCall(call, preUpdate, mid) and
794+
stepUntilNotInCall(call, mid, nodeTo)
739795
)
796+
or
797+
not isArgumentOfSameCall(_, preUpdate, mid) and
798+
nodeTo = mid
740799
)
741800
}
742801

0 commit comments

Comments
 (0)

Footer

© 2026 GitHub, Inc.
Back | FazBrowse Home | New Git URL