Skip to content

Commit d8afc1c

Browse files
dummyxdummyx
committed
update
1 parent fcfb9c8 commit d8afc1c

9 files changed

Lines changed: 95 additions & 99 deletions

File tree

‎codeql-custom-queries-cpp/good_guards.ql‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@ import cpp
22
import lib.guard_checker
33
import lib.types
44

5-
from ValueVariable v, PointerVariable p, GcTriggerCall gtc,
6-
PointerVariableAccess pointerUsageAccess, PointerDerivationAction innerPointerTaking
7-
where
8-
needsGuard(v, p, gtc, pointerUsageAccess, innerPointerTaking) and hasGuard(v)
9-
select v
5+
from
6+
ValueVariable v, GcTriggerCall gtc, InnerPointerUsage pointerUsageAccess,
7+
InnerPointerTakingFunctionByNameCall innerPointerTaking
8+
where needsGuard(v, gtc, pointerUsageAccess, innerPointerTaking) and hasGuard(v)
9+
select v, innerPointerTaking, gtc, pointerUsageAccess

‎codeql-custom-queries-cpp/good_guards_vo.ql‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
import cpp
2+
import lib.guard_checker
3+
import lib.types
4+
5+
from
6+
ValueVariable v, GcTriggerCall gtc, InnerPointerUsage pointerUsageAccess,
7+
InnerPointerTakingFunctionByNameCall innerPointerTaking
8+
where needsGuard(v, gtc, pointerUsageAccess, innerPointerTaking) and hasGuard(v)
9+
select v

‎codeql-custom-queries-cpp/lib/guard_checker.qll‎

Lines changed: 28 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,16 @@ predicate hasGuard(ValueVariable v) {
2020
)
2121
}
2222

23+
FunctionCall getRFunctionCallToValueVariable(
24+
ValueVariable v
25+
) {
26+
exists(FunctionCall fc, Assignment assign |
27+
assign.getRValue().getAChild*() = fc and
28+
assign.getLValue().getAChild*() = v.getAnAccess() and
29+
fc.getTarget().getName() = "rb_funcall" and result = fc
30+
)
31+
}
32+
2333
predicate tripleTransition(ControlFlowNode a, ControlFlowNode b, ControlFlowNode c) {
2434
a.getASuccessor*() = b and b.getASuccessor*() = c
2535
}
@@ -47,10 +57,9 @@ predicate isAllocOrGcFunction(Function function) {
4757
predicate isAllocOrGcCall(FunctionCall call) {
4858
call.getTarget().getName() in [
4959
"rb_str_new", "rb_str_buf_new", "rb_str_resize", "rb_str_concat", "rb_str_append",
50-
"rb_ary_new", "rb_ary_push", "rb_ary_concat", "rb_ary_store",
51-
"rb_hash_new", "rb_hash_aset", "rb_hash_lookup2",
52-
"rb_obj_alloc", "rb_class_new_instance", "rb_funcall",
53-
"ALLOC", "ALLOC_N", "REALLOC_N"
60+
"rb_ary_new", "rb_ary_push", "rb_ary_concat", "rb_ary_store", "rb_hash_new", "rb_hash_aset",
61+
"rb_hash_lookup2", "rb_obj_alloc", "rb_class_new_instance", "rb_funcall", "ALLOC", "ALLOC_N",
62+
"REALLOC_N"
5463
]
5564
or
5665
call.getTarget() instanceof GcTriggerFunction
@@ -117,7 +126,7 @@ predicate isGcTriggerWithFunctionPointer(Function function) {
117126
}
118127

119128
class GcTriggerFunction extends Function {
120-
GcTriggerFunction() { isGcTrigger(this) or isAllocOrGcFunction(this) }
129+
GcTriggerFunction() { isGcTrigger(this) }
121130
}
122131

123132
class GcTriggerFunctionWithFunctionPointer extends Function {
@@ -133,29 +142,29 @@ class GcTriggerCall extends FunctionCall {
133142
}
134143

135144
predicate needsGuard(
136-
ValueVariable v, PointerVariable innerPointer, GcTriggerCall gtc,
137-
ControlFlowNode pointerAccess, ControlFlowNode innerPointerTaking
145+
ValueVariable v, GcTriggerCall gtc, InnerPointerUsage pointerUsageAccess,
146+
InnerPointerTakingFunctionByNameCall innerPointerTaking
138147
) {
139148
(
140149
gtc.getControlFlowScope() = v.getParentScope*().(Function) and
141150
gtc.getControlFlowScope() = innerPointerTaking.getControlFlowScope()
142151
) and
143-
// Ensure the pointer is derived before a GC trigger happens
144-
after(innerPointerTaking, gtc) and
145152
isTarget(v) and
146153
// residue
147154
// isInitialVariableAccess(v.getAnAccess(), v) and
148-
innerPointer != v and
149-
pointerAccess.(PointerVariableAccess).getTarget() = innerPointer and
150-
after(innerPointerTaking, pointerAccess) and
151155
(
152-
isPointerUsedAfterGcTrigger(pointerAccess, gtc)
153-
or
154-
pointerPassedToGcAlloc(gtc, pointerAccess)
155-
or
156-
exists(GcTriggerCall gtcInter |
157-
gtcInter.getAnArgument() = pointerAccess or gtc.getAnArgument() = innerPointerTaking
156+
exists(PointerVariable innerPointer |
157+
innerPointer != v and
158+
pointerUsageAccess.(PointerVariableAccess).getTarget() = innerPointer and
159+
hasInnerPointerTaken(v, innerPointer, innerPointerTaking) and
160+
isPointerUsedAfterGcTrigger(pointerUsageAccess, gtc)
158161
)
162+
/*or
163+
exists(GcTriggerCall callee |
164+
callee = gtc.getASuccessor*() and
165+
callee.getAnArgument().getAChild*() = innerPointerTaking and
166+
innerPointerTaking.getAnArgument().getAChild*() = v.getAnAccess()
167+
)*/
159168
) and
160169
// disable interprocedural pointer usage for now
161170
// and not exists(ValueAccess va | gtc.getASuccessor*() = va)
@@ -164,8 +173,7 @@ predicate needsGuard(
164173
* passedToGcTrigger(v, initVAccess.(ValueAccess), gcTriggerCall)
165174
*/
166175

167-
notAccessedAfterGcTrigger(v, gtc) and
168-
hasInnerPointerTaken(v, innerPointer, innerPointerTaking)
176+
notAccessedAfterGcTrigger(v, gtc)
169177
}
170178

171179
predicate isGuardAccess(ValueAccess vAccess) {

‎codeql-custom-queries-cpp/lib/patterns.qll‎

Lines changed: 33 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -26,19 +26,13 @@ predicate isInitialVariableAccess(ControlFlowNode node, ValueVariable v) {
2626
* ```
2727
*/
2828
predicate hasInnerPointerAssignment(
29-
ValueVariable v, PointerVariable innerPointer, ControlFlowNode innerPointerTaking
29+
ValueVariable v, PointerVariable innerPointer,
30+
InnerPointerTakingFunctionByNameCall innerPointerTaking
3031
) {
3132
exists(Assignment assignment |
3233
assignment.getLValue().getAChild*().(VariableAccess).getTarget() = innerPointer and
33-
assignment.getRValue().getAChild*() instanceof InnerPointerTakingFunctionByNameCall and
34-
assignment
35-
.getRValue()
36-
.getAChild*()
37-
.(InnerPointerTakingFunctionByNameCall)
38-
.getAnArgument()
39-
.(ValueAccess)
40-
.getTarget() = v and
41-
assignment = innerPointerTaking
34+
assignment.getRValue().getAChild*() = innerPointerTaking and
35+
innerPointerTaking.getAnArgument().(ValueAccess).getTarget() = v
4236
)
4337
}
4438

@@ -52,17 +46,15 @@ predicate hasInnerPointerAssignment(
5246
* ```
5347
*/
5448
predicate hasInnerPointerDeclaration(
55-
ValueVariable v, PointerVariable innerPointer, ControlFlowNode innerPointerTaking
49+
ValueVariable v, PointerVariable innerPointer,
50+
InnerPointerTakingFunctionByNameCall innerPointerTaking
5651
) {
57-
exists(
58-
Declaration decl, VariableDeclarationEntry declEntry,
59-
InnerPointerTakingFunctionByNameCall pointerTakingCall
60-
|
52+
exists(Declaration decl, VariableDeclarationEntry declEntry |
6153
decl.getADeclarationEntry() = declEntry and
6254
declEntry.getVariable() = innerPointer and
63-
innerPointer.getInitializer().getExpr() = pointerTakingCall and
64-
pointerTakingCall.getAnArgument().getAChild*().(ValueAccess).getTarget() = v and
65-
pointerTakingCall = innerPointerTaking
55+
innerPointer.getInitializer().getExpr() = innerPointerTaking and
56+
innerPointerTaking.getAnArgument().getAChild*().(ValueAccess).getTarget() = v and
57+
innerPointerTaking = innerPointerTaking
6658
)
6759
}
6860

@@ -76,30 +68,28 @@ predicate hasInnerPointerDeclaration(
7668
* ```
7769
*/
7870
predicate hasInnerPointerFunctionCall(
79-
ValueVariable v, PointerVariable innerPointer, ControlFlowNode innerPointerTaking
71+
ValueVariable v, PointerVariable innerPointer,
72+
InnerPointerTakingFunctionByNameCall innerPointerTaking
8073
) {
81-
exists(InnerPointerTakingFunctionByNameCall pointerTakingCall |
82-
(
83-
pointerTakingCall = innerPointerTaking and
84-
pointerTakingCall.getAnArgument().getAChild*().(ValueAccess).getTarget() = v
85-
or
86-
pointerTakingCall.getAnArgument().getAChild*().(FieldAccess).getQualifier() = v.getAnAccess()
87-
) and
88-
pointerTakingCall.getAnArgument().getAChild*().(PointerVariableAccess).getTarget() =
89-
innerPointer
90-
)
74+
(
75+
innerPointerTaking.getAnArgument().getAChild*().(ValueAccess).getTarget() = v
76+
or
77+
innerPointerTaking.getAnArgument().getAChild*().(FieldAccess).getQualifier() = v.getAnAccess()
78+
) and
79+
innerPointerTaking.getAnArgument().getAChild*().(PointerVariableAccess).getTarget() = innerPointer
9180
}
9281

9382
/**
9483
* Checks if any of the inner pointer patterns exist for the given variables.
9584
*/
9685
predicate hasInnerPointerTaken(
97-
ValueVariable v, PointerVariable innerPointer, ControlFlowNode innerPointerTaking
86+
ValueVariable v, PointerVariable innerPointer,
87+
InnerPointerTakingFunctionByNameCall innerPointerTaking
9888
) {
9989
hasInnerPointerAssignment(v, innerPointer, innerPointerTaking)
10090
or
101-
hasInnerPointerDeclaration(v, innerPointer, innerPointerTaking)
102-
or
91+
// or
92+
// hasInnerPointerDeclaration(v, innerPointer, innerPointerTaking)
10393
hasInnerPointerFunctionCall(v, innerPointer, innerPointerTaking)
10494
}
10595

@@ -138,23 +128,21 @@ predicate calleeParameterUsedInAlloc(Function callee, int idx) {
138128
)
139129
}
140130

141-
142131
/*
143-
predicate passedToGcTrigger(ValueVariable v, ValueAccess initVAccess, FunctionCall gcTriggerCall) {
144-
exists(int i |
145-
initVAccess = v.getAnAccess() and
146-
i < count(gcTriggerCall.getAnArgument()) and
147-
gcTriggerCall.getAnArgumentSubExpr(i) = v.getAnAccess() and
148-
isArgumentNotSafe(gcTriggerCall.getTarget(), i)
149-
)
150-
}
151-
*/
132+
* predicate passedToGcTrigger(ValueVariable v, ValueAccess initVAccess, FunctionCall gcTriggerCall) {
133+
* exists(int i |
134+
* initVAccess = v.getAnAccess() and
135+
* i < count(gcTriggerCall.getAnArgument()) and
136+
* gcTriggerCall.getAnArgumentSubExpr(i) = v.getAnAccess() and
137+
* isArgumentNotSafe(gcTriggerCall.getTarget(), i)
138+
* )
139+
* }
140+
*/
152141

153142
predicate notAccessedAfterGcTrigger(ValueVariable v, GcTriggerCall gcTriggerCall) {
154-
155143
not exists(VariableAccess va |
156-
va.getTarget() = v and va = gcTriggerCall.getASuccessor+() and not isGuardAccess(va)
157-
)
144+
va.getTarget() = v and va = gcTriggerCall.getASuccessor+() and not isGuardAccess(va)
145+
)
158146
// notAfter(gcTriggerCall, v.getAnAccess())
159147
}
160148

‎codeql-custom-queries-cpp/lib/types.qll‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@ class ValueVariable extends Variable {
88
ValueVariable() { this.getType().getName() = "VALUE" }
99
}
1010

11-
1211
class InnerPointerTakingFunctionByNameCall extends FunctionCall {
1312
InnerPointerTakingFunctionByNameCall() {
1413
this.getTarget() instanceof InnerPointerTakingFunctionByName
@@ -18,6 +17,8 @@ class InnerPointerTakingFunctionByNameCall extends FunctionCall {
1817
class InnerPointerTakingFunctionByName extends Function {
1918
InnerPointerTakingFunctionByName() {
2019
this.getName() in [
20+
"BDIGITS",
21+
"BIGNUM_DIGITS",
2122
"RSTRING_PTR",
2223
"RSTRING_END",
2324
"RSTRING_GETMEM",
@@ -62,12 +63,15 @@ class InnerPointerTakingFunctionByName extends Function {
6263
}
6364
}
6465

65-
6666
class PointerDerivationAction extends ControlFlowNode {
67-
PointerDerivationAction() {
68-
this instanceof Assignment or
69-
this instanceof InnerPointerTakingFunctionByNameCall
67+
PointerDerivationAction() {
68+
this instanceof Assignment or
69+
this instanceof InnerPointerTakingFunctionByNameCall
70+
}
7071
}
72+
73+
class InnerPointerUsage extends ControlFlowNode {
74+
InnerPointerUsage() { this instanceof FunctionCall or this instanceof PointerVariableAccess }
7175
}
7276

7377
class ValueVariableMatch extends Variable {

‎codeql-custom-queries-cpp/missing_guards.ql‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@ import lib.guard_checker
33
import lib.patterns
44
import lib.types
55

6-
from ValueVariable v, PointerVariable p, GcTriggerCall gtc,
7-
PointerVariableAccess pointerUsageAccess, PointerDerivationAction innerPointerTaking
8-
where
9-
needsGuard(v, p, gtc, pointerUsageAccess, innerPointerTaking) and not hasGuard(v)
10-
select v, innerPointerTaking, gtc, pointerUsageAccess
6+
from
7+
ValueVariable v, GcTriggerCall gtc, InnerPointerUsage pointerUsageAccess,
8+
InnerPointerTakingFunctionByNameCall innerPointerTaking
9+
where needsGuard(v, gtc, pointerUsageAccess, innerPointerTaking) and not hasGuard(v)
10+
select v, v.getInitializer(), innerPointerTaking, gtc, pointerUsageAccess

‎codeql-custom-queries-cpp/missing_guards_vo.ql‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,10 @@ import lib.guard_checker
44
from ValueVariable v
55
where
66
exists(
7-
PointerVariable p, GcTriggerCall gtc, PointerVariableAccess pointerUsageAccess,
8-
PointerDerivationAction innerPointerTaking
7+
GcTriggerCall gtc, InnerPointerUsage pointerUsageAccess,
8+
InnerPointerTakingFunctionByNameCall innerPointerTaking
99
|
10-
needsGuard(v, p, gtc, pointerUsageAccess, innerPointerTaking)
10+
needsGuard(v, gtc, pointerUsageAccess, innerPointerTaking)
1111
) and
1212
not hasGuard(v)
1313
select v

‎codeql-custom-queries-cpp/redundant_guards.ql‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,10 @@ import lib.guard_checker
44
from ValueVariable v
55
where
66
not exists(
7-
PointerVariable p, GcTriggerCall gtc, PointerVariableAccess pointerUsageAccess,
8-
PointerDerivationAction innerPointerTaking
7+
GcTriggerCall gtc, InnerPointerUsage pointerUsageAccess,
8+
InnerPointerTakingFunctionByNameCall innerPointerTaking
99
|
10-
needsGuard(v, p, gtc, pointerUsageAccess, innerPointerTaking)
10+
needsGuard(v, gtc, pointerUsageAccess, innerPointerTaking)
1111
) and
1212
hasGuard(v)
1313
select v

‎codeql-custom-queries-cpp/redundant_guards_vo.ql‎

Lines changed: 0 additions & 13 deletions
This file was deleted.

0 commit comments

Comments
 (0)