Skip to content

Commit d06b7b0

Browse files
MathiasVPMathiasVP
committed
C++: Remove more address -> value flow in the name of performance.
1 parent 9e63abd commit d06b7b0

File tree

12 files changed

+74
-73
lines changed

12 files changed

+74
-73
lines changed

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,7 @@ private module VirtualDispatch {
130130
*
131131
* Used to fix a join ordering issue in flowsFrom.
132132
*/
133+
pragma[noinline]
133134
private predicate returnNodeWithKindAndEnclosingCallable(
134135
ReturnNode node, ReturnKind kind, DataFlowCallable callable
135136
) {

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll‎

Lines changed: 31 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -809,11 +809,17 @@ private module StoreNodeFlow {
809809
private predicate simpleOperandLocalFlowStep(Instruction iFrom, Operand opTo) {
810810
// Propagate flow from an instruction to its exact uses.
811811
// We do this for all instruction/operand pairs, except when the operand is the
812-
// side effect operand of a ReturnIndirectionInstruction. This is because we
813-
// get this flow through the shared SSA library already, and including this
814-
// flow here will create multiple paths from a parameter node to a return node
815-
// which creates a blowup when computing dataflow.
816-
not any(ReturnIndirectionInstruction ret).getSideEffectOperand() = opTo and
812+
// side effect operand of a ReturnIndirectionInstruction, or the load operand of a LoadInstruction.
813+
// This is because we get these flows through the shared SSA library already, and including this
814+
// flow here will create multiple dataflow paths which creates a blowup in stage 3 of dataflow.
815+
(
816+
not any(ReturnIndirectionInstruction ret).getSideEffectOperand() = opTo and
817+
not any(LoadInstruction load).getSourceValueOperand() = opTo
818+
or
819+
// We do, however, need the flow from phi instructions as we don't use the phi nodes generated by
820+
// the shared SSA library.
821+
iFrom instanceof PhiInstruction
822+
) and
817823
opTo.getDef() = iFrom
818824
or
819825
// Since the side effect operand of a `ReadSideEffectInstruction` is never precise we
@@ -825,6 +831,23 @@ private predicate simpleOperandLocalFlowStep(Instruction iFrom, Operand opTo) {
825831
)
826832
}
827833

834+
pragma[noinline]
835+
private predicate getAddressType(LoadInstruction load, Type t) {
836+
exists(Instruction address |
837+
address = load.getSourceAddress() and
838+
t = address.getResultType()
839+
)
840+
}
841+
842+
private class ReferenceDereferenceInstruction extends LoadInstruction {
843+
ReferenceDereferenceInstruction() {
844+
exists(ReferenceType ref |
845+
getAddressType(this, ref) and
846+
this.getResultType() = ref.getBaseType()
847+
)
848+
}
849+
}
850+
828851
private predicate simpleInstructionLocalFlowStep(Operand opFrom, Instruction iTo) {
829852
iTo.(CopyInstruction).getSourceValueOperand() = opFrom
830853
or
@@ -837,6 +860,9 @@ private predicate simpleInstructionLocalFlowStep(Operand opFrom, Instruction iTo
837860
or
838861
iTo.(InheritanceConversionInstruction).getUnaryOperand() = opFrom
839862
or
863+
// Conflate references and values like in AST dataflow.
864+
iTo.(ReferenceDereferenceInstruction).getSourceAddressOperand() = opFrom
865+
or
840866
// Flow through modeled functions
841867
modelFlow(opFrom, iTo)
842868
}

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/Ssa.qll‎

Lines changed: 19 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -309,11 +309,22 @@ private Instruction getDefinitionOrChiInstruction(Instruction input) {
309309
}
310310

311311
private predicate phiHasInput(PhiInstruction phi, Node input) {
312-
getDefinitionOrChiInstruction(phi.getAnInput()) =
313-
[input.asInstruction(), input.(StoreNode).getStoreInstruction()]
312+
getDefinitionOrChiInstruction(phi.getAnInput()) = input.asInstruction()
313+
or
314+
exists(StoreNode storeNode |
315+
storeNode = input and
316+
storeNode.isTerminal() and
317+
getDefinitionOrChiInstruction(phi.getAnInput()) = storeNode.getStoreInstruction()
318+
)
314319
}
315320

316-
private predicate adjacentDefRead(Node nodeFrom, Node nodeTo) {
321+
/**
322+
* Holds if `nodeFrom` is a read or write, and `nTo` is the next subsequent read of the variable
323+
* written (or read) by `storeOrRead`.
324+
*/
325+
cached
326+
predicate ssaFlow(Node nodeFrom, Node nodeTo) {
327+
// Def-use/use-use flow from an `InstructionNode` to an `OperandNode`.
317328
exists(IRBlock bb1, int i1, IRBlock bb2, int i2, DefOrUse defOrUse, Use use |
318329
defOrUse.hasRankInBlock(bb1, i1) and
319330
use.hasRankInBlock(bb2, i2) and
@@ -322,6 +333,7 @@ private predicate adjacentDefRead(Node nodeFrom, Node nodeTo) {
322333
flowOutOfAddressStep(use.getOperand(), nodeTo)
323334
)
324335
or
336+
// Use-use flow from a `ReadNode` to an `OperandNode`.
325337
exists(ReadNode read, IRBlock bb1, int i1, IRBlock bb2, int i2, Use use1, Use use2 |
326338
read = nodeFrom and
327339
use1.hasRankInBlock(bb1, i1) and
@@ -331,6 +343,7 @@ private predicate adjacentDefRead(Node nodeFrom, Node nodeTo) {
331343
flowOutOfAddressStep(use2.getOperand(), nodeTo)
332344
)
333345
or
346+
// Def-use flow from a `StoreNode` to an `OperandNode`.
334347
exists(StoreNode store, IRBlock bb1, int i1, IRBlock bb2, int i2, Def def, Use use |
335348
store = nodeFrom and
336349
store.isTerminal() and
@@ -341,9 +354,9 @@ private predicate adjacentDefRead(Node nodeFrom, Node nodeTo) {
341354
flowOutOfAddressStep(use.getOperand(), nodeTo)
342355
)
343356
or
344-
// This next case is a bit annoying. The write side effect on an expression like `a = new A;` writes to
345-
// a fresh address returned by `operator new`, and there's no easy way to use the `adjacentDefRead`
346-
// predicate to hook that up to the assignment to `a`. So instead we flow to the _first_ use of the
357+
// This final case is a bit annoying. The write side effect on an expression like `a = new A;` writes
358+
// to a fresh address returned by `operator new`, and there's no easy way to use the shared SSA
359+
// library to hook that up to the assignment to `a`. So instead we flow to the _first_ use of the
347360
// value computed by `operator new` that occurs after `nodeFrom` (to avoid a loop in the
348361
// dataflow graph).
349362
exists(StoreNode store, WriteSideEffectInstruction write, IRBlock bb, int i1, int i2, Operand op |
@@ -368,19 +381,8 @@ private predicate adjacentDefRead(Node nodeFrom, Node nodeTo) {
368381
or
369382
// Flow to phi instructions
370383
phiHasInput(nodeTo.asInstruction(), nodeFrom)
371-
or
372-
// Flow out of PostUpdateNodes and into phi instructions
373-
nodeFrom.(StoreNode).isTerminal() and
374-
phiHasInput(nodeTo.asInstruction(), nodeFrom)
375384
}
376385

377-
/**
378-
* Holds if `nodeFrom` is a read or write, and `nTo` is the next subsequent read of the variable
379-
* written (or read) by `storeOrRead`.
380-
*/
381-
cached
382-
predicate ssaFlow(Node nodeFrom, Node nodeTo) { adjacentDefRead(nodeFrom, nodeTo) }
383-
384386
private predicate flowOutOfAddressStep(Operand operand, Node nTo) {
385387
// Flow into a read node
386388
exists(ReadNode readNode | readNode = nTo |

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/TaintTrackingUtil.qll‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -82,8 +82,6 @@ private predicate operandToInstructionTaintStep(Operand opFrom, Instruction inst
8282
instrTo.(FieldAddressInstruction).getField().getDeclaringType() instanceof Union
8383
)
8484
or
85-
instrTo.(LoadInstruction).getSourceAddressOperand() = opFrom
86-
or
8785
// Flow from an element to an array or union that contains it.
8886
instrTo.(ChiInstruction).getPartialOperand() = opFrom and
8987
not instrTo.isResultConflated() and

‎cpp/ql/test/library-tests/dataflow/dataflow-tests/test.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,7 @@ void local_references(int &source1, int clean1) {
107107
int t = clean1;
108108
int &ref = t;
109109
t = source();
110-
sink(ref); // $ ir MISSING: ast
110+
sink(ref); // $ MISSING: ast,ir
111111
}
112112
}
113113

‎cpp/ql/test/library-tests/dataflow/fields/aliasing.cpp‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,12 +35,12 @@ void assignAfterAlias() {
3535
S s1 = { 0, 0 };
3636
S &ref1 = s1;
3737
ref1.m1 = user_input();
38-
sink(s1.m1); // $ ir MISSING: ast
38+
sink(s1.m1); // $ MISSING: ast,ir
3939

4040
S s2 = { 0, 0 };
4141
S &ref2 = s2;
4242
s2.m1 = user_input();
43-
sink(ref2.m1); // $ ir MISSING: ast
43+
sink(ref2.m1); // $ MISSING: ast,ir
4444
}
4545

4646
void assignAfterCopy() {
@@ -77,14 +77,14 @@ void pointerIntermediate() {
7777
Wrapper w = { { 0, 0 } };
7878
S *s = &w.s;
7979
s->m1 = user_input();
80-
sink(w.s.m1); // $ ir MISSING: ast
80+
sink(w.s.m1); // $ MISSING: ast,ir
8181
}
8282

8383
void referenceIntermediate() {
8484
Wrapper w = { { 0, 0 } };
8585
S &s = w.s;
8686
s.m1 = user_input();
87-
sink(w.s.m1); // $ ir MISSING: ast
87+
sink(w.s.m1); // $ MISSING: ast,ir
8888
}
8989

9090
void nestedAssign() {

‎cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected‎

Lines changed: 0 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -306,7 +306,6 @@ edges
306306
| C.cpp:18:12:18:18 | C output argument [s1] | C.cpp:19:8:19:11 | c [s1] |
307307
| C.cpp:18:12:18:18 | C output argument [s3] | C.cpp:19:8:19:11 | c [s3] |
308308
| C.cpp:18:12:18:18 | new [post update] [s1] | C.cpp:19:8:19:11 | c [s1] |
309-
| C.cpp:18:12:18:18 | new [post update] [s3] | C.cpp:19:8:19:11 | c [s3] |
310309
| C.cpp:19:8:19:11 | c [s1] | C.cpp:27:8:27:11 | this [s1] |
311310
| C.cpp:19:8:19:11 | c [s3] | C.cpp:27:8:27:11 | this [s3] |
312311
| C.cpp:22:3:22:3 | ReturnIndirection [s1] | C.cpp:18:12:18:18 | C output argument [s1] |
@@ -315,7 +314,6 @@ edges
315314
| C.cpp:22:3:22:3 | this [post update] [s1] | C.cpp:22:3:22:3 | ReturnIndirection [s1] |
316315
| C.cpp:22:9:22:22 | FieldAddress [post update] | C.cpp:22:3:22:3 | this [post update] [s1] |
317316
| C.cpp:22:12:22:21 | new | C.cpp:22:9:22:22 | FieldAddress [post update] |
318-
| C.cpp:24:5:24:8 | this [post update] [s3] | C.cpp:18:12:18:18 | new [post update] [s3] |
319317
| C.cpp:24:5:24:8 | this [post update] [s3] | C.cpp:22:3:22:3 | ReturnIndirection [s3] |
320318
| C.cpp:24:11:24:12 | s3 [post update] | C.cpp:24:5:24:8 | this [post update] [s3] |
321319
| C.cpp:24:16:24:25 | new | C.cpp:24:11:24:12 | s3 [post update] |
@@ -421,20 +419,15 @@ edges
421419
| aliasing.cpp:29:11:29:12 | FieldAddress [read] | aliasing.cpp:29:11:29:12 | m1 |
422420
| aliasing.cpp:30:8:30:9 | s2 [read] [m1] | aliasing.cpp:30:11:30:12 | FieldAddress [read] |
423421
| aliasing.cpp:30:11:30:12 | FieldAddress [read] | aliasing.cpp:30:11:30:12 | m1 |
424-
| aliasing.cpp:37:13:37:22 | call to user_input | aliasing.cpp:38:11:38:12 | m1 |
425-
| aliasing.cpp:42:11:42:20 | call to user_input | aliasing.cpp:43:13:43:14 | m1 |
426422
| aliasing.cpp:60:3:60:4 | s2 [post update] [m1] | aliasing.cpp:62:8:62:12 | copy2 [read] [m1] |
427423
| aliasing.cpp:60:6:60:7 | m1 [post update] | aliasing.cpp:60:3:60:4 | s2 [post update] [m1] |
428424
| aliasing.cpp:60:11:60:20 | call to user_input | aliasing.cpp:60:6:60:7 | m1 [post update] |
429425
| aliasing.cpp:62:8:62:12 | copy2 [read] [m1] | aliasing.cpp:62:14:62:15 | FieldAddress [read] |
430426
| aliasing.cpp:62:14:62:15 | FieldAddress [read] | aliasing.cpp:62:14:62:15 | m1 |
431-
| aliasing.cpp:79:11:79:20 | call to user_input | aliasing.cpp:80:12:80:13 | m1 |
432-
| aliasing.cpp:86:10:86:19 | call to user_input | aliasing.cpp:87:12:87:13 | m1 |
433427
| aliasing.cpp:92:3:92:3 | w [post update] [s, m1] | aliasing.cpp:93:8:93:8 | w [read] [s, m1] |
434428
| aliasing.cpp:92:5:92:5 | s [post update] [m1] | aliasing.cpp:92:3:92:3 | w [post update] [s, m1] |
435429
| aliasing.cpp:92:7:92:8 | m1 [post update] | aliasing.cpp:92:5:92:5 | s [post update] [m1] |
436430
| aliasing.cpp:92:12:92:21 | call to user_input | aliasing.cpp:92:7:92:8 | m1 [post update] |
437-
| aliasing.cpp:92:12:92:21 | call to user_input | aliasing.cpp:93:12:93:13 | m1 |
438431
| aliasing.cpp:93:8:93:8 | w [read] [s, m1] | aliasing.cpp:93:10:93:10 | s [read] [m1] |
439432
| aliasing.cpp:93:10:93:10 | s [read] [m1] | aliasing.cpp:93:12:93:13 | FieldAddress [read] |
440433
| aliasing.cpp:93:12:93:13 | FieldAddress [read] | aliasing.cpp:93:12:93:13 | m1 |
@@ -536,8 +529,6 @@ edges
536529
| arrays.cpp:36:12:36:14 | arr [post update] [data] | arrays.cpp:36:5:36:10 | nested [post update] [arr, data] |
537530
| arrays.cpp:36:19:36:22 | data [post update] | arrays.cpp:36:3:36:17 | access to array [post update] [data] |
538531
| arrays.cpp:36:26:36:35 | call to user_input | arrays.cpp:36:19:36:22 | data [post update] |
539-
| arrays.cpp:36:26:36:35 | call to user_input | arrays.cpp:37:3:37:6 | data |
540-
| arrays.cpp:36:26:36:35 | call to user_input | arrays.cpp:37:24:37:27 | data |
541532
| arrays.cpp:37:3:37:6 | data | arrays.cpp:37:24:37:27 | sink output argument |
542533
| arrays.cpp:37:3:37:6 | data | realistic.cpp:41:17:41:17 | o |
543534
| arrays.cpp:37:8:37:8 | o [post update] [nested, arr, data] | arrays.cpp:38:8:38:8 | o [read] [nested, arr, data] |
@@ -1156,8 +1147,6 @@ edges
11561147
| struct_init.c:20:13:20:14 | VariableAddress [post update] [a] | struct_init.c:24:10:24:12 | & ... indirection [a] |
11571148
| struct_init.c:20:17:20:36 | FieldAddress [post update] | struct_init.c:20:13:20:14 | VariableAddress [post update] [a] |
11581149
| struct_init.c:20:20:20:29 | call to user_input | struct_init.c:20:17:20:36 | FieldAddress [post update] |
1159-
| struct_init.c:20:20:20:29 | call to user_input | struct_init.c:22:3:22:6 | a |
1160-
| struct_init.c:20:20:20:29 | call to user_input | struct_init.c:22:11:22:11 | a |
11611150
| struct_init.c:22:3:22:6 | a | realistic.cpp:41:17:41:17 | o |
11621151
| struct_init.c:22:3:22:6 | a | struct_init.c:22:11:22:11 | sink output argument |
11631152
| struct_init.c:22:8:22:9 | ab [post update] [a] | struct_init.c:24:10:24:12 | & ... indirection [a] |
@@ -1172,8 +1161,6 @@ edges
11721161
| struct_init.c:26:23:29:3 | FieldAddress [post update] [a] | struct_init.c:26:16:26:20 | VariableAddress [post update] [nestedAB, a] |
11731162
| struct_init.c:27:5:27:23 | FieldAddress [post update] | struct_init.c:26:23:29:3 | FieldAddress [post update] [a] |
11741163
| struct_init.c:27:7:27:16 | call to user_input | struct_init.c:27:5:27:23 | FieldAddress [post update] |
1175-
| struct_init.c:27:7:27:16 | call to user_input | struct_init.c:31:3:31:6 | a |
1176-
| struct_init.c:27:7:27:16 | call to user_input | struct_init.c:31:23:31:23 | a |
11771164
| struct_init.c:31:3:31:6 | a | realistic.cpp:41:17:41:17 | o |
11781165
| struct_init.c:31:3:31:6 | a | struct_init.c:31:23:31:23 | sink output argument |
11791166
| struct_init.c:31:8:31:12 | outer [post update] [nestedAB, a] | struct_init.c:36:11:36:15 | outer [read] [nestedAB, a] |
@@ -1451,7 +1438,6 @@ nodes
14511438
| C.cpp:18:12:18:18 | C output argument [s1] | semmle.label | C output argument [s1] |
14521439
| C.cpp:18:12:18:18 | C output argument [s3] | semmle.label | C output argument [s3] |
14531440
| C.cpp:18:12:18:18 | new [post update] [s1] | semmle.label | new [post update] [s1] |
1454-
| C.cpp:18:12:18:18 | new [post update] [s3] | semmle.label | new [post update] [s3] |
14551441
| C.cpp:19:8:19:11 | c [s1] | semmle.label | c [s1] |
14561442
| C.cpp:19:8:19:11 | c [s3] | semmle.label | c [s3] |
14571443
| C.cpp:22:3:22:3 | ReturnIndirection [s1] | semmle.label | ReturnIndirection [s1] |
@@ -1567,20 +1553,12 @@ nodes
15671553
| aliasing.cpp:30:8:30:9 | s2 [read] [m1] | semmle.label | s2 [read] [m1] |
15681554
| aliasing.cpp:30:11:30:12 | FieldAddress [read] | semmle.label | FieldAddress [read] |
15691555
| aliasing.cpp:30:11:30:12 | m1 | semmle.label | m1 |
1570-
| aliasing.cpp:37:13:37:22 | call to user_input | semmle.label | call to user_input |
1571-
| aliasing.cpp:38:11:38:12 | m1 | semmle.label | m1 |
1572-
| aliasing.cpp:42:11:42:20 | call to user_input | semmle.label | call to user_input |
1573-
| aliasing.cpp:43:13:43:14 | m1 | semmle.label | m1 |
15741556
| aliasing.cpp:60:3:60:4 | s2 [post update] [m1] | semmle.label | s2 [post update] [m1] |
15751557
| aliasing.cpp:60:6:60:7 | m1 [post update] | semmle.label | m1 [post update] |
15761558
| aliasing.cpp:60:11:60:20 | call to user_input | semmle.label | call to user_input |
15771559
| aliasing.cpp:62:8:62:12 | copy2 [read] [m1] | semmle.label | copy2 [read] [m1] |
15781560
| aliasing.cpp:62:14:62:15 | FieldAddress [read] | semmle.label | FieldAddress [read] |
15791561
| aliasing.cpp:62:14:62:15 | m1 | semmle.label | m1 |
1580-
| aliasing.cpp:79:11:79:20 | call to user_input | semmle.label | call to user_input |
1581-
| aliasing.cpp:80:12:80:13 | m1 | semmle.label | m1 |
1582-
| aliasing.cpp:86:10:86:19 | call to user_input | semmle.label | call to user_input |
1583-
| aliasing.cpp:87:12:87:13 | m1 | semmle.label | m1 |
15841562
| aliasing.cpp:92:3:92:3 | w [post update] [s, m1] | semmle.label | w [post update] [s, m1] |
15851563
| aliasing.cpp:92:5:92:5 | s [post update] [m1] | semmle.label | s [post update] [m1] |
15861564
| aliasing.cpp:92:7:92:8 | m1 [post update] | semmle.label | m1 [post update] |
@@ -2446,11 +2424,7 @@ subpaths
24462424
| E.cpp:32:13:32:18 | buffer | E.cpp:29:21:29:29 | argument_source output argument | E.cpp:32:13:32:18 | buffer | buffer flows from $@ | E.cpp:29:21:29:29 | argument_source output argument | argument_source output argument |
24472425
| aliasing.cpp:29:11:29:12 | m1 | aliasing.cpp:9:11:9:20 | call to user_input | aliasing.cpp:29:11:29:12 | m1 | m1 flows from $@ | aliasing.cpp:9:11:9:20 | call to user_input | call to user_input |
24482426
| aliasing.cpp:30:11:30:12 | m1 | aliasing.cpp:13:10:13:19 | call to user_input | aliasing.cpp:30:11:30:12 | m1 | m1 flows from $@ | aliasing.cpp:13:10:13:19 | call to user_input | call to user_input |
2449-
| aliasing.cpp:38:11:38:12 | m1 | aliasing.cpp:37:13:37:22 | call to user_input | aliasing.cpp:38:11:38:12 | m1 | m1 flows from $@ | aliasing.cpp:37:13:37:22 | call to user_input | call to user_input |
2450-
| aliasing.cpp:43:13:43:14 | m1 | aliasing.cpp:42:11:42:20 | call to user_input | aliasing.cpp:43:13:43:14 | m1 | m1 flows from $@ | aliasing.cpp:42:11:42:20 | call to user_input | call to user_input |
24512427
| aliasing.cpp:62:14:62:15 | m1 | aliasing.cpp:60:11:60:20 | call to user_input | aliasing.cpp:62:14:62:15 | m1 | m1 flows from $@ | aliasing.cpp:60:11:60:20 | call to user_input | call to user_input |
2452-
| aliasing.cpp:80:12:80:13 | m1 | aliasing.cpp:79:11:79:20 | call to user_input | aliasing.cpp:80:12:80:13 | m1 | m1 flows from $@ | aliasing.cpp:79:11:79:20 | call to user_input | call to user_input |
2453-
| aliasing.cpp:87:12:87:13 | m1 | aliasing.cpp:86:10:86:19 | call to user_input | aliasing.cpp:87:12:87:13 | m1 | m1 flows from $@ | aliasing.cpp:86:10:86:19 | call to user_input | call to user_input |
24542428
| aliasing.cpp:93:12:93:13 | m1 | aliasing.cpp:92:12:92:21 | call to user_input | aliasing.cpp:93:12:93:13 | m1 | m1 flows from $@ | aliasing.cpp:92:12:92:21 | call to user_input | call to user_input |
24552429
| aliasing.cpp:143:8:143:16 | access to array | aliasing.cpp:106:9:106:18 | call to user_input | aliasing.cpp:143:8:143:16 | access to array | access to array flows from $@ | aliasing.cpp:106:9:106:18 | call to user_input | call to user_input |
24562430
| aliasing.cpp:159:8:159:14 | * ... | aliasing.cpp:106:9:106:18 | call to user_input | aliasing.cpp:159:8:159:14 | * ... | * ... flows from $@ | aliasing.cpp:106:9:106:18 | call to user_input | call to user_input |

‎cpp/ql/test/library-tests/dataflow/security-taint/tainted_diff.expected‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,10 @@
1010
| test.cpp:49:23:49:28 | call to getenv | test.cpp:50:29:50:40 | envStrGlobal | AST only |
1111
| test.cpp:49:23:49:28 | call to getenv | test.cpp:52:2:52:12 | * ... | AST only |
1212
| test.cpp:49:23:49:28 | call to getenv | test.cpp:52:3:52:12 | envStr_ptr | AST only |
13+
| test.cpp:49:23:49:28 | call to getenv | test.cpp:54:6:54:35 | ! ... | AST only |
14+
| test.cpp:49:23:49:28 | call to getenv | test.cpp:54:7:54:12 | call to strcmp | AST only |
15+
| test.cpp:49:23:49:28 | call to getenv | test.cpp:54:7:54:35 | (bool)... | AST only |
16+
| test.cpp:49:23:49:28 | call to getenv | test.cpp:54:14:54:25 | envStrGlobal | AST only |
1317
| test.cpp:60:29:60:34 | call to getenv | test.cpp:10:27:10:27 | s | AST only |
1418
| test.cpp:60:29:60:34 | call to getenv | test.cpp:60:18:60:25 | userName | AST only |
1519
| test.cpp:68:28:68:33 | call to getenv | test.cpp:11:20:11:21 | s1 | AST only |

‎cpp/ql/test/library-tests/dataflow/security-taint/tainted_ir.expected‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,6 @@
1414
| test.cpp:49:23:49:28 | call to getenv | test.cpp:49:23:49:28 | call to getenv |
1515
| test.cpp:49:23:49:28 | call to getenv | test.cpp:49:23:49:40 | (const char *)... |
1616
| test.cpp:49:23:49:28 | call to getenv | test.cpp:52:16:52:21 | envStr |
17-
| test.cpp:49:23:49:28 | call to getenv | test.cpp:54:6:54:35 | ! ... |
18-
| test.cpp:49:23:49:28 | call to getenv | test.cpp:54:7:54:12 | call to strcmp |
19-
| test.cpp:49:23:49:28 | call to getenv | test.cpp:54:7:54:35 | (bool)... |
20-
| test.cpp:49:23:49:28 | call to getenv | test.cpp:54:14:54:25 | envStrGlobal |
2117
| test.cpp:60:29:60:34 | call to getenv | test.cpp:60:29:60:34 | call to getenv |
2218
| test.cpp:60:29:60:34 | call to getenv | test.cpp:60:29:60:47 | (const char *)... |
2319
| test.cpp:60:29:60:34 | call to getenv | test.cpp:64:25:64:32 | userName |

‎cpp/ql/test/library-tests/dataflow/smart-pointers-taint/test.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ void test_unique_ptr_int() {
77
std::unique_ptr<int> p1(new int(source()));
88
std::unique_ptr<int> p2 = std::make_unique<int>(source());
99

10-
sink(*p1); // $ ir MISSING: ast
10+
sink(*p1); // $ MISSING: ast,ir
1111
sink(*p2); // $ ast ir=8:50
1212
}
1313

@@ -31,7 +31,7 @@ void test_shared_ptr_int() {
3131
std::shared_ptr<int> p1(new int(source()));
3232
std::shared_ptr<int> p2 = std::make_shared<int>(source());
3333

34-
sink(*p1); // $ ast ir
34+
sink(*p1); // $ ast MISSING: ir
3535
sink(*p2); // $ ast ir=32:50
3636
}
3737

0 commit comments

Comments
 (0)