Skip to content

Update EXP39-C to use the new dataflow library #1201

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
MichaelRFairhurst wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update EXP39-C to use the new dataflow library #1201

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 15 additions & 14 deletions c/cert/src/rules/EXP39-C/DoNotAccessVariableViaPointerOfIncompatibleType.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@

import cpp
import codingstandards.c.cert
import semmle.code.cpp.dataflow.DataFlow
import semmle.code.cpp.dataflow.new.DataFlow
import semmle.code.cpp.controlflow.Dominance
import IndirectCastFlow::PathGraph

Expand All @@ -35,12 +35,12 @@ class MemsetFunction extends Function {
}
}

class IndirectCastAnalysisUnconvertedCastExpr extends Expr {
IndirectCastAnalysisUnconvertedCastExpr() { this = any(Cast c).getUnconverted() }
class CastedExpr extends Expr {
CastedExpr() { this = any(Cast c).getExpr() }
}

class IndirectCastAnalysisDereferenceSink extends Expr {
IndirectCastAnalysisDereferenceSink() { dereferenced(this) }
class DereferencedExpr extends Expr {
DereferencedExpr() { dereferenced(this) }
}

class ReallocationFunction extends AllocationFunction {
Expand Down Expand Up @@ -68,14 +68,14 @@ module IndirectCastConfig implements DataFlow::StateConfigSig {

predicate isSource(DataFlow::Node source, FlowState state) {
state instanceof IndirectCastDefaultFlowState and
source.asExpr() instanceof IndirectCastAnalysisUnconvertedCastExpr
source.asExpr() instanceof CastedExpr
}

predicate isSink(DataFlow::Node sink, FlowState state) {
sink.asExpr() instanceof IndirectCastAnalysisUnconvertedCastExpr and
sink.asExpr() instanceof CastedExpr and
state instanceof IndirectCastDefaultFlowState
or
sink.asExpr() instanceof IndirectCastAnalysisDereferenceSink and
sink.asExpr() instanceof DereferencedExpr and
state instanceof IndirectCastReallocatedFlowState and
// The memset call won't always have an edge to subsequent dereferences.
//
Expand Down Expand Up @@ -193,17 +193,18 @@ Type compatibleTypes(Type type) {
}

from
IndirectCastFlow::PathNode source, IndirectCastFlow::PathNode sink, Cast cast, Type fromType,
Type toType
Expr sinkExpr, IndirectCastFlow::PathNode source, IndirectCastFlow::PathNode sink, Cast cast,
Type fromType, Type toType
where
not isExcluded(sink.getNode().asExpr(),
Pointers3Package::doNotAccessVariableViaPointerOfIncompatibleTypeQuery()) and
not isExcluded(sinkExpr, Pointers3Package::doNotAccessVariableViaPointerOfIncompatibleTypeQuery()) and
cast.getFile().compiledAsC() and
IndirectCastFlow::flowPath(source, sink) and
// include only sinks which are not a compatible type to the associated source
source.getNode().asExpr() = cast.getUnconverted() and
fromType = cast.getUnconverted().getType().(PointerType).getBaseType() and
toType = sink.getNode().asExpr().getActualType().(PointerType).getBaseType() and
not toType = compatibleTypes(fromType)
select sink.getNode().asExpr().getUnconverted(), source, sink,
not toType = compatibleTypes(fromType) and
sinkExpr = sink.getNode().asExpr() and
(sinkExpr instanceof CastedExpr or sinkExpr instanceof DereferencedExpr)
select sinkExpr, source, sink,
"Cast from " + fromType + " to " + toType + " results in an incompatible pointer base type."
82 changes: 42 additions & 40 deletions c/cert/test/rules/EXP39-C/DoNotAccessVariableViaPointerOfIncompatibleType.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,67 +1,69 @@
WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotAccessVariableViaPointerOfIncompatibleType.ql:66,38-46)
WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotAccessVariableViaPointerOfIncompatibleType.ql:69,22-30)
WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotAccessVariableViaPointerOfIncompatibleType.ql:74,20-28)
WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotAccessVariableViaPointerOfIncompatibleType.ql:107,23-31)
WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotAccessVariableViaPointerOfIncompatibleType.ql:116,5-13)
WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotAccessVariableViaPointerOfIncompatibleType.ql:116,45-53)
WARNING: module 'DataFlow' has been deprecated and may be removed in future (DoNotAccessVariableViaPointerOfIncompatibleType.ql:138,27-35)
edges
| test.c:49:8:49:9 | s3 | test.c:50:8:50:9 | s1 | provenance | |
| test.c:49:3:49:9 | ... = ... | test.c:50:8:50:9 | s1 | provenance | |
| test.c:49:8:49:9 | s3 | test.c:49:3:49:9 | ... = ... | provenance | |
| test.c:60:16:60:18 | E1A | test.c:60:16:60:18 | E1A | provenance | |
| test.c:60:16:60:18 | E1A | test.c:61:16:61:17 | e1 | provenance | |
| test.c:60:16:60:18 | E1A | test.c:65:10:65:12 | & ... | provenance | |
| test.c:68:22:68:22 | v | test.c:68:41:68:41 | v | provenance | |
| test.c:68:22:68:22 | v | test.c:68:34:68:41 | v | provenance | |
| test.c:72:13:72:15 | & ... | test.c:68:22:68:22 | v | provenance | |
| test.c:74:13:74:15 | & ... | test.c:68:22:68:22 | v | provenance | |
| test.c:97:32:97:37 | call to malloc | test.c:98:40:98:41 | s2 | provenance | |
| test.c:97:32:97:37 | call to malloc | test.c:98:40:98:41 | s2 | provenance | |
| test.c:98:32:98:38 | call to realloc | test.c:99:3:99:4 | s3 | provenance | |
| test.c:98:32:98:38 | call to realloc | test.c:100:10:100:11 | s3 | provenance | |
| test.c:98:40:98:41 | s2 | test.c:98:32:98:38 | call to realloc | provenance | Config |
| test.c:97:19:97:56 | call to malloc | test.c:97:19:97:56 | call to malloc | provenance | |
| test.c:97:19:97:56 | call to malloc | test.c:98:40:98:41 | s2 | provenance | |
| test.c:97:19:97:56 | call to malloc | test.c:98:40:98:41 | s2 | provenance | |
| test.c:98:19:98:61 | call to realloc | test.c:98:19:98:61 | call to realloc | provenance | |
| test.c:98:19:98:61 | call to realloc | test.c:98:19:98:61 | call to realloc | provenance | |
| test.c:98:19:98:61 | call to realloc | test.c:99:3:99:4 | s3 | provenance | |
| test.c:98:19:98:61 | call to realloc | test.c:100:10:100:11 | s3 | provenance | |
| test.c:98:40:98:41 | s2 | test.c:98:19:98:61 | call to realloc | provenance | Config |
nodes
| test.c:6:19:6:20 | & ... | semmle.label | & ... |
| test.c:11:10:11:11 | & ... | semmle.label | & ... |
| test.c:13:17:13:19 | & ... | semmle.label | & ... |
| test.c:15:17:15:19 | & ... | semmle.label | & ... |
| test.c:19:18:19:20 | & ... | semmle.label | & ... |
| test.c:20:20:20:22 | & ... | semmle.label | & ... |
| test.c:22:11:22:13 | & ... | semmle.label | & ... |
| test.c:27:17:27:19 | & ... | semmle.label | & ... |
| test.c:28:10:28:12 | & ... | semmle.label | & ... |
| test.c:29:13:29:15 | & ... | semmle.label | & ... |
| test.c:30:19:30:21 | & ... | semmle.label | & ... |
| test.c:31:16:31:18 | & ... | semmle.label | & ... |
| test.c:6:12:6:20 | & ... | semmle.label | & ... |
| test.c:11:3:11:11 | & ... | semmle.label | & ... |
| test.c:13:3:13:19 | & ... | semmle.label | & ... |
| test.c:15:3:15:19 | & ... | semmle.label | & ... |
| test.c:19:3:19:20 | & ... | semmle.label | & ... |
| test.c:20:3:20:22 | & ... | semmle.label | & ... |
| test.c:22:3:22:13 | & ... | semmle.label | & ... |
| test.c:27:3:27:19 | & ... | semmle.label | & ... |
| test.c:28:3:28:12 | & ... | semmle.label | & ... |
| test.c:29:3:29:15 | & ... | semmle.label | & ... |
| test.c:30:3:30:21 | & ... | semmle.label | & ... |
| test.c:31:3:31:18 | & ... | semmle.label | & ... |
| test.c:47:8:47:9 | s2 | semmle.label | s2 |
| test.c:49:3:49:9 | ... = ... | semmle.label | ... = ... |
| test.c:49:8:49:9 | s3 | semmle.label | s3 |
| test.c:49:8:49:9 | s3 | semmle.label | s3 |
| test.c:50:8:50:9 | s1 | semmle.label | s1 |
| test.c:60:16:60:18 | E1A | semmle.label | E1A |
| test.c:60:16:60:18 | E1A | semmle.label | E1A |
| test.c:60:16:60:18 | E1A | semmle.label | E1A |
| test.c:61:16:61:17 | e1 | semmle.label | e1 |
| test.c:65:10:65:12 | & ... | semmle.label | & ... |
| test.c:65:3:65:12 | & ... | semmle.label | & ... |
| test.c:68:22:68:22 | v | semmle.label | v |
| test.c:68:41:68:41 | v | semmle.label | v |
| test.c:68:34:68:41 | v | semmle.label | v |
| test.c:72:13:72:15 | & ... | semmle.label | & ... |
| test.c:72:13:72:15 | & ... | semmle.label | & ... |
| test.c:74:13:74:15 | & ... | semmle.label | & ... |
| test.c:74:13:74:15 | & ... | semmle.label | & ... |
| test.c:97:32:97:37 | call to malloc | semmle.label | call to malloc |
| test.c:97:32:97:37 | call to malloc | semmle.label | call to malloc |
| test.c:98:32:98:38 | call to realloc | semmle.label | call to realloc |
| test.c:98:32:98:38 | call to realloc | semmle.label | call to realloc |
| test.c:98:32:98:38 | call to realloc | semmle.label | call to realloc |
| test.c:97:19:97:56 | call to malloc | semmle.label | call to malloc |
| test.c:97:19:97:56 | call to malloc | semmle.label | call to malloc |
| test.c:97:19:97:56 | call to malloc | semmle.label | call to malloc |
| test.c:98:19:98:61 | call to realloc | semmle.label | call to realloc |
| test.c:98:19:98:61 | call to realloc | semmle.label | call to realloc |
| test.c:98:19:98:61 | call to realloc | semmle.label | call to realloc |
| test.c:98:19:98:61 | call to realloc | semmle.label | call to realloc |
| test.c:98:19:98:61 | call to realloc | semmle.label | call to realloc |
| test.c:98:40:98:41 | s2 | semmle.label | s2 |
| test.c:98:40:98:41 | s2 | semmle.label | s2 |
| test.c:99:3:99:4 | s3 | semmle.label | s3 |
| test.c:100:10:100:11 | s3 | semmle.label | s3 |
subpaths
#select
| test.c:6:19:6:20 | & ... | test.c:6:19:6:20 | & ... | test.c:6:19:6:20 | & ... | Cast from float to int results in an incompatible pointer base type. |
| test.c:11:10:11:11 | & ... | test.c:11:10:11:11 | & ... | test.c:11:10:11:11 | & ... | Cast from short[2] to int results in an incompatible pointer base type. |
| test.c:13:17:13:19 | & ... | test.c:13:17:13:19 | & ... | test.c:13:17:13:19 | & ... | Cast from short[2] to short[4] results in an incompatible pointer base type. |
| test.c:19:18:19:20 | & ... | test.c:19:18:19:20 | & ... | test.c:19:18:19:20 | & ... | Cast from char to signed char results in an incompatible pointer base type. |
| test.c:30:19:30:21 | & ... | test.c:30:19:30:21 | & ... | test.c:30:19:30:21 | & ... | Cast from int to unsigned int results in an incompatible pointer base type. |
| test.c:6:19:6:20 | & ... | test.c:6:12:6:20 | & ... | test.c:6:12:6:20 | & ... | Cast from float to int results in an incompatible pointer base type. |
| test.c:11:10:11:11 | & ... | test.c:11:3:11:11 | & ... | test.c:11:3:11:11 | & ... | Cast from short[2] to int results in an incompatible pointer base type. |
| test.c:13:17:13:19 | & ... | test.c:13:3:13:19 | & ... | test.c:13:3:13:19 | & ... | Cast from short[2] to short[4] results in an incompatible pointer base type. |
| test.c:19:18:19:20 | & ... | test.c:19:3:19:20 | & ... | test.c:19:3:19:20 | & ... | Cast from char to signed char results in an incompatible pointer base type. |
| test.c:30:19:30:21 | & ... | test.c:30:3:30:21 | & ... | test.c:30:3:30:21 | & ... | Cast from int to unsigned int results in an incompatible pointer base type. |
| test.c:47:8:47:9 | s2 | test.c:47:8:47:9 | s2 | test.c:47:8:47:9 | s2 | Cast from (unnamed class/struct/union) to (unnamed class/struct/union) results in an incompatible pointer base type. |
| test.c:49:8:49:9 | s3 | test.c:49:8:49:9 | s3 | test.c:49:8:49:9 | s3 | Cast from S1 to (unnamed class/struct/union) results in an incompatible pointer base type. |
| test.c:50:8:50:9 | s1 | test.c:50:8:50:9 | s1 | test.c:50:8:50:9 | s1 | Cast from (unnamed class/struct/union) to S1 results in an incompatible pointer base type. |
| test.c:68:41:68:41 | v | test.c:72:13:72:15 | & ... | test.c:68:41:68:41 | v | Cast from float to int results in an incompatible pointer base type. |
| test.c:68:41:68:41 | v | test.c:72:13:72:15 | & ... | test.c:68:34:68:41 | v | Cast from float to int results in an incompatible pointer base type. |
| test.c:99:3:99:4 | s3 | test.c:98:40:98:41 | s2 | test.c:99:3:99:4 | s3 | Cast from S2 to S3 results in an incompatible pointer base type. |
3 changes: 3 additions & 0 deletions change_notes/2026-09-20-update-exp39-c-to-use-new-dataflow.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
- `EXP39-C` - `DoNotAccessVariableViaPointerOfIncompatibleType.ql`
- Updated the underlying dataflow library to use the new dataflow from the deprecated old data flow. This may cause behavioral changes in some analyses, usually with improved results and performance.
- Some refactoring required to accommodate functional changes in how dataflow nodes attach to the AST. No functional changes to the analysis from this are expected.
Comment on lines +2 to +3
Loading