Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

C++: Implement use-after-free and double-free queries using the new IR use-use dataflow #12569

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 24 commits into from
Apr 17, 2023
Merged

C++: Implement use-after-free and double-free queries using the new IR use-use dataflow #12569

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
24 commits
Select commit Hold shift + click to select a range
d65bb3b
C++: Make basic block information available from dataflow nodes.
MathiasVP Apr 11, 2023
dfe00ff
C++: Add a flow-after-free library.
MathiasVP Apr 11, 2023
cc12e74
C++: Add double-free query.
MathiasVP Apr 11, 2023
fb2ec15
C++: Add double-free query documentation.
MathiasVP Apr 11, 2023
a8151b4
C++: Add double-free tests.
MathiasVP Apr 11, 2023
17fe5f2
C++: Change the id of the experimental double-free query to not overl…
MathiasVP Apr 11, 2023
725004a
C++: Modernize use-after-free query using dataflow.
MathiasVP Apr 11, 2023
3c88590
C++: Accept test changes for the new use-after-query.
MathiasVP Apr 11, 2023
c1960c6
C++: Add double-free change note.
MathiasVP Apr 11, 2023
259d5b6
C++: Add use-after-free change note.
MathiasVP Apr 11, 2023
49cceb2
C++: Fix joins.
MathiasVP Apr 12, 2023
ab70f57
C++: More QLDoc.
MathiasVP Apr 12, 2023
ba4e3ae
Update cpp/ql/src/Critical/FlowAfterFree.qll
MathiasVP Apr 12, 2023
e0aeea0
C++: Fix qhelp for double-free.
MathiasVP Apr 13, 2023
d304022
C++: Add QLDoc to 'isExcludeFreePair'.
MathiasVP Apr 13, 2023
c76dbeb
C++: Ensure that the 'use-after-free' query is run on 'test_free.cpp'.
MathiasVP Apr 13, 2023
416f8d5
C++: Fix test annotations.
MathiasVP Apr 13, 2023
23a7cd9
C++: Fix missing result and accept test changes.
MathiasVP Apr 13, 2023
40dde93
C++: Fix FP and accept test changes.
MathiasVP Apr 13, 2023
31b71ea
C++: Fix annotations.
MathiasVP Apr 13, 2023
1ac5db3
C++: Fix annotations.
MathiasVP Apr 13, 2023
b2d4a82
C++: Fix annotations.
MathiasVP Apr 13, 2023
dba46bd
Update cpp/ql/src/Critical/DoubleFree.ql
MathiasVP Apr 17, 2023
fa5ed04
Update cpp/ql/src/Critical/DoubleFree.qhelp
MathiasVP Apr 17, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
C++: Make basic block information available from dataflow nodes.
  • Loading branch information
@MathiasVP
MathiasVP committed Apr 11, 2023
commit d65bb3b23242e19800911d8c732ae8ce408f50d8
20 changes: 2 additions & 18 deletions 20 cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -897,23 +897,6 @@ private class MyConsistencyConfiguration extends Consistency::ConsistencyConfigu
}
}

/**
* Gets the basic block of `node`.
*/
IRBlock getBasicBlock(Node node) {
node.asInstruction().getBlock() = result
or
node.asOperand().getUse().getBlock() = result
or
node.(SsaPhiNode).getPhiNode().getBasicBlock() = result
or
node.(RawIndirectOperand).getOperand().getUse().getBlock() = result
or
node.(RawIndirectInstruction).getInstruction().getBlock() = result
or
result = getBasicBlock(node.(PostUpdateNode).getPreUpdateNode())
}

/**
* A local flow relation that includes both local steps, read steps and
* argument-to-return flow through summarized functions.
Expand Down Expand Up @@ -999,7 +982,8 @@ private int countNumberOfBranchesUsingParameter(SwitchInstruction switch, Parame
// we pick the one with the highest edge count.
result =
max(SsaPhiNode phi |
switch.getSuccessor(caseOrDefaultEdge()).getBlock().dominanceFrontier() = getBasicBlock(phi) and
switch.getSuccessor(caseOrDefaultEdge()).getBlock().dominanceFrontier() =
phi.getBasicBlock() and
phi.getSourceVariable() = sv
|
strictcount(phi.getAnInput())
Expand Down
22 changes: 20 additions & 2 deletions 22 cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,6 +160,24 @@ class Node extends TIRDataFlowNode {
/** Gets the operands corresponding to this node, if any. */
Operand asOperand() { result = this.(OperandNode).getOperand() }

/** Holds if this node is at index `i` in basic block `block`. */
final predicate hasIndexInBlock(IRBlock block, int i) {
this.asInstruction() = block.getInstruction(i)
or
this.asOperand().getUse() = block.getInstruction(i)
or
this.(SsaPhiNode).getPhiNode().getBasicBlock() = block and i = -1
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I understand that phi nodes are defined to have index -1 in the basic block (is Ssa), but it is unclear to me if this is safe to use for comparison.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The index isn't supposed to be used for comparing dataflow nodes anyway. It's only used to give an ordering on the nodes, and there's no good way to order phi nodes. So using -1 for all the phi nodes in the block is really the most sensible choice

or
this.(RawIndirectOperand).getOperand().getUse() = block.getInstruction(i)
or
this.(RawIndirectInstruction).getInstruction() = block.getInstruction(i)
or
this.(PostUpdateNode).getPreUpdateNode().hasIndexInBlock(block, i)
}

/** Gets the basic block of this node, if any. */
final IRBlock getBasicBlock() { this.hasIndexInBlock(result, _) }

/**
* Gets the non-conversion expression corresponding to this node, if any.
* This predicate only has a result on nodes that represent the value of
Expand Down Expand Up @@ -530,7 +548,7 @@ class SsaPhiNode extends Node, TSsaPhiNode {
*/
final Node getAnInput(boolean fromBackEdge) {
localFlowStep(result, this) and
if phi.getBasicBlock().dominates(getBasicBlock(result))
if phi.getBasicBlock().dominates(result.getBasicBlock())
then fromBackEdge = true
else fromBackEdge = false
}
Expand Down Expand Up @@ -1887,7 +1905,7 @@ module BarrierGuard<guardChecksSig/3 guardChecks> {
e = value.getAnInstruction().getConvertedResultExpression() and
result.getConvertedExpr() = e and
guardChecks(g, value.getAnInstruction().getConvertedResultExpression(), edge) and
g.controls(getBasicBlock(result), edge)
g.controls(result.getBasicBlock(), edge)
)
}
}
Expand Down
Morty Proxy This is a proxified and sanitized view of the page, visit original site.