Skip to content

Shared/C++: Handle non-standard return values in MaD flow sources/sinks#19569

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
MathiasVP merged 4 commits into from
May 23, 2025
Merged

Shared/C++: Handle non-standard return values in MaD flow sources/sinks #19569

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
69ea19c
Shared: Add a 'getReturnValueKind' predicate and use it in 'interpret…
MathiasVP May 23, 2025
07c4eca
C++: Implement the new predicate for C++.
MathiasVP May 23, 2025
cf39103
C++: Accept test changes.
MathiasVP May 23, 2025
92e0b64
Shared: Fix QLDoc.
MathiasVP May 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -22,7 +22,11 @@ module Input implements InputSig<Location, DataFlowImplSpecific::CppDataFlow> {

ArgumentPosition callbackSelfParameterPosition() { result = TDirectPosition(-1) }

ReturnKind getStandardReturnValueKind() { result.(NormalReturnKind).getIndirectionIndex() = 0 }
ReturnKind getStandardReturnValueKind() { result = getReturnValueKind("") }

ReturnKind getReturnValueKind(string arg) {
arg = repeatStars(result.(NormalReturnKind).getIndirectionIndex())
}

string encodeParameterPosition(ParameterPosition pos) { result = pos.toString() }

Expand Down
6 changes: 3 additions & 3 deletions cpp/ql/test/library-tests/dataflow/models-as-data/tests.cpp
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -56,9 +56,9 @@ void test_sources() {
sink(v_direct); // $ ir

sink(remoteMadSourceIndirect());
sink(*remoteMadSourceIndirect()); // $ MISSING: ir
sink(*remoteMadSourceIndirect()); // $ ir
sink(*remoteMadSourceDoubleIndirect());
sink(**remoteMadSourceDoubleIndirect()); // $ MISSING: ir
sink(**remoteMadSourceDoubleIndirect()); // $ ir

int a, b, c, d;

Expand DownExpand Up@@ -124,7 +124,7 @@ void test_sinks() {
// test sources + sinks together

madSinkArg0(localMadSource()); // $ ir
madSinkIndirectArg0(remoteMadSourceIndirect()); // $ MISSING: ir
madSinkIndirectArg0(remoteMadSourceIndirect()); // $ ir
madSinkVar = remoteMadSourceVar; // $ ir
*madSinkVarIndirect = remoteMadSourceVar; // $ MISSING: ir
}
Expand Down
38 changes: 31 additions & 7 deletions shared/dataflow/codeql/dataflow/internal/FlowSummaryImpl.qll
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -54,6 +54,20 @@ signature module InputSig<LocationSig Location, DF::InputSig<Location> Lang> {
/** Gets the return kind corresponding to specification `"ReturnValue"`. */
Lang::ReturnKind getStandardReturnValueKind();

/**
* Gets the return kind corresponding to specification `"ReturnValue"` when
* supplied with the argument `arg`.
*
* Note that it is expected that the following equality holds:
* ```
* getReturnValueKind("") = getStandardReturnValueKind()
* ```
*/
default Lang::ReturnKind getReturnValueKind(string arg) {
arg = "" and
result = getStandardReturnValueKind()
}

/** Gets the textual representation of parameter position `pos` used in MaD. */
string encodeParameterPosition(Lang::ParameterPosition pos);

Expand DownExpand Up@@ -2164,9 +2178,15 @@ module Make<
)
)
or
c = "ReturnValue" and
node.asNode() =
getAnOutNodeExt(mid.asCall(), TValueReturn(getStandardReturnValueKind()))
c.getName() = "ReturnValue" and
exists(ReturnKind rk |
not exists(c.getAnArgument()) and
rk = getStandardReturnValueKind()
or
rk = getReturnValueKind(c.getAnArgument())
Comment thread
jketema marked this conversation as resolved.
|
node.asNode() = getAnOutNodeExt(mid.asCall(), TValueReturn(rk))
)
or
SourceSinkInterpretationInput::interpretOutput(c, mid, node)
)
Expand DownExpand Up@@ -2198,12 +2218,16 @@ module Make<
)
)
or
exists(ReturnNode ret, ValueReturnKind kind |
c = "ReturnValue" and
exists(ReturnNode ret, ReturnKind kind |
Comment thread
jketema marked this conversation as resolved.
c.getName() = "ReturnValue" and
ret = node.asNode() and
kind.getKind() = ret.getKind() and
kind.getKind() = getStandardReturnValueKind() and
kind = ret.getKind() and
mid.asCallable() = getNodeEnclosingCallable(ret)
|
not exists(c.getAnArgument()) and
kind = getStandardReturnValueKind()
or
kind = getReturnValueKind(c.getAnArgument())
)
or
SourceSinkInterpretationInput::interpretInput(c, mid, node)
Expand Down