Skip to content

C++: Fix two more joins#22513

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
MathiasVP merged 2 commits into from
Sep 5, 2026
+45 −14
Merged

C++: Fix two more joins #22513

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8bc69b4
C++: Fix a bad join.
MathiasVP Sep 4, 2026
0208f19
C++: Reduce tuple duplication in store step pipeline.
MathiasVP Sep 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -256,7 +256,7 @@ private module Input2 implements Impl::Private::InputSig2 {
pragma[nomagic]
private predicate hasKindAndEnclosingFunction(Function f, ReturnKind rk, ReturnNode r) {
r.getEnclosingCallable().asSourceCallable() = f and
r.getKind() = rk
pragma[only_bind_into](r).getKind() = rk
}

pragma[nomagic]
Expand Down
57 changes: 44 additions & 13 deletions cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -122,6 +122,47 @@ private module Cached {
FlowSummaryImpl::Private::Steps::summaryJumpStep(n1, n2)
}

bindingset[store]
pragma[inline_late]
private predicate nodeHasInstructionLate(Node node, StoreInstruction store, int indirectionIndex) {
nodeHasInstruction(node, store, indirectionIndex)
}

pragma[nomagic]
private predicate storeStepSource(
Operand fieldAddress, int contentIndirectionIndex, Node node, boolean certain
) {
exists(int indirectionIndex, int numberOfLoads, StoreInstruction store |
nodeHasInstructionLate(node, store, indirectionIndex) and
numberOfLoadsFromOperand(fieldAddress, store.getDestinationAddressOperand(), numberOfLoads,
certain) and
contentIndirectionIndex = 1 + indirectionIndex + numberOfLoads
)
}

pragma[nomagic]
private predicate hasFieldAddressAndField(Field f, PostFieldUpdateNode pfu, Operand fieldAddress) {
pfu.getIndirectionIndex() = 1 and
pfu.getUpdatedField() = f and
pfu.getFieldAddress() = fieldAddress
}

pragma[nomagic]
private predicate hasFieldAndIndirectionIndex(Field f, int indirectionIndex, FieldContent fc) {
fc.getAField() = f and
fc.getIndirectionIndex() = indirectionIndex
}

pragma[nomagic]
private predicate storeStepTarget(
Operand address, int indirectionIndex, PostFieldUpdateNode pfu, FieldContent fc
) {
exists(Field f |
hasFieldAddressAndField(f, pfu, address) and
hasFieldAndIndirectionIndex(f, indirectionIndex, fc)
)
}

/**
* Holds if data can flow from `node1` to `node2` via an assignment to `f`.
* Thus, `node2` references an object with a field `f` that contains the
Expand All@@ -132,19 +173,9 @@ private module Cached {
*/
cached
predicate storeStepImpl(Node node1, Content c, Node node2, boolean certain) {
exists(
PostFieldUpdateNode postFieldUpdate, int indirectionIndex1, int numberOfLoads,
StoreInstruction store, FieldContent fc
|
postFieldUpdate = node2 and
fc = c and
nodeHasInstruction(node1, pragma[only_bind_into](store),
pragma[only_bind_into](indirectionIndex1)) and
postFieldUpdate.getIndirectionIndex() = 1 and
numberOfLoadsFromOperand(postFieldUpdate.getFieldAddress(),
store.getDestinationAddressOperand(), numberOfLoads, certain) and
fc.getAField() = postFieldUpdate.getUpdatedField() and
getIndirectionIndexLate(fc) = 1 + indirectionIndex1 + numberOfLoads
exists(Operand fieldAddress, int indirectionIndex |
storeStepSource(fieldAddress, indirectionIndex, node1, certain) and
storeStepTarget(fieldAddress, indirectionIndex, node2, c)
)
or
// models-as-data summarized flow
Expand Down
Loading