C++: Add a new library for constructing macro flow

[Mathias Vorreiter Pedersen (MathiasVP)]

This is a new cute little library I made as a response to a request from Ben Rodes (@bdrodes). The library makes it easy to construct paths that shows how an expression constructed from a set of nested macro expansions ends up in a piece of code. For example, let's say we want to find uses of sizeof(int) and we see code like this:

#defineDEBUG1
#defineMY_SIZEOF(x) sizeof(x)
#ifdef DEBUG
#defineMY_FOO(y) MY_SIZEOF(y)
#else
#defineMY_FOO(y) 0
#endifinttest() {
returnMY_FOO(int);
}

If you simply create a query that finds occurences of sizeof(int) you'll flag up the returned expression. However, it's not clear to a user why that expression is being alerted on. With this library we can do:

/** * @kind path-problem */import cpp
import semmle.code.cpp.macroflow.MacroFlow
module MyConfig implements MacroFlow::ConfigSig{predicateisSink(Expre){e.(SizeofTypeOperator).getTypeOperand()instanceofIntType}}module Flow = MacroFlow::Make<MyConfig>;
import Flow::PathGraph
from Flow::Noden1, Flow::Noden2,Exprewhere Flow::flowsTo(n1,n2,e)selecte,n1,n2,"Use of sizeof with integer type."

and we then get:

which makes it clear to a user where that sizeof is coming from.

I think this library could be really useful in general for C/C++ queries going forward. I may even upstream it to GitHub if I can find a good place to use it.