Skip to content

Commit 37caf0e

Browse files
MichaelRFairhurstMichaelRFairhurst
committed
Merge remote-tracking branch 'origin/main' into michaelrfairhurst/implement-concurrency9-package
2 parents 00defdd + d34b85c commit 37caf0e

File tree

116 files changed

+6369
-326
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

116 files changed

+6369
-326
lines changed

‎c/cert/src/rules/ARR39-C/DoNotAddOrSubtractAScaledIntegerToAPointer.ql

+1-1
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313

1414
import cpp
1515
import codingstandards.c.cert
16-
import codingstandards.cpp.Pointers
16+
import codingstandards.cpp.types.Pointers
1717
import semmle.code.cpp.dataflow.TaintTracking
1818
import ScaledIntegerPointerArithmeticFlow::PathGraph
1919

‎c/cert/src/rules/DCL40-C/IncompatibleFunctionDeclarations.ql

+3-5
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616

1717
import cpp
1818
import codingstandards.c.cert
19-
import codingstandards.cpp.Compatible
19+
import codingstandards.cpp.types.Compatible
2020
import ExternalIdentifiers
2121

2222
from ExternalIdentifiers d, FunctionDeclarationEntry f1, FunctionDeclarationEntry f2
@@ -29,12 +29,10 @@ where
2929
f1.getName() = f2.getName() and
3030
(
3131
//return type check
32-
not typesCompatible(f1.getType(), f2.getType())
32+
not FunctionDeclarationTypeEquivalence<TypesCompatibleConfig>::equalReturnTypes(f1, f2)
3333
or
3434
//parameter type check
35-
parameterTypesIncompatible(f1, f2)
36-
or
37-
not f1.getNumberOfParameters() = f2.getNumberOfParameters()
35+
not FunctionDeclarationTypeEquivalence<TypesCompatibleConfig>::equalParameterTypes(f1, f2)
3836
) and
3937
// Apply ordering on start line, trying to avoid the optimiser applying this join too early
4038
// in the pipeline

‎c/common/src/codingstandards/c/Generic.qll

+150
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
import cpp
2+
import codingstandards.cpp.Macro
3+
import codingstandards.cpp.MatchingParenthesis
4+
5+
string genericRegexp() { result = "\\b_Generic\\s*\\(\\s*(.+),.*" }
6+
7+
bindingset[input]
8+
string deparenthesize(string input) {
9+
input = "(" + result + ")" and
10+
result = input.substring(1, input.length() - 1)
11+
}
12+
13+
class GenericMacro extends Macro {
14+
string ctrlExpr;
15+
16+
GenericMacro() { ctrlExpr = getBody().regexpCapture(genericRegexp(), 1).trim() }
17+
18+
string getAParameter() { result = this.(FunctionLikeMacro).getAParameter() }
19+
20+
string getControllingExprString() {
21+
if exists(string s | s = deparenthesize(ctrlExpr))
22+
then result = deparenthesize(ctrlExpr).trim()
23+
else result = ctrlExpr
24+
}
25+
26+
/**
27+
* Whether the controlling expression of the `_Generic` expr in this macro's controlling
28+
* expression refers to one of this macro's parameters.
29+
*/
30+
predicate hasControllingExprFromMacroParameter() {
31+
getControllingExprString().matches(getAParameter())
32+
}
33+
}
34+
35+
class GenericMacroString extends string {
36+
GenericMacroString() { this = any(Macro m).getBody() and this.matches("%_Generic%") }
37+
}
38+
39+
import MatchingParenthesis<GenericMacroString>
40+
41+
class ParsedGenericMacro extends Macro {
42+
ParsedRoot macroBody;
43+
Parsed genericBody;
44+
string beforeGenericBody;
45+
string afterGenericBody;
46+
47+
ParsedGenericMacro() {
48+
macroBody.getInputString() = this.getBody() and
49+
exists(ParsedText genericText |
50+
genericText.getText().matches("%_Generic%") and
51+
genericBody = genericText.getParent().getChild(genericText.getChildIdx() + 1) and
52+
genericBody.getRoot() = macroBody
53+
) and
54+
beforeGenericBody =
55+
textFrom(macroBody.getStartToken(), genericBody.getStartToken().getPrevious()) and
56+
(
57+
if exists(genericBody.getEndToken().getNext())
58+
then afterGenericBody = textFrom(genericBody.getEndToken().getNext(), macroBody.getEndToken())
59+
else afterGenericBody = ""
60+
)
61+
}
62+
63+
string getAParameter() { result = this.(FunctionLikeMacro).getAParameter() }
64+
65+
int getAParsedGenericCommaSeparatorOffset() {
66+
exists(ParsedText text |
67+
text.getParent() = genericBody and
68+
result = text.getStartToken().getStartPos() + text.getText().indexOf(",")
69+
)
70+
}
71+
72+
int getAParsedGenericColonSeparatorOffset() {
73+
exists(ParsedText text |
74+
text.getParent() = genericBody and
75+
result = text.getStartToken().getStartPos() + text.getText().indexOf(":")
76+
)
77+
}
78+
79+
int getParsedGenericCommaSeparatorOffset(int i) {
80+
result = rank[i](int index | index = getAParsedGenericCommaSeparatorOffset())
81+
}
82+
83+
bindingset[start, end]
84+
int getParsedGenericColon(int start, int end) {
85+
result =
86+
min(int offset |
87+
offset = getAParsedGenericColonSeparatorOffset() and
88+
offset >= start and
89+
offset <= end
90+
)
91+
}
92+
93+
predicate hasParsedFullSelectionRange(int idx, int start, int end) {
94+
idx = 1 and
95+
start = genericBody.getStartToken().getEndPos() and
96+
end = getParsedGenericCommaSeparatorOffset(idx)
97+
or
98+
not exists(getParsedGenericCommaSeparatorOffset(idx)) and
99+
start = getParsedGenericCommaSeparatorOffset(idx - 1) and
100+
end = genericBody.getEndToken().getStartPos()
101+
or
102+
start = getParsedGenericCommaSeparatorOffset(idx - 1) and
103+
end = getParsedGenericCommaSeparatorOffset(idx)
104+
}
105+
106+
string getSelectionString(int idx) {
107+
exists(int start, int rawStart, int end |
108+
hasParsedFullSelectionRange(idx, rawStart, end) and
109+
(
110+
if exists(getParsedGenericColon(rawStart, end))
111+
then start = getParsedGenericColon(rawStart, end)
112+
else start = rawStart
113+
) and
114+
result = genericBody.getInputString().substring(start, end)
115+
)
116+
}
117+
118+
string getControllingExprString() { result = getSelectionString(1).trim() }
119+
120+
bindingset[str, word]
121+
private int countWordInString(string word, string str) {
122+
result =
123+
max(int occurrence |
124+
exists(str.regexpFind("\\b" + word + "\\b", occurrence, _)) or occurrence = -1
125+
|
126+
occurrence + 1
127+
)
128+
}
129+
130+
int expansionsOutsideExpr(string parameter) {
131+
parameter = getAParameter() and
132+
result =
133+
countWordInString(parameter, beforeGenericBody) +
134+
countWordInString(parameter, afterGenericBody)
135+
}
136+
137+
int expansionsInsideSelection(string parameter, int idx) {
138+
parameter = getAParameter() and
139+
result = countWordInString(parameter, getSelectionString(idx))
140+
}
141+
142+
int expansionsInsideControllingExpr(string parameter) {
143+
result = expansionsInsideSelection(parameter, 1)
144+
}
145+
146+
int expansionsInsideAssociation(string parameter, int idx) {
147+
not idx = 0 and
148+
result = expansionsInsideSelection(parameter, idx + 1)
149+
}
150+
}

‎c/common/src/codingstandards/c/OutOfBounds.qll

+1-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
*/
66

77
import cpp
8-
import codingstandards.cpp.Pointers
8+
import codingstandards.cpp.types.Pointers
99
import codingstandards.c.Variable
1010
import codingstandards.cpp.Allocations
1111
import codingstandards.cpp.Overflow

‎c/common/src/codingstandards/c/UndefinedBehavior.qll

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
import cpp
2-
import codingstandards.cpp.Pointers
2+
import codingstandards.cpp.types.Pointers
33
import codingstandards.cpp.UndefinedBehavior
44

55
/**

‎c/misra/src/codingstandards/c/misra/EssentialTypes.qll

+9-9
Original file line numberDiff line numberDiff line change
@@ -164,14 +164,14 @@ EssentialTypeCategory getEssentialTypeCategory(Type type) {
164164
*/
165165
pragma[nomagic]
166166
Type getEssentialType(Expr e) {
167-
if e.hasExplicitConversion()
168-
then
169-
if e.getConversion() instanceof ParenthesisExpr
170-
then
171-
if e.getConversion().(ParenthesisExpr).hasExplicitConversion()
172-
then result = e.getConversion().(ParenthesisExpr).getConversion().getType()
173-
else result = e.getConversion().(ParenthesisExpr).getExpr().(EssentialExpr).getEssentialType()
174-
else result = e.getConversion().getType()
167+
if e.hasConversion()
168+
then result = getEssentialTypeOfConversion(e.getFullyConverted())
169+
else result = e.(EssentialExpr).getEssentialType()
170+
}
171+
172+
Type getEssentialTypeOfConversion(Expr e) {
173+
if e.(Conversion).isImplicit() or e instanceof ParenthesisExpr or e instanceof C11GenericExpr
174+
then result = getEssentialTypeOfConversion(e.(Conversion).getExpr())
175175
else result = e.(EssentialExpr).getEssentialType()
176176
}
177177

@@ -455,7 +455,7 @@ class EssentialLiteral extends EssentialExpr, Literal {
455455
if underlyingStandardType.(IntType).isSigned()
456456
then result = stlr(this)
457457
else result = utlr(this)
458-
else result = underlyingStandardType
458+
else result = getStandardType()
459459
)
460460
)
461461
}

‎c/misra/src/rules/DIR-4-15/PossibleMisuseOfUndetectedInfinity.ql

+142
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
/**
2+
* @id c/misra/possible-misuse-of-undetected-infinity
3+
* @name DIR-4-15: Evaluation of floating-point expressions shall not lead to the undetected generation of infinities
4+
* @description Evaluation of floating-point expressions shall not lead to the undetected generation
5+
* of infinities.
6+
* @kind path-problem
7+
* @precision medium
8+
* @problem.severity warning
9+
* @tags external/misra/id/dir-4-15
10+
* correctness
11+
* external/misra/c/2012/amendment3
12+
* external/misra/obligation/required
13+
*/
14+
15+
import cpp
16+
import codeql.util.Boolean
17+
import codingstandards.c.misra
18+
import codingstandards.cpp.RestrictedRangeAnalysis
19+
import codingstandards.cpp.FloatingPoint
20+
import codingstandards.cpp.AlertReporting
21+
import semmle.code.cpp.controlflow.Guards
22+
import semmle.code.cpp.dataflow.new.DataFlow
23+
import semmle.code.cpp.dataflow.new.TaintTracking
24+
import semmle.code.cpp.controlflow.Dominance
25+
26+
module InvalidInfinityUsage implements DataFlow::ConfigSig {
27+
/**
28+
* An operation which does not have Infinity as an input, but may produce Infinity, according
29+
* to the `RestrictedRangeAnalysis` module.
30+
*/
31+
predicate isSource(DataFlow::Node node) {
32+
potentialSource(node) and
33+
not exists(DataFlow::Node prior |
34+
isAdditionalFlowStep(prior, node) and
35+
potentialSource(prior)
36+
)
37+
}
38+
39+
/**
40+
* An operation which may produce Infinity acconding to the `RestrictedRangeAnalysis` module.
41+
*/
42+
additional predicate potentialSource(DataFlow::Node node) {
43+
node.asExpr() instanceof Operation and
44+
exprMayEqualInfinity(node.asExpr(), _)
45+
}
46+
47+
predicate isBarrierOut(DataFlow::Node node) {
48+
guardedNotFPClass(node.asExpr(), TInfinite())
49+
or
50+
exists(Expr e |
51+
e.getType() instanceof IntegralType and
52+
e = node.asConvertedExpr()
53+
)
54+
}
55+
56+
/**
57+
* An additional flow step to handle operations which propagate Infinity.
58+
*
59+
* This double checks that an Infinity may propagate by checking the `RestrictedRangeAnalysis`
60+
* value estimate. This is conservative, since `RestrictedRangeAnalysis` is performed locally
61+
* in scope with unanalyzable values in a finite range. However, this conservative approach
62+
* leverages analysis of guards and other local conditions to avoid false positives.
63+
*/
64+
predicate isAdditionalFlowStep(DataFlow::Node source, DataFlow::Node sink) {
65+
exists(Operation o |
66+
o.getAnOperand() = source.asExpr() and
67+
o = sink.asExpr() and
68+
potentialSource(sink)
69+
)
70+
}
71+
72+
predicate isSink(DataFlow::Node node) {
73+
node instanceof InvalidInfinityUsage and
74+
(
75+
// Require that range analysis finds this value potentially infinite, to avoid false positives
76+
// in the presence of guards. This may induce false negatives.
77+
exprMayEqualInfinity(node.asExpr(), _)
78+
or
79+
// Unanalyzable expressions are not checked against range analysis, which assumes a finite
80+
// range.
81+
not RestrictedRangeAnalysis::canBoundExpr(node.asExpr())
82+
or
83+
node.asExpr().(VariableAccess).getTarget() instanceof Parameter
84+
)
85+
}
86+
}
87+
88+
class InvalidInfinityUsage extends DataFlow::Node {
89+
string description;
90+
91+
InvalidInfinityUsage() {
92+
// Case 2: NaNs and infinities shall not be cast to integers
93+
exists(Conversion c |
94+
asExpr() = c.getUnconverted() and
95+
c.getExpr().getType() instanceof FloatingPointType and
96+
c.getType() instanceof IntegralType and
97+
description = "cast to integer."
98+
)
99+
or
100+
// Case 3: Infinities shall not underflow or otherwise produce finite values
101+
exists(BinaryOperation op |
102+
asExpr() = op.getRightOperand() and
103+
op.getOperator() = "/" and
104+
description = "divisor, which would silently underflow and produce zero."
105+
)
106+
}
107+
108+
string getDescription() { result = description }
109+
}
110+
111+
module InvalidInfinityFlow = DataFlow::Global<InvalidInfinityUsage>;
112+
113+
import InvalidInfinityFlow::PathGraph
114+
115+
from
116+
Element elem, InvalidInfinityFlow::PathNode source, InvalidInfinityFlow::PathNode sink,
117+
InvalidInfinityUsage usage, Expr sourceExpr, string sourceString, Function function,
118+
string computedInFunction
119+
where
120+
elem = MacroUnwrapper<Expr>::unwrapElement(sink.getNode().asExpr()) and
121+
not InvalidInfinityFlow::PathGraph::edges(_, source, _, _) and
122+
not InvalidInfinityFlow::PathGraph::edges(sink, _, _, _) and
123+
not isExcluded(elem, FloatingTypes2Package::possibleMisuseOfUndetectedInfinityQuery()) and
124+
not sourceExpr.isFromTemplateInstantiation(_) and
125+
not usage.asExpr().isFromTemplateInstantiation(_) and
126+
usage = sink.getNode() and
127+
sourceExpr = source.getNode().asExpr() and
128+
function = sourceExpr.getEnclosingFunction() and
129+
InvalidInfinityFlow::flow(source.getNode(), usage) and
130+
(
131+
if not sourceExpr.getEnclosingFunction() = usage.asExpr().getEnclosingFunction()
132+
then computedInFunction = "computed in function $@ "
133+
else computedInFunction = ""
134+
) and
135+
(
136+
if sourceExpr instanceof DivExpr
137+
then sourceString = "from division by zero"
138+
else sourceString = sourceExpr.toString()
139+
)
140+
select elem, source, sink,
141+
"Possibly infinite float value $@ " + computedInFunction + "flows to " + usage.getDescription(),
142+
sourceExpr, sourceString, function, function.getName()

0 commit comments

Comments
 (0)