stash

Author: hvitved

cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll

@@ -813,6 +813,7 @@ private predicate viableParamArgCand(
   not inBarrier(p, config)
 }
 
+pragma[nomagic]
 private predicate parameterFlowReturn(
   ParameterNode p, ReturnNodeExt ret, ReturnKindExt kind, DataFlowType t1, DataFlowType t2,
   Summary summary, Configuration config
@@ -1006,6 +1007,12 @@ private class TaintStoreNode extends NodeExt, TTaintStoreNode {
   }
 }
 
+private predicate additionalLocalFlowStepExt(NodeExt node1, NodeExt node2, Configuration config) {
+  node1 = TReadTaintNode(_, node2.getNode(), _, _, config)
+  or
+  node2 = TTaintStoreNode(node1.getNode(), _, _, _, config)
+}
+
 pragma[nomagic]
 private predicate localFlowBigStepExt(
   NodeExt node1, NodeExt node2, boolean preservesValue, Configuration config
@@ -1048,12 +1055,6 @@ private predicate additionalJumpStepExt(NodeExt node1, NodeExt node2, Configurat
   additionalJumpStep(node1.getNode(), node2.getNode(), config)
 }
 
-private predicate additionalLocalFlowStepExt(NodeExt node1, NodeExt node2, Configuration config) {
-  node1 = TReadTaintNode(_, node2.getNode(), _, _, config)
-  or
-  node2 = TTaintStoreNode(node1.getNode(), _, _, _, config)
-}
-
 private predicate argumentValueFlowsThrough(NodeExt node1, NodeExt node2) {
   argumentValueFlowsThrough(_, node1.getNode(), TContentNone(), TContentNone(), node2.getNode())
 }
@@ -1341,7 +1342,7 @@ private predicate readCand2(Content f, boolean read, Configuration config) {
     useFieldFlow(config) and
     nodeCandFwd2(node, _, true, unbind(config)) and
     readExt(node, f, mid, config) and
-    storeCandFwd2(f, _, unbind(config)) and
+    storeCandFwd2(f, unbindBool(read), unbind(config)) and
     nodeCand2(mid, _, read, config)
   )
 }
@@ -1358,10 +1359,10 @@ private predicate nodeCand2Store(
 }
 
 pragma[nomagic]
-private predicate storeCand(Content f, boolean stored, Configuration conf) {
+private predicate storeCand2(Content f, boolean stored, Configuration conf) {
   exists(NodeExt node |
     nodeCand2Store(f, node, _, stored, conf) and
-    nodeCand2(node, _, _, conf)
+    nodeCand2(node, _, stored, conf)
   )
 }
 
@@ -1372,17 +1373,19 @@ private predicate storeCand(Content f, boolean stored, Configuration conf) {
  */
 pragma[noinline]
 private predicate readStoreCand(Content f, boolean nonEmpty, Configuration conf) {
-  storeCand(f, nonEmpty, conf) and
+  storeCand2(f, nonEmpty, conf) and
   readCand2(f, nonEmpty, conf)
 }
 
+private predicate nodeCand2(NodeExt node, Configuration config) { nodeCand2(node, _, _, config) }
+
 pragma[nomagic]
 private predicate flowOutOfCallableNodeCand2(
   NodeExt node1, NodeExt node2, boolean allowsFieldFlow, boolean apfEmpty, Configuration config
 ) {
   flowOutOfCallableNodeCand1(node1, node2, allowsFieldFlow, config) and
   nodeCand2(node2, _, apfEmpty.booleanNot(), config) and
-  nodeCand2(node1, _, _, unbind(config))
+  nodeCand2(node1, unbind(config))
 }
 
 pragma[nomagic]
@@ -1391,7 +1394,23 @@ private predicate flowIntoCallableNodeCand2(
 ) {
   flowIntoCallableNodeCand1(node1, node2, allowsFieldFlow, config) and
   nodeCand2(node2, _, apfEmpty.booleanNot(), config) and
-  nodeCand2(node1, _, _, unbind(config))
+  nodeCand2(node1, unbind(config))
+}
+
+pragma[nomagic]
+private predicate readExtCand(
+  NodeExt node1, Content f, NodeExt node2, boolean apfEmpty, Configuration config
+) {
+  readExt(node1, f, node2, config) and
+  readStoreCand(f, apfEmpty, config)
+}
+
+pragma[nomagic]
+private predicate storeExtCand(
+  NodeExt node1, Content f, NodeExt node2, boolean apfEmpty, Configuration config
+) {
+  storeExt(node1, f, node2, config) and
+  readStoreCand(f, apfEmpty, config)
 }
 
 private newtype TAccessPathFront =
@@ -1446,7 +1465,7 @@ private predicate flowCandFwd(
  */
 private class AccessPathFrontNilNode extends TNodeExt {
   AccessPathFrontNilNode() {
-    nodeCand2(this, _, _, _) and
+    nodeCand2(this, _) and
     (
       any(Configuration c).isSource(this.(NodeExt).getNode())
       or
@@ -1476,7 +1495,7 @@ private predicate flowCandFwd0(
   apf = node.(AccessPathFrontNilNode).getApf() and
   apfEmpty = true
   or
-  nodeCand2(node, _, _, _) and
+  nodeCand2(node, unbind(config)) and
   (
     exists(NodeExt mid |
       flowCandFwd(mid, fromArg, apf, apfEmpty, config) and
@@ -1531,9 +1550,10 @@ private predicate flowCandFwd0(
     (apfEmpty = true or allowsFieldFlow = true)
   )
   or
-  exists(Content f, AccessPathFront apf0, boolean apf0Empty |
-    flowCandFwdStore(f, node, fromArg, apf0, apf0Empty, config) and
-    readStoreCand(f, unbindBool(apf0Empty.booleanNot()), unbind(config)) and
+  exists(NodeExt mid, Content f, boolean apf0Empty |
+    flowCandFwd(mid, fromArg, _, apf0Empty, config) and
+    storeExtCand(mid, f, node, _/*apf0Empty*/, config) and
+    nodeCand2(node, _, true, unbind(config)) and
     apf.headUsesContent(f) and
     apfEmpty = false
   )
@@ -1544,34 +1564,23 @@ private predicate flowCandFwd0(
   )
 }
 
-pragma[nomagic]
-private predicate flowCandFwdStore(
-  Content f, NodeExt node, boolean fromArg, AccessPathFront apf, boolean apfEmpty,
-  Configuration config
-) {
-  exists(NodeExt mid |
-    flowCandFwd(mid, fromArg, apf, apfEmpty, config) and
-    storeExt(mid, f, node, config) and
-    nodeCand2(node, _, true, unbind(config)) and
-    compatibleTypes(apf.getType(), f.getType())
-  )
-}
-
 pragma[nomagic]
 private predicate consCandFwd(Content f, AccessPathFront apf, boolean apfEmpty, Configuration config) {
-  exists(NodeExt n |
-    flowCandFwdStore(f, n, _, apf, apfEmpty, config) and
-    readStoreCand(f, unbindBool(apfEmpty.booleanNot()), unbind(config))
+  exists(NodeExt mid, NodeExt n |
+    flowCandFwd(mid, _, apf, apfEmpty, config) and
+    storeExtCand(mid, f, n, _ /*apfEmpty*/, config) and
+    nodeCand2(n, _, true, unbind(config)) and
+    compatibleTypes(apf.getType(), f.getType())
   )
 }
 
 pragma[nomagic]
 private predicate flowCandFwdRead(Content f, NodeExt node, boolean fromArg, Configuration config) {
-  exists(NodeExt mid, AccessPathFront apf |
+  exists(NodeExt mid, AccessPathFrontHead apf |
     flowCandFwd(mid, fromArg, apf, false, config) and
-    readExt(mid, f, node, config) and
+    readExtCand(mid, f, node, _, config) and
     apf.headUsesContent(f) and
-    nodeCand2(node, _, _, unbind(config))
+    nodeCand2(node, unbind(config))
   )
 }
 
@@ -1662,7 +1671,7 @@ private predicate flowCandRead(
   NodeExt node, Content f, boolean toReturn, AccessPathFront apf0, Configuration config
 ) {
   exists(NodeExt mid |
-    readExt(node, f, mid, config) and
+    readExtCand(node, f, mid, _, config) and
     flowCand(mid, toReturn, apf0, _, config)
   )
 }
@@ -1672,7 +1681,7 @@ private predicate flowCandStore(
   NodeExt node, Content f, boolean toReturn, AccessPathFront apf0, Configuration config
 ) {
   exists(NodeExt mid |
-    storeExt(node, f, mid, config) and
+    storeExtCand(node, f, mid, _, config) and
     flowCand(mid, toReturn, apf0, _, config)
   )
 }
@@ -1911,7 +1920,7 @@ pragma[nomagic]
 private predicate flowFwdStore0(
   NodeExt mid, Content f, NodeExt node, AccessPathFront apf0, Configuration config
 ) {
-  storeExt(mid, f, node, config) and
+  storeExtCand(mid, f, node, _, config) and
   flowCand(mid, _, apf0, _, config)
 }
 
@@ -1931,7 +1940,7 @@ private predicate flowFwdRead(
 ) {
   exists(NodeExt mid, AccessPathFrontHead apf0 |
     flowFwd(mid, fromArg, apf0, false, ap0, config) and
-    readExt(mid, f, node, config) and
+    readExtCand(mid, f, node, _, config) and
     apf0.headUsesContent(f) and
     flowCand(node, _, _, _, unbind(config))
   )
@@ -2027,7 +2036,7 @@ pragma[nomagic]
 private predicate storeFwd(
   NodeExt node1, Content f, NodeExt node2, AccessPath ap, AccessPath ap0, Configuration config
 ) {
-  storeExt(node1, f, node2, config) and
+  storeExtCand(node1, f, node2, _, config) and
   flowFwdStore(node2, f, ap, _, _, config) and
   ap0 = push(f, ap)
 }
@@ -2046,7 +2055,7 @@ pragma[nomagic]
 private predicate readFwd(
   NodeExt node1, Content f, NodeExt node2, AccessPath ap, AccessPath ap0, Configuration config
 ) {
-  readExt(node1, f, node2, config) and
+  readExtCand(node1, f, node2, _, config) and
   flowFwdRead(node2, f, ap, _, config) and
   ap0 = pop(f, ap)
 }