Skip to content

Commit a88540a

Browse files
mbaludambaluda
committed
A18-1-4 MEM53-CPP update dataflow imports and adjust expected output
1 parent cd36b7f commit a88540a

8 files changed

Lines changed: 92 additions & 73 deletions

File tree

‎cpp/autosar/src/rules/A18-1-4/PointerToAnElementOfAnArrayPassedToASmartPointer.ql‎

Lines changed: 8 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
import cpp
1717
import codingstandards.cpp.autosar
1818
import codingstandards.cpp.SmartPointers
19-
import semmle.code.cpp.dataflow.TaintTracking
19+
import semmle.code.cpp.dataflow.new.TaintTracking
2020
import SingleObjectSmartPointerArrayConstructionFlow::PathGraph
2121

2222
class AutosarSmartPointerArraySpecialisation extends AutosarSmartPointer {
@@ -32,7 +32,7 @@ module SingleObjectSmartPointerArrayConstructionConfig implements DataFlow::Conf
3232
mf.getDeclaringType() instanceof AutosarSmartPointerArraySpecialisation and
3333
mf instanceof AutosarSmartPointerReleaseMemberFunction
3434
|
35-
fc.getParent()
35+
fc
3636
)
3737
}
3838

@@ -47,21 +47,14 @@ module SingleObjectSmartPointerArrayConstructionConfig implements DataFlow::Conf
4747
)
4848
}
4949

50-
predicate isAdditionalFlowStep(DataFlow::Node source, DataFlow::Node sink) {
51-
exists(AutosarUniquePointer sp, FunctionCall fc |
52-
fc = sp.getAReleaseCall() and
53-
source.asExpr() = fc.getQualifier() and
54-
sink.asExpr() = fc
55-
)
56-
}
57-
5850
predicate isBarrierIn(DataFlow::Node node) {
59-
// Exclude flow into header files outside the source archive which are summarized by the
60-
// additional taint steps above.
51+
// Exclude flow through `release()` implementations summarized by its taint model.
6152
exists(AutosarUniquePointer sp |
62-
sp.getAReleaseCall().getTarget() = node.asExpr().(ThisExpr).getEnclosingFunction()
63-
|
64-
not exists(node.getLocation().getFile().getRelativePath())
53+
sp.getAReleaseCall().getTarget() =
54+
[
55+
node.asExpr().(ThisExpr).getEnclosingFunction(),
56+
node.asIndirectExpr().(ThisExpr).getEnclosingFunction()
57+
]
6558
)
6659
}
6760
}

‎cpp/autosar/test/rules/A18-1-4/PointerToAnElementOfAnArrayPassedToASmartPointer.expected‎

Lines changed: 10 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,24 @@
1-
WARNING: module 'DataFlow' has been deprecated and may be removed in future (PointerToAnElementOfAnArrayPassedToASmartPointer.ql:26,67-75)
2-
WARNING: module 'DataFlow' has been deprecated and may be removed in future (PointerToAnElementOfAnArrayPassedToASmartPointer.ql:27,22-30)
3-
WARNING: module 'DataFlow' has been deprecated and may be removed in future (PointerToAnElementOfAnArrayPassedToASmartPointer.ql:39,20-28)
4-
WARNING: module 'DataFlow' has been deprecated and may be removed in future (PointerToAnElementOfAnArrayPassedToASmartPointer.ql:50,34-42)
5-
WARNING: module 'DataFlow' has been deprecated and may be removed in future (PointerToAnElementOfAnArrayPassedToASmartPointer.ql:50,57-65)
6-
WARNING: module 'DataFlow' has been deprecated and may be removed in future (PointerToAnElementOfAnArrayPassedToASmartPointer.ql:58,25-33)
7-
WARNING: module 'TaintTracking' has been deprecated and may be removed in future (PointerToAnElementOfAnArrayPassedToASmartPointer.ql:70,3-16)
81
edges
9-
| test.cpp:3:36:3:45 | new[] | test.cpp:19:27:19:44 | call to allocate_int_array | provenance | |
10-
| test.cpp:3:36:3:45 | new[] | test.cpp:23:12:23:29 | call to allocate_int_array | provenance | |
11-
| test.cpp:3:36:3:45 | new[] | test.cpp:27:20:27:37 | call to allocate_int_array | provenance | |
12-
| test.cpp:11:29:11:41 | call to unique_ptr | test.cpp:12:27:12:28 | v2 | provenance | |
13-
| test.cpp:12:27:12:28 | v2 | test.cpp:12:30:12:36 | call to release | provenance | |
14-
| test.cpp:12:27:12:28 | v2 | test.cpp:12:30:12:36 | call to release | provenance | Config |
2+
| test.cpp:3:6:3:23 | *allocate_int_array | test.cpp:19:27:19:44 | call to allocate_int_array | provenance | |
3+
| test.cpp:3:6:3:23 | *allocate_int_array | test.cpp:23:12:23:29 | call to allocate_int_array | provenance | |
4+
| test.cpp:3:6:3:23 | *allocate_int_array | test.cpp:27:20:27:37 | call to allocate_int_array | provenance | |
5+
| test.cpp:3:36:3:45 | new[] | test.cpp:3:6:3:23 | *allocate_int_array | provenance | |
6+
| test.cpp:3:36:3:45 | new[] | test.cpp:3:36:3:45 | new[] | provenance | |
7+
| test.cpp:27:20:27:37 | call to allocate_int_array | test.cpp:27:20:27:37 | call to allocate_int_array | provenance | |
158
| test.cpp:27:20:27:37 | call to allocate_int_array | test.cpp:32:12:32:20 | int_array | provenance | |
169
nodes
10+
| test.cpp:3:6:3:23 | *allocate_int_array | semmle.label | *allocate_int_array |
11+
| test.cpp:3:36:3:45 | new[] | semmle.label | new[] |
1712
| test.cpp:3:36:3:45 | new[] | semmle.label | new[] |
18-
| test.cpp:11:29:11:41 | call to unique_ptr | semmle.label | call to unique_ptr |
19-
| test.cpp:12:27:12:28 | v2 | semmle.label | v2 |
2013
| test.cpp:12:30:12:36 | call to release | semmle.label | call to release |
2114
| test.cpp:19:27:19:44 | call to allocate_int_array | semmle.label | call to allocate_int_array |
2215
| test.cpp:23:12:23:29 | call to allocate_int_array | semmle.label | call to allocate_int_array |
2316
| test.cpp:27:20:27:37 | call to allocate_int_array | semmle.label | call to allocate_int_array |
17+
| test.cpp:27:20:27:37 | call to allocate_int_array | semmle.label | call to allocate_int_array |
2418
| test.cpp:32:12:32:20 | int_array | semmle.label | int_array |
2519
subpaths
2620
#select
27-
| test.cpp:12:30:12:36 | call to release | test.cpp:11:29:11:41 | call to unique_ptr | test.cpp:12:30:12:36 | call to release | A pointer to an element of an array of objects flows to a smart pointer of a single object type. |
21+
| test.cpp:12:30:12:36 | call to release | test.cpp:12:30:12:36 | call to release | test.cpp:12:30:12:36 | call to release | A pointer to an element of an array of objects flows to a smart pointer of a single object type. |
2822
| test.cpp:19:27:19:44 | call to allocate_int_array | test.cpp:3:36:3:45 | new[] | test.cpp:19:27:19:44 | call to allocate_int_array | A pointer to an element of an array of objects flows to a smart pointer of a single object type. |
2923
| test.cpp:23:12:23:29 | call to allocate_int_array | test.cpp:3:36:3:45 | new[] | test.cpp:23:12:23:29 | call to allocate_int_array | A pointer to an element of an array of objects flows to a smart pointer of a single object type. |
3024
| test.cpp:32:12:32:20 | int_array | test.cpp:3:36:3:45 | new[] | test.cpp:32:12:32:20 | int_array | A pointer to an element of an array of objects flows to a smart pointer of a single object type. |

‎cpp/cert/src/rules/MEM53-CPP/MissingConstructorCallForManuallyManagedObject.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ import cpp
1919
import codingstandards.cpp.cert
2020
import codingstandards.cpp.types.TrivialType
2121
import ManuallyManagedLifetime
22-
import semmle.code.cpp.dataflow.TaintTracking
22+
import semmle.code.cpp.dataflow.new.TaintTracking
2323
import AllocToStaticCastFlow::PathGraph
2424

2525
/*

‎cpp/cert/src/rules/MEM53-CPP/MissingDestructorCallForManuallyManagedObject.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
import cpp
1919
import codingstandards.cpp.cert
2020
import ManuallyManagedLifetime
21-
import semmle.code.cpp.dataflow.DataFlow
21+
import semmle.code.cpp.dataflow.new.DataFlow
2222
import FreeWithoutDestructorFlow::PathGraph
2323

2424
from FreeWithoutDestructorFlow::PathNode source, FreeWithoutDestructorFlow::PathNode sink

‎cpp/cert/test/rules/MEM53-CPP/MissingConstructorCallForManuallyManagedObject.expected‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,22 @@
11
edges
22
nodes
3-
| test.cpp:16:26:16:31 | call to malloc | semmle.label | call to malloc |
4-
| test.cpp:17:38:17:43 | call to malloc | semmle.label | call to malloc |
5-
| test.cpp:18:26:18:39 | call to operator new | semmle.label | call to operator new |
6-
| test.cpp:20:29:20:42 | call to operator new | semmle.label | call to operator new |
7-
| test.cpp:45:26:45:31 | call to malloc | semmle.label | call to malloc |
8-
| test.cpp:46:38:46:43 | call to malloc | semmle.label | call to malloc |
9-
| test.cpp:47:26:47:39 | call to operator new | semmle.label | call to operator new |
10-
| test.cpp:49:29:49:42 | call to operator new | semmle.label | call to operator new |
11-
| test.cpp:51:29:51:42 | call to operator new | semmle.label | call to operator new |
3+
| test.cpp:16:16:16:47 | call to malloc | semmle.label | call to malloc |
4+
| test.cpp:17:16:17:60 | call to malloc | semmle.label | call to malloc |
5+
| test.cpp:18:16:18:55 | call to operator new | semmle.label | call to operator new |
6+
| test.cpp:20:7:20:59 | call to operator new | semmle.label | call to operator new |
7+
| test.cpp:45:16:45:47 | call to malloc | semmle.label | call to malloc |
8+
| test.cpp:46:16:46:60 | call to malloc | semmle.label | call to malloc |
9+
| test.cpp:47:16:47:55 | call to operator new | semmle.label | call to operator new |
10+
| test.cpp:49:7:49:59 | call to operator new | semmle.label | call to operator new |
11+
| test.cpp:51:7:51:59 | call to operator new | semmle.label | call to operator new |
1212
subpaths
1313
#select
14-
| test.cpp:16:26:16:31 | call to malloc | test.cpp:16:26:16:31 | call to malloc | test.cpp:16:26:16:31 | call to malloc | Allocation to cast without constructor call |
15-
| test.cpp:17:38:17:43 | call to malloc | test.cpp:17:38:17:43 | call to malloc | test.cpp:17:38:17:43 | call to malloc | Allocation to cast without constructor call |
16-
| test.cpp:18:26:18:39 | call to operator new | test.cpp:18:26:18:39 | call to operator new | test.cpp:18:26:18:39 | call to operator new | Allocation to cast without constructor call |
17-
| test.cpp:20:29:20:42 | call to operator new | test.cpp:20:29:20:42 | call to operator new | test.cpp:20:29:20:42 | call to operator new | Allocation to cast without constructor call |
18-
| test.cpp:45:26:45:31 | call to malloc | test.cpp:45:26:45:31 | call to malloc | test.cpp:45:26:45:31 | call to malloc | Allocation to cast without constructor call |
19-
| test.cpp:46:38:46:43 | call to malloc | test.cpp:46:38:46:43 | call to malloc | test.cpp:46:38:46:43 | call to malloc | Allocation to cast without constructor call |
20-
| test.cpp:47:26:47:39 | call to operator new | test.cpp:47:26:47:39 | call to operator new | test.cpp:47:26:47:39 | call to operator new | Allocation to cast without constructor call |
21-
| test.cpp:49:29:49:42 | call to operator new | test.cpp:49:29:49:42 | call to operator new | test.cpp:49:29:49:42 | call to operator new | Allocation to cast without constructor call |
22-
| test.cpp:51:29:51:42 | call to operator new | test.cpp:51:29:51:42 | call to operator new | test.cpp:51:29:51:42 | call to operator new | Allocation to cast without constructor call |
14+
| test.cpp:16:16:16:47 | call to malloc | test.cpp:16:16:16:47 | call to malloc | test.cpp:16:16:16:47 | call to malloc | Allocation to cast without constructor call |
15+
| test.cpp:17:16:17:60 | call to malloc | test.cpp:17:16:17:60 | call to malloc | test.cpp:17:16:17:60 | call to malloc | Allocation to cast without constructor call |
16+
| test.cpp:18:16:18:55 | call to operator new | test.cpp:18:16:18:55 | call to operator new | test.cpp:18:16:18:55 | call to operator new | Allocation to cast without constructor call |
17+
| test.cpp:20:7:20:59 | call to operator new | test.cpp:20:7:20:59 | call to operator new | test.cpp:20:7:20:59 | call to operator new | Allocation to cast without constructor call |
18+
| test.cpp:45:16:45:47 | call to malloc | test.cpp:45:16:45:47 | call to malloc | test.cpp:45:16:45:47 | call to malloc | Allocation to cast without constructor call |
19+
| test.cpp:46:16:46:60 | call to malloc | test.cpp:46:16:46:60 | call to malloc | test.cpp:46:16:46:60 | call to malloc | Allocation to cast without constructor call |
20+
| test.cpp:47:16:47:55 | call to operator new | test.cpp:47:16:47:55 | call to operator new | test.cpp:47:16:47:55 | call to operator new | Allocation to cast without constructor call |
21+
| test.cpp:49:7:49:59 | call to operator new | test.cpp:49:7:49:59 | call to operator new | test.cpp:49:7:49:59 | call to operator new | Allocation to cast without constructor call |
22+
| test.cpp:51:7:51:59 | call to operator new | test.cpp:51:7:51:59 | call to operator new | test.cpp:51:7:51:59 | call to operator new | Allocation to cast without constructor call |

‎cpp/cert/test/rules/MEM53-CPP/MissingDestructorCallForManuallyManagedObject.expected‎

Lines changed: 20 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,28 @@
11
edges
2-
| test.cpp:16:26:16:31 | call to malloc | test.cpp:22:8:22:9 | a1 | provenance | |
3-
| test.cpp:17:38:17:43 | call to malloc | test.cpp:23:8:23:9 | a2 | provenance | |
4-
| test.cpp:18:26:18:39 | call to operator new | test.cpp:26:21:26:22 | a3 | provenance | |
5-
| test.cpp:20:29:20:42 | call to operator new | test.cpp:27:21:27:22 | a4 | provenance | |
2+
| test.cpp:16:16:16:47 | call to malloc | test.cpp:16:16:16:47 | call to malloc | provenance | |
3+
| test.cpp:16:16:16:47 | call to malloc | test.cpp:22:8:22:9 | a1 | provenance | |
4+
| test.cpp:17:16:17:60 | call to malloc | test.cpp:17:16:17:60 | call to malloc | provenance | |
5+
| test.cpp:17:16:17:60 | call to malloc | test.cpp:23:8:23:9 | a2 | provenance | |
6+
| test.cpp:18:16:18:55 | call to operator new | test.cpp:18:16:18:55 | call to operator new | provenance | |
7+
| test.cpp:18:16:18:55 | call to operator new | test.cpp:26:21:26:22 | a3 | provenance | |
8+
| test.cpp:20:7:20:59 | call to operator new | test.cpp:20:7:20:59 | call to operator new | provenance | |
9+
| test.cpp:20:7:20:59 | call to operator new | test.cpp:27:21:27:22 | a4 | provenance | |
610
nodes
7-
| test.cpp:16:26:16:31 | call to malloc | semmle.label | call to malloc |
8-
| test.cpp:17:38:17:43 | call to malloc | semmle.label | call to malloc |
9-
| test.cpp:18:26:18:39 | call to operator new | semmle.label | call to operator new |
10-
| test.cpp:20:29:20:42 | call to operator new | semmle.label | call to operator new |
11+
| test.cpp:16:16:16:47 | call to malloc | semmle.label | call to malloc |
12+
| test.cpp:16:16:16:47 | call to malloc | semmle.label | call to malloc |
13+
| test.cpp:17:16:17:60 | call to malloc | semmle.label | call to malloc |
14+
| test.cpp:17:16:17:60 | call to malloc | semmle.label | call to malloc |
15+
| test.cpp:18:16:18:55 | call to operator new | semmle.label | call to operator new |
16+
| test.cpp:18:16:18:55 | call to operator new | semmle.label | call to operator new |
17+
| test.cpp:20:7:20:59 | call to operator new | semmle.label | call to operator new |
18+
| test.cpp:20:7:20:59 | call to operator new | semmle.label | call to operator new |
1119
| test.cpp:22:8:22:9 | a1 | semmle.label | a1 |
1220
| test.cpp:23:8:23:9 | a2 | semmle.label | a2 |
1321
| test.cpp:26:21:26:22 | a3 | semmle.label | a3 |
1422
| test.cpp:27:21:27:22 | a4 | semmle.label | a4 |
1523
subpaths
1624
#select
17-
| test.cpp:22:8:22:9 | a1 | test.cpp:16:26:16:31 | call to malloc | test.cpp:22:8:22:9 | a1 | Memory freed without an appropriate destructor called. |
18-
| test.cpp:23:8:23:9 | a2 | test.cpp:17:38:17:43 | call to malloc | test.cpp:23:8:23:9 | a2 | Memory freed without an appropriate destructor called. |
19-
| test.cpp:26:21:26:22 | a3 | test.cpp:18:26:18:39 | call to operator new | test.cpp:26:21:26:22 | a3 | Memory freed without an appropriate destructor called. |
20-
| test.cpp:27:21:27:22 | a4 | test.cpp:20:29:20:42 | call to operator new | test.cpp:27:21:27:22 | a4 | Memory freed without an appropriate destructor called. |
25+
| test.cpp:22:8:22:9 | a1 | test.cpp:16:16:16:47 | call to malloc | test.cpp:22:8:22:9 | a1 | Memory freed without an appropriate destructor called. |
26+
| test.cpp:23:8:23:9 | a2 | test.cpp:17:16:17:60 | call to malloc | test.cpp:23:8:23:9 | a2 | Memory freed without an appropriate destructor called. |
27+
| test.cpp:26:21:26:22 | a3 | test.cpp:18:16:18:55 | call to operator new | test.cpp:26:21:26:22 | a3 | Memory freed without an appropriate destructor called. |
28+
| test.cpp:27:21:27:22 | a4 | test.cpp:20:7:20:59 | call to operator new | test.cpp:27:21:27:22 | a4 | Memory freed without an appropriate destructor called. |

‎cpp/common/src/codingstandards/cpp/allocations/PlacementNew.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222

2323
import cpp
2424
import codingstandards.cpp.Conversion
25-
import semmle.code.cpp.dataflow.DataFlow
25+
import semmle.code.cpp.dataflow.new.DataFlow
2626

2727
/*
2828
* TODO You can also have alignas on types

0 commit comments

Comments
 (0)