to ensure
+ * portability.
+ * @kind problem
+ * @id cpp/suspicious-call-to-memset
+ * @problem.severity recommendation
+ * @precision medium
+ * @tags reliability
+ * correctness
+ * external/cwe/cwe-676
+ */
+import cpp
+
+/**
+ * Holds if `e` is a `sizeof` expression on type `t`, with
+ * optional multiplication by a constant.
+ */
+predicate sizeOfExpr(Expr e, Type t) {
+ (
+ t = e.(SizeofTypeOperator).getTypeOperand()
+ ) or (
+ t = e.(SizeofExprOperator).getExprOperand().getType()
+ ) or (
+ sizeOfExpr(e.(MulExpr).getAnOperand(), t) and
+ e.(MulExpr).getAnOperand() instanceof Literal
+ )
+}
+
+/**
+ * Gets the type `t` with typedefs, array types and references removed.
+ *
+ * This is similar to `Type.stripType` except that it doesn't remove
+ * a `PointerType`.
+ */
+Type stripType(Type t) {
+ result = stripType(t.(TypedefType).getBaseType()) or
+ result = stripType(t.(ArrayType).getBaseType()) or
+ result = stripType(t.(ReferenceType).getBaseType()) or
+ result = stripType(t.(SpecifiedType).getBaseType()) or
+ (
+ not t instanceof TypedefType and
+ not t instanceof ArrayType and
+ not t instanceof ReferenceType and
+ not t instanceof SpecifiedType and
+ result = t
+ )
+}
+
+/**
+ * Holds if `t` points to `base` via a specified number of levels of pointer
+ * indirection. Intermediate typedefs and array types are allowed.
+ */
+predicate pointerIndirection(Type t, int indirection, Type base) {
+ exists(Type u |
+ u = stripType(t) and
+ u = stripType(base) and
+ not u instanceof PointerType and
+ indirection = 0
+ ) or (
+ pointerIndirection(stripType(t).(PointerType).getBaseType(), indirection - 1, base)
+ )
+}
+
+/**
+ * Holds if `t` points to a non-pointer, non-array type via a specified number
+ * of levels of pointer indirection. Intermediate typedefs and array types are
+ * allowed.
+ */
+predicate pointerIndirection2(Type t, int indirection) {
+ (
+ not stripType(t) instanceof PointerType and
+ indirection = 0
+ ) or (
+ pointerIndirection2(stripType(t).(PointerType).getBaseType(), indirection - 1)
+ )
+}
+
+/**
+ * Holds if `memset(dataArg, _, sizeArg)`, where `sizeArg` has the form
+ * `sizeof(type)`, could be reasonable.
+ */
+predicate reasonableMemset(FunctionCall fc) {
+ exists(Expr dataArg, Expr sizeArg |
+ dataArg = fc.getArgument(0) and sizeArg = fc.getArgument(2) and
+ exists(Type dataType, Type sizeOfType |
+ dataType = dataArg.getType() and
+ sizeOfExpr(sizeArg, sizeOfType) and
+ exists (int i |
+ exists(Type base |
+ // memset(&t, _, sizeof(t))
+ pointerIndirection(dataType, i + 1, base) and
+ pointerIndirection(sizeOfType, i, base)
+ ) or exists(Type base |
+ // memset(t[n], _, sizeof(t))
+ pointerIndirection(dataType.getUnspecifiedType().(ArrayType), i, base) and
+ pointerIndirection(sizeOfType, i, base)
+ ) or exists(VoidType vt |
+ // memset(void *, _, sizeof(t))
+ pointerIndirection(dataType, i + 1, vt) and
+ pointerIndirection2(sizeOfType, i)
+ ) or exists(Type ct |
+ // memset(char *, _, sizeof(t)) and similar
+ ct.getSize() = 1 and
+ pointerIndirection(dataType, i + 1, ct) and
+ pointerIndirection2(sizeOfType, i)
+ ) or exists(Type ct |
+ // memset(char [], _, sizeof(t)) and similar
+ ct.getSize() = 1 and
+ pointerIndirection(dataType.getUnspecifiedType().(ArrayType), i, ct) and
+ pointerIndirection2(sizeOfType, i)
+ )
+ )
+ )
+ )
+}
+
+from FunctionCall fc, Type t
+where
+ fc.getTarget().hasName("memset") and
+ sizeOfExpr(fc.getArgument(2), t) and
+ not reasonableMemset(fc)
+select fc, "The size of the memory area set by memset should not be the size of the type " + t.getName() + "."
diff --git a/cpp/ql/src/Likely Bugs/Memory Management/SuspiciousCallToStrncat.cpp b/cpp/ql/src/Likely Bugs/Memory Management/SuspiciousCallToStrncat.cpp
new file mode 100644
index 000000000000..219d082414dd
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/Memory Management/SuspiciousCallToStrncat.cpp
@@ -0,0 +1,4 @@
+strncat(dest, src, strlen(dest)); //wrong: should use remaining size of dest
+
+strncat(dest, src, sizeof(dest)); //wrong: should use remaining size of dest.
+ //Also fails if dest is a pointer and not an array.
diff --git a/cpp/ql/src/Likely Bugs/Memory Management/SuspiciousCallToStrncat.qhelp b/cpp/ql/src/Likely Bugs/Memory Management/SuspiciousCallToStrncat.qhelp
new file mode 100644
index 000000000000..5424338e1d15
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/Memory Management/SuspiciousCallToStrncat.qhelp
@@ -0,0 +1,31 @@
+
+
+
+The standard library function strncat appends a source string to a target string.
+The third argument defines the maximum number of characters to append and should be less than or equal to the remaining space in the destination buffer. Calls of the form strncat(dest, src, strlen(dest)) or strncat(dest, src, sizeof(dest)) set the third argument to the entire size of the destination buffer. Executing a call of this type may cause a buffer overflow unless the buffer is known to be empty. Buffer overflows can lead to anything from a segmentation fault to a security vulnerability.
+
+
+
+Check the highlighted function calls carefully to ensure that no buffer overflow is possible. For a more robust solution, consider updating the function call to include the remaining space in the destination buffer.
+
+
+
+
+
+
+
+
+cplusplus.com: strncat,
+ strncpy.
+
+ I. Gerg, An Overview and Example of the Buffer-Overflow Exploit. IANewsletter vol 7 no 4, 2005.
+
+
+ M. Donaldson, Inside the Buffer Overflow Attack: Mechanism, Method & Prevention. SANS Institute InfoSec Reading Room, 2002.
+
+
+
+
+
diff --git a/cpp/ql/src/Likely Bugs/Memory Management/SuspiciousCallToStrncat.ql b/cpp/ql/src/Likely Bugs/Memory Management/SuspiciousCallToStrncat.ql
new file mode 100644
index 000000000000..665ea8ecccc3
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/Memory Management/SuspiciousCallToStrncat.ql
@@ -0,0 +1,23 @@
+/**
+ * @name Potentially unsafe call to strncat
+ * @description Calling 'strncat' with the size of the destination buffer
+ * as the third argument may result in a buffer overflow.
+ * @kind problem
+ * @problem.severity warning
+ * @precision medium
+ * @id cpp/unsafe-strncat
+ * @tags reliability
+ * correctness
+ * external/cwe/cwe-676
+ * external/cwe/cwe-119
+ * external/cwe/cwe-251
+ */
+import cpp
+import Buffer
+
+from FunctionCall fc, VariableAccess va1, VariableAccess va2
+where fc.getTarget().(Function).hasName("strncat") and
+ va1 = fc.getArgument(0) and
+ va2 = fc.getArgument(2).(BufferSizeExpr).getArg() and
+ va1.getTarget() = va2.getTarget()
+select fc, "Potentially unsafe call to strncat."
diff --git a/cpp/ql/src/Likely Bugs/Memory Management/SuspiciousSizeof.cpp b/cpp/ql/src/Likely Bugs/Memory Management/SuspiciousSizeof.cpp
new file mode 100644
index 000000000000..7c38d27a73a9
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/Memory Management/SuspiciousSizeof.cpp
@@ -0,0 +1,4 @@
+void f(char s[]) {
+ int size = sizeof(s); //wrong: s is now a char*, not an array.
+ //sizeof(s) will evaluate to sizeof(char *)
+}
diff --git a/cpp/ql/src/Likely Bugs/Memory Management/SuspiciousSizeof.qhelp b/cpp/ql/src/Likely Bugs/Memory Management/SuspiciousSizeof.qhelp
new file mode 100644
index 000000000000..a3dd9f05dda4
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/Memory Management/SuspiciousSizeof.qhelp
@@ -0,0 +1,35 @@
+
+
+
+
+
+This rule finds expressions that take the size of a function parameter of array type.
+In C, function parameters of array type are treated as if they had the corresponding pointer type,
+so their size is always the size of the pointer type (typically either four or eight).
+In particular, one cannot determine the size of a memory buffer passed as a parameter in this way.
+
+Using the sizeof operator on pointer types will produce unexpected results if the developer intended
+to get the size of an array instead of the pointer.
+
+
+
+
+
+Modify the function to take an extra argument indicating the buffer size.
+
+
+
+
+
+
+
+
+
+ Comp.lang.c, Frequently Asked Questions: Question 6.3: So what is meant by the "equivalence of pointers and arrays" in C?.
+
+
+
+
+
diff --git a/cpp/ql/src/Likely Bugs/Memory Management/SuspiciousSizeof.ql b/cpp/ql/src/Likely Bugs/Memory Management/SuspiciousSizeof.ql
new file mode 100644
index 000000000000..238f876e1bd2
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/Memory Management/SuspiciousSizeof.ql
@@ -0,0 +1,37 @@
+/**
+ * @name Suspicious 'sizeof' use
+ * @description Taking 'sizeof' of an array parameter is often mistakenly thought
+ * to yield the size of the underlying array, but it always yields
+ * the machine pointer size.
+ * @kind problem
+ * @problem.severity warning
+ * @precision medium
+ * @id cpp/suspicious-sizeof
+ * @tags reliability
+ * correctness
+ * external/cwe/cwe-467
+ */
+import cpp
+
+class CandidateParameter extends Parameter {
+ CandidateParameter() {
+ // an array parameter
+ getType().getUnspecifiedType() instanceof ArrayType
+ or
+ (
+ // a pointer parameter
+ getType().getUnspecifiedType() instanceof PointerType and
+
+ // whose address is never taken (rules out common
+ // false positive patterns)
+ not exists(AddressOfExpr aoe | aoe.getAddressable() = this)
+ )
+ }
+}
+
+from SizeofExprOperator seo, VariableAccess va
+where seo.getExprOperand() = va and
+ va.getTarget() instanceof CandidateParameter and
+ not va.isAffectedByMacro() and
+ not va.isCompilerGenerated()
+select seo, "This evaluates to the size of the pointer type, which may not be what you want."
diff --git a/cpp/ql/src/Likely Bugs/Memory Management/UninitializedLocal.cpp b/cpp/ql/src/Likely Bugs/Memory Management/UninitializedLocal.cpp
new file mode 100644
index 000000000000..4e818111d26c
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/Memory Management/UninitializedLocal.cpp
@@ -0,0 +1,31 @@
+int absWrong(int i) {
+ int j;
+ if (i > 0) {
+ j = i;
+ } else if (i < 0) {
+ j = -i;
+ }
+ return j; // wrong: j may not be initialized before use
+}
+
+int absCorrect1(int i) {
+ int j = 0;
+ if (i > 0) {
+ j = i;
+ } else if (i < 0) {
+ j = -i;
+ }
+ return j; // correct: j always initialized before use
+}
+
+int absCorrect2(int i) {
+ int j;
+ if (i > 0) {
+ j = i;
+ } else if (i < 0) {
+ j = -i;
+ } else {
+ j = 0;
+ }
+ return j; // correct: j always initialized before use
+}
\ No newline at end of file
diff --git a/cpp/ql/src/Likely Bugs/Memory Management/UninitializedLocal.qhelp b/cpp/ql/src/Likely Bugs/Memory Management/UninitializedLocal.qhelp
new file mode 100644
index 000000000000..1427f74525e3
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/Memory Management/UninitializedLocal.qhelp
@@ -0,0 +1,38 @@
+
+
+
+
+
+ A local non-static variable of a non-class type has an undefined value
+before it is initialized. For example, it is incorrect to rely on
+an uninitialized integer to have the value 0.
+
+
+
+
+
+
+Review the code and consider whether the variable should have an initializer or
+whether some path through the program lacks an assignment to the variable.
+
+
+
+
+The function absWrong does not initialize the variable j
+in the case where i = 0. Functions absCorrect1 and
+absCorrect2 remedy this deficiency by adding an initializer and adding
+an assignment to one of the paths through the program, respectively.
+
+
+
+
+
+
+
+
+ ISO/IEC 9899:2011: Programming languages - C (Section 6.3.2.1).
+
+
+
diff --git a/cpp/ql/src/Likely Bugs/Memory Management/UninitializedLocal.ql b/cpp/ql/src/Likely Bugs/Memory Management/UninitializedLocal.ql
new file mode 100644
index 000000000000..f14b6bbea702
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/Memory Management/UninitializedLocal.ql
@@ -0,0 +1,91 @@
+/**
+ * @name Potentially uninitialized local variable
+ * @description Reading from a local variable that has not been assigned to
+ * will typically yield garbage.
+ * @kind problem
+ * @id cpp/uninitialized-local
+ * @problem.severity warning
+ * @precision medium
+ * @tags security
+ * external/cwe/cwe-665
+ * external/cwe/cwe-457
+ */
+
+import cpp
+import semmle.code.cpp.controlflow.LocalScopeVariableReachability
+
+/**
+ * Auxiliary predicate: Types that don't require initialization
+ * before they are used, since they're stack-allocated.
+ */
+predicate allocatedType(Type t) {
+ /* Arrays: "int foo[1]; foo[0] = 42;" is ok. */
+ t instanceof ArrayType or
+ /* Structs: "struct foo bar; bar.baz = 42" is ok. */
+ t instanceof Class or
+ /* Typedefs to other allocated types are fine. */
+ allocatedType(t.(TypedefType).getUnderlyingType()) or
+ /* Type specifiers don't affect whether or not a type is allocated. */
+ allocatedType(t.getUnspecifiedType())
+}
+
+/**
+ * A declaration of a local variable that leaves the
+ * variable uninitialized.
+ */
+DeclStmt declWithNoInit(LocalVariable v) {
+ result.getADeclaration() = v and
+ not exists(v.getInitializer()) and
+ /* The type of the variable is not stack-allocated. */
+ not allocatedType(v.getType()) and
+ /* The variable is not static (otherwise it is zeroed). */
+ not v.isStatic() and
+ /* The variable is not extern (otherwise it is zeroed). */
+ not v.hasSpecifier("extern")
+}
+
+class UninitialisedLocalReachability extends LocalScopeVariableReachability {
+ UninitialisedLocalReachability() { this = "UninitialisedLocal" }
+
+ override predicate isSource(ControlFlowNode node, LocalScopeVariable v) {
+ node = declWithNoInit(v)
+ }
+
+ override predicate isSink(ControlFlowNode node, LocalScopeVariable v) {
+ useOfVarActual(v, node)
+ }
+
+ override predicate isBarrier(ControlFlowNode node, LocalScopeVariable v) {
+ // only report the _first_ possibly uninitialized use
+ useOfVarActual(v, node) or
+ definitionBarrier(v, node)
+ }
+}
+
+pragma[noinline]
+predicate containsInlineAssembly(Function f) {
+ exists(AsmStmt s | s.getEnclosingFunction() = f)
+}
+
+/**
+ * Auxiliary predicate: List common exceptions or false positives
+ * for this check to exclude them.
+ */
+VariableAccess commonException() {
+ /* If the uninitialized use we've found is in a macro expansion, it's
+ * typically something like va_start(), and we don't want to complain.
+ */
+ result.getParent().isInMacroExpansion() or
+ result.getParent() instanceof BuiltInOperation or
+ /*
+ * Finally, exclude functions that contain assembly blocks. It's
+ * anyone's guess what happens in those.
+ */
+ containsInlineAssembly(result.getEnclosingFunction())
+}
+
+from UninitialisedLocalReachability r, LocalVariable v, VariableAccess va
+where
+ r.reaches(_, v, va) and
+ not va = commonException()
+select va, "The variable $@ may not be initialized here.", v, v.getName()
diff --git a/cpp/ql/src/Likely Bugs/Memory Management/UnsafeUseOfStrcat.cpp b/cpp/ql/src/Likely Bugs/Memory Management/UnsafeUseOfStrcat.cpp
new file mode 100644
index 000000000000..a17e89e711e2
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/Memory Management/UnsafeUseOfStrcat.cpp
@@ -0,0 +1,12 @@
+void f(char *s) {
+ char buf[80];
+ strcpy(buf, "s: ");
+ strcat(buf, s); // wrong: buffer not checked before strcat
+}
+
+void g(char *s) {
+ char buf[80];
+ strcpy(buf, "s: ");
+ if(strlen(s) < 77)
+ strcat(buf, s); // correct: buffer size checked before strcat
+}
diff --git a/cpp/ql/src/Likely Bugs/Memory Management/UnsafeUseOfStrcat.qhelp b/cpp/ql/src/Likely Bugs/Memory Management/UnsafeUseOfStrcat.qhelp
new file mode 100644
index 000000000000..6f985f1b2e48
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/Memory Management/UnsafeUseOfStrcat.qhelp
@@ -0,0 +1,35 @@
+
+
+
+The standard library function strcat appends a source string to a target string. If you do not check the size of the source string then you cannot guarantee that
+appending the data to the target string will not cause a buffer overflow. Buffer overflows can lead to anything from a segmentation fault to a security vulnerability.
+
+
+
+Check the highlighted function calls carefully to ensure that no buffer overflow is possible.
+For a more robust solution, consider adding explicit range checks or using the strncat
+function instead.
+
+
+
+
+
+
+
+
+
+
+ I. Gerg, An Overview and Example of the Buffer-Overflow Exploit. IANewsletter vol 7, no 4, 2005.
+
+
+ M. Donaldson, Inside the Buffer Overflow Attack: Mechanism, Method & Prevention. SANS Institute InfoSec Reading Room. 2002.
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Likely Bugs/Memory Management/UnsafeUseOfStrcat.ql b/cpp/ql/src/Likely Bugs/Memory Management/UnsafeUseOfStrcat.ql
new file mode 100644
index 000000000000..ab88ceb96e20
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/Memory Management/UnsafeUseOfStrcat.ql
@@ -0,0 +1,38 @@
+/**
+ * @name Potentially unsafe use of strcat
+ * @description Using 'strcat' without checking the size of the source string
+ * may result in a buffer overflow
+ * @kind problem
+ * @problem.severity warning
+ * @precision medium
+ * @id cpp/unsafe-strcat
+ * @tags reliability
+ * correctness
+ * external/cwe/cwe-676
+ * external/cwe/cwe-120
+ * external/cwe/cwe-251
+ */
+import cpp
+import Buffer
+
+/**
+ * An access to a variable that is initialized by a constant
+ * expression, and is never used as an lvalue anywhere else.
+ */
+predicate isEffectivelyConstAccess(VariableAccess a)
+{
+ exists(Variable v |
+ a.getTarget() = v and
+ v.getInitializer().getExpr().isConstant() and
+ not v.getAnAccess().isUsedAsLValue()
+ )
+}
+
+from FunctionCall fc, VariableAccess src
+where fc.getTarget().hasName("strcat") and
+ src = fc.getArgument(1) and
+ not src.getType() instanceof ArrayType and
+ not exists(BufferSizeExpr bse |
+ bse.getArg().(VariableAccess).getTarget() = src.getTarget()) and
+ not isEffectivelyConstAccess(src)
+select fc, "Always check the size of the source buffer when using strcat."
diff --git a/cpp/ql/src/Likely Bugs/NestedLoopSameVar.cpp b/cpp/ql/src/Likely Bugs/NestedLoopSameVar.cpp
new file mode 100644
index 000000000000..7dd968cec7d0
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/NestedLoopSameVar.cpp
@@ -0,0 +1,16 @@
+int x1 = 0;
+for (x1 = 0; x1 < 100; x1++) {
+ int x2 = 0;
+ for (x1 = 0; x1 < 300; x1++) {
+ // this is most likely a typo
+ // the outer loop will exit immediately
+ }
+}
+
+for (x1 = 0; x1 < 100; x1++) {
+ if(x1 == 10 && condition) {
+ for (; x1 < 75; x1++) {
+ // this should be written as a while loop
+ }
+ }
+}
diff --git a/cpp/ql/src/Likely Bugs/NestedLoopSameVar.qhelp b/cpp/ql/src/Likely Bugs/NestedLoopSameVar.qhelp
new file mode 100644
index 000000000000..9180a91da270
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/NestedLoopSameVar.qhelp
@@ -0,0 +1,36 @@
+
+
+
+
+
+This rule finds nested loops in which the iteration variable is the same for both loops.
+The behavior of the loop will be difficult to understand as the inner loop will affect the
+iteration variable of the outer loop; this is most likely a typo.
+
+The rule flags the condition expression in the inner loop that uses the same variable as the iteration variable of the
+outer loop.
+
+
+
+If the inner loop is starting by initializing the variable to 0, it's most likely a typo and then the inner loop variable should be changed. It is good practice to use descriptive names in nested loops rather than i and j to avoid confusion. If the inner loop is merely consuming the rest of the iteration as a special case, then it's better to replace the inner for loop with a while loop and also document it.
+
+
+
+
+
+
+
+
+ Tutorialspoint - The C++ Programming Language: C++ nested loops
+
+
+ MSDN Library: Nested Control Structures
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Likely Bugs/NestedLoopSameVar.ql b/cpp/ql/src/Likely Bugs/NestedLoopSameVar.ql
new file mode 100644
index 000000000000..4edf3d0706e7
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/NestedLoopSameVar.ql
@@ -0,0 +1,17 @@
+/**
+ * @name Nested loops with same variable
+ * @description When a nested loop uses the same iteration variable as its outer loop, the
+ * behavior of the outer loop easily becomes difficult to understand as the
+ * inner loop will affect its control flow. It is likely to be a typo.
+ * @kind problem
+ * @problem.severity warning
+ * @precision medium
+ * @id cpp/nested-loops-with-same-variable
+ * @tags maintainability
+ * correctness
+ */
+import NestedLoopSameVar
+
+from ForStmt inner, Variable iteration, ForStmt outer
+where nestedForViolation(inner, iteration, outer)
+select inner.getCondition(), "Nested for statement uses loop variable $@ of enclosing $@.", iteration, iteration.getName(), outer, "for statement"
diff --git a/cpp/ql/src/Likely Bugs/NestedLoopSameVar.qll b/cpp/ql/src/Likely Bugs/NestedLoopSameVar.qll
new file mode 100644
index 000000000000..0dbe236d418e
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/NestedLoopSameVar.qll
@@ -0,0 +1,37 @@
+/**
+ * Provides the implementation of the query 'Nested loops with same variable'.
+ */
+
+import cpp
+
+/**
+ * An access to a field of the form `object.field`.
+ */
+predicate simpleFieldAccess(Variable object, Variable field, VariableAccess access) {
+ access.getTarget() = field and
+ access.getQualifier().(VariableAccess).getTarget() = object
+}
+
+/**
+ * Holds if `inner` and `outer` are nested for statements that
+ * use the same loop variable `iteration`.
+ */
+predicate nestedForViolation(ForStmt inner, Variable iteration, ForStmt outer) {
+ // same variable
+ iteration = inner.getAnIterationVariable() and
+ iteration = outer.getAnIterationVariable() and
+
+ // field accesses must have the same object
+ (
+ iteration instanceof Field implies
+ exists(Variable obj |
+ simpleFieldAccess(obj, iteration, inner.getCondition().getAChild*()) and
+ simpleFieldAccess(obj, iteration, outer.getCondition().getAChild*())
+ )
+ ) and
+
+ // ordinary nested loops
+ exists(inner.getInitialization()) and
+ inner.getParent+() = outer and
+ inner.getASuccessor+() = outer.getCondition()
+}
diff --git a/cpp/ql/src/Likely Bugs/OO/IncorrectConstructorDelegation.qhelp b/cpp/ql/src/Likely Bugs/OO/IncorrectConstructorDelegation.qhelp
new file mode 100644
index 000000000000..88af1203ef9e
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/OO/IncorrectConstructorDelegation.qhelp
@@ -0,0 +1,68 @@
+
+
+
+
+
+Prior to C++11, there is no mechanism for a constructor to delegate part of the
+object initialization to another, although other languages provide this feature.
+Consequently, any instance where a constructor call appears in the body of a constructor
+without being used is suspect.
+
+
+
+The rule flags constructor calls in constructors which are not used in some way. This
+is usually a misguided attempt to share some initialization code between multiple
+constructors, or to provide sensible defaults for some constructor parameters. The effect
+of a flagged expression would be to initialize an instance of the current class on the stack,
+and then let it go out of scope at the end of the constructor call.
+
+There are several ways to address the underlying issue of sharing initialization code,
+and the most appropriate needs to picked in each case. Roughly speaking, the options are:
+
+
+ - Introduce actual default values for the constructor parameters.
+ - Duplicate the initialization code in each constructor.
+ - Factor out the initialization code into a member function that is called from
+ each constructor.
+ - If your compiler supports it, use C++11's constructor delegation feature.
+
+
+
+
+
+class Circle {
+private:
+ double m_x;
+ double m_y;
+ double m_radius;
+
+ double m_area;
+
+public:
+ // Real constructor:
+ Circle(double x, double y, double radius) :
+ m_x(x), m_y(y), m_radius(radius)
+ {
+ m_area = 3.14159 * m_radius * m_radius;
+ }
+
+ Circle() {
+ // WRONG: Attempt to define the unit circle by default fails.
+ Circle(0, 0, 1);
+ }
+};
+
+
+
+
+
+ Dr Dobb's Journal:
+ Delegating constructors?
+ Wikipedia:
+ Object construction improvement in C++11.
+
+
+
+
diff --git a/cpp/ql/src/Likely Bugs/OO/IncorrectConstructorDelegation.ql b/cpp/ql/src/Likely Bugs/OO/IncorrectConstructorDelegation.ql
new file mode 100644
index 000000000000..5399c0afc9c9
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/OO/IncorrectConstructorDelegation.ql
@@ -0,0 +1,21 @@
+/**
+ * @name Incorrect constructor delegation
+ * @description A constructor in C++ cannot delegate part of the object
+ * initialization to another by calling it. This is likely to
+ * leave part of the object uninitialized.
+ * @kind problem
+ * @problem.severity warning
+ * @precision high
+ * @id cpp/constructor-delegation
+ * @tags maintainability
+ * readability
+ * language-features
+ */
+
+import cpp
+
+from FunctionCall call
+where call.getTarget() = call.getEnclosingFunction().(Constructor).getDeclaringType().getAConstructor()
+ and call.getParent() instanceof ExprStmt
+select call, "The constructor " + call.getTarget().getName() +
+ " may leave the instance uninitialized, as it tries to delegate to another constructor."
diff --git a/cpp/ql/src/Likely Bugs/OO/NonVirtualDestructor.cpp b/cpp/ql/src/Likely Bugs/OO/NonVirtualDestructor.cpp
new file mode 100644
index 000000000000..93ceb8dd1114
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/OO/NonVirtualDestructor.cpp
@@ -0,0 +1,31 @@
+class Base {
+public:
+ Resource *p;
+ Base() {
+ p = createResource();
+ }
+ //...
+ ~Base() {
+ //wrong: this destructor is non-virtual, but Base has a derived class
+ // with a non-virtual destructor
+ freeResource(p);
+ }
+};
+
+class Derived: public Base {
+public:
+ Resource *dp;
+ Derived() {
+ dp = createResource2();
+ }
+ ~Derived() {
+ freeResource2(dp);
+ }
+};
+
+int f() {
+ Base *b = new Derived(); //creates resources for both Base::p and Derived::dp
+ //...
+ delete b; //will only call Base::~Base(), leaking the resource dp.
+ // Change both destructors to virtual to ensure they are both called.
+}
diff --git a/cpp/ql/src/Likely Bugs/OO/NonVirtualDestructor.qhelp b/cpp/ql/src/Likely Bugs/OO/NonVirtualDestructor.qhelp
new file mode 100644
index 000000000000..864057eaa36d
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/OO/NonVirtualDestructor.qhelp
@@ -0,0 +1,26 @@
+
+
+
+
+
+This rule finds classes that define a non-virtual destructor, yet they have derived classes that also define a non-virtual destructor.
+This can prevent proper cleanup of resources as only the destructor of the type of the variable will be called (instead of the type of the
+object instance).
+
+
+
+Make the destructor virtual.
+
+
+
+
+
+
+
+
+R. Chen, When should your destructor be virtual?.
+S. Meyers. Effective C++ 3d ed. pp 40-44. Addison-Wesley Professional, 2005.
+
+
diff --git a/cpp/ql/src/Likely Bugs/OO/NonVirtualDestructor.ql b/cpp/ql/src/Likely Bugs/OO/NonVirtualDestructor.ql
new file mode 100644
index 000000000000..b9350c66dca4
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/OO/NonVirtualDestructor.ql
@@ -0,0 +1,21 @@
+/**
+ * @name Non-virtual destructor
+ * @description When a class and its derived class both define non-virtual
+ * destructors, the destructor of the derived class may not
+ * always be called.
+ * @kind problem
+ * @id cpp/non-virtual-destructor
+ * @problem.severity warning
+ * @tags reliability
+ */
+
+// This query is deprecated, and replaced by jsf/4.10 Classes/AV Rule 78.ql, which has far fewer false positives on typical code.
+
+import cpp
+
+from Class base, Destructor d1, Class derived, Destructor d2
+where derived.getABaseClass+() = base and
+ d1.getDeclaringType() = base and
+ not d1.isVirtual() and
+ d2.getDeclaringType() = derived
+select d1, "This destructor should probably be virtual."
diff --git a/cpp/ql/src/Likely Bugs/OO/SelfAssignmentCheck.cpp b/cpp/ql/src/Likely Bugs/OO/SelfAssignmentCheck.cpp
new file mode 100644
index 000000000000..a9b7df2a2b2f
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/OO/SelfAssignmentCheck.cpp
@@ -0,0 +1,39 @@
+
+class MyClass
+{
+public:
+ MyClass() : data(new Data()) {}
+ ~MyClass() {delete data;}
+
+ MyClass &operator=(const MyClass &other)
+ {
+ delete data;
+ data = other.data->clone(); // BAD: if other == *this, other.data has already been deleted!
+ return *this;
+ }
+
+private:
+ Data *data;
+};
+
+// If someone assigns a `MyClass` object to itself, the delete expression deletes both `this->data`
+// and `other.data`, since `*this` and `other` are the same object. But the call to `clone` uses
+// `*other.data`, which is no longer a valid object. Fix this by adding a check:
+
+class MyClass
+{
+public:
+ MyClass() : data(new Data()) {}
+ ~MyClass() {delete data;}
+
+ MyClass &operator=(const MyClass &other)
+ {
+ if (this == &other) { return *this; } // FIXED
+ delete data;
+ data = other.data->clone();
+ return *this;
+ }
+
+private:
+ Data *data;
+};
diff --git a/cpp/ql/src/Likely Bugs/OO/SelfAssignmentCheck.qhelp b/cpp/ql/src/Likely Bugs/OO/SelfAssignmentCheck.qhelp
new file mode 100644
index 000000000000..aa1e12ab9a98
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/OO/SelfAssignmentCheck.qhelp
@@ -0,0 +1,28 @@
+
+
+
+
+
+This rule finds copy assignment operators that deallocate memory but do not check for self assignment.
+This could lead to accessing an already freed memory location.
+
+This rule is particularly important if the copy assignment operator puts the current object in an invalid state
+before getting a new value from the object on the right hand side.
+
+
+
+Copy assignment operator should check for self-assignment.
+
+
+
+
+
+
+
+
+
+[1] M. Cline, Part of C++ FAQ: Assignment operators
+
+
diff --git a/cpp/ql/src/Likely Bugs/OO/SelfAssignmentCheck.ql b/cpp/ql/src/Likely Bugs/OO/SelfAssignmentCheck.ql
new file mode 100644
index 000000000000..de7496e69d5d
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/OO/SelfAssignmentCheck.ql
@@ -0,0 +1,19 @@
+/**
+ * @name Self assignment check
+ * @description Copy assignment operators should guard against self assignment;
+ * otherwise, self assignment is likely to cause memory
+ * corruption.
+ * @kind problem
+ * @id cpp/self-assignment-check
+ * @problem.severity warning
+ * @tags reliability
+ */
+import cpp
+
+// find copy assignment operators that deallocate memory but do not check for self assignment
+from CopyAssignmentOperator cao
+where exists(DestructorCall d | d.getEnclosingFunction() = cao) and
+ not exists(EqualityOperation eq | eq.getEnclosingFunction() = cao and
+ eq.getAChild() instanceof ThisExpr and
+ eq.getAChild().(AddressOfExpr).getAddressable() = cao.getParameter(0))
+select cao, "Copy assignment operator does not check for self assignment."
diff --git a/cpp/ql/src/Likely Bugs/OO/ThrowInDestructor.cpp b/cpp/ql/src/Likely Bugs/OO/ThrowInDestructor.cpp
new file mode 100644
index 000000000000..77f95e0b2573
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/OO/ThrowInDestructor.cpp
@@ -0,0 +1,19 @@
+class C {
+public:
+ //...
+ ~C(){
+ if (error) {
+ throw "Exception in destructor"; //wrong: exception thrown in destructor
+ }
+ }
+};
+
+void f() {
+ C* c = new C();
+ try {
+ doOperation(c);
+ delete c;
+ } catch ( char * do_operation_exception) {
+ delete c; //would immediately terminate program if C::~C throws an exception
+ }
+}
diff --git a/cpp/ql/src/Likely Bugs/OO/ThrowInDestructor.qhelp b/cpp/ql/src/Likely Bugs/OO/ThrowInDestructor.qhelp
new file mode 100644
index 000000000000..a1880228a655
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/OO/ThrowInDestructor.qhelp
@@ -0,0 +1,32 @@
+
+
+
+
+
+This rule finds exceptions thrown in destructors. This is dangerous: If the destructor is called during stack unwinding as part of the
+handling of another exception, throwing an additional exception will immediately terminate the program as per the C++ specification.
+
+
+
+Handle the error condition in a different way.
+
+
+
+
+
+
+
+
+
+
+ M. Cline, C++ FAQ: How can I handle a destructor that fails?
+
+
+ B. Stroustrup. The C++ Programming Language Special Edition p 380. Addison Wesley. 2000.
+
+
+
+
+
diff --git a/cpp/ql/src/Likely Bugs/OO/ThrowInDestructor.ql b/cpp/ql/src/Likely Bugs/OO/ThrowInDestructor.ql
new file mode 100644
index 000000000000..61c099e1b6af
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/OO/ThrowInDestructor.ql
@@ -0,0 +1,74 @@
+/**
+ * @name Exception thrown in destructor
+ * @description Throwing an exception from a destructor may cause immediate
+ * program termination.
+ * @kind problem
+ * @problem.severity warning
+ * @precision very-high
+ * @id cpp/throw-in-destructor
+ * @tags reliability
+ * readability
+ * language-features
+ */
+import cpp
+
+// This predicate finds the catch block enclosing a rethrow expression.
+predicate bindEnclosingCatch(ReThrowExpr te, CatchBlock cb)
+{
+ te.getEnclosingBlock().getEnclosingBlock*() = cb
+ and not exists(CatchBlock other | te.getEnclosingBlock().getEnclosingBlock*() = other and other.getEnclosingBlock+() = cb)
+}
+
+// This predicate strips references from types, i.e. T -> T, T* -> T*, T& -> T.
+predicate bindStrippedReferenceType(Type qualified, Type unqualified)
+{
+ (not(qualified instanceof ReferenceType) and unqualified = qualified)
+ or unqualified = qualified.(ReferenceType).getBaseType()
+}
+
+// This predicate determines (to a first approximation) the type thrown by a throw or rethrow expression.
+predicate bindThrownType(ThrowExpr te, Type thrown)
+{
+ // For normal throws, the thrown type is easily determined as the type of the throw expression.
+ (not(te instanceof ReThrowExpr) and thrown = te.getActualType())
+
+ // For rethrows, we use the unqualified version of the type caught by the enclosing catch block.
+ // Note that this is not precise, but is a reasonable first approximation.
+ or exists(CatchBlock cb | bindEnclosingCatch(te, cb) and bindStrippedReferenceType(cb.getParameter().getType().getUnspecifiedType(), thrown))
+}
+
+// This predicate determines the catch blocks that can catch the exceptions thrown by each throw expression.
+pragma[inline]
+predicate canCatch(ThrowExpr te, CatchBlock cb)
+{
+ exists(Type thrown, Type caught |
+ bindThrownType(te, thrown)
+ and caught = cb.getParameter().getType().getUnspecifiedType()
+ and not bindEnclosingCatch(te, cb)
+
+ and
+ (
+ // Catching primitives by value or reference
+ bindStrippedReferenceType(caught, thrown)
+
+ // Catching class types by value or reference
+ or exists(Class c | c = thrown and bindStrippedReferenceType(caught, c.getABaseClass*()))
+ )
+ )
+}
+
+// Find throw expressions such that there is a path in the control flow graph from the expression to
+// the end of the destructor without an intervening catch block that can catch the type thrown.
+from Destructor d, ThrowExpr te
+where
+ te.getEnclosingFunction() = d
+ and not exists(CatchBlock cb |
+ te.getASuccessor+() = cb
+ and cb.getASuccessor+() = d
+ | canCatch(te, cb)
+ or
+ // Catch anything -- written as `catch(...)`.
+ not exists(cb.getParameter())
+ )
+select te, "Exception thrown in destructor."
+
diff --git a/cpp/ql/src/Likely Bugs/OO/VirtualCallInStructor.cpp b/cpp/ql/src/Likely Bugs/OO/VirtualCallInStructor.cpp
new file mode 100644
index 000000000000..8c2fb3a4e172
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/OO/VirtualCallInStructor.cpp
@@ -0,0 +1,35 @@
+class Base {
+protected:
+ Resource* resource;
+public:
+ virtual void init() {
+ resource = createResource();
+ }
+ virtual void release() {
+ freeResource(resource);
+ }
+};
+
+class Derived: public Base {
+ virtual void init() {
+ resource = createResourceV2();
+ }
+ virtual void release() {
+ freeResourceV2(resource);
+ }
+};
+
+Base::Base() {
+ this->init();
+}
+Base::~Base() {
+ this->release();
+}
+
+int f() {
+ // this will call Base::Base() and then Derived::Derived(), but this->init()
+ // inBase::Base() will resolve to Base::init(), not Derived::init()
+ // The reason for this is that when Base::Base is called, the object being
+ // created is still of type Base (including the vtable)
+ Derived* d = new Derived();
+}
diff --git a/cpp/ql/src/Likely Bugs/OO/VirtualCallInStructor.qhelp b/cpp/ql/src/Likely Bugs/OO/VirtualCallInStructor.qhelp
new file mode 100644
index 000000000000..289b24531f02
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/OO/VirtualCallInStructor.qhelp
@@ -0,0 +1,23 @@
+
+
+
+
+
+This rule finds calls to virtual methods from within constructors and destructors. If the constructor of a derived class calls the constructor of its base type, the dynamic type of the object is the base type for the duration of the constructor call, so virtual method dispatch may yield unexpected results. The same holds for destructors.
+
+
+
+Carefully check the flagged calls to make sure they will behave as expected.
+
+
+
+
+
+
+
+
+S. Meyer. Effective C++ 3d ed. pp 48-52. Addison Wesley. 2005. Excerpt available here.
+
+
diff --git a/cpp/ql/src/Likely Bugs/OO/VirtualCallInStructor.ql b/cpp/ql/src/Likely Bugs/OO/VirtualCallInStructor.ql
new file mode 100644
index 000000000000..c73f79fb9170
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/OO/VirtualCallInStructor.ql
@@ -0,0 +1,27 @@
+/**
+ * @name Virtual call in constructor or destructor
+ * @description Calling a virtual function from a constructor or destructor
+ * rarely has the intended effect. It is likely to either cause a
+ * bug or confuse readers.
+ * @kind problem
+ * @id cpp/virtual-call-in-structor
+ * @problem.severity warning
+ * @tags reliability
+ */
+import cpp
+
+class Structor extends MemberFunction {
+ Structor() {
+ this instanceof Constructor
+ or this instanceof Destructor
+ }
+}
+
+from Structor s, FunctionCall c, VirtualFunction vf
+where c.getEnclosingFunction() = s and
+ vf = c.getTarget() and
+ exists(VirtualFunction vff |
+ vff.overrides(vf) and
+ vff.getDeclaringType().getABaseClass+() = s.getDeclaringType())
+select c, "Virtual call in constructor or destructor."
+
diff --git a/cpp/ql/src/Likely Bugs/ReturnConstType.cpp b/cpp/ql/src/Likely Bugs/ReturnConstType.cpp
new file mode 100644
index 000000000000..d93b9a7acb3d
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/ReturnConstType.cpp
@@ -0,0 +1,9 @@
+// The leftmost const has no effect here.
+const int square(const int x) {
+ return x * x;
+}
+
+// The const has no effect here, and can easily be mistaken for const char*.
+char* const id(char* s) {
+ return s;
+}
diff --git a/cpp/ql/src/Likely Bugs/ReturnConstType.qhelp b/cpp/ql/src/Likely Bugs/ReturnConstType.qhelp
new file mode 100644
index 000000000000..f285cf11df85
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/ReturnConstType.qhelp
@@ -0,0 +1,31 @@
+
+
+
+
+
+This rule finds non-member functions with a superfluous const qualifier
+on their return type.
+
+
+
+The superfluous const qualifier should be removed, as it serves no purpose.
+If the return type contains embedded qualifiers, then care should be taken to remove only
+the superfluous one.
+
+
+
+
+
+
+
+
+
+ comp.lang.c FAQ list · Question 6.3
+
+
+
+
+
+
diff --git a/cpp/ql/src/Likely Bugs/ReturnConstType.ql b/cpp/ql/src/Likely Bugs/ReturnConstType.ql
new file mode 100644
index 000000000000..ab20cef95fca
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/ReturnConstType.ql
@@ -0,0 +1,17 @@
+/**
+ * @name Constant return type
+ * @description A 'const' modifier on a function return type is useless and should be removed for clarity.
+ * @kind problem
+ * @problem.severity warning
+ * @precision very-high
+ * @id cpp/non-member-const-no-effect
+ * @tags maintainability
+ * readability
+ * language-features
+ */
+import ReturnConstTypeCommon
+
+from Function f
+where hasSuperfluousConstReturn(f)
+ and not f instanceof MemberFunction
+select f, "The 'const' modifier has no effect on a return type and can be removed."
diff --git a/cpp/ql/src/Likely Bugs/ReturnConstTypeCommon.qll b/cpp/ql/src/Likely Bugs/ReturnConstTypeCommon.qll
new file mode 100644
index 000000000000..fdcb0bf5ba27
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/ReturnConstTypeCommon.qll
@@ -0,0 +1,21 @@
+import cpp
+
+private predicate mightHaveConstMethods(Type t) {
+ t instanceof Class
+ or t instanceof TemplateParameter
+}
+
+predicate hasSuperfluousConstReturn(Function f) {
+ exists(Type t | t = f.getType() |
+ // This is the primary thing we're testing for,
+ t instanceof SpecifiedType
+ and t.hasSpecifier("const")
+ and (not affectedByMacro(t))
+ // but "const" is meaningful when applied to user defined types,
+ and not mightHaveConstMethods(t.getUnspecifiedType())
+ )
+ // and therefore "const T" might be meaningful for other values of "T".
+ and not exists(TemplateFunction t | f = t.getAnInstantiation() |
+ t.getType().involvesTemplateParameter()
+ )
+}
diff --git a/cpp/ql/src/Likely Bugs/ReturnConstTypeMember.cpp b/cpp/ql/src/Likely Bugs/ReturnConstTypeMember.cpp
new file mode 100644
index 000000000000..cc6b6da3abb4
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/ReturnConstTypeMember.cpp
@@ -0,0 +1,13 @@
+struct S {
+ int val;
+
+ // The const has no effect here.
+ auto getValIncorrect() -> const int {
+ return val;
+ }
+
+ // Whereas here it does make a semantic difference.
+ auto getValCorrect() const -> int {
+ return val
+ }
+};
diff --git a/cpp/ql/src/Likely Bugs/ReturnConstTypeMember.qhelp b/cpp/ql/src/Likely Bugs/ReturnConstTypeMember.qhelp
new file mode 100644
index 000000000000..4b4d90485411
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/ReturnConstTypeMember.qhelp
@@ -0,0 +1,30 @@
+
+
+
+
+
+This rule finds member functions with a superfluous const qualifier
+on their return type. This might be caused by confusion about how to declare a const
+method. In particular, when C++11 trailing return types are used, it becomes much easier
+to mis-declare a const method by putting const on the wrong side of
+->.
+
+
+
+The superfluous const qualifier should be removed, as it serves no purpose.
+If the return type contains embedded qualifiers, then care should be taken to remove only
+the superfluous one.
+Alternatively, if the intention was to have a const method, then the qualifier
+should be moved to immediately after the argument list.
+
+
+
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Likely Bugs/ReturnConstTypeMember.ql b/cpp/ql/src/Likely Bugs/ReturnConstTypeMember.ql
new file mode 100644
index 000000000000..724036c7c1eb
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/ReturnConstTypeMember.ql
@@ -0,0 +1,20 @@
+/**
+ * @name Constant return type on member
+ * @description A 'const' modifier on a member function return type is useless. It is usually a typo or misunderstanding, since the syntax for a 'const' function is 'int foo() const', not 'const int foo()'.
+ * @kind problem
+ * @problem.severity warning
+ * @precision very-high
+ * @id cpp/member-const-no-effect
+ * @tags maintainability
+ * readability
+ * language-features
+ */
+import ReturnConstTypeCommon
+
+from MemberFunction f, string message
+where hasSuperfluousConstReturn(f) and
+ if f.hasSpecifier("const") or f.isStatic() then
+ message = "The 'const' modifier has no effect on return types. The 'const' modifying the return type can be removed."
+ else
+ message = "The 'const' modifier has no effect on return types. For a const function, the 'const' should go after the parameter list."
+select f, message
diff --git a/cpp/ql/src/Likely Bugs/ShortLoopVarName.cpp b/cpp/ql/src/Likely Bugs/ShortLoopVarName.cpp
new file mode 100644
index 000000000000..568c994ec640
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/ShortLoopVarName.cpp
@@ -0,0 +1,14 @@
+int i = 0;
+for (i = 0; i < NUM_RECORDS; i++) {
+ int j = 0;
+ //This loop should have a more descriptive iteration variable
+ for (j = 0; j < NUM_FIELDS; j++) {
+ process(record[i]->field[j]);
+ }
+
+ int field_idx = 0;
+ //Better: the inner loop has a descriptive name
+ for (field_idx = 0; field_idx < NUM_FIELDS; field_idx++) {
+ save(record[i]->field[field_idx]);
+ }
+}
\ No newline at end of file
diff --git a/cpp/ql/src/Likely Bugs/ShortLoopVarName.qhelp b/cpp/ql/src/Likely Bugs/ShortLoopVarName.qhelp
new file mode 100644
index 000000000000..4f89ed78a920
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/ShortLoopVarName.qhelp
@@ -0,0 +1,30 @@
+
+
+
+
+
+This rule finds loops with an iteration variable that has a short name.
+ The iteration variable of a nested loop should have a descriptive name:
+avoid short names like i, j, or k that can cause confusion except in very simple loops.
+
+
+
+Change the name of the inner loop's iteration variables to something more descriptive, to make it
+easier to understand code in complex, nested loops.
+
+
+
+
+
+
+
+
+ ROS C++ Style Guide: Variables
+
+
+
+
+
+
diff --git a/cpp/ql/src/Likely Bugs/ShortLoopVarName.ql b/cpp/ql/src/Likely Bugs/ShortLoopVarName.ql
new file mode 100644
index 000000000000..92696cfc870d
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/ShortLoopVarName.ql
@@ -0,0 +1,53 @@
+/**
+ * @name Error-prone name of loop variable
+ * @description The iteration variable of a nested loop should have a descriptive name: short names like i, j, or k can cause confusion except in very simple loops.
+ * @kind problem
+ * @id cpp/short-loop-var-name
+ * @problem.severity recommendation
+ * @precision medium
+ * @tags maintainability
+ * readability
+ */
+import cpp
+
+predicate short(Variable v) {
+ v.getName().length() = 1
+}
+
+predicate forStmtAncestor(Stmt child, ForStmt parent) {
+ child.getParent() = parent or forStmtAncestor(child.getParent(), parent)
+}
+
+/**
+ * Gets an `ArrayExpr` that's nested directly inside `ArrayExpr ae`.
+ */
+ArrayExpr getANestedArrayExpr(ArrayExpr ae) {
+ result.getArrayBase() = ae
+}
+
+/**
+ * Holds if variables `a` and `b` are accessed in a way that looks like they
+ * are a coordinate pair. For example:
+ * ```
+ * arr[x][y]
+ * arr[(y * width) + x]
+ * ```
+ */
+predicate coordinatePair(Variable a, Variable b) {
+ exists(ArrayExpr ae |
+ getANestedArrayExpr*(ae).getArrayOffset().getAChild*() = a.getAnAccess() and
+ getANestedArrayExpr*(ae).getArrayOffset().getAChild*() = b.getAnAccess() and
+ not a = b
+ )
+}
+
+from ForStmt outer, ForStmt inner, Variable iterationVar, Variable innerVar
+where forStmtAncestor(inner, outer) and short(innerVar)
+ and iterationVar = outer.getAnIterationVariable()
+ and innerVar = inner.getAnIterationVariable()
+ and short(iterationVar)
+ and not coordinatePair(iterationVar, innerVar)
+select iterationVar,
+ "Iteration variable " + iterationVar.getName() + " for $@ should have a descriptive name, since there is $@.",
+ outer, "this loop",
+ inner, "a nested loop"
diff --git a/cpp/ql/src/Likely Bugs/UseInOwnInitializer.cpp b/cpp/ql/src/Likely Bugs/UseInOwnInitializer.cpp
new file mode 100644
index 000000000000..da05a7ea3c3b
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/UseInOwnInitializer.cpp
@@ -0,0 +1,10 @@
+int f() {
+ int x = x; // BAD: undefined behavior occurs here
+ x = 0;
+ return x;
+}
+
+int g() {
+ int x = 0; // GOOD
+ return x;
+}
diff --git a/cpp/ql/src/Likely Bugs/UseInOwnInitializer.qhelp b/cpp/ql/src/Likely Bugs/UseInOwnInitializer.qhelp
new file mode 100644
index 000000000000..945a21cba4ff
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/UseInOwnInitializer.qhelp
@@ -0,0 +1,29 @@
+
+
+
+
+
+A variable is in scope in its own initializer, but it is undefined behavior to load from it before it is first assigned to.
+
+
+
+Do not use a variable in its own initializer unless it is part of an address calculation or a sizeof expression.
+
+
+
+
+
+
+
+
+
+ SEI CERT Secure Coding Standard: EXP53-CPP. Do not read uninitialized memory
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Likely Bugs/UseInOwnInitializer.ql b/cpp/ql/src/Likely Bugs/UseInOwnInitializer.ql
new file mode 100644
index 000000000000..0ae5a91a54da
--- /dev/null
+++ b/cpp/ql/src/Likely Bugs/UseInOwnInitializer.ql
@@ -0,0 +1,30 @@
+/**
+ * @name Variable used in its own initializer
+ * @id cpp/use-in-own-initializer
+ * @description Loading from a variable in its own initializer may lead to undefined behavior.
+ * @kind problem
+ * @problem.severity warning
+ * @precision high
+ * @tags maintainability
+ * correctness
+ */
+
+import cpp
+
+from Initializer init, Variable v, VariableAccess va
+where init.getDeclaration() = v
+ and va.getTarget() = v
+ and va.getParent*() = init
+ and (
+ va.hasLValueToRValueConversion() or
+ exists (Assignment assn | assn.getLValue() = va) or
+ exists (CrementOperation crement | crement.getAnOperand() = va)
+ )
+ and not va.isUnevaluated()
+ and not (
+ va.getParent() = init and
+ exists(MacroInvocation mi |
+ va = mi.getExpr()
+ )
+ )
+select va, v.getName() + " is used in its own initializer."
diff --git a/cpp/ql/src/META-INF/MANIFEST.MF b/cpp/ql/src/META-INF/MANIFEST.MF
new file mode 100644
index 000000000000..9297719168ec
--- /dev/null
+++ b/cpp/ql/src/META-INF/MANIFEST.MF
@@ -0,0 +1,8 @@
+Manifest-Version: 1.0
+Bundle-ManifestVersion: 2
+Bundle-Name: Semmle C/C++ Default Queries
+Bundle-SymbolicName: com.semmle.plugin.semmlecode.cpp.queries;singleton:=true
+Bundle-Version: 1.18.0.qualifier
+Bundle-Vendor: Semmle Ltd.
+Bundle-ActivationPolicy: lazy
+Require-Bundle: com.semmle.plugin.qdt.ui;bundle-version="[1.18.0.qualifier,1.18.0.qualifier]"
diff --git a/cpp/ql/src/Metrics/Classes/CAfferentCoupling.qhelp b/cpp/ql/src/Metrics/Classes/CAfferentCoupling.qhelp
new file mode 100644
index 000000000000..06c4bbf2539d
--- /dev/null
+++ b/cpp/ql/src/Metrics/Classes/CAfferentCoupling.qhelp
@@ -0,0 +1,81 @@
+
+
+
+
+This metric measures the number of incoming dependencies for each class,
+ i.e. the number of other classes that depend on it.
+
+
+
+Classes that are depended upon by many other classes typically require a lot of
+effort to change, because changing them will force their dependents to change
+as well. This is not necessarily a bad thing -- indeed, most systems will have
+some such classes (one example might be a string class). However, classes with a high number
+of incoming dependencies
+and a high number of outgoing dependencies are hard to maintain. They are hard to
+change (high afferent coupling) and yet there are many reasons to
+change them (high efferent coupling). This contradiction yields code that is very
+hard to maintain or test.
+
+
+
+Conversely, some classes may only be depended on by very few other classes. Again,
+this is not necessarily a problem -- we would expect, for example, that the
+top-level classes of a system would meet this criterion. When lower-level
+classes have very few incoming dependencies, however, it can be an indication
+that a class is not pulling its weight. In extreme cases, classes may even
+have an afferent coupling of 0, indicating that they are dead
+code.
+
+
+
+
+
+
+It is unwise to refactor a class based purely on its high or low number of
+incoming dependencies -- a class's afferent coupling value only makes sense
+in the context of its role in the system as a whole. However, when combined
+with other metrics such as efferent coupling, it is possible to make some
+general recommendations:
+
+
+
+-
+Classes with high numbers of incoming and outgoing dependencies
+are prime candidates for refactoring (although this
+will not always be easy). The general strategy is to split the class into
+smaller classes, each of which has fewer responsibilities, and refactor the code
+that used the original class accordingly.
+
+
+-
+Classes that have very few incoming dependencies and are not at the top level
+of a system may not be pulling their weight and should be refactored.
+
+
+-
+Classes that have an afferent coupling of
0 may be dead code --
+in this situation, they can often be deleted.
+
+
+
+
+
+
+
+
+
+ M. Fowler. Refactoring. Addison-Wesley, 1999.
+
+
+ Wikipedia: Code refactoring
+
+
+ Refactoring as Meta Programming?
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Classes/CAfferentCoupling.ql b/cpp/ql/src/Metrics/Classes/CAfferentCoupling.ql
new file mode 100644
index 000000000000..e2747ecad28b
--- /dev/null
+++ b/cpp/ql/src/Metrics/Classes/CAfferentCoupling.ql
@@ -0,0 +1,17 @@
+/**
+ * @name Incoming dependencies per class
+ * @description The number of classes that depend on a class.
+ * @kind treemap
+ * @id cpp/afferent-coupling-per-class
+ * @treemap.warnOn highValues
+ * @metricType reftype
+ * @metricAggregate avg max
+ * @tags maintainability
+ * modularity
+ */
+import cpp
+
+from Class c
+where c.fromSource()
+select c, c.getMetrics().getAfferentCoupling() as n
+order by n desc
diff --git a/cpp/ql/src/Metrics/Classes/CEfferentCoupling.qhelp b/cpp/ql/src/Metrics/Classes/CEfferentCoupling.qhelp
new file mode 100644
index 000000000000..335280e416c9
--- /dev/null
+++ b/cpp/ql/src/Metrics/Classes/CEfferentCoupling.qhelp
@@ -0,0 +1,46 @@
+
+
+
+
+This metric measures the number of outgoing dependencies for each class,
+i.e. the number of other classes on which each class depends.
+
+
+
+Classes that depend on many other classes are quite brittle, because if any of
+their dependencies change then they may have to as well. Furthermore, the
+reason for the high number of dependencies is often that different bits of
+the class depend on different sets of other classes, so it is not uncommon to
+find that classes with high efferent coupling also lack cohesion.
+
+
+
+
+
+
+Efferent coupling can be reduced by splitting a class into pieces along its
+dependency fault lines.
+
+
+
+
+
+
+
+R. Martin. Agile Software Development: Principles, Patterns and Practices. Pearson, 2011.
+
+
+ M. Fowler. Refactoring. Addison-Wesley, 1999.
+
+
+ Wikipedia: Code refactoring
+
+
+ Refactoring as Meta Programming?
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Classes/CEfferentCoupling.ql b/cpp/ql/src/Metrics/Classes/CEfferentCoupling.ql
new file mode 100644
index 000000000000..1c8952810696
--- /dev/null
+++ b/cpp/ql/src/Metrics/Classes/CEfferentCoupling.ql
@@ -0,0 +1,17 @@
+/**
+ * @name Outgoing dependencies per class
+ * @description The number of classes on which a class depends.
+ * @kind treemap
+ * @id cpp/outgoing-type-dependencies
+ * @treemap.warnOn highValues
+ * @metricType reftype
+ * @metricAggregate avg max
+ * @tags testability
+ * modularity
+ */
+import cpp
+
+from Class c
+where c.fromSource()
+select c, c.getMetrics().getEfferentCoupling() as n
+order by n desc
diff --git a/cpp/ql/src/Metrics/Classes/CHalsteadBugs.ql b/cpp/ql/src/Metrics/Classes/CHalsteadBugs.ql
new file mode 100644
index 000000000000..0346c812c6f7
--- /dev/null
+++ b/cpp/ql/src/Metrics/Classes/CHalsteadBugs.ql
@@ -0,0 +1,14 @@
+/**
+ * @name Halstead bug measure
+ * @description Measures the expected number of delivered defects.
+ * The Halstead bug count is known to be an underestimate.
+ * @kind treemap
+ * @id cpp/halstead-bugs-per-class
+ * @treemap.warnOn highValues
+ * @metricType reftype
+ * @metricAggregate avg sum max
+ */
+import cpp
+
+from MetricClass mc
+select mc, mc.getHalsteadDeliveredBugs()
diff --git a/cpp/ql/src/Metrics/Classes/CHalsteadDifficulty.ql b/cpp/ql/src/Metrics/Classes/CHalsteadDifficulty.ql
new file mode 100644
index 000000000000..0346b43974c3
--- /dev/null
+++ b/cpp/ql/src/Metrics/Classes/CHalsteadDifficulty.ql
@@ -0,0 +1,13 @@
+/**
+ * @name Halstead difficulty
+ * @description Measures the error proneness of implementing the program
+ * @kind treemap
+ * @id cpp/halstead-difficulty-per-class
+ * @treemap.warnOn highValues
+ * @metricType reftype
+ * @metricAggregate avg sum max
+ */
+import cpp
+
+from MetricClass mc
+select mc, mc.getHalsteadDifficulty()
diff --git a/cpp/ql/src/Metrics/Classes/CHalsteadEffort.ql b/cpp/ql/src/Metrics/Classes/CHalsteadEffort.ql
new file mode 100644
index 000000000000..086916029503
--- /dev/null
+++ b/cpp/ql/src/Metrics/Classes/CHalsteadEffort.ql
@@ -0,0 +1,13 @@
+/**
+ * @name Halstead effort
+ * @description Measures the effort to implement the program
+ * @kind treemap
+ * @id cpp/halstead-effort-per-class
+ * @treemap.warnOn highValues
+ * @metricType reftype
+ * @metricAggregate avg sum max
+ */
+import cpp
+
+from MetricClass mc
+select mc, mc.getHalsteadEffort()
diff --git a/cpp/ql/src/Metrics/Classes/CHalsteadLength.ql b/cpp/ql/src/Metrics/Classes/CHalsteadLength.ql
new file mode 100644
index 000000000000..31351583a674
--- /dev/null
+++ b/cpp/ql/src/Metrics/Classes/CHalsteadLength.ql
@@ -0,0 +1,13 @@
+/**
+ * @name Halstead length
+ * @description Total number of operands and operators
+ * @kind treemap
+ * @id cpp/halstead-length-per-class
+ * @treemap.warnOn highValues
+ * @metricType reftype
+ * @metricAggregate avg sum max
+ */
+import cpp
+
+from MetricClass mc
+select mc, mc.getHalsteadLength()
diff --git a/cpp/ql/src/Metrics/Classes/CHalsteadVocabulary.ql b/cpp/ql/src/Metrics/Classes/CHalsteadVocabulary.ql
new file mode 100644
index 000000000000..9e92d621ce96
--- /dev/null
+++ b/cpp/ql/src/Metrics/Classes/CHalsteadVocabulary.ql
@@ -0,0 +1,13 @@
+/**
+ * @name Halstead vocabulary
+ * @description Number of distinct operands and operators used
+ * @kind treemap
+ * @id cpp/halstead-vocabulary-per-class
+ * @treemap.warnOn highValues
+ * @metricType reftype
+ * @metricAggregate avg sum max
+ */
+import cpp
+
+from MetricClass mc
+select mc, mc.getHalsteadVocabulary()
diff --git a/cpp/ql/src/Metrics/Classes/CHalsteadVolume.ql b/cpp/ql/src/Metrics/Classes/CHalsteadVolume.ql
new file mode 100644
index 000000000000..50759cf173cb
--- /dev/null
+++ b/cpp/ql/src/Metrics/Classes/CHalsteadVolume.ql
@@ -0,0 +1,13 @@
+/**
+ * @name Halstead volume
+ * @description The information contents of the program
+ * @kind treemap
+ * @id cpp/halstead-volume-per-class
+ * @treemap.warnOn highValues
+ * @metricType reftype
+ * @metricAggregate avg sum max
+ */
+import cpp
+
+from MetricClass mc
+select mc, mc.getHalsteadVolume()
diff --git a/cpp/ql/src/Metrics/Classes/CInheritanceDepth.qhelp b/cpp/ql/src/Metrics/Classes/CInheritanceDepth.qhelp
new file mode 100644
index 000000000000..25480749bba6
--- /dev/null
+++ b/cpp/ql/src/Metrics/Classes/CInheritanceDepth.qhelp
@@ -0,0 +1,66 @@
+
+
+
+
+This metric measures the inheritance depth of a class.
+
+
+
+Whilst inheritance provides an avenue for code reuse, overly-deep class
+hierarchies can become a maintenance headache. Classes that inherit from
+many other classes can be brittle and hard to understand, because they
+depend on all of the classes further up the hierarchy. Conversely, changes
+to classes nearer the root of the hierarchy become harder and harder
+to make without breaking the descendants. In extreme cases, where the
+design of the hierarchy is seriously inappropriate, the class at the top of
+the hierarchy can become a 'blob' class: a storage point for anything that
+might be needed by one of its descendants. This is a key indicator that some
+serious refactoring is needed.
+
+
+
+
+
+
+As with many metrics, a high inheritance depth should be seen as an indicator
+that something is amiss, but further investigation will be needed to clarify
+the cause of the problem. Here are two possibilities:
+
+
+
+
+-
+A class and its superclass represent fundamentally the same abstraction.
+In this case, they should generally be merged together (see the 'Collapse
+Hierarchy' refactoring on pp.279-80 of [Fowler]).
+
+
+-
+The class hierarchy is trying to represent variation in more than one
+dimension using single inheritance. This can lead to an unnecessarily
+deep class hierarchy with lots of code duplication.
+
+
+
+In languages that support it (such as C++), this situation can be modeled
+somewhat more effectively using multiple inheritance, but an altogether better
+approach is to use a component-based architecture (i.e. composition).
+
+
+
+
+
+
+
+
+ M. Fowler. Refactoring. Addison-Wesley, 1999.
+
+
+ Wikipedia: Code refactoring
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Classes/CInheritanceDepth.ql b/cpp/ql/src/Metrics/Classes/CInheritanceDepth.ql
new file mode 100644
index 000000000000..77e9414f9fd8
--- /dev/null
+++ b/cpp/ql/src/Metrics/Classes/CInheritanceDepth.ql
@@ -0,0 +1,16 @@
+/**
+ * @name Inheritance depth per class
+ * @description The depth of a class in the inheritance hierarchy.
+ * @kind treemap
+ * @id cpp/inheritance-depth-per-class
+ * @treemap.warnOn highValues
+ * @metricType reftype
+ * @metricAggregate avg max
+ * @tags modularity
+ */
+import cpp
+
+from Class c
+where c.fromSource()
+select c, c.getMetrics().getInheritanceDepth() as n
+order by n desc
diff --git a/cpp/ql/src/Metrics/Classes/CLackOfCohesionCK.qhelp b/cpp/ql/src/Metrics/Classes/CLackOfCohesionCK.qhelp
new file mode 100644
index 000000000000..f283056d2a84
--- /dev/null
+++ b/cpp/ql/src/Metrics/Classes/CLackOfCohesionCK.qhelp
@@ -0,0 +1,77 @@
+
+
+
+
+This metric provides an indication of the lack of cohesion of a class,
+using a method proposed by Chidamber and Kemerer in 1994. The idea
+behind measuring a class's cohesion is that most funcions in well-designed
+classes will access the same fields. Types that exhibit a lack of cohesion
+are often trying to take on multiple responsibilities, and should be split
+into several smaller classes.
+
+
+
+Various measures of lack of cohesion have been proposed: while the basic
+intuition is simple, the precise way to measure this property has been the
+subject of intense debate. Rather than getting involved in this debate,
+more than one such lack of cohesion measure is provided for comparison purposes.
+
+
+
+The Chidamber and Kemerer version of lack of cohesion inspects pairs of
+functions. If there are many pairs that access the same data, then the class
+is cohesive. On the other hand, if there are many pairs that do not access
+any common data, then the class is not cohesive. More precisely, if we let
+n1 be the number of pairs of distinct functions in a class
+that do not have at least one commonly-accessed field, and let
+n2 be the number of pairs of distinct functions in a class
+that do have at least one commonly-accessed field, then the lack of
+cohesion measure LCOM can be defined as:
+
+
+
+LCOM = max((n1 - n2) / 2, 0)
+
+
+
+High values of LCOM indicate a worrisome lack of cohesion. The
+precise value of the metric for which warnings are issued is configurable,
+but as a rough indication, an LCOM of 500 or more
+may give you cause for concern.
+
+
+
+
+
+
+Classes generally lack cohesion because they are taking on more responsibilities
+than they should (see [Martin] for more on responsibilities). In general, the
+solution is to identify each of the different responsibilities the class is
+taking on, and split them out into multiple classes, e.g. using the 'Extract
+Class' refactoring from [Fowler].
+
+
+
+
+
+
+
+
+
+S. R. Chidamber and C. F. Kemerer. A metrics suite for object-oriented design. IEEE Transactions on Software Engineering, 20(6):476-493, 1994.
+
+
+M. Fowler. Refactoring pp. 65, 122-5. Addison-Wesley, 1999.
+
+
+R. Martin. The Single Responsibility Principle. Published online.
+
+
+O. de Moor et al. Keynote Address: .QL for Source Code Analysis. Proceedings of the 7th IEEE International Working Conference on Source Code Analysis and Manipulation, 2007.
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Classes/CLackOfCohesionCK.ql b/cpp/ql/src/Metrics/Classes/CLackOfCohesionCK.ql
new file mode 100644
index 000000000000..c6dbe2f762e8
--- /dev/null
+++ b/cpp/ql/src/Metrics/Classes/CLackOfCohesionCK.ql
@@ -0,0 +1,17 @@
+/**
+ * @name Lack of cohesion per class (LCOM-CK)
+ * @description Lack of cohesion for a class as defined by Chidamber
+ * and Kemerer.
+ * @kind treemap
+ * @id cpp/lack-of-cohesion-ck
+ * @treemap.warnOn highValues
+ * @metricType reftype
+ * @metricAggregate avg max
+ * @tags modularity
+ */
+import cpp
+
+from Class c
+where c.fromSource()
+select c, c.getMetrics().getLackOfCohesionCK() as n
+order by n desc
diff --git a/cpp/ql/src/Metrics/Classes/CLackOfCohesionHS.ql b/cpp/ql/src/Metrics/Classes/CLackOfCohesionHS.ql
new file mode 100644
index 000000000000..93050e8ca10e
--- /dev/null
+++ b/cpp/ql/src/Metrics/Classes/CLackOfCohesionHS.ql
@@ -0,0 +1,15 @@
+/**
+ * @name Lack of cohesion per class (LCOM-HS)
+ * @description Lack of cohesion for a class as defined by Henderson-Sellers.
+ * @kind treemap
+ * @id cpp/lack-of-cohesion-hs
+ * @treemap.warnOn highValues
+ * @metricType reftype
+ * @metricAggregate avg max
+ */
+import cpp
+
+from Class c
+where c.fromSource()
+select c, c.getMetrics().getLackOfCohesionHS() as n
+order by n desc
diff --git a/cpp/ql/src/Metrics/Classes/CLinesOfCode.qhelp b/cpp/ql/src/Metrics/Classes/CLinesOfCode.qhelp
new file mode 100644
index 000000000000..01dca35c20ea
--- /dev/null
+++ b/cpp/ql/src/Metrics/Classes/CLinesOfCode.qhelp
@@ -0,0 +1,51 @@
+
+
+
+
+This metric measures the number of lines of code for each class.
+
+
+
+Large classes can be problematic:
+
+
+
+-
+They can be hard to understand and maintain, even with good tool support.
+
+
+-
+They often arise as a result of bundling many unrelated things into the same
+class, and so can be a symptom of weak class cohesion.
+
+
+
+
+
+
+
+Classes are generally too large because they are taking on more responsibilities
+than they should (see [Martin] for more on responsibilities). In general, the
+solution is to identify each of the different responsibilities the class is
+taking on, and split them out into multiple classes, e.g. using the 'Extract
+Class' refactoring from [Fowler].
+
+
+
+
+
+
+
+
+
+M. Fowler. Refactoring pp. 65, 122-5. Addison-Wesley, 1999.
+
+
+R. Martin. The Single Responsibility Principle. Published online.
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Classes/CLinesOfCode.ql b/cpp/ql/src/Metrics/Classes/CLinesOfCode.ql
new file mode 100644
index 000000000000..f958732e4795
--- /dev/null
+++ b/cpp/ql/src/Metrics/Classes/CLinesOfCode.ql
@@ -0,0 +1,20 @@
+/**
+ * @name Lines of code per class
+ * @description The number of lines of code in a class.
+ * @kind treemap
+ * @id cpp/lines-of-code-per-class
+ * @treemap.warnOn highValues
+ * @metricType reftype
+ * @metricAggregate avg sum max
+ * @tags maintainability
+ */
+import cpp
+
+from Class c, int n
+where c.fromSource()
+ and n = c.getMetrics().getNumberOfMembers()
+ + sum(Function f |
+ c.getACanonicalMemberFunction() = f |
+ f.getMetrics().getNumberOfLinesOfCode())
+select c, n
+order by n desc
diff --git a/cpp/ql/src/Metrics/Classes/CNumberOfFields.qhelp b/cpp/ql/src/Metrics/Classes/CNumberOfFields.qhelp
new file mode 100644
index 000000000000..a4e09e92caf7
--- /dev/null
+++ b/cpp/ql/src/Metrics/Classes/CNumberOfFields.qhelp
@@ -0,0 +1,53 @@
+
+
+
+
+This metric measures the number of fields in classes below this
+location in the tree. At a class level, it just measures the number of
+fields in the class itself.
+
+
+
+There are at least a couple of reasons why a class may have too many fields:
+
+
+
+- The class in general may be too big / have too many responsibilities.
+- Several of the fields may be part of the same abstraction.
+
+
+
+
+
+
+The best resolution depends on the underlying reason behind it:
+
+
+
+-
+If the class is too big, it should be split into multiple smaller classes.
+
+
+-
+If several of the fields are part of the same abstraction, they should be
+grouped into a separate class, using the 'Extract Class' refactoring described
+in [Fowler].
+
+
+
+
+
+
+
+
+M. Fowler. Refactoring pp. 65, 122-5. Addison-Wesley, 1999.
+
+
+R. Martin. The Single Responsibility Principle. Published online.
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Classes/CNumberOfFields.ql b/cpp/ql/src/Metrics/Classes/CNumberOfFields.ql
new file mode 100644
index 000000000000..a83383975368
--- /dev/null
+++ b/cpp/ql/src/Metrics/Classes/CNumberOfFields.ql
@@ -0,0 +1,16 @@
+/**
+ * @name Number of fields per class
+ * @description The number of fields in a class.
+ * @kind treemap
+ * @id cpp/fields-per-type
+ * @treemap.warnOn highValues
+ * @metricType reftype
+ * @metricAggregate avg sum max
+ * @tags maintainability
+ */
+import cpp
+
+from Class c
+where c.fromSource()
+select c, c.getMetrics().getNumberOfFields() as n
+order by n desc
diff --git a/cpp/ql/src/Metrics/Classes/CNumberOfFunctions.qhelp b/cpp/ql/src/Metrics/Classes/CNumberOfFunctions.qhelp
new file mode 100644
index 000000000000..cc62cb50f498
--- /dev/null
+++ b/cpp/ql/src/Metrics/Classes/CNumberOfFunctions.qhelp
@@ -0,0 +1,100 @@
+
+
+
+
+This metric measures the number of functions in classes below this
+location in the tree. At a class level, it just measures the number of
+functions in the class itself.
+
+
+
+A class with too many functions is generally trying to do too much, either at
+the interface or implementation level or both. It can be difficult for readers
+to understand because there is a confusing list of operations. Such
+classes often lack cohesion and are prime candidates for refactoring.
+
+
+
+
+
+
+Classes have too many functions for a variety of reasons, and the appropriate
+fix is different in each case:
+
+
+
+
+-
+The class may be too large in general, and taking on more responsibilities
+than it should (see [Martin] for more on responsibilities). In this case,
+the solution is to identify each of the different responsibilities the class
+is taking on, and split it into multiple classes, e.g. using the 'Extract
+Class' refactoring from [Fowler].
+
+
+-
+There may be lots of duplication within the class itself, i.e. some of the
+functions may be doing overlapping things. In this case, the solution is to
+redesign the class so that each new function has a single, unique
+responsibility.
+
+
+-
+The class may be quite small at the implementation level, but trying to
+provide its user with a wide range of 'utility' functions that don't actually
+need to be part of the class. (A classic example of this is the
+
std::string class in the C++ Standard Library.) As [Sutter]
+observes, there are at least two key problems with this approach:
+
+
+
+-
+It may be possible to generalize some of the utility functions beyond the
+narrow context of the class in question -- by bundling them with the class,
+the class author reduces the scope for functionality reuse.
+
+
+-
+It's usually impossible for the class author to know every possible
+operation that the user might want to perform on the class, so the public
+interface will inherently be incomplete. New utility functions will end up
+having a different syntax to the privileged public functions in the class,
+negatively impacting on code consistency.
+
+
+
+To refactor a class like this, simply move its utility functions elsewhere,
+paring its public interface down to the bare minimum.
+
+
+-
+The class may be a base class in a badly-designed inheritance hierarchy.
+Such classes have many public functions in order to support features that
+are only used by one or two of their descendants. In this situation, the
+solution is to redesign the hierarchy, possibly by refactoring it into a
+component-based architecture (see [Microsoft Patterns & Practices Team]).
+
+
+
+
+
+
+
+
+
+M. Fowler. Refactoring pp. 65, 122-5. Addison-Wesley, 1999.
+
+
+R. Martin. The Single Responsibility Principle. Published online.
+
+
+H. Sutter. GotW #84: Monoliths "Unstrung". Published online, 2002.
+
+
+Microsoft Patterns & Practices Team. Architectural Patterns and Styles Microsoft Application Architecture Guide, 2nd Edition. Microsoft Press, 2009.
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Classes/CNumberOfFunctions.ql b/cpp/ql/src/Metrics/Classes/CNumberOfFunctions.ql
new file mode 100644
index 000000000000..a027f058aa27
--- /dev/null
+++ b/cpp/ql/src/Metrics/Classes/CNumberOfFunctions.ql
@@ -0,0 +1,16 @@
+/**
+ * @name Number of functions per class
+ * @description The number of member functions in a class.
+ * @kind treemap
+ * @id cpp/number-of-functions-per-class
+ * @treemap.warnOn highValues
+ * @metricType reftype
+ * @metricAggregate avg sum max
+ * @tags maintainability
+ */
+import cpp
+
+from Class c
+where c.fromSource()
+select c, c.getMetrics().getNumberOfMemberFunctions() as n
+order by n desc
diff --git a/cpp/ql/src/Metrics/Classes/CNumberOfStatements.ql b/cpp/ql/src/Metrics/Classes/CNumberOfStatements.ql
new file mode 100644
index 000000000000..73285348ad78
--- /dev/null
+++ b/cpp/ql/src/Metrics/Classes/CNumberOfStatements.ql
@@ -0,0 +1,17 @@
+/**
+ * @name Number of statements per class
+ * @description The number of statements in the member functions of a class.
+ * For template functions, only the statements in the template
+ * itself, not in the instantiations, are counted.
+ * @kind treemap
+ * @id cpp/statements-per-type
+ * @treemap.warnOn highValues
+ * @metricType reftype
+ * @metricAggregate avg sum max
+ */
+import cpp
+
+from Class c, int n
+where c.fromSource()
+ and n = count(Stmt s | s.getEnclosingFunction() = c.getACanonicalMemberFunction())
+select c, n
diff --git a/cpp/ql/src/Metrics/Classes/CPercentageOfComplexCode.qhelp b/cpp/ql/src/Metrics/Classes/CPercentageOfComplexCode.qhelp
new file mode 100644
index 000000000000..176df0bbc151
--- /dev/null
+++ b/cpp/ql/src/Metrics/Classes/CPercentageOfComplexCode.qhelp
@@ -0,0 +1,51 @@
+
+
+
+
+This metric measures the percentage of the code within each class that is part
+of a complex function (defined to be a function that has a high cyclomatic
+complexity, i.e. there are a high number of linearly-independent execution
+paths through the function).
+
+
+
+Functions with high cyclomatic complexity are typically difficult to understand
+and test. Classes whose code is primarily contained within such tricky functions
+are often strong candidates for refactoring.
+
+
+
+
+
+
+Each of the individual functions whose cyclomatic complexity is too high should
+be simplified, e.g. by tidying up complex logic and/or by splitting the function
+into multiple smaller functions using the 'Extract Method' refactoring from
+[Fowler]. If splitting the functions up results in a class with too many
+functions, the refactoring should be followed up with another one to resolve the
+new problem (as per the advice given for that situation).
+
+
+
+
+
+
+
+
+
+
+
+ M. Fowler. Refactoring. Addison-Wesley, 1999.
+
+
+ Wikipedia: Code refactoring
+
+
+ Refactoring as Meta Programming?
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Classes/CPercentageOfComplexCode.ql b/cpp/ql/src/Metrics/Classes/CPercentageOfComplexCode.ql
new file mode 100644
index 000000000000..30d46951ef24
--- /dev/null
+++ b/cpp/ql/src/Metrics/Classes/CPercentageOfComplexCode.ql
@@ -0,0 +1,26 @@
+/**
+ * @name Percentage of complex code per class
+ * @description The percentage of the code in a class that is part of
+ * a complex member function.
+ * @kind treemap
+ * @id cpp/percentage-of-complex-code-per-class
+ * @treemap.warnOn highValues
+ * @metricType reftype
+ * @metricAggregate avg max
+ * @tags complexity
+ */
+import cpp
+
+from Class c, int ccLoc, int loc
+where c.fromSource()
+ and ccLoc = sum(Function f |
+ c.getACanonicalMemberFunction() = f and
+ f.getMetrics().getCyclomaticComplexity() > 18 |
+ f.getMetrics().getNumberOfLinesOfCode())
+ and loc = sum(Function f |
+ c.getACanonicalMemberFunction() = f |
+ f.getMetrics().getNumberOfLinesOfCode())
+ + c.getMetrics().getNumberOfMembers()
+ and loc != 0
+select c, (ccLoc * 100).(float) / loc as n
+order by n desc
diff --git a/cpp/ql/src/Metrics/Classes/CResponse.qhelp b/cpp/ql/src/Metrics/Classes/CResponse.qhelp
new file mode 100644
index 000000000000..26ba5d6321ec
--- /dev/null
+++ b/cpp/ql/src/Metrics/Classes/CResponse.qhelp
@@ -0,0 +1,38 @@
+
+
+
+
+This metric measures the number of different functions that can be executed
+by an object of that class in response to a message.
+
+
+
+Classes with a high response metric can be difficult to understand and test,
+because you have to read through all the functions that can possibly be called
+in order to fully understand what's going on.
+
+
+
+
+
+
+Generally speaking, when a class has a high response metric, it is because it
+contains functions that individually make large numbers of calls and/or
+because it has high efferent coupling. The solution is therefore to fix these
+underlying problems, and the class's response will decrease accordingly.
+
+
+
+
+
+
+
+
+
+S. R. Chidamber and C. F. Kemerer. A metrics suite for object-oriented design. IEEE Transactions on Software Engineering, 20(6):476-493, 1994.
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Classes/CResponse.ql b/cpp/ql/src/Metrics/Classes/CResponse.ql
new file mode 100644
index 000000000000..1d3a8b13a3b5
--- /dev/null
+++ b/cpp/ql/src/Metrics/Classes/CResponse.ql
@@ -0,0 +1,17 @@
+/**
+ * @name Response per class
+ * @description The number of different member functions or
+ * constructors that can be executed by a class.
+ * @kind treemap
+ * @id cpp/response-per-class
+ * @treemap.warnOn highValues
+ * @metricType reftype
+ * @metricAggregate avg max
+ * @tags maintainability
+ * complexity
+ */
+import cpp
+
+from Class c
+where c.fromSource()
+select c, c.getMetrics().getResponse()
diff --git a/cpp/ql/src/Metrics/Classes/CSizeOfAPI.qhelp b/cpp/ql/src/Metrics/Classes/CSizeOfAPI.qhelp
new file mode 100644
index 000000000000..0d560f920aa6
--- /dev/null
+++ b/cpp/ql/src/Metrics/Classes/CSizeOfAPI.qhelp
@@ -0,0 +1,97 @@
+
+
+
+
+This metric measures the number of public functions for each public class.
+
+
+
+A class with too many public functions is generally trying to do too much,
+either at the interface or implementation level or both.
+It can be difficult for readers to understand because there is a
+confusing list of operations. Such classes often lack cohesion and are prime candidates for refactoring.
+
+
+
+
+
+
+Classes have wide interfaces for a variety of different reasons, and the
+appropriate fix is different in each case:
+
+
+
+
+-
+The class may be too large in general, and taking on more responsibilities
+than it should (see [Martin] for more on responsibilities). In this case,
+the solution is to identify each of the different responsibilities the class
+is taking on, and split it into multiple classes, e.g. using the 'Extract
+Class' refactoring from [Fowler].
+
+
+-
+There may be lots of duplication within the class itself, that is, the actions of
+some of the public functions may overlap. In this case, the solution
+is to redesign the interface so that each new public function has a single,
+unique responsibility.
+
+
+-
+The class may be quite small at the implementation level, but trying to
+provide its user with a wide range of 'utility' functions that don't actually
+need to be part of the class. (A classic example of this is the
+
std::string class in the C++ Standard Library.) As [Sutter]
+observes, there are at least two key problems with this approach:
+
+
+-
+It may be possible to generalize some of the utility functions beyond the
+narrow context of the class in question -- by bundling them with the class,
+the class author reduces the scope for functionality reuse.
+
+
+-
+It's usually impossible for the class author to know every possible
+operation that the user might want to perform on the class, so the public
+interface will inherently be incomplete. New utility functions will end up
+having a different syntax to the privileged public functions in the class,
+negatively impacting on code consistency.
+
+
+
+To refactor a class like this, simply move its utility functions elsewhere,
+paring its public interface down to the bare minimum.
+
+
+-
+The class may be a base class in a badly-designed inheritance hierarchy.
+Such classes have many public functions to support features that
+are only used by one or two of their descendants. In this situation, the
+solution is to redesign the hierarchy, possibly by refactoring it into a
+component-based architecture.
+
+
+
+
+
+
+
+
+
+
+
+M. Fowler. Refactoring pp. 65, 122-5. Addison-Wesley, 1999.
+
+
+R. Martin. The Single Responsibility Principle. Published online.
+
+
+H. Sutter. GotW #84: Monoliths "Unstrung". Published online, 2002.
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Classes/CSizeOfAPI.ql b/cpp/ql/src/Metrics/Classes/CSizeOfAPI.ql
new file mode 100644
index 000000000000..353896af952d
--- /dev/null
+++ b/cpp/ql/src/Metrics/Classes/CSizeOfAPI.ql
@@ -0,0 +1,17 @@
+/**
+ * @name Size of API per class
+ * @description The number of public member functions in a public class.
+ * @kind treemap
+ * @id cpp/size-of-api-per-class
+ * @treemap.warnOn highValues
+ * @metricType reftype
+ * @metricAggregate avg sum max
+ * @tags modularity
+ */
+import cpp
+
+from Class c, int n
+where c.fromSource()
+ and n = count(Function f | c.getAPublicCanonicalMember() = f)
+select c, n
+order by n desc
diff --git a/cpp/ql/src/Metrics/Classes/CSpecialisation.qhelp b/cpp/ql/src/Metrics/Classes/CSpecialisation.qhelp
new file mode 100644
index 000000000000..f8744580f7a9
--- /dev/null
+++ b/cpp/ql/src/Metrics/Classes/CSpecialisation.qhelp
@@ -0,0 +1,48 @@
+
+
+
+
+This metric measures the extent to which a subclass overrides (replaces) the
+behavior of its ancestor classes. It is computed as follows: we determine
+the number of overridden functions in the subclass (not counting overrides of
+abstract functions), multiply by its depth in the inheritance hierarchy and then
+divide by its total number of functions.
+
+
+
+If a class overrides many of the functions of its ancestor classes, it is an
+indication that the ancestor classes may not model sensible abstractions.
+This is particularly true for subclasses that are lower down in the
+inheritance hierarchy. In general, subclasses should add behavior to their
+superclasses, rather than redefining the behavior that is already there.
+
+
+
+
+
+
+The main reason that classes have a high specialization index is that
+multiple subclasses specialize a common base class in exactly the same
+way. In this case, the relevant function(s) should be pulled up into the base
+class (see the 'Pull Up Method' refactoring in [Fowler]).
+
+
+
+
+
+
+
+M. Fowler. Refactoring pp. 260-3. Addison-Wesley, 1999.
+
+
+M. Lorenz and J. Kidd. Object-oriented Software Metrics. Prentice Hall, 1994.
+
+
+O. de Moor et al. Keynote Address: .QL for Source Code Analysis. Proceedings of the 7th IEEE International Working Conference on Source Code Analysis and Manipulation, 2007.
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Classes/CSpecialisation.ql b/cpp/ql/src/Metrics/Classes/CSpecialisation.ql
new file mode 100644
index 000000000000..5abaf44cd584
--- /dev/null
+++ b/cpp/ql/src/Metrics/Classes/CSpecialisation.ql
@@ -0,0 +1,16 @@
+/**
+ * @name Specialization per class
+ * @description The extent to which a subclass refines the behavior
+ * of its superclasses.
+ * @kind treemap
+ * @id cpp/specialisation-per-class
+ * @treemap.warnOn highValues
+ * @metricType reftype
+ * @metricAggregate avg max
+ * @tags modularity
+ */
+import cpp
+
+from Class c
+where c.fromSource()
+select c, c.getMetrics().getSpecialisationIndex()
diff --git a/cpp/ql/src/Metrics/Dependencies/ExternalDependencies.ql b/cpp/ql/src/Metrics/Dependencies/ExternalDependencies.ql
new file mode 100644
index 000000000000..b41cda73b927
--- /dev/null
+++ b/cpp/ql/src/Metrics/Dependencies/ExternalDependencies.ql
@@ -0,0 +1,18 @@
+/**
+ * @name External dependencies
+ * @description Count the number of dependencies a C/C++ source file has on external libraries.
+ * @kind treemap
+ * @treemap.warnOn highValues
+ * @metricType externalDependency
+ * @precision medium
+ * @id cpp/external-dependencies
+ */
+
+import ExternalDependencies
+
+from File file, int num, string encodedDependency
+where
+ encodedDependencies(file, encodedDependency, num)
+select
+ encodedDependency, num
+order by num desc
diff --git a/cpp/ql/src/Metrics/Dependencies/ExternalDependencies.qll b/cpp/ql/src/Metrics/Dependencies/ExternalDependencies.qll
new file mode 100644
index 000000000000..4d7d05fc9b2b
--- /dev/null
+++ b/cpp/ql/src/Metrics/Dependencies/ExternalDependencies.qll
@@ -0,0 +1,110 @@
+/**
+ * Support for ExternalDependencies.ql query.
+ *
+ * This performs a "technology inventory" by associating each source file
+ * with the libraries it uses.
+ */
+import cpp
+import semmle.code.cpp.commons.Dependency
+
+/**
+ * An `Element` that is to be considered a Library.
+ */
+abstract class LibraryElement extends Element {
+ abstract string getName();
+ abstract string getVersion();
+ abstract File getAFile();
+}
+
+/**
+ * Anything that is to be considered a library.
+ */
+private newtype LibraryT =
+ LibraryTElement(LibraryElement lib, string name, string version) {
+ lib.getName() = name and
+ lib.getVersion() = version
+ } or
+ LibraryTExternalPackage(@external_package ep, string name, string version) {
+ exists(string namespace, string package_name |
+ external_packages(ep, namespace, package_name, version) and
+ name = package_name
+ )
+ }
+
+/**
+ * A library that can have dependencies on it.
+ */
+class Library extends LibraryT {
+ string name;
+ string version;
+
+ Library() {
+ exists(LibraryElement lib |
+ this = LibraryTElement(lib, name, version)
+ ) or exists(@external_package ep |
+ this = LibraryTExternalPackage(ep, name, version)
+ )
+ }
+
+ string getName() {
+ result = name
+ }
+
+ string getVersion() {
+ // The versions reported for C/C++ dependencies are just the versions that
+ // happen to be installed on the system where the build takes place.
+ // Reporting those versions is likely to cause misunderstandings, both for
+ // people reading them and for the vulnerability checker of lgtm.
+ result = "unknown"
+ }
+
+ string toString() { result = getName() + "-" + getVersion() }
+
+ File getAFile() {
+ exists(LibraryElement lib |
+ this = LibraryTElement(lib, _, _) and
+ result = lib.getAFile()
+ ) or exists(@external_package ep |
+ this = LibraryTExternalPackage(ep, _, _) and
+ header_to_external_package(result, ep)
+ )
+ }
+}
+
+/**
+ * Holds if there are `num` dependencies from `sourceFile` on `destLib` (and
+ * `sourceFile` is not in `destLib`).
+ */
+predicate libDependencies(File sourceFile, Library destLib, int num) {
+ num = strictcount(Element source, Element dest, File destFile |
+ // dependency from source -> dest.
+ dependsOnSimple(source, dest) and
+ sourceFile = source.getFile() and
+ destFile = dest.getFile() and
+
+ // destFile is inside destLib, sourceFile is outside.
+ destFile = destLib.getAFile() and
+ not sourceFile = destLib.getAFile() and
+
+ // don't include dependencies from template instantiations that
+ // may depend back on types in the using code.
+ not source.isFromTemplateInstantiation(_) and
+
+ // exclude very common dependencies
+ not destLib.getName() = "linux" and
+ not destLib.getName().regexpMatch("gcc-[0-9]+") and
+ not destLib.getName() = "glibc"
+ )
+}
+
+/**
+ * Generate the table of dependencies for the query (with some
+ * packages that basically all projects depend on excluded).
+ */
+predicate encodedDependencies(File source, string encodedDependency, int num)
+{
+ exists(Library destLib |
+ libDependencies(source, destLib, num) and
+ encodedDependency = "/" + source.getRelativePath() + "<|>" + destLib.getName() + "<|>" + destLib.getVersion()
+ )
+}
diff --git a/cpp/ql/src/Metrics/Dependencies/ExternalDependenciesSourceLinks.ql b/cpp/ql/src/Metrics/Dependencies/ExternalDependenciesSourceLinks.ql
new file mode 100644
index 000000000000..a399d867222e
--- /dev/null
+++ b/cpp/ql/src/Metrics/Dependencies/ExternalDependenciesSourceLinks.ql
@@ -0,0 +1,22 @@
+/**
+ * @name External dependency source links
+ * @kind source-link
+ * @metricType externalDependency
+ * @id cpp/dependency-source-links
+ */
+
+import ExternalDependencies
+
+/*
+ * This query creates the source links for the ExternalDependencies.ql query.
+ * Although the entities in question are of the form '/file/path<|>dependency<|>version',
+ * the /file/path is a bare string relative to the root of the source archive, and not
+ * tied to a particular revision. We need the File entity (the second column here) to
+ * recover that information once we are in the dashboard database, using the
+ * ExternalEntity.getASourceLink() method.
+ */
+from File file, int num, string encodedDependency
+where
+ encodedDependencies(file, encodedDependency, num)
+select
+ encodedDependency, file
diff --git a/cpp/ql/src/Metrics/External/FileCompilationDisplayStrings.ql b/cpp/ql/src/Metrics/External/FileCompilationDisplayStrings.ql
new file mode 100644
index 000000000000..deed26111965
--- /dev/null
+++ b/cpp/ql/src/Metrics/External/FileCompilationDisplayStrings.ql
@@ -0,0 +1,11 @@
+/**
+ * @name Display strings for file compilations
+ * @kind display-string
+ * @id cpp/file-compilation-display-strings
+ * @metricType fileCompilation
+ */
+import cpp
+
+from Compilation c, int i
+select c.toString() + ":" + i.toString(), c.toString() + ":" + i.toString() + ":" + c.getFileCompiled(i)
+
diff --git a/cpp/ql/src/Metrics/External/FileCompilationSourceLinks.ql b/cpp/ql/src/Metrics/External/FileCompilationSourceLinks.ql
new file mode 100644
index 000000000000..e3e88296166e
--- /dev/null
+++ b/cpp/ql/src/Metrics/External/FileCompilationSourceLinks.ql
@@ -0,0 +1,11 @@
+/**
+ * @name Source links for file compilations
+ * @kind source-link
+ * @id cpp/file-compilation-source-links
+ * @metricType fileCompilation
+ */
+import cpp
+
+from Compilation c, int i
+select c.toString() + ":" + i.toString(), c.getFileCompiled(i)
+
diff --git a/cpp/ql/src/Metrics/Files/AutogeneratedLOC.ql b/cpp/ql/src/Metrics/Files/AutogeneratedLOC.ql
new file mode 100644
index 000000000000..b8965e931926
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/AutogeneratedLOC.ql
@@ -0,0 +1,20 @@
+/**
+ * @name Autogenerated lines of code
+ * @kind treemap
+ * @id cpp/autogenerated-loc
+ * @description Measures the number of lines in autogenerated files that
+ * contain code (rather than lines that only contain
+ * comments or are blank).
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate sum
+ */
+
+import cpp
+import semmle.code.cpp.AutogeneratedFile
+
+from AutogeneratedFile af
+where af.fromSource()
+select af, af.getMetrics().getNumberOfLinesOfCode() as n
+order by n desc
+
diff --git a/cpp/ql/src/Metrics/Files/ConditionalSegmentConditions.ql b/cpp/ql/src/Metrics/Files/ConditionalSegmentConditions.ql
new file mode 100644
index 000000000000..6f1cb2402b62
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/ConditionalSegmentConditions.ql
@@ -0,0 +1,33 @@
+/**
+ * @name Number of distinct conditions used in #if, #ifdef, #ifndef etc. per file
+ * @description For each file, the number of unique conditions used by
+ * `#if`, `#ifdef`, and `#ifndef`.
+ * @kind treemap
+ * @id cpp/conditional-segment-conditions
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg max
+ */
+import cpp
+
+predicate preprocessorOpenCondition(PreprocessorDirective d) {
+ d instanceof PreprocessorIf or
+ d instanceof PreprocessorIfdef or
+ d instanceof PreprocessorIfndef
+}
+
+predicate headerGuard(PreprocessorIfndef notdef) {
+ notdef.getHead().regexpMatch(".*_H_.*")
+ or
+ notdef.getHead().regexpMatch(".*_H")
+}
+
+from File f
+where f.fromSource()
+select f, count(string s |
+ exists(PreprocessorDirective open |
+ preprocessorOpenCondition(open)
+ and not headerGuard(open)
+ and open.getFile() = f
+ and s = open.getHead()))
+
diff --git a/cpp/ql/src/Metrics/Files/ConditionalSegmentLines.ql b/cpp/ql/src/Metrics/Files/ConditionalSegmentLines.ql
new file mode 100644
index 000000000000..b7dcab8758ce
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/ConditionalSegmentLines.ql
@@ -0,0 +1,122 @@
+/**
+ * @name Number of conditionally compiled lines
+ * @description The number of lines that are subject to conditional
+ * compilation constraints defined using `#if`, `#ifdef`,
+ * and `#ifndef`.
+ * @kind treemap
+ * @id cpp/conditional-segment-lines
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg sum max
+ */
+import cpp
+import semmle.code.cpp.headers.MultipleInclusion
+
+predicate preprocessorOpenCondition(PreprocessorDirective d, File f, int line) {
+ (d instanceof PreprocessorIf or
+ d instanceof PreprocessorIfdef or
+ d instanceof PreprocessorIfndef)
+ and
+ exists(Location l |
+ l = d.getLocation() |
+ f = l.getFile() and line = l.getStartLine())
+}
+
+predicate preprocessorCloseCondition(PreprocessorDirective d, File f, int line) {
+ d instanceof PreprocessorEndif
+ and
+ exists(Location l |
+ l = d.getLocation() |
+ f = l.getFile() and line = l.getStartLine())
+}
+
+private
+predicate relevantLine(File f, int line) {
+ preprocessorOpenCondition(_, f, line) or
+ preprocessorCloseCondition(_, f, line)
+}
+
+predicate relevantDirective(PreprocessorDirective d, File f, int line) {
+ preprocessorOpenCondition(d, f, line) or
+ preprocessorCloseCondition(d, f, line)
+}
+
+private
+predicate relevantLineWithRank(File f, int rnk, int line) {
+ line = rank[rnk](int l | relevantLine(f, l) | l)
+}
+
+private
+PreprocessorDirective next(PreprocessorDirective ppd) {
+ exists(File f, int line, int rnk, int nextLine |
+ relevantDirective(ppd, f, line) and
+ relevantLineWithRank(f, rnk, line) and
+ relevantLineWithRank(f, rnk + 1, nextLine) and
+ relevantDirective(result, f, nextLine)
+ )
+}
+
+private
+int level(PreprocessorDirective ppd) {
+ (relevantDirective(ppd, _, _)
+ and not exists(PreprocessorDirective previous | ppd = next(previous))
+ and result = 0)
+ or
+ exists(PreprocessorDirective previous |
+ ppd = next(previous) and
+ preprocessorOpenCondition(previous, _, _) and
+ result = level(previous) + 1)
+ or
+ exists(PreprocessorDirective previous |
+ ppd = next(previous) and
+ preprocessorCloseCondition(previous, _, _) and
+ result = level(previous) - 1)
+}
+
+private
+predicate openWithDepth(int depth, File f, PreprocessorDirective open, int line) {
+ preprocessorOpenCondition(open, f, line) and
+ depth = level(open) and
+ depth < 2 // beyond 2, we don't care about the macros anymore
+}
+private
+predicate closeWithDepth(int depth, File f, PreprocessorDirective close, int line) {
+ preprocessorCloseCondition(close, f, line) and
+ depth = level(close) - 1 and
+ depth < 2 // beyond 2, we don't care about the macros anymore
+}
+
+predicate length(PreprocessorDirective open, int length) {
+ exists(int depth, File f, int start, int end |
+ openWithDepth(depth, f, open, start) and
+ end = min(PreprocessorDirective endif, int closeLine |
+ closeWithDepth(depth, f, endif, closeLine) and
+ closeLine > start|
+ closeLine) and
+ length = end - start - 1
+ )
+}
+
+predicate headerGuard(PreprocessorDirective notdef, File f) {
+ exists(CorrectIncludeGuard g |
+ notdef = g.getIfndef() and f = notdef.getFile())
+}
+
+predicate headerGuardChild(PreprocessorDirective open) {
+ exists(File f, PreprocessorDirective headerGuard |
+ headerGuard(headerGuard, f) and
+ openWithDepth(1, f, open, _))
+}
+
+predicate topLevelOpen(PreprocessorDirective open) {
+ (openWithDepth(0, _, open, _) and not headerGuard(open,_))
+ or
+ headerGuardChild(open)
+}
+
+from File f
+where f.fromSource()
+select f, sum(PreprocessorDirective open, int length |
+ open.getFile() = f and
+ topLevelOpen(open) and length(open, length) |
+ length)
diff --git a/cpp/ql/src/Metrics/Files/FAfferentCoupling.qhelp b/cpp/ql/src/Metrics/Files/FAfferentCoupling.qhelp
new file mode 100644
index 000000000000..cbffbcbfb546
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FAfferentCoupling.qhelp
@@ -0,0 +1,55 @@
+
+
+
+This metric measures, for each file, how many other files depend on it.
+
+A file depends on another file if:
+
+- It calls a function in that file
+- It reads or writes a variable declared in that file
+- It uses a type declared in that file
+
+
+Many incoming dependencies can be good or bad, depending on the nature of the file.
+
+A large number of incoming dependencies is good for:
+
+- files containing logging functions
+- files containing system-wide utility functions
+
+
+A large number of incoming dependencies may be a problem for:
+
+- files that should be internal to a particular component
+- files containing functions or classes with unstable interfaces
+
+
+A file with many dependencies on it is risky to change, since large parts of a system
+may be affected. Such files should be well documented and have clean APIs.
+
+
+
+
+Group widely used utility functions together. Replace calls to a component's internals
+with uses of its public API (augmenting it if necessary).
+
+Ensure that the public API is well-documented.
+
+
+
+
+
+ M. Fowler. Refactoring. Addison-Wesley, 1999.
+
+
+ Wikipedia: Code refactoring
+
+
+ Refactoring as Meta Programming?
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Files/FAfferentCoupling.ql b/cpp/ql/src/Metrics/Files/FAfferentCoupling.ql
new file mode 100644
index 000000000000..0aab056038e0
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FAfferentCoupling.ql
@@ -0,0 +1,17 @@
+/**
+ * @name Incoming dependencies per file
+ * @description The number of files that depend on a file.
+ * @kind treemap
+ * @id cpp/afferent-coupling-per-file
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg max
+ * @tags maintainability
+ * modularity
+ */
+import cpp
+
+from File f
+where f.fromSource()
+select f, f.getMetrics().getAfferentCoupling() as n
+order by n desc
diff --git a/cpp/ql/src/Metrics/Files/FCommentRatio.qhelp b/cpp/ql/src/Metrics/Files/FCommentRatio.qhelp
new file mode 100644
index 000000000000..4a5c928f5cd4
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FCommentRatio.qhelp
@@ -0,0 +1,29 @@
+
+
+
+This metric measures the percentage of lines in a file that contain a comment or are part of a multi-line comment.
+
+Having a low percentage of comments is an indication that a file does not have sufficient
+documentation. Undocumented code is hard to understand, modify, and reuse.
+
+
+
+
+Add documentation to files with a low percentage of comments. It is most useful to start
+documenting the public functions first.
+
+
+
+
+
+ C++ Programming, Coding style conventions
+
+
+ Wikipedia: Need for comments
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Files/FCommentRatio.ql b/cpp/ql/src/Metrics/Files/FCommentRatio.ql
new file mode 100644
index 000000000000..245404ca1a95
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FCommentRatio.ql
@@ -0,0 +1,17 @@
+/**
+ * @name Percentage of comments
+ * @description The percentage of lines that contain comments.
+ * @kind treemap
+ * @id cpp/comment-ratio-per-file
+ * @treemap.warnOn lowValues
+ * @metricType file
+ * @metricAggregate avg max
+ * @tags maintainability
+ * documentation
+ */
+import cpp
+
+from File f, int comments, int total
+where f.fromSource() and numlines(f, total, _, comments) and total > 0
+select f, 100.0 * (comments.(float) / total.(float)) as ratio
+order by ratio desc
diff --git a/cpp/ql/src/Metrics/Files/FCyclomaticComplexity.cpp b/cpp/ql/src/Metrics/Files/FCyclomaticComplexity.cpp
new file mode 100644
index 000000000000..5a09f4d78c60
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FCyclomaticComplexity.cpp
@@ -0,0 +1,21 @@
+int f(int i, int j) {
+ // start
+ int result;
+ if(i % 2 == 0) {
+ // iEven
+ result = i + j;
+ }
+ else {
+ // iOdd
+ if(j % 2 == 0) {
+ // jEven
+ result = i * j;
+ }
+ else {
+ // jOdd
+ result = i - j;
+ }
+ }
+ return result;
+ // end
+}
\ No newline at end of file
diff --git a/cpp/ql/src/Metrics/Files/FCyclomaticComplexity.qhelp b/cpp/ql/src/Metrics/Files/FCyclomaticComplexity.qhelp
new file mode 100644
index 000000000000..be463857db9a
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FCyclomaticComplexity.qhelp
@@ -0,0 +1,77 @@
+
+
+
+
+
+This metric measures the average cyclomatic complexity of the functions in a file.
+
+
+
+The cyclomatic complexity of a function is the number of linearly independent execution paths
+through that function. A path is linearly independent path if it differs from all other paths
+by at least one node. Straight-line code therefore has a cyclomatic complexity of one, while
+branches, switches and loops increase cyclomatic complexity.
+
+
+
+Functions with a high cyclomatic complexity are typically hard to understand and test. By extension,
+files whose functions have a high average cyclomatic complexity are problematic, and usually would
+benefit from refactoring.
+
+
+
+As a concrete example, consider the following function:
+
+
+
+
+
+The control flow graph for this function is as follows:
+
+
+
+
+
+The graph shows that the number of linearly independent execution
+paths through the function, and hence its cyclomatic complexity, is
+3. The three paths are:
+
+
+
+start -> iEven -> endstart -> iOdd -> jEven -> endstart -> iOdd -> jOdd -> end
+
+
+
+
+
+Functions with a high cyclomatic complexity should be simplified, for instance by
+tidying up any complex logic within them or by splitting them into multiple methods
+using the Extract Method refactoring.
+
+
+
+
+
+
+M. Fowler, Refactoring. Addison-Wesley, 1999.
+
+
+T. J. McCabe, A Complexity Measure. IEEE Transactions on Software Engineering, SE-2(4), December 1976.
+
+
+Dave Thomas, Refactoring as Meta Programming?, in Journal of Object Technology, vol. 4, no. 1, January-February 2005, pp. 7-11.
+
+
+Wikipedia: Cyclomatic complexity
+
+
+Wikipedia: Code refactoring
+
+
+
+
\ No newline at end of file
diff --git a/cpp/ql/src/Metrics/Files/FCyclomaticComplexity.ql b/cpp/ql/src/Metrics/Files/FCyclomaticComplexity.ql
new file mode 100644
index 000000000000..f07d0b6eba30
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FCyclomaticComplexity.ql
@@ -0,0 +1,29 @@
+/**
+ * @name Average cyclomatic complexity of files
+ * @description The average cyclomatic complexity of the functions in a file.
+ * @kind treemap
+ * @id cpp/average-cyclomatic-complexity-per-file
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg max
+ * @tags testability
+ * complexity
+ */
+import cpp
+
+from File f, float complexity, float loc
+where f.fromSource()
+ and loc = sum(FunctionDeclarationEntry fde |
+ fde.getFile() = f |
+ fde.getNumberOfLines()).(float)
+ and if loc > 0 then
+ // Weighted average of complexity by function length
+ complexity =
+ sum(FunctionDeclarationEntry fde |
+ fde.getFile() = f |
+ fde.getNumberOfLines() * fde.getCyclomaticComplexity()).(float)
+ /
+ loc
+ else
+ complexity = 0
+select f, complexity
diff --git a/cpp/ql/src/Metrics/Files/FCyclomaticComplexity_ControlFlow.gv b/cpp/ql/src/Metrics/Files/FCyclomaticComplexity_ControlFlow.gv
new file mode 100644
index 000000000000..dfccd0640803
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FCyclomaticComplexity_ControlFlow.gv
@@ -0,0 +1,11 @@
+digraph
+{
+ start -> iEven;
+ start -> iOdd;
+ iEven -> end;
+ iOdd -> jEven;
+ iOdd -> jOdd;
+ jEven -> end;
+ jOdd -> end;
+}
+
diff --git a/cpp/ql/src/Metrics/Files/FCyclomaticComplexity_ControlFlow.png b/cpp/ql/src/Metrics/Files/FCyclomaticComplexity_ControlFlow.png
new file mode 100644
index 000000000000..f5c409f8bff9
Binary files /dev/null and b/cpp/ql/src/Metrics/Files/FCyclomaticComplexity_ControlFlow.png differ
diff --git a/cpp/ql/src/Metrics/Files/FDirectIncludes.qhelp b/cpp/ql/src/Metrics/Files/FDirectIncludes.qhelp
new file mode 100644
index 000000000000..2bab2e5130c0
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FDirectIncludes.qhelp
@@ -0,0 +1,35 @@
+
+
+
+This metric measures the number of files that are directly included using #include.
+
+Files with lots of #include directives often either have too many
+responsibilities or not all of the directives are needed. In the former case, the
+file may be hard to comprehend and maintain; the latter causes build-times to be
+unnecessarily long.
+
+
+
+
+
+Split and/or refactor files with too many responsibilities, and remove any unnecessary
+#include directives.
+
+
+
+
+
+ M. Fowler. Refactoring. Addison-Wesley, 1999.
+
+
+ Wikipedia: Code refactoring
+
+
+ Refactoring as Meta Programming?
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Files/FDirectIncludes.ql b/cpp/ql/src/Metrics/Files/FDirectIncludes.ql
new file mode 100644
index 000000000000..e06969091df4
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FDirectIncludes.ql
@@ -0,0 +1,16 @@
+/**
+ * @name Includes per file
+ * @description The number of files directly included by this file using
+ * `#include`.
+ * @kind treemap
+ * @id cpp/direct-includes-per-file
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg max
+ */
+import cpp
+
+from File f, int n
+where f.fromSource()
+ and n = count(Include i | i.getFile() = f)
+select f, n
diff --git a/cpp/ql/src/Metrics/Files/FEfferentCoupling.qhelp b/cpp/ql/src/Metrics/Files/FEfferentCoupling.qhelp
new file mode 100644
index 000000000000..013defa9f8bf
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FEfferentCoupling.qhelp
@@ -0,0 +1,39 @@
+
+
+
+This metric measures the number of files that a particular file depends on. A file depends on another file if:
+
+- It calls a function in that file
+- It reads or writes a variable declared in that file
+- It uses a type declared in that file
+
+
+The number of other files that a source-file depends on is a way of judging
+how cohesive it is. A source-file with a single well-defined purpose is likely
+to have fewer dependencies than a source-file where functions have been "thrown in"
+over time. The former is desirable, because files with a single well-defined
+purpose are more easily comprehended and maintained.
+
+
+
+
+Consider, breaking the file up into smaller ones. This could either be done by splitting up unrelated functionality, or extracting common operations into a library.
+
+
+
+
+
+ M. Fowler. Refactoring. Addison-Wesley, 1999.
+
+
+ Wikipedia: Code refactoring
+
+
+ Refactoring as Meta Programming?
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Files/FEfferentCoupling.ql b/cpp/ql/src/Metrics/Files/FEfferentCoupling.ql
new file mode 100644
index 000000000000..3e2116ac8776
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FEfferentCoupling.ql
@@ -0,0 +1,18 @@
+/**
+ * @name Outgoing dependencies per file
+ * @description The number of files that a file depends on.
+ * @kind treemap
+ * @id cpp/efferent-coupling-per-file
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg max
+ * @tags testability
+ * modularity
+ * maintainability
+ */
+import cpp
+
+from File f
+where f.fromSource()
+select f, f.getMetrics().getEfferentCoupling() as n
+order by n desc
diff --git a/cpp/ql/src/Metrics/Files/FHalsteadBugs.ql b/cpp/ql/src/Metrics/Files/FHalsteadBugs.ql
new file mode 100644
index 000000000000..7b6f1d54db83
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FHalsteadBugs.ql
@@ -0,0 +1,15 @@
+/**
+ * @name Halstead bug measure
+ * @description Measures the expected number of delivered bugs. The
+ * Halstead bug count is known to be an underestimate.
+ * @kind treemap
+ * @id cpp/halstead-bugs-per-file
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg sum max
+ */
+import cpp
+
+from MetricFile mc
+where mc.fromSource()
+select mc, mc.getHalsteadDeliveredBugs()
diff --git a/cpp/ql/src/Metrics/Files/FHalsteadDifficulty.ql b/cpp/ql/src/Metrics/Files/FHalsteadDifficulty.ql
new file mode 100644
index 000000000000..f0d6684940c5
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FHalsteadDifficulty.ql
@@ -0,0 +1,14 @@
+/**
+ * @name Halstead difficulty
+ * @description Measures the error proneness of implementing the program.
+ * @kind treemap
+ * @id cpp/halstead-difficulty-per-file
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg sum max
+ */
+import cpp
+
+from MetricFile mc
+where mc.fromSource()
+select mc, mc.getHalsteadDifficulty()
diff --git a/cpp/ql/src/Metrics/Files/FHalsteadEffort.ql b/cpp/ql/src/Metrics/Files/FHalsteadEffort.ql
new file mode 100644
index 000000000000..52a090cd03c5
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FHalsteadEffort.ql
@@ -0,0 +1,14 @@
+/**
+ * @name Halstead effort
+ * @description Measures the effort to implement the program.
+ * @kind treemap
+ * @id cpp/halstead-effort-per-file
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg sum max
+ */
+import cpp
+
+from MetricFile mc
+where mc.fromSource()
+select mc, mc.getHalsteadEffort()
diff --git a/cpp/ql/src/Metrics/Files/FHalsteadLength.ql b/cpp/ql/src/Metrics/Files/FHalsteadLength.ql
new file mode 100644
index 000000000000..f90bbbec6a0c
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FHalsteadLength.ql
@@ -0,0 +1,14 @@
+/**
+ * @name Halstead length
+ * @description Total number of operands and operators
+ * @kind treemap
+ * @id cpp/halstead-length-per-file
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg sum max
+ */
+import cpp
+
+from MetricFile mc
+where mc.fromSource()
+select mc, mc.getHalsteadLength()
diff --git a/cpp/ql/src/Metrics/Files/FHalsteadVocabulary.ql b/cpp/ql/src/Metrics/Files/FHalsteadVocabulary.ql
new file mode 100644
index 000000000000..c933aee0cd8e
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FHalsteadVocabulary.ql
@@ -0,0 +1,14 @@
+/**
+ * @name Halstead vocabulary
+ * @description Number of distinct operands and operators used.
+ * @kind treemap
+ * @id cpp/halstead-vocabulary-per-file
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg sum max
+ */
+import cpp
+
+from MetricFile mc
+where mc.fromSource()
+select mc, mc.getHalsteadVocabulary()
diff --git a/cpp/ql/src/Metrics/Files/FHalsteadVolume.ql b/cpp/ql/src/Metrics/Files/FHalsteadVolume.ql
new file mode 100644
index 000000000000..78528d43dbc2
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FHalsteadVolume.ql
@@ -0,0 +1,14 @@
+/**
+ * @name Halstead volume
+ * @description The information contents of the program.
+ * @kind treemap
+ * @id cpp/halstead-volume-per-file
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg sum max
+ */
+import cpp
+
+from MetricFile mc
+where mc.fromSource()
+select mc, mc.getHalsteadVolume()
diff --git a/cpp/ql/src/Metrics/Files/FLines.ql b/cpp/ql/src/Metrics/Files/FLines.ql
new file mode 100644
index 000000000000..c582a8cf1e0a
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FLines.ql
@@ -0,0 +1,15 @@
+/**
+ * @name Number of lines
+ * @description The number of lines in each file.
+ * @kind treemap
+ * @id cpp/lines-per-file
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg sum max
+ */
+import cpp
+
+from File f
+where f.fromSource()
+select f, f.getMetrics().getNumberOfLines() as n
+order by n desc
diff --git a/cpp/ql/src/Metrics/Files/FLinesOfCode.qhelp b/cpp/ql/src/Metrics/Files/FLinesOfCode.qhelp
new file mode 100644
index 000000000000..4eb6c1c5b009
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FLinesOfCode.qhelp
@@ -0,0 +1,30 @@
+
+
+
+This metric measures the number of lines of code in a file. This excludes comments and blank lines.
+
+Having too many lines of code in a file is an indication that it can be split into several files of more manageable size. Generated code is a notable exception to this.
+
+
+
+
+Long files should be examined to see if they can be split into smaller, more cohesive files.
+
+
+
+
+
+ M. Fowler. Refactoring. Addison-Wesley, 1999.
+
+
+ Wikipedia: Code refactoring
+
+
+ Refactoring as Meta Programming?
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Files/FLinesOfCode.ql b/cpp/ql/src/Metrics/Files/FLinesOfCode.ql
new file mode 100644
index 000000000000..33d1bfd6b2b6
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FLinesOfCode.ql
@@ -0,0 +1,20 @@
+/**
+ * @name Lines of code in files
+ * @kind treemap
+ * @description Measures the number of lines in a file that contain
+ * code (rather than lines that only contain comments
+ * or are blank)
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg sum max
+ * @precision very-high
+ * @id cpp/lines-of-code-in-files
+ * @tags maintainability
+ * complexity
+ */
+import cpp
+
+from File f
+where f.fromSource()
+select f, f.getMetrics().getNumberOfLinesOfCode() as n
+order by n desc
diff --git a/cpp/ql/src/Metrics/Files/FLinesOfCommentedOutCode.qhelp b/cpp/ql/src/Metrics/Files/FLinesOfCommentedOutCode.qhelp
new file mode 100644
index 000000000000..d435289b652c
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FLinesOfCommentedOutCode.qhelp
@@ -0,0 +1,7 @@
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Files/FLinesOfCommentedOutCode.ql b/cpp/ql/src/Metrics/Files/FLinesOfCommentedOutCode.ql
new file mode 100644
index 000000000000..6ad0e469a8e5
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FLinesOfCommentedOutCode.ql
@@ -0,0 +1,20 @@
+/**
+ * @name Lines of commented-out code in files
+ * @description The number of lines of commented-out code in a file.
+ * @kind treemap
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg sum max
+ * @precision high
+ * @id cpp/lines-of-commented-out-code-in-files
+ * @tags documentation
+ */
+
+import Documentation.CommentedOutCode
+
+from File f, int n
+where n = sum(CommentedOutCode comment |
+ comment.getFile() = f |
+ comment.numCodeLines())
+select f, n
+order by n desc
diff --git a/cpp/ql/src/Metrics/Files/FLinesOfComments.qhelp b/cpp/ql/src/Metrics/Files/FLinesOfComments.qhelp
new file mode 100644
index 000000000000..d1b1d9849181
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FLinesOfComments.qhelp
@@ -0,0 +1,29 @@
+
+
+
+This metric measures the number of lines of comments in a file.
+
+Files that have too few comments are more likely to be insufficiently documented.
+Long files that have no comments at all require particular scrutiny, as these are more likely
+to need explicit documentation in comments.
+
+
+
+Files with few to no comments should be examined to see if they require documentation. Particular attention
+should be given to long files.
+
+
+
+
+
+ C++ Programming, Coding style conventions
+
+
+ Wikipedia: Need for comments
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Files/FLinesOfComments.ql b/cpp/ql/src/Metrics/Files/FLinesOfComments.ql
new file mode 100644
index 000000000000..05f8ccf9e5b8
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FLinesOfComments.ql
@@ -0,0 +1,20 @@
+/**
+ * @name Lines of comments in files
+ * @description Measures the number of lines which contain a comment
+ * or part of a comment (that is, which are part of a
+ * multi-line comment).
+ * @kind treemap
+ * @treemap.warnOn lowValues
+ * @metricType file
+ * @metricAggregate avg sum max
+ * @precision very-high
+ * @id cpp/lines-of-comments-in-files
+ * @tags maintainability
+ * documentation
+ */
+import cpp
+
+from File f
+where f.fromSource()
+select f, f.getMetrics().getNumberOfLinesOfComments() as n
+order by n desc
diff --git a/cpp/ql/src/Metrics/Files/FLinesOfDuplicatedCode.qhelp b/cpp/ql/src/Metrics/Files/FLinesOfDuplicatedCode.qhelp
new file mode 100644
index 000000000000..30a98df0ceeb
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FLinesOfDuplicatedCode.qhelp
@@ -0,0 +1,6 @@
+
+
+
+
\ No newline at end of file
diff --git a/cpp/ql/src/Metrics/Files/FLinesOfDuplicatedCode.ql b/cpp/ql/src/Metrics/Files/FLinesOfDuplicatedCode.ql
new file mode 100644
index 000000000000..e905793c948a
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FLinesOfDuplicatedCode.ql
@@ -0,0 +1,23 @@
+/**
+ * @name Duplicated lines in files
+ * @description The number of lines in a file, including code, comment
+ * and whitespace lines, which are duplicated in at least
+ * one other place.
+ * @kind treemap
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg sum max
+ * @precision high
+ * @tags testability
+ * modularity
+ * @id cpp/duplicated-lines-in-files
+ */
+import external.CodeDuplication
+
+from File f, int n
+where n = count(int line |
+ exists(DuplicateBlock d | d.sourceFile() = f |
+ line in [d.sourceStartLine()..d.sourceEndLine()])
+ and not whitelistedLineForDuplication(f, line))
+select f, n
+order by n desc
diff --git a/cpp/ql/src/Metrics/Files/FMacroRatio.cpp b/cpp/ql/src/Metrics/Files/FMacroRatio.cpp
new file mode 100644
index 000000000000..abde7d39a20a
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FMacroRatio.cpp
@@ -0,0 +1,10 @@
+/* Example of good macros */
+#define TCP_NODELAY 1
+#define TCP_MAXSEG 2
+#define TCP_CORK 3
+
+/*
+ * In contrast, functions that use this macro are hard to read without
+ * knowing its exact definition
+ */
+#define JSKW_TEST_GUESS(index) i = (index); goto test_guess;
diff --git a/cpp/ql/src/Metrics/Files/FMacroRatio.qhelp b/cpp/ql/src/Metrics/Files/FMacroRatio.qhelp
new file mode 100644
index 000000000000..805c53e9a74a
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FMacroRatio.qhelp
@@ -0,0 +1,42 @@
+
+
+
+This metric measures the percentage of lines of code in each file that use macros.
+
+Macros are useful for defining constants in header files to avoid having magic constants scattered
+throughout a project. However, files with a high percentage of lines that use macros are likely to be
+using macros to encapsulate functionality. Such use can lead to code that is hard to read and understand,
+because standard assumptions about the control-flow of a function, and how many times expressions are
+evaluated, may no longer hold.
+
+With regards to performance, modern compilers usually perform aggressive inlining and the difference
+between a macro invocation and a function call is negligible. Functions have much better error checking
+and IDE support than macros.
+
+
+
+
+
+
+
+Try to limit the use of macros to constants. Complicated uses of macros can often be replaced by functions.
+
+
+
+
+
+ Macros
+
+
+ Rejuvenating C++ Programs through
+Demacrofication
+
+
+ Outgrowing Macrophobia
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Files/FMacroRatio.ql b/cpp/ql/src/Metrics/Files/FMacroRatio.ql
new file mode 100644
index 000000000000..81082253221d
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FMacroRatio.ql
@@ -0,0 +1,27 @@
+/**
+ * @name Usage of macros
+ * @description The percentage of source lines in each file that contain
+ * use of macros.
+ * @kind treemap
+ * @id cpp/macro-ratio-per-file
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg max
+ */
+import cpp
+
+predicate macroLines(File f, int line) {
+ exists(MacroInvocation mi |
+ mi.getFile() = f and
+ mi.getLocation().getStartLine() = line)
+}
+
+predicate macroLineCount(File f, int num) {
+ num = count(int line | macroLines(f, line))
+}
+
+from MetricFile f, int macroLines, int loc
+where f.fromSource() and loc = f.getNumberOfLinesOfCode() and loc > 0 and
+ macroLineCount(f, macroLines)
+select f, 100.0 * (macroLines.(float) / loc.(float)) as ratio
+order by ratio desc
diff --git a/cpp/ql/src/Metrics/Files/FNumberOfClasses.ql b/cpp/ql/src/Metrics/Files/FNumberOfClasses.ql
new file mode 100644
index 000000000000..ff39473ea62c
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FNumberOfClasses.ql
@@ -0,0 +1,16 @@
+/**
+ * @name Number of classes per file
+ * @kind treemap
+ * @id cpp/number-of-classes-per-file
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg sum max
+ * @tags maintainability
+ */
+import cpp
+
+from File f, int n
+where f.fromSource()
+ and n = count(Class c | c.getAFile() = f)
+select f, n
+order by n desc
diff --git a/cpp/ql/src/Metrics/Files/FNumberOfTests.qhelp b/cpp/ql/src/Metrics/Files/FNumberOfTests.qhelp
new file mode 100644
index 000000000000..d016e3c0e1fa
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FNumberOfTests.qhelp
@@ -0,0 +1,54 @@
+
+
+
+
+ This metric measures the number of tests in this file.
+
+
+
+ Tests are recognised if they are implemented with one of the major
+ unit testing frameworks. Currently the Boost and CppUnit frameworks
+ are recognised.
+
+
+
+ In general, having many test cases is a good thing rather than a bad
+ thing. However, at the file level, tests should typically be grouped
+ by the functionality they relate to, which makes a file with an
+ exceptionally high number of tests a strong candidate for splitting
+ up. At a higher level, this metric makes it possible to compare the
+ number of tests in different components, potentially flagging
+ functionality that is comparatively under-tested.
+
+
+
+
+ Since it is typically not a problem to have too many tests, this
+ metric is usually included for the purposes of collecting
+ information, rather than finding problematic areas in the code. With
+ that in mind, it is usually a good idea to avoid an excessive number
+ of tests in a single file, and to maintain a broadly comparable
+ level of testing across components.
+
+
+
+ When assessing the thoroughness of a code base's test suite, the number
+ of test methods provides only part of the story. Test coverage
+ statistics allow a more detailed examination of which parts of the
+ code deserve improvements in this area.
+
+
+
+
+
+ Boost: official website at
+ http://www.boost.org/.
+
+
+ CppUnit: official website at
+ https://freedesktop.org/wiki/Software/cppunit/.
+
+
+
diff --git a/cpp/ql/src/Metrics/Files/FNumberOfTests.ql b/cpp/ql/src/Metrics/Files/FNumberOfTests.ql
new file mode 100644
index 000000000000..f5e45897970c
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FNumberOfTests.ql
@@ -0,0 +1,28 @@
+/**
+ * @name Number of tests
+ * @description The number of test methods defined in a file.
+ * @kind treemap
+ * @treemap.warnOn lowValues
+ * @metricType file
+ * @metricAggregate avg sum max
+ * @precision medium
+ * @id cpp/tests-in-files
+ * @tags maintainability
+ */
+import cpp
+
+Expr getTest() {
+ // cppunit tests; https://freedesktop.org/wiki/Software/cppunit/
+ exists(Function f | result.(FunctionCall).getTarget() = f
+ and f.getNamespace().getName() = "CppUnit"
+ and f.getName() = "addTest")
+ or
+ // boost tests; http://www.boost.org/
+ exists(Function f | result.(FunctionCall).getTarget() = f
+ and f.getQualifiedName() = "boost::unit_test::make_test_case")
+}
+
+from File f, int n
+where n = strictcount(Expr e | e = getTest() and e.getFile() = f)
+select f, n
+order by n desc
diff --git a/cpp/ql/src/Metrics/Files/FTimeInFrontend.qhelp b/cpp/ql/src/Metrics/Files/FTimeInFrontend.qhelp
new file mode 100644
index 000000000000..8a01952f3756
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FTimeInFrontend.qhelp
@@ -0,0 +1,29 @@
+
+
+
+This metric measures the amount of time (in milliseconds) spent compiling a C/C++ file, including time spent processing all files included by the pre-processor.
+
+Files that take too long to build usually have too many includes.
+
+
+
+Files that take a long time to build should be checked to see if they are including only the necessary files in order to reduce build time.
+
+
+
+
+
+ The #include Directive
+
+
+ Include operation
+
+
+ C++ Compilation Speed
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Files/FTimeInFrontend.ql b/cpp/ql/src/Metrics/Files/FTimeInFrontend.ql
new file mode 100644
index 000000000000..720f0b278a69
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FTimeInFrontend.ql
@@ -0,0 +1,19 @@
+/**
+ * @name Compilation time
+ * @description Measures the amount of time (in milliseconds) spent
+ * compiling a C/C++ file, including time spent processing
+ * all files included by the pre-processor.
+ * @kind treemap
+ * @id cpp/time-in-frontend-per-file
+ * @metricType fileCompilation
+ * @metricAggregate avg sum max
+ */
+import cpp
+
+from string x, float t
+where exists(Compilation c, int i |
+ x = c.toString() + ":" + i.toString() and
+ t = 1000 * c.getFrontendCpuSeconds(i) and
+ c.getFileCompiled(i).fromSource())
+select x, t
+order by t desc
diff --git a/cpp/ql/src/Metrics/Files/FTodoComments.qhelp b/cpp/ql/src/Metrics/Files/FTodoComments.qhelp
new file mode 100644
index 000000000000..a0906beb799e
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FTodoComments.qhelp
@@ -0,0 +1,34 @@
+
+
+
+This metric measures the number of TODO or FIXME comments in the code.
+
+These comments tend to document points of ambiguity in the software's requirements. Often
+they refer to corner-cases that are not handled or potential defects. It is therefore very
+important to monitor such comments and, where appropriate, escalate comments to an
+defect-tracking system or other means of ensuring that action is taken.
+
+
+
+
+Remove unnecessary TODO/FIXME comments, and those that are no longer relevant. File tickets
+for the remaining comments in a defect-tracker, or otherwise ensure that someone is responsible
+for fixing them.
+
+
+
+
+
+ Wikipedia: Comment tags
+
+
+ TODO or not TODO
+
+
+ The case against TODO
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Files/FTodoComments.ql b/cpp/ql/src/Metrics/Files/FTodoComments.ql
new file mode 100644
index 000000000000..8265f6253164
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FTodoComments.ql
@@ -0,0 +1,21 @@
+/**
+ * @name Number of todo/fixme comments per file
+ * @description The number of TODO or FIXME comments in a file.
+ * @kind treemap
+ * @id cpp/todo-comments-per-file
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg sum max
+ * @tags maintainability
+ * documentation
+ */
+import cpp
+
+from File f, int n
+where f.fromSource()
+ and n = count(Comment c |
+ c.getFile() = f and
+ (c.getContents().matches("%TODO%") or
+ c.getContents().matches("%FIXME%")))
+select f, n
+order by n
diff --git a/cpp/ql/src/Metrics/Files/FTransitiveIncludes.qhelp b/cpp/ql/src/Metrics/Files/FTransitiveIncludes.qhelp
new file mode 100644
index 000000000000..4e0b989b1213
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FTransitiveIncludes.qhelp
@@ -0,0 +1,38 @@
+
+
+
+This metric measures the number of files that are directly or indirectly included using #include.
+
+The value of this metric is usually directly correlated to the file's
+build time: the more included files, the longer the compilation time.
+
+Often, files with a large number of includes do not require most of the included definitions, so they are contributing to unnecessarily long build times.
+
+
+
+
+
+- Remove redundant
#include directives
+- Use the specific header file required, if possible, rather than a high-level header that includes many other header files as well
+- Split header files that contain lots of unrelated definitions or include large unrelated header files
+
+
+
+
+
+
+ Header files
+
+
+ Decoupling C Header Files
+
+
+ C++ Best Practice -
+Designing Header Files
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Files/FTransitiveIncludes.ql b/cpp/ql/src/Metrics/Files/FTransitiveIncludes.ql
new file mode 100644
index 000000000000..7d6d88f55b31
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FTransitiveIncludes.ql
@@ -0,0 +1,18 @@
+/**
+ * @name Indirect includes per file
+ * @description The number of files included by the
+ * pre-processor - either directly by an `#include`
+ * directive, or indirectly (by being included by an
+ * included file).
+ * @kind treemap
+ * @id cpp/transitive-includes-per-file
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg max
+ */
+import cpp
+
+from File f, int n
+where f.fromSource()
+ and n = count(File g | g = f.getAnIncludedFile+())
+select f, n
diff --git a/cpp/ql/src/Metrics/Files/FTransitiveSourceIncludes.qhelp b/cpp/ql/src/Metrics/Files/FTransitiveSourceIncludes.qhelp
new file mode 100644
index 000000000000..a3091c68285d
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FTransitiveSourceIncludes.qhelp
@@ -0,0 +1,43 @@
+
+
+
+This metric measures the number of files that are directly or indirectly included using
+#include, excluding header files which are outside the main source tree (for example, system headers).
+
+
+The value of this metric is usually correlated to the file's
+build time: the more included files, the longer the compilation time.
+Since we don't count system headers, however, it is also a measure of
+the amount of the current code base that the present file relies on.
+
+Often, files with a large number of includes do not require most of the included definitions, so
+they are contributing to unnecessarily long build times and creating artificial build dependencies.
+
+
+
+
+
+- Remove redundant
#include directives
+- Use the specific header file required, if possible, rather than a high-level header that includes many other header files as well
+- Split header files that contain lots of unrelated definitions or include large unrelated header files
+
+
+
+
+
+
+
+ Header files
+
+
+ Decoupling C Header Files
+
+
+ C++ Best Practice -
+Designing Header Files
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Files/FTransitiveSourceIncludes.ql b/cpp/ql/src/Metrics/Files/FTransitiveSourceIncludes.ql
new file mode 100644
index 000000000000..a919e322a64c
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FTransitiveSourceIncludes.ql
@@ -0,0 +1,26 @@
+/**
+ * @name Indirect source includes per file
+ * @description The number of source files included by the
+ * pre-processor - either directly by an `#include`
+ * directive, or indirectly (by being included by an
+ * included file). This metric excludes included files
+ * that aren't part of the main code base (like system
+ * headers).
+ * @kind treemap
+ * @id cpp/transitive-source-includes-per-file
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg max
+ */
+import cpp
+
+predicate isInCodebase(File f) {
+ exists(string prefix |
+ sourceLocationPrefix(prefix) |
+ f.getAbsolutePath().prefix(prefix.length()) = prefix)
+}
+
+from File f, int n
+where f.fromSource()
+ and n = count(File g | g = f.getAnIncludedFile+() and isInCodebase(g))
+select f, n
diff --git a/cpp/ql/src/Metrics/Files/FunctionLength.qhelp b/cpp/ql/src/Metrics/Files/FunctionLength.qhelp
new file mode 100644
index 000000000000..b9dea7ea6c1d
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FunctionLength.qhelp
@@ -0,0 +1,29 @@
+
+
+
+This metric measures the average number of lines of code per function in a file.
+
+Having too many lines of code in a function is an indication that it can be split into several functions of more manageable size.
+
+
+
+Long functions should be examined to see if they can be split into smaller, more cohesive functions.
+
+
+
+
+
+ M. Fowler. Refactoring. Addison-Wesley, 1999.
+
+
+ Wikipedia: Code refactoring
+
+
+ Refactoring as Meta Programming?
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Files/FunctionLength.ql b/cpp/ql/src/Metrics/Files/FunctionLength.ql
new file mode 100644
index 000000000000..bd875102550f
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/FunctionLength.ql
@@ -0,0 +1,17 @@
+/**
+ * @name Function length
+ * @description The average number of lines in functions in each file.
+ * @kind treemap
+ * @id cpp/function-length
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg max
+ */
+import cpp
+
+from File f
+where f.fromSource()
+select f, avg(MetricFunction fn |
+ fn.getFile() = f
+ and not fn instanceof MemberFunction |
+ fn.getNumberOfLinesOfCode())
diff --git a/cpp/ql/src/Metrics/Files/NumberOfFunctions.qhelp b/cpp/ql/src/Metrics/Files/NumberOfFunctions.qhelp
new file mode 100644
index 000000000000..4a088a69e117
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/NumberOfFunctions.qhelp
@@ -0,0 +1,38 @@
+
+
+
+This metric measures the number of functions defined in each file.
+
+
+Tracking this metric over time will indicate which parts of the system are under active
+development. Cross-referencing with the other metrics "Cyclomatic Complexity" and "Lines of
+Code" is recommended, because files with high values for all three metrics are very likely
+to be too big and unwieldy; such files should be split up.
+
+
+
+
+If a file is too big, identify the different tasks that are carried out by its functions
+and split the file according to these tasks.
+
+
+
+
+
+ Functions
+
+
+ M. Fowler. Refactoring. Addison-Wesley, 1999.
+
+
+ Wikipedia: Code refactoring
+
+
+ Refactoring as Meta Programming?
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Files/NumberOfFunctions.ql b/cpp/ql/src/Metrics/Files/NumberOfFunctions.ql
new file mode 100644
index 000000000000..68092ad63939
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/NumberOfFunctions.ql
@@ -0,0 +1,16 @@
+/**
+ * @name Functions per file
+ * @description The total number of functions in each file.
+ * @kind treemap
+ * @id cpp/number-of-functions
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg sum max
+ */
+import cpp
+
+from File f
+where f.fromSource()
+select f, count(Function fn |
+ fn.getFile() = f
+ and not fn instanceof MemberFunction)
diff --git a/cpp/ql/src/Metrics/Files/NumberOfGlobals.qhelp b/cpp/ql/src/Metrics/Files/NumberOfGlobals.qhelp
new file mode 100644
index 000000000000..feaebc47f7dc
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/NumberOfGlobals.qhelp
@@ -0,0 +1,34 @@
+
+
+
+This metric measures the number of global variables in a file. This includes both public and file-local global variables.
+
+Globals in general should be avoided as it is too easy for them to be modified in other parts of the code.
+It also pollutes the name space and public globals expose internal representation. This is particularly
+important in multi-threaded applications as every global is likely going to require some synchronization
+mechanism to ensure that they are accessed and written in the correct order.
+
+
+
+Try to eliminate globals by passing them as parameters to functions. If global state is necessary,
+try to encapsulate related variables into structs and classes. In C++ it is preferable to group state
+as well as functions into classes.
+
+
+
+
+
+ Global variables
+
+
+ C++: Global warning
+
+
+ Minimize the scope of variables and functions
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Files/NumberOfGlobals.ql b/cpp/ql/src/Metrics/Files/NumberOfGlobals.ql
new file mode 100644
index 000000000000..0a957bf83795
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/NumberOfGlobals.ql
@@ -0,0 +1,44 @@
+/**
+ * @name Global variables
+ * @description The total number of global variables in each file.
+ * @kind treemap
+ * @id cpp/number-of-globals
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg sum max
+ */
+import cpp
+
+predicate macroLocation(File f, int startLine, int endLine) {
+ exists(MacroInvocation mi, Location l |
+ l = mi.getLocation() and
+ l.getFile() = f and
+ l.getStartLine() = startLine and
+ l.getEndLine() = endLine
+ )
+}
+
+pragma[nomagic]
+Location getVariableLocation(Variable v) {
+ result = v.getLocation()
+}
+
+predicate globalLocation(GlobalVariable gv, File f, int startLine, int endLine) {
+ exists(Location l |
+ l = getVariableLocation(gv) and
+ l.hasLocationInfo(f.getAbsolutePath(), startLine, _, endLine, _)
+ )
+}
+
+predicate inMacro(GlobalVariable gv) {
+ exists(File f, int macroStart, int macroEnd, int varStart, int varEnd |
+ macroLocation(f, macroStart, macroEnd) and
+ globalLocation(gv, f, varStart, varEnd) and
+ varStart >= macroStart and
+ varEnd <= macroEnd
+ )
+}
+
+from File f
+where f.fromSource()
+select f, count(GlobalVariable gv | gv.getFile() = f and not inMacro(gv))
diff --git a/cpp/ql/src/Metrics/Files/NumberOfParameters.qhelp b/cpp/ql/src/Metrics/Files/NumberOfParameters.qhelp
new file mode 100644
index 000000000000..0186a747a344
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/NumberOfParameters.qhelp
@@ -0,0 +1,44 @@
+
+
+
+This metric measures the average number of parameters to functions.
+
+Functions with an excessive number of parameters often exhibit one or more of the
+following problems.
+
+
+- The functions lack cohesion because they do several unrelated tasks.
+- Several of the arguments would be better grouped together using a struct or class,
+ because they represent one conceptual entity.
+- Calling the function is prone to mistakes because arguments may be accidentally transposed,
+ possibly without a type-error.
+
+
+
+
+
+Consider refactoring functions with too many arguments into smaller functions, each with
+a single well-defined purpose.
+
+It may also be possible to create new abstractions for usefully grouping arguments. For
+example, rather than representing a buffer by a pointer and an integer length, they could be
+encapsulated into a single struct, with utility functions for common operations.
+
+
+
+
+
+ M. Fowler. Refactoring. Addison-Wesley, 1999.
+
+
+ Wikipedia: Code refactoring
+
+
+ Refactoring as Meta Programming?
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Files/NumberOfParameters.ql b/cpp/ql/src/Metrics/Files/NumberOfParameters.ql
new file mode 100644
index 000000000000..6c64eaebfe27
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/NumberOfParameters.ql
@@ -0,0 +1,18 @@
+/**
+ * @name Parameters per function
+ * @description The average number of parameters of functions in each file.
+ * @kind treemap
+ * @id cpp/number-of-parameters
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg max
+ * @tags testability
+ * complexity
+ */
+import cpp
+
+from File f
+where f.fromSource()
+select f, avg(Function fn |
+ fn.getFile() = f and not fn instanceof MemberFunction |
+ fn.getNumberOfParameters())
diff --git a/cpp/ql/src/Metrics/Files/NumberOfPublicFunctions.qhelp b/cpp/ql/src/Metrics/Files/NumberOfPublicFunctions.qhelp
new file mode 100644
index 000000000000..d93eb88484c4
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/NumberOfPublicFunctions.qhelp
@@ -0,0 +1,42 @@
+
+
+
+This metric measures the number of public functions in a file.
+
+Public functions are the API between a component and other parts of a program. As such,
+it makes sense to monitor the number of public functions and consider the following
+questions:
+
+
+- Is the API too large and unwieldy?
+- When adding new functions, what effect will the new additions have on the cost of
+ maintaining the additions (given that other components may come to rely on them)?
+- Do any public functions inadvertently expose implementation details of a component?
+
+
+
+
+
+Adjust the API of a component in consideration of the above questions.
+
+
+
+
+
+ Functions
+
+
+ M. Fowler. Refactoring. Addison-Wesley, 1999.
+
+
+ Wikipedia: Code refactoring
+
+
+ Refactoring as Meta Programming?
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Files/NumberOfPublicFunctions.ql b/cpp/ql/src/Metrics/Files/NumberOfPublicFunctions.ql
new file mode 100644
index 000000000000..482425101eb9
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/NumberOfPublicFunctions.ql
@@ -0,0 +1,18 @@
+/**
+ * @name Public functions per file
+ * @description The total number of public (non-static) functions in
+ * each file.
+ * @kind treemap
+ * @id cpp/number-of-public-functions
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg sum max
+ */
+import cpp
+
+from File f
+where f.fromSource()
+select f, count(Function fn |
+ fn.getFile() = f
+ and not fn instanceof MemberFunction
+ and not fn.isStatic())
diff --git a/cpp/ql/src/Metrics/Files/NumberOfPublicGlobals.qhelp b/cpp/ql/src/Metrics/Files/NumberOfPublicGlobals.qhelp
new file mode 100644
index 000000000000..d2b42aae4c56
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/NumberOfPublicGlobals.qhelp
@@ -0,0 +1,40 @@
+
+
+
+This metric measures the number of public global variables in a file.
+
+Global variables can cause several problems:
+
+
+- lack of encapsulation, because state is exposed to the whole program, rather than a single module
+- difficulty maintaining the software, because code using or manipulating the value of the global may be scattered across the software, so its hard to track them all down when making a change
+- defects in multi-threading, because the code that uses globals is usually not thread-safe
+
+
+
+
+
+
+Make global variables local to a file, and provide functions for manipulating the
+value of the variable in a thread-safe way. If possible, make the variable an instance
+variable in a class or struct that is passed from function to function as necessary so
+that there is no global state.
+
+
+
+
+
+ Global variables
+
+
+ C++: Global warning
+
+
+ Minimize the scope of variables and functions
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Files/NumberOfPublicGlobals.ql b/cpp/ql/src/Metrics/Files/NumberOfPublicGlobals.ql
new file mode 100644
index 000000000000..2abef690d822
--- /dev/null
+++ b/cpp/ql/src/Metrics/Files/NumberOfPublicGlobals.ql
@@ -0,0 +1,49 @@
+/**
+ * @name Public global variables
+ * @description The total number of global variables in each file with
+ * external (public) visibility.
+ * @kind treemap
+ * @id cpp/number-of-public-globals
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg sum max
+ * @tags maintainability
+ * modularity
+ */
+import cpp
+
+predicate macroLocation(File f, int startLine, int endLine) {
+ exists(MacroInvocation mi, Location l |
+ l = mi.getLocation() and
+ l.getFile() = f and
+ l.getStartLine() = startLine and
+ l.getEndLine() = endLine
+ )
+}
+
+pragma[nomagic]
+Location getVariableLocation(Variable v) {
+ result = v.getLocation()
+}
+
+predicate globalLocation(GlobalVariable gv, File f, int startLine, int endLine) {
+ exists(Location l |
+ l = getVariableLocation(gv) and
+ l.hasLocationInfo(f.getAbsolutePath(), startLine, _, endLine, _))
+}
+
+predicate inMacro(GlobalVariable gv) {
+ exists(File f, int macroStart, int macroEnd, int varStart, int varEnd |
+ macroLocation(f, macroStart, macroEnd) and
+ globalLocation(gv, f, varStart, varEnd) and
+ varStart >= macroStart and
+ varEnd <= macroEnd
+ )
+}
+
+from File f
+where f.fromSource()
+select f, count(GlobalVariable gv |
+ gv.getFile() = f
+ and not gv.isStatic()
+ and not inMacro(gv))
diff --git a/cpp/ql/src/Metrics/Functions/FunCyclomaticComplexity.qhelp b/cpp/ql/src/Metrics/Functions/FunCyclomaticComplexity.qhelp
new file mode 100644
index 000000000000..9dc5a723b115
--- /dev/null
+++ b/cpp/ql/src/Metrics/Functions/FunCyclomaticComplexity.qhelp
@@ -0,0 +1,40 @@
+
+
+
+This metric measures the cyclomatic complexity of each function in the project.
+
+The cyclomatic complexity of a function is an indication of the number of paths that can be taken during the execution of a function.
+Straight-line code has zero cyclomatic complexity, while branches and loops increase cyclomatic complexity. A cyclomatic complexity above 50 should be considered bad practice and above 75 should definitely be addressed.
+
+Functions with high cyclomatic complexity suffer from the following problems:
+
+- Difficult to test since tests should be provided for each possible execution
+- Difficult to understand since a developer needs to understand how all conditions interact
+- Difficult to maintain since many execution paths is an indication of functions that perform too many tasks
+
+
+
+
+The primary way to reduce the complexity is to extract sub-functionality into separate functions. This improves on all problems described above. If the function naturally breaks up into a sequence of operations it is preferable to extract each operation as a separate function. Even if that's not the case it is often possible to extract the body of an iteration into a separate function to reduce complexity. If the complexity can't be reduced significantly make sure that the function is properly documented and carefully tested.
+
+
+
+
+
+ Functions
+
+
+ M. Fowler. Refactoring. Addison-Wesley, 1999.
+
+
+ Wikipedia: Code refactoring
+
+
+ Refactoring as Meta Programming?
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Functions/FunCyclomaticComplexity.ql b/cpp/ql/src/Metrics/Functions/FunCyclomaticComplexity.ql
new file mode 100644
index 000000000000..30b24868d451
--- /dev/null
+++ b/cpp/ql/src/Metrics/Functions/FunCyclomaticComplexity.ql
@@ -0,0 +1,19 @@
+/**
+ * @name Cyclomatic complexity of functions
+ * @description The Cyclomatic complexity (an indication of how many
+ * tests are necessary, based on the number of branching
+ * statements) per function.
+ * @kind treemap
+ * @id cpp/cyclomatic-complexity-per-function
+ * @treemap.warnOn highValues
+ * @metricType callable
+ * @metricAggregate avg max sum
+ * @tags testability
+ * maintainability
+ * complexity
+ */
+import cpp
+
+from Function f
+where strictcount(f.getEntryPoint()) = 1
+select f, f.getMetrics().getCyclomaticComplexity()
diff --git a/cpp/ql/src/Metrics/Functions/FunIterationNestingDepth.ql b/cpp/ql/src/Metrics/Functions/FunIterationNestingDepth.ql
new file mode 100644
index 000000000000..69ab2627e0a1
--- /dev/null
+++ b/cpp/ql/src/Metrics/Functions/FunIterationNestingDepth.ql
@@ -0,0 +1,19 @@
+/**
+ * @name Iteration depth
+ * @description The maximum number of nested loops in each function.
+ * @kind treemap
+ * @id cpp/iteration-nesting-depth-per-function
+ * @treemap.warnOn highValues
+ * @metricType callable
+ * @metricAggregate avg max
+ */
+import cpp
+
+int iterationDepth(Stmt l) {
+ result = count(Loop other | l.getParent*() = other)
+}
+
+from Function f, int depth
+where depth = max(Stmt s | s.getEnclosingFunction() = f | iterationDepth(s))
+ and strictcount(f.getEntryPoint()) = 1
+select f, depth order by depth desc
diff --git a/cpp/ql/src/Metrics/Functions/FunLinesOfCode.qhelp b/cpp/ql/src/Metrics/Functions/FunLinesOfCode.qhelp
new file mode 100644
index 000000000000..cd0af9c1063b
--- /dev/null
+++ b/cpp/ql/src/Metrics/Functions/FunLinesOfCode.qhelp
@@ -0,0 +1,28 @@
+
+
+
+This metric measures the number of lines of code in a function. This excludes comments and blank lines.
+
+Having too many lines of code in a function is an indication that it can be split into several functions of more manageable size.
+
+
+
+Long functions should be examined to see if they can be split into smaller, more cohesive functions.
+
+
+
+
+
+ M. Fowler. Refactoring. Addison-Wesley, 1999.
+
+
+ Wikipedia: Code refactoring
+
+
+ Refactoring as Meta Programming?
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Functions/FunLinesOfCode.ql b/cpp/ql/src/Metrics/Functions/FunLinesOfCode.ql
new file mode 100644
index 000000000000..dd458edb10b5
--- /dev/null
+++ b/cpp/ql/src/Metrics/Functions/FunLinesOfCode.ql
@@ -0,0 +1,17 @@
+/**
+ * @name Lines of code per function
+ * @description Measures the number of lines in a function that contain
+ * code (rather than lines that only contain comments or
+ * are blank).
+ * @kind treemap
+ * @id cpp/lines-of-code-per-function
+ * @treemap.warnOn highValues
+ * @metricType callable
+ * @metricAggregate avg sum max
+ * @tags maintainability
+ */
+import cpp
+
+from Function f
+where strictcount(f.getEntryPoint()) = 1
+select f, f.getMetrics().getNumberOfLinesOfCode()
diff --git a/cpp/ql/src/Metrics/Functions/FunLinesOfComments.qhelp b/cpp/ql/src/Metrics/Functions/FunLinesOfComments.qhelp
new file mode 100644
index 000000000000..6232b6bd4418
--- /dev/null
+++ b/cpp/ql/src/Metrics/Functions/FunLinesOfComments.qhelp
@@ -0,0 +1,28 @@
+
+
+
+This metric measures the number of lines of comments in a function.
+
+Functions that have too few comments are more likely to be insufficiently documented.
+Long, complex functions that have no comments at all require particular scrutiny, as these are more likely
+to need explicit documentation in comments.
+
+
+
+Functions with few to no comments should be examined to see if they require documentation. Particular attention
+should be given to long, complex functions.
+
+
+
+
+
+ C++ Programming, Coding style conventions
+
+
+ Wikipedia: Need for comments
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Functions/FunLinesOfComments.ql b/cpp/ql/src/Metrics/Functions/FunLinesOfComments.ql
new file mode 100644
index 000000000000..98440e505d1a
--- /dev/null
+++ b/cpp/ql/src/Metrics/Functions/FunLinesOfComments.ql
@@ -0,0 +1,18 @@
+/**
+ * @name Lines of comments per function
+ * @description Measures the number of lines in a function that contain
+ * a comment or part of a comment (that is, which are part
+ * of a multi-line comment).
+ * @kind treemap
+ * @id cpp/lines-of-comments-per-function
+ * @treemap.warnOn lowValues
+ * @metricType callable
+ * @metricAggregate avg sum max
+ * @tags maintainability
+ * documentation
+ */
+import cpp
+
+from Function f
+where strictcount(f.getEntryPoint()) = 1
+select f, f.getMetrics().getNumberOfLinesOfComments()
diff --git a/cpp/ql/src/Metrics/Functions/FunNumberOfCalls.qhelp b/cpp/ql/src/Metrics/Functions/FunNumberOfCalls.qhelp
new file mode 100644
index 000000000000..54bcd9ece016
--- /dev/null
+++ b/cpp/ql/src/Metrics/Functions/FunNumberOfCalls.qhelp
@@ -0,0 +1,32 @@
+
+
+
+This metric measures the number of function calls in each function. Only explicit calls are included, i.e., calls in macro expansions and compiler generated calls are not counted.
+
+
+Functions with many calls are hard to understand and maintain. It is usually a sign of a function with too many responsibilities.
+
+
+
+The primary way to reduce the complexity is to extract sub-functionality into separate functions. If the function naturally breaks up into a sequence of operations it is preferable to extract each operation as a separate function. This is most likely the case for large functions with low cyclomatic complexity. Even if the code is straight forward it is better to extract functionality for readability purposes. Moreover, it may enable reuse of the extracted subfunctionality.
+
+
+
+
+
+ Functions
+
+
+ M. Fowler. Refactoring. Addison-Wesley, 1999.
+
+
+ Wikipedia: Code refactoring
+
+
+ Refactoring as Meta Programming?
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Functions/FunNumberOfCalls.ql b/cpp/ql/src/Metrics/Functions/FunNumberOfCalls.ql
new file mode 100644
index 000000000000..ee972222c36c
--- /dev/null
+++ b/cpp/ql/src/Metrics/Functions/FunNumberOfCalls.ql
@@ -0,0 +1,27 @@
+/**
+ * @name Number of function calls per function
+ * @description The number of C/C++ function calls per function.
+ * @kind treemap
+ * @id cpp/number-of-calls-per-function
+ * @treemap.warnOn highValues
+ * @metricType callable
+ * @metricAggregate avg sum max
+ * @tags maintainability
+ * complexity
+ */
+import cpp
+
+predicate callToOperator(FunctionCall fc) {
+ fc.getTarget() instanceof Operator or
+ fc.getTarget() instanceof ConversionOperator
+}
+
+from Function f, int n, int o
+where strictcount(f.getEntryPoint()) = 1
+ and o = count(FunctionCall c |
+ c.getEnclosingFunction() = f and
+ not c.isInMacroExpansion() and
+ not c.isCompilerGenerated() and
+ not callToOperator(c))
+ and n = o / count(f.getBlock())
+select f, n
diff --git a/cpp/ql/src/Metrics/Functions/FunNumberOfParameters.qhelp b/cpp/ql/src/Metrics/Functions/FunNumberOfParameters.qhelp
new file mode 100644
index 000000000000..e6257c28fae0
--- /dev/null
+++ b/cpp/ql/src/Metrics/Functions/FunNumberOfParameters.qhelp
@@ -0,0 +1,37 @@
+
+
+
+This metric measures the number of formal parameters per function.
+
+Functions with too many formal parameters are hard to use and maintain due to their complex
+interface. Using them is hard since you need to provide the right number of parameters in the
+right order. This can be particularly prone to mistakes if many of the parameters share the same type.
+
+
+
+If the function takes many related parameters they should be grouped into a class or struct.
+This improves the usability of the function with more explicit naming, and also avoids reduces
+the risk of forgetting parameters and accidental reordering. If some of the parameters are optional,
+either explicitly with default value, or accepting NULL or 0, then it may be better to create separate
+functions for the different use cases.
+
+
+
+
+
+ Functions
+
+
+ M. Fowler. Refactoring. Addison-Wesley, 1999.
+
+
+ Wikipedia: Code refactoring
+
+
+ Refactoring as Meta Programming?
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Functions/FunNumberOfParameters.ql b/cpp/ql/src/Metrics/Functions/FunNumberOfParameters.ql
new file mode 100644
index 000000000000..f05191a52376
--- /dev/null
+++ b/cpp/ql/src/Metrics/Functions/FunNumberOfParameters.ql
@@ -0,0 +1,16 @@
+/**
+ * @name Number of parameters per function
+ * @description The number of formal parameters for each function.
+ * @kind treemap
+ * @id cpp/number-of-parameters-per-function
+ * @treemap.warnOn highValues
+ * @metricType callable
+ * @metricAggregate avg max
+ * @tags testability
+ * maintainability
+ */
+import cpp
+
+from Function f
+where strictcount(f.getEntryPoint()) = 1
+select f, f.getMetrics().getNumberOfParameters()
diff --git a/cpp/ql/src/Metrics/Functions/FunNumberOfStatements.qhelp b/cpp/ql/src/Metrics/Functions/FunNumberOfStatements.qhelp
new file mode 100644
index 000000000000..6578190d3f01
--- /dev/null
+++ b/cpp/ql/src/Metrics/Functions/FunNumberOfStatements.qhelp
@@ -0,0 +1,39 @@
+
+
+
+This metric measures the number of statements (including control statements such as
+if and while) in each function.
+
+
+Functions with many statements are hard to understand and maintain. It is usually a
+sign of a function with too many responsibilities.
+
+
+
+The primary way to improve the complexity is to extract sub-functionality into separate
+functions. If the function naturally breaks up into a sequence of operations it is
+preferable to extract each operation as a separate function. This is most likely the case
+for large functions with low cyclomatic complexity. Even if the code is straight forward
+it is better to extract functionality for readability purposes. Moreover, it may enable
+reuse of the extracted subfunctionality.
+
+
+
+
+
+ Functions
+
+
+ M. Fowler. Refactoring. Addison-Wesley, 1999.
+
+
+ Wikipedia: Code refactoring
+
+
+ Refactoring as Meta Programming?
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Functions/FunNumberOfStatements.ql b/cpp/ql/src/Metrics/Functions/FunNumberOfStatements.ql
new file mode 100644
index 000000000000..07211dc78f5e
--- /dev/null
+++ b/cpp/ql/src/Metrics/Functions/FunNumberOfStatements.ql
@@ -0,0 +1,16 @@
+/**
+ * @name Number of statements per function
+ * @description The number of C/C++ statements per function.
+ * @kind treemap
+ * @id cpp/statements-per-function
+ * @treemap.warnOn highValues
+ * @metricType callable
+ * @metricAggregate avg sum max
+ * @tags maintainability
+ */
+import cpp
+
+from Function f, int n
+where strictcount(f.getEntryPoint()) = 1 and
+ n = count(Stmt s | s.getEnclosingFunction() = f)
+select f, n
diff --git a/cpp/ql/src/Metrics/Functions/FunPercentageOfComments.qhelp b/cpp/ql/src/Metrics/Functions/FunPercentageOfComments.qhelp
new file mode 100644
index 000000000000..5f998e3e476d
--- /dev/null
+++ b/cpp/ql/src/Metrics/Functions/FunPercentageOfComments.qhelp
@@ -0,0 +1,27 @@
+
+
+
+This metric measures the percentage of lines in an function that contain a comment or
+are part of a multi-line comment.
+
+Having a low comment ratio is an indication that a function does not have sufficient
+documentation.
+
+
+
+Start by adding documentation to functions that are used from other parts of the code. Then document large complex functions, as they benefit most from documentation.
+
+
+
+
+
+ C++ Programming, Coding style conventions
+
+
+ Wikipedia: Need for comments
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Functions/FunPercentageOfComments.ql b/cpp/ql/src/Metrics/Functions/FunPercentageOfComments.ql
new file mode 100644
index 000000000000..ebeefec5b423
--- /dev/null
+++ b/cpp/ql/src/Metrics/Functions/FunPercentageOfComments.ql
@@ -0,0 +1,17 @@
+/**
+ * @name Comment ratio per function
+ * @description The ratio of comment lines to the total number of lines
+ * in a function.
+ * @kind treemap
+ * @id cpp/percentage-of-comments-per-function
+ * @treemap.warnOn lowValues
+ * @metricType callable
+ * @metricAggregate avg max
+ * @tags maintainability
+ * documentation
+ */
+import cpp
+
+from MetricFunction f
+where f.getNumberOfLines() > 0 and strictcount(f.getEntryPoint()) = 1
+select f, 100.0 * (f.getNumberOfLinesOfComments().(float) / f.getNumberOfLines().(float))
diff --git a/cpp/ql/src/Metrics/Functions/StatementNestingDepth.qhelp b/cpp/ql/src/Metrics/Functions/StatementNestingDepth.qhelp
new file mode 100644
index 000000000000..135a20daa8af
--- /dev/null
+++ b/cpp/ql/src/Metrics/Functions/StatementNestingDepth.qhelp
@@ -0,0 +1,33 @@
+
+
+
+
+This metric measures the maximum nesting depth in a file. This includes nested branch and loop statements, but not blocks.
+
+
+
+Deep nesting makes code very difficult to read and modify, and is also a sign that a function/class has lost cohesion
+(i.e. is doing too many unrelated things). Try to keep nesting depth below 7 levels.
+
+
+
+
+Reduce the nesting in the file by putting the code in the inner loops/branches in separate functions.
+
+
+
+
+
+ M. Fowler. Refactoring. Addison-Wesley, 1999.
+
+
+ Wikipedia: Code refactoring
+
+
+ Refactoring as Meta Programming?
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Functions/StatementNestingDepth.ql b/cpp/ql/src/Metrics/Functions/StatementNestingDepth.ql
new file mode 100644
index 000000000000..0e9ce896611c
--- /dev/null
+++ b/cpp/ql/src/Metrics/Functions/StatementNestingDepth.ql
@@ -0,0 +1,19 @@
+/**
+ * @name Nesting depth
+ * @description The maximum number of nested statements (for example,
+ * `if`, `for`, `while`, etc.). Blocks are not counted.
+ * @kind treemap
+ * @id cpp/statement-nesting-depth
+ * @treemap.warnOn highValues
+ * @metricType callable
+ * @metricAggregate avg max
+ * @tags maintainability
+ * complexity
+ */
+import cpp
+
+from MetricFunction f, int depth
+where depth = f.getNestingDepth()
+ and strictcount(f.getEntryPoint()) = 1
+select f, depth
+order by depth desc
diff --git a/cpp/ql/src/Metrics/History/HChurn.qhelp b/cpp/ql/src/Metrics/History/HChurn.qhelp
new file mode 100644
index 000000000000..2d248a0ac182
--- /dev/null
+++ b/cpp/ql/src/Metrics/History/HChurn.qhelp
@@ -0,0 +1,42 @@
+
+
+
+
+This metric measures the number of lines of text that have been added, deleted
+or modified in files below this location in the tree.
+
+
+
+Code churn is known to be a good (if not the best) predictor of defects in a
+code component (see e.g. [Nagappan] or [Khoshgoftaar]). The intuition is that
+files, packages or projects that have experienced a disproportionately high
+amount of churn for the amount of code involved may have been harder to write,
+and are thus likely to contain more bugs.
+
+
+
+
+
+
+It is a fact of life that some code is going to be changed more than the rest,
+and little can be done to change this. However, bearing in mind code churn's
+effectiveness as a defect predictor, code that has been repeatedly changed
+should be subjected to vigorous testing and code review.
+
+
+
+
+
+
+
+N. Nagappan et al. Change Bursts as Defect Predictors. In Proceedings of the 21st IEEE International Symposium on Software Reliability Engineering, 2010.
+
+
+T. M. Khoshgoftaar and R. M. Szabo. Improving code churn predictions during the system test and maintenance phases. In ICSM '94, 1994, pp. 58-67.
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/History/HChurn.ql b/cpp/ql/src/Metrics/History/HChurn.ql
new file mode 100644
index 000000000000..40b4459caca5
--- /dev/null
+++ b/cpp/ql/src/Metrics/History/HChurn.ql
@@ -0,0 +1,21 @@
+/**
+ * @name Churned lines per file
+ * @description Number of churned lines per file, across the revision
+ * history in the database.
+ * @kind treemap
+ * @id cpp/historical-churn
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg sum max
+ */
+import cpp
+import external.VCS
+
+from File f, int n
+where n = sum(Commit entry, int churn |
+ churn = entry.getRecentChurnForFile(f) and
+ not artificialChange(entry) |
+ churn)
+ and exists(f.getMetrics().getNumberOfLinesOfCode())
+select f, n
+order by n desc
diff --git a/cpp/ql/src/Metrics/History/HLinesAdded.qhelp b/cpp/ql/src/Metrics/History/HLinesAdded.qhelp
new file mode 100644
index 000000000000..fc812fc8357c
--- /dev/null
+++ b/cpp/ql/src/Metrics/History/HLinesAdded.qhelp
@@ -0,0 +1,6 @@
+
+
+
+
diff --git a/cpp/ql/src/Metrics/History/HLinesAdded.ql b/cpp/ql/src/Metrics/History/HLinesAdded.ql
new file mode 100644
index 000000000000..1a9fcc301e33
--- /dev/null
+++ b/cpp/ql/src/Metrics/History/HLinesAdded.ql
@@ -0,0 +1,21 @@
+/**
+ * @name Added lines per file
+ * @description Number of added lines per file, across the revision
+ * history in the database.
+ * @kind treemap
+ * @id cpp/historical-lines-added
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg sum max
+ */
+import cpp
+import external.VCS
+
+from File f, int n
+where n = sum(Commit entry, int churn |
+ churn = entry.getRecentAdditionsForFile(f) and
+ not artificialChange(entry) |
+ churn)
+ and exists(f.getMetrics().getNumberOfLinesOfCode())
+select f, n
+order by n desc
diff --git a/cpp/ql/src/Metrics/History/HLinesDeleted.qhelp b/cpp/ql/src/Metrics/History/HLinesDeleted.qhelp
new file mode 100644
index 000000000000..fc812fc8357c
--- /dev/null
+++ b/cpp/ql/src/Metrics/History/HLinesDeleted.qhelp
@@ -0,0 +1,6 @@
+
+
+
+
diff --git a/cpp/ql/src/Metrics/History/HLinesDeleted.ql b/cpp/ql/src/Metrics/History/HLinesDeleted.ql
new file mode 100644
index 000000000000..72e547060568
--- /dev/null
+++ b/cpp/ql/src/Metrics/History/HLinesDeleted.ql
@@ -0,0 +1,21 @@
+/**
+ * @name Deleted lines per file
+ * @description Number of deleted lines per file, across the revision
+ * history in the database.
+ * @kind treemap
+ * @id cpp/historical-lines-deleted
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg sum max
+ */
+import cpp
+import external.VCS
+
+from File f, int n
+where n = sum(Commit entry, int churn |
+ churn = entry.getRecentDeletionsForFile(f)
+ and not artificialChange(entry) |
+ churn)
+ and exists(f.getMetrics().getNumberOfLinesOfCode())
+select f, n
+order by n desc
diff --git a/cpp/ql/src/Metrics/History/HNumberOfAuthors.qhelp b/cpp/ql/src/Metrics/History/HNumberOfAuthors.qhelp
new file mode 100644
index 000000000000..00ec48b744f0
--- /dev/null
+++ b/cpp/ql/src/Metrics/History/HNumberOfAuthors.qhelp
@@ -0,0 +1,48 @@
+
+
+
+
+This metric measures the number of different authors (by examining the
+version control history)
+for files below this location in the tree. (This is a better version
+of the metric that counts the number of different authors using Javadoc
+tags.)
+
+
+
+Files that have been changed by a large number of different authors are
+by definition the product of many minds. New authors working on a file
+may be less familiar with the design and implementation of the code than
+the original authors, which can be a potential source of bugs. Furthermore,
+code that has been worked on by many people, if not carefully maintained,
+often ends up lacking conceptual integrity. For both of these reasons, any
+code that has been worked on by an unusually high number of different people
+merits careful inspection in code reviews.
+
+
+
+
+
+
+There is clearly no way to reduce the number of authors that have worked
+on a file - it is impossible to rewrite history. However, files highlighted
+by this metric should be given special attention in a code review, and may
+ultimately be good candidates for refactoring/rewriting by an individual,
+experienced developer.
+
+
+
+
+
+
+
+
+
+F. P. Brooks Jr. The Mythical Man-Month, Chapter 4. Addison-Wesley, 1974.
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/History/HNumberOfAuthors.ql b/cpp/ql/src/Metrics/History/HNumberOfAuthors.ql
new file mode 100644
index 000000000000..1da244ff31aa
--- /dev/null
+++ b/cpp/ql/src/Metrics/History/HNumberOfAuthors.ql
@@ -0,0 +1,16 @@
+/**
+ * @name Number of authors
+ * @description Number of distinct authors for each file.
+ * @kind treemap
+ * @id cpp/historical-number-of-authors
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg min max
+ */
+import cpp
+import external.VCS
+
+from File f
+where exists(f.getMetrics().getNumberOfLinesOfCode())
+select f, count(Author author | author.getAnEditedFile() = f)
+
diff --git a/cpp/ql/src/Metrics/History/HNumberOfChanges.qhelp b/cpp/ql/src/Metrics/History/HNumberOfChanges.qhelp
new file mode 100644
index 000000000000..8625b20bee9d
--- /dev/null
+++ b/cpp/ql/src/Metrics/History/HNumberOfChanges.qhelp
@@ -0,0 +1,30 @@
+
+
+
+
+This metric measures the total number of file-level changes made to files
+below this location in the tree. For an individual file, it measures the
+number of commits that have affected that file. For a directory of files, it
+measures the sum of the file-level changes for each of the files in the
+directory.
+
+
+
+For example, suppose we have a directory containing two files, A and B. If the
+number of file-level changes to A is 100, and the number of
+file-level changes to B is 80, then the total number of
+file-level changes to the directory is 180. Note that this is
+likely to be different (in some cases very different) from the number of
+commits that affected any file in the directory, since more than one file can
+be changed by a single commit. (Note what would happen if we performed
+80 commits on A and B, followed by another 20
+commits on A alone - the total number of file-level changes would be
+180, but the number of commits involved would be
+100.)
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/History/HNumberOfChanges.ql b/cpp/ql/src/Metrics/History/HNumberOfChanges.ql
new file mode 100644
index 000000000000..e3b2396662c8
--- /dev/null
+++ b/cpp/ql/src/Metrics/History/HNumberOfChanges.ql
@@ -0,0 +1,17 @@
+/**
+ * @name Number of file-level changes
+ * @description The number of file-level changes made (by version
+ * control history).
+ * @kind treemap
+ * @id cpp/historical-number-of-changes
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg min max sum
+ */
+import cpp
+import external.VCS
+
+from File f
+where exists(f.getMetrics().getNumberOfLinesOfCode())
+select f, count(Commit svn |
+ f = svn.getAnAffectedFile() and not artificialChange(svn))
diff --git a/cpp/ql/src/Metrics/History/HNumberOfCoCommits.qhelp b/cpp/ql/src/Metrics/History/HNumberOfCoCommits.qhelp
new file mode 100644
index 000000000000..6a767d576589
--- /dev/null
+++ b/cpp/ql/src/Metrics/History/HNumberOfCoCommits.qhelp
@@ -0,0 +1,51 @@
+
+
+
+
+This metric measures the average number of co-committed files for the files
+below this location in the tree.
+
+
+
+A co-committed file is one that is committed at the same time as a given file.
+For instance, if you commit files A, B and C together, then B and C would be
+the co-committed files of A for that commit. The value of the metric for an
+individual file is the average number of such co-committed files over all
+commits. The value of the metric for a directory is the aggregation of these
+averages - for instance, if we are using max as our aggregation
+function, the value would be the maximum of the average number of co-commits
+over all files in the directory.
+
+
+
+An unusually high value for this metric may indicate that the file in question
+is too tightly-coupled to other files, and it is difficult to change it in
+isolation. Alternatively, it may just be an indication that you commit lots of
+unrelated changes at the same time.
+
+
+
+
+
+
+Examine the file in question to see what the problem is.
+
+
+
+-
+If the file is too tightly coupled, it will have high values for its afferent
+and/or efferent coupling metrics, and you should apply the advice given there.
+
+
+-
+If the file is not tightly coupled, but you find that you are committing lots
+of unrelated changes at the same time, then you may want to revisit your commit
+practices.
+
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/History/HNumberOfCoCommits.ql b/cpp/ql/src/Metrics/History/HNumberOfCoCommits.ql
new file mode 100644
index 000000000000..66dd16071630
--- /dev/null
+++ b/cpp/ql/src/Metrics/History/HNumberOfCoCommits.ql
@@ -0,0 +1,23 @@
+/**
+ * @name Number of co-committed files
+ * @description The average number of other files that are touched
+ * whenever a file is affected by a commit.
+ * @kind treemap
+ * @id cpp/historical-number-of-co-commits
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg min max
+ */
+import cpp
+import external.VCS
+
+int committedFiles(Commit commit) {
+ result = count(commit.getAnAffectedFile())
+}
+
+from File f
+where exists(f.getMetrics().getNumberOfLinesOfCode())
+select f, avg(Commit commit |
+ commit.getAnAffectedFile() = f |
+ committedFiles(commit) - 1)
+
diff --git a/cpp/ql/src/Metrics/History/HNumberOfReCommits.qhelp b/cpp/ql/src/Metrics/History/HNumberOfReCommits.qhelp
new file mode 100644
index 000000000000..37edc9aecf15
--- /dev/null
+++ b/cpp/ql/src/Metrics/History/HNumberOfReCommits.qhelp
@@ -0,0 +1,53 @@
+
+
+
+
+This metric measures the number of file re-commits that have occurred below
+this location in the tree. A re-commit is taken to mean a commit to a file
+that was touched less than five days ago.
+
+
+
+In a system that is being developed using a controlled change process (where
+changes are not committed until they are in some sense 'complete'), re-commits
+can be (but are not always) an indication that an initial change was not
+successful and had to be revisited within a short time period. The intuition
+is that the original change may have been difficult to get right, and hence
+the code in the file may be more than usually defect-prone. The concept is
+somewhat similar to that of 'change bursts', as described in [Nagappan].
+
+
+
+
+
+
+High numbers of re-commits can be addressed on two levels: preventative and
+corrective.
+
+
+
+-
+On the preventative side, a high number of re-commits may be an indication
+that your code review process needs an overhaul.
+
+
+-
+On the corrective side, code that has experienced a high number of re-commits
+should be vigorously code reviewed and tested.
+
+
+
+
+
+
+
+
+
+N. Nagappan et al. Change Bursts as Defect Predictors. In Proceedings of the 21st IEEE International Symposium on Software Reliability Engineering, 2010.
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/History/HNumberOfReCommits.ql b/cpp/ql/src/Metrics/History/HNumberOfReCommits.ql
new file mode 100644
index 000000000000..de958ad32b5e
--- /dev/null
+++ b/cpp/ql/src/Metrics/History/HNumberOfReCommits.ql
@@ -0,0 +1,30 @@
+/**
+ * @name Number of re-commits for each file
+ * @description A re-commit is taken to mean a commit to a file that
+ * was touched less than five days ago.
+ * @kind treemap
+ * @id cpp/historical-number-of-re-commits
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg min max
+ */
+import cpp
+import external.VCS
+
+predicate inRange(Commit first, Commit second) {
+ first.getAnAffectedFile() = second.getAnAffectedFile() and
+ first != second and
+ exists(int n | n = first.getDate().daysTo(second.getDate()) and
+ n >= 0 and n < 5)
+}
+
+int recommitsForFile(File f) {
+ result = count(Commit recommit |
+ f = recommit.getAnAffectedFile() and
+ exists(Commit prev | inRange(prev, recommit)))
+}
+
+from File f
+where exists(f.getMetrics().getNumberOfLinesOfCode())
+select f, recommitsForFile(f)
+
diff --git a/cpp/ql/src/Metrics/History/HNumberOfRecentAuthors.ql b/cpp/ql/src/Metrics/History/HNumberOfRecentAuthors.ql
new file mode 100644
index 000000000000..c912897f4047
--- /dev/null
+++ b/cpp/ql/src/Metrics/History/HNumberOfRecentAuthors.ql
@@ -0,0 +1,22 @@
+/**
+ * @name Number of recent authors
+ * @description Number of distinct authors that have recently made
+ * changes.
+ * @kind treemap
+ * @id cpp/historical-number-of-recent-authors
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg min max
+ */
+import cpp
+import external.VCS
+
+from File f
+where exists(f.getMetrics().getNumberOfLinesOfCode())
+select f, count(Author author |
+ exists(Commit e |
+ e = author.getACommit() and
+ f = e.getAnAffectedFile() and
+ e.daysToNow() <= 180 and
+ not artificialChange(e)))
+
diff --git a/cpp/ql/src/Metrics/History/HNumberOfRecentChangedFiles.ql b/cpp/ql/src/Metrics/History/HNumberOfRecentChangedFiles.ql
new file mode 100644
index 000000000000..8009356cde98
--- /dev/null
+++ b/cpp/ql/src/Metrics/History/HNumberOfRecentChangedFiles.ql
@@ -0,0 +1,20 @@
+/**
+ * @name Recently changed files
+ * @description Number of files recently edited.
+ * @kind treemap
+ * @id cpp/historical-number-of-recent-changed-files
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg min max sum
+ */
+import cpp
+import external.VCS
+
+from File f
+where exists(Commit e |
+ e.getAnAffectedFile() = f and
+ e.daysToNow() <= 180 and
+ not artificialChange(e))
+ and exists(f.getMetrics().getNumberOfLinesOfCode())
+select f, 1
+
diff --git a/cpp/ql/src/Metrics/History/HNumberOfRecentChanges.qhelp b/cpp/ql/src/Metrics/History/HNumberOfRecentChanges.qhelp
new file mode 100644
index 000000000000..fa03a183d8e4
--- /dev/null
+++ b/cpp/ql/src/Metrics/History/HNumberOfRecentChanges.qhelp
@@ -0,0 +1,63 @@
+
+
+
+
+This metric measures the number of recent changes to files that have occurred
+below this location in the tree. A recent change is taken to mean a change
+that has occurred in the last 180 days.
+
+
+
+All code that has changed a great deal may be more than usually prone to
+defects, but this is particularly true of code that has been changing
+dramatically in the recent past, because it has not yet had a chance to be
+properly field-tested in order to iron out the bugs.
+
+
+
+
+
+
+There is more than one reason why a file may have been changing a lot
+recently:
+
+
+
+-
+The file may be part of a new subsystem that is being written. New code is
+always going to change a lot in a short period of time, but it is important
+to ensure that it is properly code reviewed and unit tested before integrating
+it into a working product.
+
+
+-
+The file may be being heavily refactored. Large refactorings are sometimes
+essential, but they are also quite risky. You should write proper regression
+tests before starting on a major refactoring, and check that they still pass
+once you're done.
+
+
+-
+The same bit of code may be being changed repeatedly because it is difficult
+to get right. Aside from vigorous code reviewing and testing, it may be a good
+idea to rethink the system design - if something is that hard
+to get right (and it's not an inherently difficult concept), you might be making life unnecessarily hard for yourself and
+risking introducing insidious defects.
+
+
+
+
+
+
+
+
+
+
+N. Nagappan et al. Change Bursts as Defect Predictors. In Proceedings of the 21st IEEE International Symposium on Software Reliability Engineering, 2010.
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/History/HNumberOfRecentChanges.ql b/cpp/ql/src/Metrics/History/HNumberOfRecentChanges.ql
new file mode 100644
index 000000000000..2ce984f40a11
--- /dev/null
+++ b/cpp/ql/src/Metrics/History/HNumberOfRecentChanges.ql
@@ -0,0 +1,21 @@
+/**
+ * @name Recent changes
+ * @description Number of recent commits to this file.
+ * @kind treemap
+ * @id cpp/historical-number-of-recent-changes
+ * @treemap.warnOn highValues
+ * @metricType file
+ * @metricAggregate avg min max sum
+ */
+import cpp
+import external.VCS
+
+from File f, int n
+where n = count(Commit e |
+ e.getAnAffectedFile() = f and
+ e.daysToNow() <= 180 and
+ not artificialChange(e))
+ and exists(f.getMetrics().getNumberOfLinesOfCode())
+select f, n
+order by n desc
+
diff --git a/cpp/ql/src/Metrics/Internal/CallableDisplayStrings.ql b/cpp/ql/src/Metrics/Internal/CallableDisplayStrings.ql
new file mode 100644
index 000000000000..d02e7f1165dc
--- /dev/null
+++ b/cpp/ql/src/Metrics/Internal/CallableDisplayStrings.ql
@@ -0,0 +1,11 @@
+/**
+ * @name Display strings of functions
+ * @kind display-string
+ * @id cpp/callable-display-strings
+ * @metricType callable
+ */
+import cpp
+
+from Function f
+where f.fromSource()
+select f, f.getName()
diff --git a/cpp/ql/src/Metrics/Internal/CallableExtents.ql b/cpp/ql/src/Metrics/Internal/CallableExtents.ql
new file mode 100644
index 000000000000..b8ac8803734f
--- /dev/null
+++ b/cpp/ql/src/Metrics/Internal/CallableExtents.ql
@@ -0,0 +1,34 @@
+/**
+ * @name Extents of functions
+ * @kind extent
+ * @id cpp/callable-extents
+ * @metricType callable
+ */
+import cpp
+
+/**
+ * A Function with location overridden to cover its entire range,
+ * including the body (if any), as opposed to the location of its name
+ * only.
+ */
+class RangeFunction extends Function {
+ /**
+ * Holds if this function is at the specified location.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `filepath`.
+ * For more information, see
+ * [LGTM locations](https://lgtm.com/help/ql/locations).
+ */
+ predicate hasLocationInfo(string path, int sl, int sc, int el, int ec) {
+ super.getLocation().hasLocationInfo(path, sl, sc, _, _)
+ and
+ (
+ this.getBlock().getLocation().hasLocationInfo(path, _, _, el, ec) or
+ (not exists(this.getBlock()) and el = sl+1 and ec=1)
+ )
+ }
+}
+
+from RangeFunction f
+where f.fromSource()
+select f.getLocation(), f
diff --git a/cpp/ql/src/Metrics/Internal/CallableSourceLinks.ql b/cpp/ql/src/Metrics/Internal/CallableSourceLinks.ql
new file mode 100644
index 000000000000..f6d1667b0192
--- /dev/null
+++ b/cpp/ql/src/Metrics/Internal/CallableSourceLinks.ql
@@ -0,0 +1,11 @@
+/**
+ * @name Source links of functions
+ * @kind source-link
+ * @id cpp/callable-source-links
+ * @metricType callable
+ */
+import cpp
+
+from Function f
+where f.fromSource()
+select f, f.getFile()
diff --git a/cpp/ql/src/Metrics/Internal/ReftypeDisplayStrings.ql b/cpp/ql/src/Metrics/Internal/ReftypeDisplayStrings.ql
new file mode 100644
index 000000000000..e11fdda6e628
--- /dev/null
+++ b/cpp/ql/src/Metrics/Internal/ReftypeDisplayStrings.ql
@@ -0,0 +1,11 @@
+/**
+ * @name Display strings of classes
+ * @kind display-string
+ * @id cpp/reference-type-display-strings
+ * @metricType reftype
+ */
+import cpp
+
+from Class c
+where c.fromSource()
+select c, c.getName()
diff --git a/cpp/ql/src/Metrics/Internal/ReftypeSourceLinks.ql b/cpp/ql/src/Metrics/Internal/ReftypeSourceLinks.ql
new file mode 100644
index 000000000000..d5918eaeb1f7
--- /dev/null
+++ b/cpp/ql/src/Metrics/Internal/ReftypeSourceLinks.ql
@@ -0,0 +1,11 @@
+/**
+ * @name Source links of classes
+ * @kind source-link
+ * @id cpp/reference-type-source-links
+ * @metricType reftype
+ */
+import cpp
+
+from Class c
+where c.fromSource()
+select c, c.getFile()
diff --git a/cpp/ql/src/Metrics/Namespaces/AbstractNamespaces.qhelp b/cpp/ql/src/Metrics/Namespaces/AbstractNamespaces.qhelp
new file mode 100644
index 000000000000..41cc622b84e0
--- /dev/null
+++ b/cpp/ql/src/Metrics/Namespaces/AbstractNamespaces.qhelp
@@ -0,0 +1,29 @@
+
+
+
+
+
+This query finds namespaces that have an abstractness greater than 0.20.
+
+Abstractness measures the proportion of abstract types in
+ a package relative to the total number of types in that package.
+ A highly abstract package (where the metric value is close 1)
+ that is furthermore instable is likely to be useless: the
+ class hierarchy has been over-engineered, and all those
+ abstract types are not heavily used.
+
+
+
+Try to simplify the class hierarchy.
+
+
+
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Namespaces/AbstractNamespaces.ql b/cpp/ql/src/Metrics/Namespaces/AbstractNamespaces.ql
new file mode 100644
index 000000000000..a39e7dcb76a0
--- /dev/null
+++ b/cpp/ql/src/Metrics/Namespaces/AbstractNamespaces.ql
@@ -0,0 +1,15 @@
+/**
+ * @name Abstract namespaces
+ * @description Finds namespaces that have an abstractness greater than 0.20.
+ * @kind chart
+ * @id cpp/abstract-namespaces
+ * @chart.type bar
+ */
+import cpp
+
+from Namespace n, float c
+where n.fromSource()
+ and c = n.getMetrics().getAbstractness()
+ and c > 0.20
+select n as Namespace, c as Abstractness
+order by Abstractness desc
diff --git a/cpp/ql/src/Metrics/Namespaces/ConcreteNamespaces.qhelp b/cpp/ql/src/Metrics/Namespaces/ConcreteNamespaces.qhelp
new file mode 100644
index 000000000000..24cf0f06eb72
--- /dev/null
+++ b/cpp/ql/src/Metrics/Namespaces/ConcreteNamespaces.qhelp
@@ -0,0 +1,22 @@
+
+
+
+
+
+This query finds namespaces that have an abstractness equal to 0. These namesspaces do not contain any abstract classes.
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Namespaces/ConcreteNamespaces.ql b/cpp/ql/src/Metrics/Namespaces/ConcreteNamespaces.ql
new file mode 100644
index 000000000000..5cf91aa490c8
--- /dev/null
+++ b/cpp/ql/src/Metrics/Namespaces/ConcreteNamespaces.ql
@@ -0,0 +1,14 @@
+/**
+ * @name Concrete namespaces
+ * @description Finds namespaces that have an abstractness equal to 0.
+ * @kind tree
+ * @id cpp/concrete-namespaces
+ */
+import cpp
+
+from Namespace n, float c
+where n.fromSource()
+ and c = n.getMetrics().getAbstractness()
+ and c = 0
+select n as Namespace, c as Abstractness
+order by Abstractness desc
diff --git a/cpp/ql/src/Metrics/Namespaces/HighAfferentCouplingNamespaces.qhelp b/cpp/ql/src/Metrics/Namespaces/HighAfferentCouplingNamespaces.qhelp
new file mode 100644
index 000000000000..15b284d875e6
--- /dev/null
+++ b/cpp/ql/src/Metrics/Namespaces/HighAfferentCouplingNamespaces.qhelp
@@ -0,0 +1,25 @@
+
+
+
+
+
+This query finds namespaces that have an afferent coupling greater than 20.
+
+The query counts number of namespaces depending on a namespace and
+displays those that have more than 20 namespaces depending on them.
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Namespaces/HighAfferentCouplingNamespaces.ql b/cpp/ql/src/Metrics/Namespaces/HighAfferentCouplingNamespaces.ql
new file mode 100644
index 000000000000..2c0db9c7e441
--- /dev/null
+++ b/cpp/ql/src/Metrics/Namespaces/HighAfferentCouplingNamespaces.ql
@@ -0,0 +1,16 @@
+/**
+ * @name High afferent coupling namespaces
+ * @description Finds namespaces that have an afferent coupling greater
+ * than 20.
+ * @kind chart
+ * @id cpp/high-afferent-coupling-namespaces
+ * @chart.type bar
+ */
+import cpp
+
+from Namespace n, int c
+where n.fromSource()
+ and c = n.getMetrics().getAfferentCoupling()
+ and c > 20
+select n as Namespace, c as AfferentCoupling
+order by AfferentCoupling desc
diff --git a/cpp/ql/src/Metrics/Namespaces/HighDistanceFromMainLineNamespaces.qhelp b/cpp/ql/src/Metrics/Namespaces/HighDistanceFromMainLineNamespaces.qhelp
new file mode 100644
index 000000000000..fb067f485693
--- /dev/null
+++ b/cpp/ql/src/Metrics/Namespaces/HighDistanceFromMainLineNamespaces.qhelp
@@ -0,0 +1,29 @@
+
+
+
+
+
+This query finds namespaces that do not have a good balance between abstractness and stability.
+
+This measure intends to capture the trade-off between abstractness
+ and instability: the ideal situation occurs when the sum of
+ abstractness and instability is one. That is, a package is
+ completely abstract and stable (abstractness=1 and instability=0)
+ or it is concrete and instable (abstractness=0 and instability=1).
+ We thus measure the distance from that ideal situation.
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Namespaces/HighDistanceFromMainLineNamespaces.ql b/cpp/ql/src/Metrics/Namespaces/HighDistanceFromMainLineNamespaces.ql
new file mode 100644
index 000000000000..0fdb40a7e7ad
--- /dev/null
+++ b/cpp/ql/src/Metrics/Namespaces/HighDistanceFromMainLineNamespaces.ql
@@ -0,0 +1,16 @@
+/**
+ * @name Namespaces far from main line
+ * @description Finds namespaces that do not have a good balance between
+ * abstractness and stability.
+ * @kind chart
+ * @id cpp/high-distance-from-main-line-namespaces
+ * @chart.type bar
+ */
+import cpp
+
+from Namespace n, float c
+where n.fromSource()
+ and c = n.getMetrics().getDistanceFromMain()
+ and c > 0.7
+select n as Namespace, c as DistanceFromMainline
+order by DistanceFromMainline desc
diff --git a/cpp/ql/src/Metrics/Namespaces/HighEfferentCouplingNamespaces.qhelp b/cpp/ql/src/Metrics/Namespaces/HighEfferentCouplingNamespaces.qhelp
new file mode 100644
index 000000000000..d97373f689a9
--- /dev/null
+++ b/cpp/ql/src/Metrics/Namespaces/HighEfferentCouplingNamespaces.qhelp
@@ -0,0 +1,22 @@
+
+
+
+
+
+This query finds namespaces that have an efferent coupling (that is, the number of namespaces they depend on) greater than 20.
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Namespaces/HighEfferentCouplingNamespaces.ql b/cpp/ql/src/Metrics/Namespaces/HighEfferentCouplingNamespaces.ql
new file mode 100644
index 000000000000..fb5d8614b4f5
--- /dev/null
+++ b/cpp/ql/src/Metrics/Namespaces/HighEfferentCouplingNamespaces.ql
@@ -0,0 +1,15 @@
+/**
+ * @name High efferent coupling namespaces
+ * @description Finds namespaces that have an efferent coupling greater than 20.
+ * @kind chart
+ * @id cpp/high-efferent-coupling-namespaces
+ * @chart.type bar
+ */
+import cpp
+
+from Namespace n, int c
+where n.fromSource()
+ and c = n.getMetrics().getEfferentCoupling()
+ and c > 20
+select n as Namespace, c as EfferentCoupling
+order by EfferentCoupling desc
diff --git a/cpp/ql/src/Metrics/Namespaces/StableNamespaces.qhelp b/cpp/ql/src/Metrics/Namespaces/StableNamespaces.qhelp
new file mode 100644
index 000000000000..6d3c1bb70673
--- /dev/null
+++ b/cpp/ql/src/Metrics/Namespaces/StableNamespaces.qhelp
@@ -0,0 +1,28 @@
+
+
+
+
+
+This query finds namespaces that have an instability lower than 0.2.
+
+Instability is a measure of how likely a package is to be influenced
+ by changes to other packages. If this metric value is high, it is easily
+ influenced, if it is low, the impact is likely to be minimal. Instability
+ is estimated as the number of outgoing dependencies relative to the total
+ number of depencies.
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Namespaces/StableNamespaces.ql b/cpp/ql/src/Metrics/Namespaces/StableNamespaces.ql
new file mode 100644
index 000000000000..060eb31e5a65
--- /dev/null
+++ b/cpp/ql/src/Metrics/Namespaces/StableNamespaces.ql
@@ -0,0 +1,15 @@
+/**
+ * @name Stable namespaces
+ * @description Finds namespaces that have an instability lower than 0.2.
+ * @kind chart
+ * @id cpp/stable-namespaces
+ * @chart.type bar
+ */
+import cpp
+
+from Namespace n, float c
+where n.fromSource()
+ and c = n.getMetrics().getInstability()
+ and c < 0.2
+select n as Namespace, c as Instability
+order by Instability desc
diff --git a/cpp/ql/src/Metrics/Namespaces/UnstableNamespaces.qhelp b/cpp/ql/src/Metrics/Namespaces/UnstableNamespaces.qhelp
new file mode 100644
index 000000000000..45377a202e4a
--- /dev/null
+++ b/cpp/ql/src/Metrics/Namespaces/UnstableNamespaces.qhelp
@@ -0,0 +1,28 @@
+
+
+
+
+
+This query finds namespaces that have an instability higher than 0.8.
+
+Instability is a measure of how likely a package is to be influenced
+ by changes to other packages. If this metric value is high, it is easily
+ influenced, if it is low, the impact is likely to be minimal. Instability
+ is estimated as the number of outgoing dependencies relative to the total
+ number of depencies.
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Metrics/Namespaces/UnstableNamespaces.ql b/cpp/ql/src/Metrics/Namespaces/UnstableNamespaces.ql
new file mode 100644
index 000000000000..4279dde9e7a5
--- /dev/null
+++ b/cpp/ql/src/Metrics/Namespaces/UnstableNamespaces.ql
@@ -0,0 +1,15 @@
+/**
+ * @name Unstable namespaces
+ * @description Finds namespaces that have an instability higher than 0.8.
+ * @kind chart
+ * @id cpp/unstable-namespaces
+ * @chart.type bar
+ */
+import cpp
+
+from Namespace n, float c
+where n.fromSource()
+ and c = n.getMetrics().getInstability()
+ and c > 0.8
+select n as Package, c as Instability
+order by Instability desc
diff --git a/cpp/ql/src/Metrics/queries.xml b/cpp/ql/src/Metrics/queries.xml
new file mode 100644
index 000000000000..99f4a7278c21
--- /dev/null
+++ b/cpp/ql/src/Metrics/queries.xml
@@ -0,0 +1 @@
+
diff --git a/cpp/ql/src/Microsoft/CallWithNullSAL.ql b/cpp/ql/src/Microsoft/CallWithNullSAL.ql
new file mode 100644
index 000000000000..a3ba5fd15e0e
--- /dev/null
+++ b/cpp/ql/src/Microsoft/CallWithNullSAL.ql
@@ -0,0 +1,21 @@
+/**
+ * @name SAL requires non-null argument
+ * @description When null is passed to a function that is SAL-annotated to
+ * forbid this, undefined behavior may result.
+ * @kind problem
+ * @id cpp/call-with-null-sal
+ * @problem.severity warning
+ * @tags reliability
+ */
+import cpp
+import SAL
+
+from Parameter p, Call c, Expr arg
+where any(SALNotNull a).getDeclaration() = p
+ and c.getTarget() = p.getFunction()
+ and arg = c.getArgument(p.getIndex())
+ and nullValue(arg)
+select arg, "Argument ("+ arg.toString()
+ +") for parameter $@ in call to "+ c.getTarget().getName() +
+ " may be null, but a SAL annotation forbids this.",
+ p, p.getName()
diff --git a/cpp/ql/src/Microsoft/IgnoreReturnValueSAL.ql b/cpp/ql/src/Microsoft/IgnoreReturnValueSAL.ql
new file mode 100644
index 000000000000..b8b06b9146c5
--- /dev/null
+++ b/cpp/ql/src/Microsoft/IgnoreReturnValueSAL.ql
@@ -0,0 +1,19 @@
+/**
+ * @name SAL requires inspecting return value
+ * @description When a return value is discarded even though the SAL annotation
+ * requires inspecting it, a recoverable error may turn into a
+ * whole-program crash.
+ * @kind problem
+ * @id cpp/ignore-return-value-sal
+ * @problem.severity warning
+ * @tags reliability
+ */
+import SAL
+
+from Function f, FunctionCall call
+where call.getTarget() = f
+ and call instanceof ExprInVoidContext
+ and any(SALCheckReturn a).getDeclaration() = f
+ and not getOptions().okToIgnoreReturnValue(call)
+select call, "Return value of $@ discarded although a SAL annotation "+
+ "requires inspecting it.", f, f.getName()
diff --git a/cpp/ql/src/Microsoft/InconsistentSAL.ql b/cpp/ql/src/Microsoft/InconsistentSAL.ql
new file mode 100644
index 000000000000..081c7439adba
--- /dev/null
+++ b/cpp/ql/src/Microsoft/InconsistentSAL.ql
@@ -0,0 +1,40 @@
+/**
+ * @name Inconsistent SAL annotation
+ * @description Annotations are different between declaration and definition.
+ * @kind problem
+ * @id cpp/inconsistent-sal
+ * @problem.severity warning
+ * @tags reliability
+ */
+import SAL
+
+/** Holds if `e` has SAL annotation `name`. */
+predicate hasAnnotation(DeclarationEntry e, string name) {
+ exists(SALAnnotation a |
+ a.getMacro().getName() = name and
+ a.getDeclarationEntry() = e
+ )
+}
+
+/** Holds if `e` is annotated to take its annotation from its declaration. */
+predicate inheritsDeclAnnotations(DeclarationEntry e) {
+ // Is directly annotated
+ e.isDefinition() and
+ exists(SALAnnotation a | a.getMacro().getName() = "_Use_decl_annotations_" |
+ a.getDeclarationEntry() = e
+ )
+ or
+ // or is a parameter of a function with such an annotation
+ inheritsDeclAnnotations(e.(ParameterDeclarationEntry)
+ .getFunctionDeclarationEntry())
+}
+
+from DeclarationEntry e1, DeclarationEntry e2, string name
+where e1.getDeclaration() = e2.getDeclaration()
+ and hasAnnotation(e1, name)
+ and not hasAnnotation(e2, name)
+ and not name = "_Use_decl_annotations_"
+ and not inheritsDeclAnnotations(e2)
+select e2, "Missing SAL annotation "+ name +
+ " in "+ e2.toString() +" although it is present on $@.",
+ e1, e1.toString()
diff --git a/cpp/ql/src/Microsoft/SAL.qll b/cpp/ql/src/Microsoft/SAL.qll
new file mode 100644
index 000000000000..42b86fe0caf5
--- /dev/null
+++ b/cpp/ql/src/Microsoft/SAL.qll
@@ -0,0 +1,105 @@
+import cpp
+
+class SALMacro extends Macro {
+ SALMacro() {
+ this.getFile().getBaseName() = "sal.h" or
+ this.getFile().getBaseName() = "specstrings_strict.h" or
+ this.getFile().getBaseName() = "specstrings.h"
+ }
+}
+
+class SALAnnotation extends MacroInvocation {
+ SALAnnotation() {
+ this.getMacro() instanceof SALMacro and
+ not exists(this.getParentInvocation())
+ }
+
+ /** Returns the `Declaration` annotated by `this`. */
+ Declaration getDeclaration() {
+ annotatesAt(this, result.getADeclarationEntry(), _, _)
+ }
+
+ /** Returns the `DeclarationEntry` annotated by `this`. */
+ DeclarationEntry getDeclarationEntry() {
+ annotatesAt(this, result, _, _)
+ }
+}
+
+///////////////////////////////////////////////////////////////////////////////
+// Particular SAL annotations of interest
+
+class SALCheckReturn extends SALAnnotation {
+ SALCheckReturn() {
+ exists(SALMacro m | m = this.getMacro() |
+ m.getName() = "_Check_return_" or
+ m.getName() = "_Must_inspect_result_"
+ )
+ }
+}
+
+class SALNotNull extends SALAnnotation {
+ SALNotNull() {
+ exists(SALMacro m | m = this.getMacro() |
+ not m.getName().matches("%\\_opt\\_%") and
+ (
+ m.getName().matches("\\_In%") or
+ m.getName().matches("\\_Out%") or
+ m.getName() = "_Ret_notnull_"
+ )
+ )
+ and
+ exists(Type t
+ | t = this.getDeclaration().(Variable).getType() or
+ t = this.getDeclaration().(Function).getType()
+ | t.getUnspecifiedType() instanceof PointerType
+ )
+ }
+}
+
+class SALMaybeNull extends SALAnnotation {
+ SALMaybeNull() {
+ exists(SALMacro m | m = this.getMacro() |
+ m.getName().matches("%\\_opt\\_%") or
+ m.getName().matches("\\_Ret_maybenull\\_%") or
+ m.getName() = "_Result_nullonfailure_"
+ )
+ }
+}
+
+///////////////////////////////////////////////////////////////////////////////
+// Implementation details
+
+private predicate annotatesAt(SALAnnotation a, DeclarationEntry e,
+ File file, int idx) {
+ a = salElementAt(file, idx) and
+ (
+ // Base case: `a` right before `e`
+ e = salElementAt(file, idx + 1)
+ or
+ // Recursive case: `a` right before some annotation on `e`
+ annotatesAt(_, e, file, idx + 1)
+ )
+}
+
+library class SALElement extends Element {
+ SALElement() {
+ this instanceof DeclarationEntry or
+ this instanceof SALAnnotation
+ }
+}
+
+/** Gets the `idx`th `SALElement` in `file`. */
+private SALElement salElementAt(File file, int idx) {
+ interestingLoc(file, result, interestingStartPos(file, idx))
+}
+
+/** Holds if an SALElement element at character `result` comes at
+ * position `idx` in `file`. */
+private int interestingStartPos(File file, int idx) {
+ result = rank[idx](int otherStart | interestingLoc(file, _, otherStart))
+}
+
+/** Holds if `element` in `file` is at character `startPos`. */
+private predicate interestingLoc(File file, SALElement element, int startPos) {
+ element.getLocation().charLoc(file, startPos, _)
+}
diff --git a/cpp/ql/src/Options.qll b/cpp/ql/src/Options.qll
new file mode 100644
index 000000000000..bc56cf3488d8
--- /dev/null
+++ b/cpp/ql/src/Options.qll
@@ -0,0 +1,185 @@
+/**
+ * Provides custom predicates that specify information about
+ * the behavior of the program being analyzed.
+ *
+ * By default they fall back to the reasonable defaults provided in
+ * `DefaultOptions.qll`, but by modifying this file, you can customize
+ * the standard Semmle analyses to give better results for your project.
+ */
+
+import cpp
+
+/**
+ * Customizable predicates that specify information about
+ * the behavior of the program being analyzed.
+ */
+class CustomOptions extends Options
+{
+ /**
+ * Holds if we wish to override the "may return NULL" inference for this
+ * call. If this holds, then rather than trying to infer whether this
+ * call might return NULL, we will instead test whether `returnsNull`
+ * holds for it.
+ *
+ * By default, this handles the `Xstrdup` function used by the CVS
+ * project.
+ */
+ override predicate overrideReturnsNull(Call call) {
+ Options.super.overrideReturnsNull(call)
+ }
+
+ /**
+ * Holds if this call may return NULL. This is only used if
+ * `overrideReturnsNull` holds for the call.
+ *
+ * By default, this handles the `Xstrdup` function used by the CVS
+ * project.
+ */
+ override predicate returnsNull(Call call) {
+ Options.super.returnsNull(call)
+ }
+
+ /**
+ * Holds if a call to this function will never return.
+ *
+ * By default, this holds for `exit`, `_exit`, `abort`, `__assert_fail`,
+ * `longjmp`, `error`, `__builtin_unreachable` and any function with a
+ * `noreturn` attribute.
+ */
+ override predicate exits(Function f) {
+ Options.super.exits(f)
+ }
+
+ /**
+ * Holds if evaluating expression `e` will never return, or can be assumed
+ * to never return. For example:
+ * ```
+ * __assume(0);
+ * ```
+ * (note that in this case if the hint is wrong and the expression is reached at
+ * runtime, the program's behaviour is undefined)
+ */
+ override predicate exprExits(Expr e) {
+ Options.super.exprExits(e)
+ }
+
+ /**
+ * Holds if function `f` should always have its return value checked.
+ *
+ * By default holds only for `fgets`.
+ */
+ override predicate alwaysCheckReturnValue(Function f) {
+ Options.super.alwaysCheckReturnValue(f)
+ }
+
+ /**
+ * Holds if it is reasonable to ignore the return value of function
+ * call `fc`.
+ *
+ * By default holds for calls to `select` where the first argument is
+ * `0` (commonly used as a way of sleeping), and any call inside a
+ * macro expansion.
+ */
+ override predicate okToIgnoreReturnValue(FunctionCall fc) {
+ Options.super.okToIgnoreReturnValue(fc)
+ }
+}
+
+/**
+ * A type that acts as a mutex.
+ */
+class CustomMutexType extends MutexType {
+ CustomMutexType() {
+ none()
+ }
+
+ /**
+ * Holds if `fc` is a call that always locks mutex `arg`
+ * of this type.
+ */
+ override predicate mustlockAccess(FunctionCall fc, Expr arg) {
+ none()
+ }
+
+ /**
+ * Holds if `fc` is a call that tries to lock mutex `arg`
+ * of this type, but may return without success.
+ */
+ override predicate trylockAccess(FunctionCall fc, Expr arg) {
+ none()
+ }
+
+ /**
+ * Holds if `fc` is a call that unlocks mutex `arg`
+ * of this type.
+ */
+ override predicate unlockAccess(FunctionCall fc, Expr arg) {
+ none()
+ }
+}
+
+/**
+ * DEPRECATED: customize `CustomOptions.overrideReturnsNull` instead.
+ *
+ * This predicate is required to support backwards compatibility for
+ * older `Options.qll` files. It should not be removed or modified by
+ * end users.
+ */
+predicate overrideReturnsNull(Call call) {
+ none()
+}
+
+/**
+ * DEPRECATED: customize `CustomOptions.returnsNull` instead.
+ *
+ * This predicate is required to support backwards compatibility for
+ * older `Options.qll` files. It should not be removed or modified by
+ * end users.
+ */
+predicate returnsNull(Call call) {
+ none()
+}
+
+/**
+ * DEPRECATED: customize `CustomOptions.exits` instead.
+ *
+ * This predicate is required to support backwards compatibility for
+ * older `Options.qll` files. It should not be removed or modified by
+ * end users.
+ */
+predicate exits(Function f) {
+ none()
+}
+
+/**
+ * DEPRECATED: customize `CustomOptions.exprExits` instead.
+ *
+ * This predicate is required to support backwards compatibility for
+ * older `Options.qll` files. It should not be removed or modified by
+ * end users.
+ */
+predicate exprExits(Expr e) {
+ none()
+}
+
+/**
+ * DEPRECATED: customize `CustomOptions.alwaysCheckReturnValue` instead.
+ *
+ * This predicate is required to support backwards compatibility for
+ * older `Options.qll` files. It should not be removed or modified by
+ * end users.
+ */
+predicate alwaysCheckReturnValue(Function f) {
+ none()
+}
+
+/**
+ * DEPRECATED: customize `CustomOptions.okToIgnoreReturnValue` instead.
+ *
+ * This predicate is required to support backwards compatibility for
+ * older `Options.qll` files. It should not be removed or modified by
+ * end users.
+ */
+predicate okToIgnoreReturnValue(FunctionCall fc) {
+ none()
+}
diff --git a/cpp/ql/src/PointsTo/Debug.ql b/cpp/ql/src/PointsTo/Debug.ql
new file mode 100644
index 000000000000..b3de13751f9b
--- /dev/null
+++ b/cpp/ql/src/PointsTo/Debug.ql
@@ -0,0 +1,17 @@
+/**
+ * @name Debug - find out what a particular function-pointer points to
+ * @description Query to help investigate mysterious results with ReturnStackAllocatedObject
+ * @kind table
+ * @id cpp/points-to/debug
+ */
+import cpp
+import semmle.code.cpp.pointsto.PointsTo
+
+class FieldAccessPT extends PointsToExpr
+{ override predicate interesting() { this instanceof FieldAccess } }
+
+from Function outer, FieldAccessPT fa
+where outer.hasName("rtLnDeliverableMayContainDividends")
+ and fa.(FieldAccess).getTarget().hasName("pfFunction")
+ and fa.getEnclosingFunction() = outer
+select fa, fa.pointsTo()
diff --git a/cpp/ql/src/PointsTo/PreparedStagedPointsTo.ql b/cpp/ql/src/PointsTo/PreparedStagedPointsTo.ql
new file mode 100644
index 000000000000..42ff979233ca
--- /dev/null
+++ b/cpp/ql/src/PointsTo/PreparedStagedPointsTo.ql
@@ -0,0 +1,12 @@
+/**
+ * @name PrepareStagedPointsTo
+ * @description Query to force evaluation of staged points-to predicates
+ * @kind table
+ * @id cpp/points-to/prepared-staged-points-to
+ */
+
+ import semmle.code.cpp.pointsto.PointsTo
+
+ select count(int set, Element location | setlocations(set, location)),
+ count(int set, Element element | pointstosets(set, element))
+
diff --git a/cpp/ql/src/PointsTo/Stats.ql b/cpp/ql/src/PointsTo/Stats.ql
new file mode 100644
index 000000000000..c77793ec5f23
--- /dev/null
+++ b/cpp/ql/src/PointsTo/Stats.ql
@@ -0,0 +1,20 @@
+/**
+ * @name Flow Statistics
+ * @description Count the number points-to sets with 0 or 1 incoming flow edges, and the total number of points-to sets
+ * @kind table
+ * @id cpp/points-to/stats
+ */
+import cpp
+import semmle.code.cpp.pointsto.PointsTo
+
+predicate inc(int set, int cnt)
+{
+ (setflow(set,_) or setflow(_, set)) and
+ cnt = count(int i | setflow(i, set) and i != set)
+}
+
+select
+ count(int set | inc(set, _)) as total,
+ count(int set | inc(set, 0)) as nullary,
+ count(int set | inc(set, 1)) as unary,
+ total - nullary - unary as rest
diff --git a/cpp/ql/src/PointsTo/TaintedFormatStrings.ql b/cpp/ql/src/PointsTo/TaintedFormatStrings.ql
new file mode 100644
index 000000000000..bb9977d46f5f
--- /dev/null
+++ b/cpp/ql/src/PointsTo/TaintedFormatStrings.ql
@@ -0,0 +1,89 @@
+/**
+ * @name Taint test
+ * @kind table
+ * @id cpp/points-to/tainted-format-strings
+ */
+import cpp
+import semmle.code.cpp.pointsto.PointsTo
+import semmle.code.cpp.pointsto.CallGraph
+
+predicate inputArgument(string function, int arg)
+{
+ (function = "read" and arg = 1) or
+ (function = "fread" and arg = 0) or
+ (function = "fgets" and arg = 0)
+ // ... add more
+}
+
+predicate inputBuffer(Expr e) {
+ exists(FunctionCall fc, string fname, int i |
+ fc.getTarget().getName() = fname and
+ inputArgument(fname, i) and
+ e = fc.getArgument(i))
+}
+
+class InputBuffer extends PointsToExpr
+{
+ InputBuffer() { inputBuffer(this) }
+ override predicate interesting() { inputBuffer(this) }
+}
+
+predicate formatArgument(string function, int i)
+{
+ (function = "printf" and i = 0) or
+ (function = "fprintf" and i = 1) or
+ (function = "sprintf" and i = 1) or
+ (function = "snprintf" and i = 2) or
+ (function = "d_printf" and i = 0) or
+ (function = "talloc_asprintf" and i = 1) or
+ (function = "fstr_sprintf" and i = 1) or
+ (function = "talloc_asprintf_append" and i = 1) or
+ (function = "d_fprintf" and i = 1) or
+ (function = "asprintf" and i = 1) or
+ (function = "talloc_asprintf_append_buffer" and i = 1) or
+ (function = "fdprintf" and i = 1) or
+ (function = "d_vfprintf" and i = 1) or
+ (function = "smb_xvasprintf" and i = 1) or
+ (function = "asprintf_strupper_m" and i = 1) or
+ (function = "talloc_asprintf_strupper_m" and i = 1) or
+ (function = "sprintf_append" and i = 4) or
+ (function = "x_vfprintf" and i = 1) or
+ (function = "x_fprintf" and i = 1) or
+ (function = "vasprintf" and i = 1) or
+ (function = "ldb_asprintf_errstring" and i = 1) or
+ (function = "talloc_vasprintf" and i = 1) or
+ (function = "talloc_vasprintf" and i = 1) or
+ (function = "fprintf_file" and i = 1) or
+ (function = "vsnprintf" and i = 2) or
+ (function = "talloc_vasprintf_append" and i = 1) or
+ (function = "__talloc_vaslenprintf_append" and i = 2) or
+ (function = "talloc_vasprintf_append_buffer" and i = 1) or
+ (function = "fprintf_attr" and i = 2) or
+ (function = "vprintf" and i = 0) or
+ (function = "vsprintf" and i = 1)
+}
+
+predicate formatBuffer(Expr e)
+{
+ exists(FunctionCall fc, string fname, int i |
+ fc.getTarget().getName() = fname and
+ formatArgument(fname, i) and
+ fc.getArgument(i) = e
+ )
+}
+
+class FormatBuffer extends PointsToExpr
+{
+ FormatBuffer() { formatBuffer(this) }
+ override predicate interesting() { formatBuffer(this) }
+}
+
+predicate potentialViolation(InputBuffer source, FormatBuffer dest)
+{
+ source.pointsTo() = dest.pointsTo() and
+ not exists(FunctionCall fc | fc = dest and fc.getTarget().hasName("lang_msg_rotate") and fc.getArgument(1) instanceof Literal)
+}
+
+from InputBuffer source, FormatBuffer dest
+where potentialViolation(source, dest)
+select dest.getFile() as File, dest as FormatString
diff --git a/cpp/ql/src/Power of 10/Rule 1/UseOfGoto.c b/cpp/ql/src/Power of 10/Rule 1/UseOfGoto.c
new file mode 100644
index 000000000000..ce9eb2aab3df
--- /dev/null
+++ b/cpp/ql/src/Power of 10/Rule 1/UseOfGoto.c
@@ -0,0 +1,9 @@
+int matching; int i;
+for (i = 0; i < numItems; i++) {
+ if (items[i] == item) {
+ matching = i;
+ goto found; // Problematic 'goto': Use 'break' instead.
+ }
+}
+found:
+// ... use 'matching' ...
diff --git a/cpp/ql/src/Power of 10/Rule 1/UseOfGoto.qhelp b/cpp/ql/src/Power of 10/Rule 1/UseOfGoto.qhelp
new file mode 100644
index 000000000000..b58bfe2c3037
--- /dev/null
+++ b/cpp/ql/src/Power of 10/Rule 1/UseOfGoto.qhelp
@@ -0,0 +1,27 @@
+
+
+
+
+
+Code should be restricted to very simple control flow constructs;
+in particular, the goto statement should not be used.
+Simpler control flow translates into stronger capabilities for
+analysis and often results in improved code clarity.
+
+
+
+Usually it is clearer to re-write uses of the goto statement
+in terms of the more structured control-flow constructs like
+if/else, switch statements or loops in
+conjunction with break or continue.
+
+
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Power of 10/Rule 1/UseOfGoto.ql b/cpp/ql/src/Power of 10/Rule 1/UseOfGoto.ql
new file mode 100644
index 000000000000..bd2b9311af62
--- /dev/null
+++ b/cpp/ql/src/Power of 10/Rule 1/UseOfGoto.ql
@@ -0,0 +1,13 @@
+/**
+ * @name Use of goto
+ * @description Using the goto statement complicates function control flow and hinders program understanding.
+ * @kind problem
+ * @id cpp/power-of-10/use-of-goto
+ * @problem.severity warning
+ * @tags maintainability
+ */
+
+import cpp
+
+from GotoStmt goto
+select goto, "The goto statement should not be used."
diff --git a/cpp/ql/src/Power of 10/Rule 1/UseOfJmp.ql b/cpp/ql/src/Power of 10/Rule 1/UseOfJmp.ql
new file mode 100644
index 000000000000..18b739f792ba
--- /dev/null
+++ b/cpp/ql/src/Power of 10/Rule 1/UseOfJmp.ql
@@ -0,0 +1,21 @@
+/**
+ * @name Use of setjmp or longjmp
+ * @description Using the setjmp and longjmp functions complicates control flow and hinders program understanding.
+ * @kind problem
+ * @id cpp/power-of-10/use-of-jmp
+ * @problem.severity warning
+ */
+
+import cpp
+
+class ForbiddenFunction extends Function {
+ ForbiddenFunction() {
+ exists(string name | name = this.getName() |
+ name = "setjmp" or name = "longjmp" or
+ name = "sigsetjmp" or name = "siglongjmp")
+ }
+}
+
+from FunctionCall call
+where call.getTarget() instanceof ForbiddenFunction
+select call, "The " + call.getTarget().getName() + " function should not be used."
diff --git a/cpp/ql/src/Power of 10/Rule 1/UseOfRecursion.ql b/cpp/ql/src/Power of 10/Rule 1/UseOfRecursion.ql
new file mode 100644
index 000000000000..24ccbdfae9c7
--- /dev/null
+++ b/cpp/ql/src/Power of 10/Rule 1/UseOfRecursion.ql
@@ -0,0 +1,23 @@
+/**
+ * @name Use of recursion
+ * @description Recursion makes the program call graph cyclic and hinders
+ * program understanding.
+ * @kind problem
+ * @id cpp/power-of-10/use-of-recursion
+ * @problem.severity warning
+ */
+
+import cpp
+
+class RecursiveCall extends FunctionCall {
+ RecursiveCall() {
+ this.getTarget().calls*(this.getEnclosingFunction())
+ }
+}
+
+from RecursiveCall call, string msg
+where if (call.getTarget() = call.getEnclosingFunction()) then
+ msg = "This call directly invokes its containing function $@."
+ else
+ msg = "The function " + call.getEnclosingFunction() + " is indirectly recursive via this call to $@."
+select call, msg, call.getTarget(), call.getTarget().getName()
diff --git a/cpp/ql/src/Power of 10/Rule 2/BoundedLoopIterations.ql b/cpp/ql/src/Power of 10/Rule 2/BoundedLoopIterations.ql
new file mode 100644
index 000000000000..7a34b4d9e34d
--- /dev/null
+++ b/cpp/ql/src/Power of 10/Rule 2/BoundedLoopIterations.ql
@@ -0,0 +1,116 @@
+/**
+ * @name Unbounded loop
+ * @description All loops should have a fixed upper bound; the counter should also be incremented along all paths within the loop.
+ This check excludes loops that are meant to be nonterminating (like schedulers).
+ * @kind problem
+ * @id cpp/power-of-10/bounded-loop-iterations
+ * @problem.severity warning
+ */
+
+import cpp
+
+predicate validVarForBound(Loop loop, Variable var) {
+ // The variable is read in the loop controlling expression
+ var.getAnAccess().getParent*() = loop.getControllingExpr() and
+ // The variable is not assigned in the loop body
+ not inScope(loop, var.getAnAssignment().getEnclosingStmt()) and
+ // The variable is not incremented/decremented in the loop body
+ not inScope(loop, var.getAnAccess().getParent().(CrementOperation).getEnclosingStmt())
+}
+
+predicate upperBoundCheck(Loop loop, VariableAccess checked) {
+ exists(RelationalOperation rop | loop.getControllingExpr().getAChild*() = rop |
+ checked = rop.getLesserOperand() and
+ // The RHS is something "valid", i.e. a constant or
+ // a variable that isn't assigned in the loop body
+ (
+ exists(rop.getGreaterOperand().getValue()) or
+ rop.getGreaterOperand().(VariableAccess).getTarget().isConst() or
+ validVarForBound(loop, rop.getGreaterOperand().(VariableAccess).getTarget())
+ ) and
+ not rop.getGreaterOperand() instanceof CharLiteral)
+}
+
+predicate lowerBoundCheck(Loop loop, VariableAccess checked) {
+ exists(RelationalOperation rop | loop.getControllingExpr().getAChild*() = rop |
+ checked = rop.getGreaterOperand() and
+ // The RHS is something "valid", i.e. a constant or
+ // a variable that isn't assigned in the loop body
+ (
+ exists(rop.getLesserOperand().getValue()) or
+ rop.getLesserOperand().(VariableAccess).getTarget().isConst() or
+ validVarForBound(loop, rop.getLesserOperand().(VariableAccess).getTarget())
+ ) and
+ not rop.getLesserOperand() instanceof CharLiteral)
+}
+
+VariableAccess getAnIncrement(Variable var) {
+ result.getTarget() = var and
+ (
+ result.getParent() instanceof IncrementOperation
+ or
+ exists(AssignAddExpr a | a.getLValue() = result and a.getRValue().getValue().toInt() > 0)
+ or
+ exists(AssignExpr a | a.getLValue() = result |
+ a.getRValue() =
+ any(AddExpr ae | ae.getAnOperand() = var.getAnAccess() and
+ ae.getAnOperand().getValue().toInt() > 0))
+ )
+}
+
+VariableAccess getADecrement(Variable var) {
+ result.getTarget() = var and
+ (
+ result.getParent() instanceof DecrementOperation
+ or
+ exists(AssignSubExpr a | a.getLValue() = result and a.getRValue().getValue().toInt() > 0)
+ or
+ exists(AssignExpr a | a.getLValue() = result |
+ a.getRValue() =
+ any(SubExpr ae | ae.getLeftOperand() = var.getAnAccess() and
+ ae.getRightOperand().getValue().toInt() > 0))
+ )
+}
+
+predicate inScope(Loop l, Stmt s) {
+ l.getAChild*() = s
+}
+
+predicate reachesNoInc(VariableAccess source, ControlFlowNode target) {
+ (upperBoundCheck(_, source) and source.getASuccessor() = target) or
+ exists(ControlFlowNode mid | reachesNoInc(source, mid) and not mid = getAnIncrement(source.getTarget()) |
+ target = mid.getASuccessor() and
+ inScope(source.getEnclosingStmt(), target.getEnclosingStmt()))
+}
+
+predicate reachesNoDec(VariableAccess source, ControlFlowNode target) {
+ (lowerBoundCheck(_, source) and source.getASuccessor() = target) or
+ exists(ControlFlowNode mid | reachesNoDec(source, mid) and not mid = getADecrement(source.getTarget()) |
+ target = mid.getASuccessor() and
+ inScope(source.getEnclosingStmt(), target.getEnclosingStmt()))
+}
+
+predicate hasSafeBound(Loop l) {
+ exists(VariableAccess bound | upperBoundCheck(l, bound) |
+ not reachesNoInc(bound, bound)
+ ) or exists(VariableAccess bound | lowerBoundCheck(l, bound) |
+ not reachesNoDec(bound, bound)
+ ) or exists(l.getControllingExpr().getValue())
+}
+
+from Loop loop, string msg
+where not hasSafeBound(loop) and
+ (
+ (
+ not upperBoundCheck(loop, _) and
+ not lowerBoundCheck(loop, _) and
+ msg = "This loop does not have a fixed bound."
+ ) or exists(VariableAccess bound | upperBoundCheck(loop, bound) and
+ reachesNoInc(bound, bound) and
+ msg = "The loop counter " + bound.getTarget().getName() + " is not always incremented in the loop body."
+ ) or exists(VariableAccess bound | lowerBoundCheck(loop, bound) and
+ reachesNoDec(bound, bound) and
+ msg = "The loop counter " + bound.getTarget().getName() + " is not always decremented in the loop body."
+ )
+ )
+select loop, msg
diff --git a/cpp/ql/src/Power of 10/Rule 2/ExitPermanentLoop.ql b/cpp/ql/src/Power of 10/Rule 2/ExitPermanentLoop.ql
new file mode 100644
index 000000000000..ebb8a67d51ee
--- /dev/null
+++ b/cpp/ql/src/Power of 10/Rule 2/ExitPermanentLoop.ql
@@ -0,0 +1,22 @@
+/**
+ * @name Exit from permanent loop
+ * @description Permanent loops (like "while(1) {..}") are typically meant to be non-terminating and should not be terminated by other means.
+ * @kind problem
+ * @id cpp/power-of-10/exit-permanent-loop
+ * @problem.severity warning
+ */
+
+import cpp
+
+Stmt exitFrom(Loop l) {
+ l.getAChild+() = result and
+ (result instanceof ReturnStmt or
+ exists(BreakStmt break | break = result |
+ not l.getAChild*() = break.getTarget())
+ )
+}
+
+from Loop l, Stmt exit
+where l.getControllingExpr().getValue().toInt() != 0 and
+ exit = exitFrom(l)
+select exit, "$@ should not be exited.", l, "This permanent loop"
diff --git a/cpp/ql/src/Power of 10/Rule 3/DynamicAllocAfterInit.ql b/cpp/ql/src/Power of 10/Rule 3/DynamicAllocAfterInit.ql
new file mode 100644
index 000000000000..80ddc2f367f9
--- /dev/null
+++ b/cpp/ql/src/Power of 10/Rule 3/DynamicAllocAfterInit.ql
@@ -0,0 +1,31 @@
+/**
+ * @name Dynamic allocation after initialization
+ * @description Dynamic memory allocation (using malloc() or calloc()) should be confined to the initialization routines of a program.
+ * @kind problem
+ * @id cpp/power-of-10/dynamic-alloc-after-init
+ * @problem.severity warning
+ */
+
+import cpp
+
+class Initialization extends Function {
+ Initialization() {
+ // Adapt this query to your codebase by changing this predicate to match
+ // precisely what functions count as "initialization", and are, hence,
+ // allowed to perform dynamic memory allocation.
+ this.getName().toLowerCase().matches("init%") or
+ this.getName().matches("%\\_init")
+ }
+}
+
+class Allocation extends FunctionCall {
+ Allocation() {
+ exists(string name | name = this.getTarget().getName() |
+ name = "malloc" or name = "calloc")
+ }
+}
+
+from Function f, Allocation a
+where not f instanceof Initialization and
+ a.getEnclosingFunction() = f
+select a, "Dynamic memory allocation is only allowed during initialization."
diff --git a/cpp/ql/src/Power of 10/Rule 4/FunctionTooLong.ql b/cpp/ql/src/Power of 10/Rule 4/FunctionTooLong.ql
new file mode 100644
index 000000000000..3431990dacd4
--- /dev/null
+++ b/cpp/ql/src/Power of 10/Rule 4/FunctionTooLong.ql
@@ -0,0 +1,33 @@
+/**
+ * @name Function too long
+ * @description Function length should be limited to what can be printed on a single sheet of paper (60 logical lines).
+ * @kind problem
+ * @id cpp/power-of-10/function-too-long
+ * @problem.severity warning
+ */
+
+import cpp
+
+class MacroFunctionCall extends MacroInvocation {
+ MacroFunctionCall() {
+ not exists(getParentInvocation()) and
+ this.getMacro().getHead().matches("%(%")
+ }
+
+ FunctionDeclarationEntry getFunction() {
+ result.getFunction() = this.getAGeneratedElement().(Stmt).getEnclosingFunction()
+ }
+}
+
+int logicalLength(FunctionDeclarationEntry f) {
+ result = count(Stmt s | s.getEnclosingFunction() = f.getFunction() and
+ s.getFile() = f.getFile() and
+ not s instanceof Block and
+ not s instanceof EmptyStmt and
+ not exists(ForStmt for | s = for.getInitialization()) and
+ not s.isAffectedByMacro()) + count(MacroFunctionCall mf | mf.getFunction() = f)
+}
+
+from FunctionDeclarationEntry f, int n
+where logicalLength(f) = n and n > 60
+select f.getFunction(), "Function " + f.getName() + " has too many logical lines (" + n + ", while 60 are allowed)."
diff --git a/cpp/ql/src/Power of 10/Rule 4/OneStmtPerLine.ql b/cpp/ql/src/Power of 10/Rule 4/OneStmtPerLine.ql
new file mode 100644
index 000000000000..32a85cc7f258
--- /dev/null
+++ b/cpp/ql/src/Power of 10/Rule 4/OneStmtPerLine.ql
@@ -0,0 +1,38 @@
+/**
+ * @name More than one statement per line
+ * @description Putting more than one statement on a single line hinders program understanding.
+ * @kind problem
+ * @id cpp/power-of-10/one-stmt-per-line
+ * @problem.severity warning
+ */
+
+import cpp
+
+class OneLineStmt extends Stmt {
+ OneLineStmt() {
+ this.getLocation().getStartLine() = this.getLocation().getEndLine() and
+ not this instanceof Block and
+ not exists(ForStmt for | this = for.getInitialization()) and
+ (
+ // Either this statement is not touched by a macro at all...
+ not this.isAffectedByMacro() or
+ // ... or it's the top-level statement generated by a macro invocation.
+ exists(MacroInvocation mi | this = mi.getAGeneratedElement() |
+ not this.getAChild+() = mi.getAGeneratedElement()
+ )
+ )
+ }
+
+ predicate onLine(File f, int line) {
+ f = this.getFile() and line = this.getLocation().getStartLine()
+ }
+}
+
+int numStmt(File f, int line) {
+ result = strictcount(OneLineStmt o | o.onLine(f, line))
+}
+
+from File f, int line, OneLineStmt o, int cnt
+where numStmt(f, line) = cnt and cnt > 1 and o.onLine(f, line)
+ and o.getLocation().getStartColumn() = min(OneLineStmt other, int toMin | (other.onLine(f, line)) and (toMin = other.getLocation().getStartColumn()) | toMin)
+select o, "This line contains " + cnt + " statements; only one is allowed."
diff --git a/cpp/ql/src/Power of 10/Rule 5/AssertionDensity.ql b/cpp/ql/src/Power of 10/Rule 5/AssertionDensity.ql
new file mode 100644
index 000000000000..eab591534537
--- /dev/null
+++ b/cpp/ql/src/Power of 10/Rule 5/AssertionDensity.ql
@@ -0,0 +1,42 @@
+/**
+ * @name Too few assertions
+ * @description Each function over 20 logical lines should have at least two assertions.
+ * @kind problem
+ * @id cpp/power-of-10/assertion-density
+ * @problem.severity warning
+ */
+
+import semmle.code.cpp.commons.Assertions
+
+class MacroFunctionCall extends MacroInvocation {
+ MacroFunctionCall() {
+ not exists(getParentInvocation()) and
+ this.getMacro().getHead().matches("%(%")
+ }
+
+ FunctionDeclarationEntry getFunction() {
+ result.getFunction() = this.getAGeneratedElement().(Stmt).getEnclosingFunction()
+ }
+}
+
+int logicalLength(FunctionDeclarationEntry f) {
+ result = count(Stmt s | s.getEnclosingFunction() = f.getFunction() and
+ s.getFile() = f.getFile() and
+ not s instanceof Block and
+ not s instanceof EmptyStmt and
+ not exists(ForStmt for | s = for.getInitialization()) and
+ not s.isAffectedByMacro()) + count(MacroFunctionCall mf | mf.getFunction() = f)
+}
+
+int assertionCount(FunctionDeclarationEntry f) {
+ result = count(Assertion a | a.getAsserted().getEnclosingFunction() = f.getFunction() and a.getFile() = f.getFile())
+}
+
+from FunctionDeclarationEntry f, int numAsserts, int size, int minSize
+where minSize = 20 and
+ numAsserts = assertionCount(f) and
+ numAsserts < 2 and
+ size = logicalLength(f) and
+ size > minSize
+select f.getFunction(), "Function " + f.getName() + " has " + size + " logical lines, but only "
+ + numAsserts + " assertion(s) -- minimum is 2 (for functions over " + minSize + " logical lines)."
diff --git a/cpp/ql/src/Power of 10/Rule 5/AssertionSideEffect.ql b/cpp/ql/src/Power of 10/Rule 5/AssertionSideEffect.ql
new file mode 100644
index 000000000000..6af42cececa0
--- /dev/null
+++ b/cpp/ql/src/Power of 10/Rule 5/AssertionSideEffect.ql
@@ -0,0 +1,14 @@
+/**
+ * @name Assertion with side effects
+ * @description When an assertion has side effects, disabling assertions will
+ * alter program behavior.
+ * @kind problem
+ * @id cpp/power-of-10/assertion-side-effect
+ * @problem.severity warning
+ */
+
+import semmle.code.cpp.commons.Assertions
+
+from Assertion a
+where not a.getAsserted().isPure()
+select a.getAsserted(), "Assertions should not have side effects."
diff --git a/cpp/ql/src/Power of 10/Rule 5/ConstantAssertion.ql b/cpp/ql/src/Power of 10/Rule 5/ConstantAssertion.ql
new file mode 100644
index 000000000000..8b7829e02126
--- /dev/null
+++ b/cpp/ql/src/Power of 10/Rule 5/ConstantAssertion.ql
@@ -0,0 +1,17 @@
+/**
+ * @name Constant assertion
+ * @description Assertions should check dynamic properties of pre-/post-conditions and invariants. Assertions that either always succeed or always fail are an error.
+ * @kind problem
+ * @id cpp/power-of-10/constant-assertion
+ * @problem.severity warning
+ */
+
+import semmle.code.cpp.commons.Assertions
+
+from Assertion a, string value, string msg
+where value = a.getAsserted().getValue() and
+ if value.toInt() = 0 then
+ msg = "This assertion is always false."
+ else
+ msg = "This assertion is always true."
+select a.getAsserted(), msg
diff --git a/cpp/ql/src/Power of 10/Rule 5/NonBooleanAssertion.ql b/cpp/ql/src/Power of 10/Rule 5/NonBooleanAssertion.ql
new file mode 100644
index 000000000000..f3bc0a70e1ad
--- /dev/null
+++ b/cpp/ql/src/Power of 10/Rule 5/NonBooleanAssertion.ql
@@ -0,0 +1,13 @@
+/**
+ * @name Non-Boolean assertion
+ * @description Assertions should be defined as Boolean tests, meaning "assert(p != NULL)" rather than "assert(p)".
+ * @kind problem
+ * @id cpp/power-of-10/non-boolean-assertion
+ * @problem.severity warning
+ */
+
+import semmle.code.cpp.commons.Assertions
+
+from Assertion a
+where a.getAsserted().getType() instanceof PointerType
+select a.getAsserted(), "Assertions should be defined as Boolean tests."
diff --git a/cpp/ql/src/Power of 10/Rule 6/GlobalCouldBeStatic.ql b/cpp/ql/src/Power of 10/Rule 6/GlobalCouldBeStatic.ql
new file mode 100644
index 000000000000..ea3f09d11615
--- /dev/null
+++ b/cpp/ql/src/Power of 10/Rule 6/GlobalCouldBeStatic.ql
@@ -0,0 +1,16 @@
+/**
+ * @name Global could be static
+ * @description Global variables that are not accessed outside their own file could be made static to promote information hiding.
+ * @kind problem
+ * @id cpp/power-of-10/global-could-be-static
+ * @problem.severity warning
+ */
+
+import cpp
+
+from GlobalVariable v
+where forex(VariableAccess va | va.getTarget() = v | va.getFile() = v.getDefinitionLocation().getFile())
+ and not v.hasSpecifier("static")
+ and strictcount(v.getAnAccess().getEnclosingFunction()) > 1 // If = 1, variable should be function-scope.
+select v, "The global variable " + v.getName() + " is not accessed outside of " + v.getFile().getBaseName() +
+ " and could be made static."
diff --git a/cpp/ql/src/Power of 10/Rule 6/VariableScopeTooLarge.ql b/cpp/ql/src/Power of 10/Rule 6/VariableScopeTooLarge.ql
new file mode 100644
index 000000000000..b6358d41c82d
--- /dev/null
+++ b/cpp/ql/src/Power of 10/Rule 6/VariableScopeTooLarge.ql
@@ -0,0 +1,14 @@
+/**
+ * @name Variable scope too large
+ * @description Global and file-scope variables that are accessed by only one function should be scoped within that function.
+ * @kind problem
+ * @id cpp/power-of-10/variable-scope-too-large
+ * @problem.severity warning
+ */
+
+import cpp
+
+from GlobalVariable v, Function f
+where v.getAnAccess().getEnclosingFunction() = f and
+ strictcount(v.getAnAccess().getEnclosingFunction()) = 1
+select v, "The variable " + v.getName() + " is only accessed in $@ and should be scoped accordingly.", f, f.getName()
diff --git a/cpp/ql/src/Power of 10/Rule 7/CheckArguments.ql b/cpp/ql/src/Power of 10/Rule 7/CheckArguments.ql
new file mode 100644
index 000000000000..e5d0a4d4d085
--- /dev/null
+++ b/cpp/ql/src/Power of 10/Rule 7/CheckArguments.ql
@@ -0,0 +1,24 @@
+/**
+ * @name Unchecked function argument
+ * @description Functions should check their arguments before their first use.
+ * @kind problem
+ * @id cpp/power-of-10/check-arguments
+ * @problem.severity warning
+ */
+
+import cpp
+
+predicate flow(Parameter p, ControlFlowNode n) {
+ (exists(p.getAnAccess()) and n = p.getFunction().getBlock()) or
+ exists(ControlFlowNode mid | flow(p, mid) and not mid = p.getAnAccess() and n = mid.getASuccessor())
+}
+
+VariableAccess firstAccess(Parameter p) {
+ flow(p, result) and result = p.getAnAccess()
+}
+
+from Parameter p, VariableAccess va
+where va = firstAccess(p) and
+ not exists(Expr e | e.isCondition() | e.getAChild*() = va)
+select va, "This use of parameter " + p.getName() + " has not been checked."
+
diff --git a/cpp/ql/src/Power of 10/Rule 7/CheckReturnValues.ql b/cpp/ql/src/Power of 10/Rule 7/CheckReturnValues.ql
new file mode 100644
index 000000000000..f52d65a9228c
--- /dev/null
+++ b/cpp/ql/src/Power of 10/Rule 7/CheckReturnValues.ql
@@ -0,0 +1,36 @@
+/**
+ * @name Unchecked return value
+ * @description The return value of each non-void function call should be checked for error conditions.
+ * @kind problem
+ * @id cpp/power-of-10/check-return-values
+ * @problem.severity warning
+ */
+
+import cpp
+
+/** In its full generality, the rule applies to all functions that
+ * return non-void, including things like 'printf' and 'close',
+ * which are routinely not checked because the behavior on success
+ * is the same as the behavior on failure. The recommendation is
+ * to add an explicit cast to void for such functions. For code
+ * bases that have not been developed with this rule in mind, at
+ * least for such commonly ignored functions, it may be better to
+ * add them as exceptions to this whitelist predicate.
+ */
+predicate whitelist(Function f) {
+ // Example:
+ // f.hasName("printf") or f.hasName("close") or // ...
+ none()
+}
+
+from FunctionCall c, string msg
+where not c.getTarget().getType() instanceof VoidType
+ and not whitelist(c.getTarget())
+ and
+ (
+ (c instanceof ExprInVoidContext and msg = "The return value of non-void function $@ is not checked.")
+ or
+ (definition(_, c.getParent()) and not definitionUsePair(_, c.getParent(), _) and
+ msg = "$@'s return value is stored but not checked.")
+ )
+select c, msg, c.getTarget() as f, f.getName()
diff --git a/cpp/ql/src/Power of 10/Rule 8/AvoidConditionalCompilation.ql b/cpp/ql/src/Power of 10/Rule 8/AvoidConditionalCompilation.ql
new file mode 100644
index 000000000000..e7626bbcba08
--- /dev/null
+++ b/cpp/ql/src/Power of 10/Rule 8/AvoidConditionalCompilation.ql
@@ -0,0 +1,14 @@
+/**
+ * @name Conditional compilation
+ * @description The use of conditional compilation directives must be kept to a minimum -- e.g. for header guards only.
+ * @kind problem
+ * @id cpp/power-of-10/avoid-conditional-compilation
+ * @problem.severity warning
+ */
+
+import cpp
+
+from PreprocessorDirective i
+where (i instanceof PreprocessorIf or i instanceof PreprocessorIfdef or i instanceof PreprocessorIfndef)
+ and not i.getFile() instanceof HeaderFile
+select i, "Use of conditional compilation must be kept to a minimum."
diff --git a/cpp/ql/src/Power of 10/Rule 8/PartialMacro.ql b/cpp/ql/src/Power of 10/Rule 8/PartialMacro.ql
new file mode 100644
index 000000000000..bcbd026ed15d
--- /dev/null
+++ b/cpp/ql/src/Power of 10/Rule 8/PartialMacro.ql
@@ -0,0 +1,27 @@
+/**
+ * @name Partial macro
+ * @description Macros must expand to complete syntactic units -- "#define MY_IF if(" is not legal.
+ * @kind problem
+ * @id cpp/power-of-10/partial-macro
+ * @problem.severity warning
+ */
+
+import cpp
+
+predicate incomplete(Macro m) {
+ exists(string body | body = m.getBody() and not m.getBody().matches("%\\") |
+ body.regexpMatch("[^(]*\\).*") or
+ body.regexpMatch("[^\\[]*].*") or
+ body.regexpMatch("[^{]*}.*") or
+ body.regexpMatch(".*\\([^)]*") or
+ body.regexpMatch(".*\\[[^\\]]*") or
+ body.regexpMatch(".*\\{[^}]*") or
+ count(body.indexOf("(")) != count(body.indexOf(")")) or
+ count(body.indexOf("[")) != count(body.indexOf("]")) or
+ count(body.indexOf("{")) != count(body.indexOf("}"))
+ )
+}
+
+from Macro m
+where incomplete(m)
+select m, "The macro " + m.getHead() + " will not expand into a syntactic unit."
diff --git a/cpp/ql/src/Power of 10/Rule 8/RestrictPreprocessor.ql b/cpp/ql/src/Power of 10/Rule 8/RestrictPreprocessor.ql
new file mode 100644
index 000000000000..32237426a1f5
--- /dev/null
+++ b/cpp/ql/src/Power of 10/Rule 8/RestrictPreprocessor.ql
@@ -0,0 +1,20 @@
+/**
+ * @name Disallowed preprocessor use
+ * @description The use of the preprocessor must be limited to inclusion of header files and simple macro definitions.
+ * @kind problem
+ * @id cpp/power-of-10/restrict-preprocessor
+ * @problem.severity warning
+ */
+
+import cpp
+
+from PreprocessorDirective p
+where not p instanceof Include and
+ not p instanceof Macro and
+ not p instanceof PreprocessorIf and
+ not p instanceof PreprocessorElif and
+ not p instanceof PreprocessorElse and
+ not p instanceof PreprocessorIfdef and
+ not p instanceof PreprocessorIfndef and
+ not p instanceof PreprocessorEndif
+select p, "This preprocessor directive is not allowed."
diff --git a/cpp/ql/src/Power of 10/Rule 8/UndisciplinedMacro.ql b/cpp/ql/src/Power of 10/Rule 8/UndisciplinedMacro.ql
new file mode 100644
index 000000000000..9dcb50581714
--- /dev/null
+++ b/cpp/ql/src/Power of 10/Rule 8/UndisciplinedMacro.ql
@@ -0,0 +1,14 @@
+/**
+ * @name Undisciplined macro
+ * @description Macros are not allowed to use complex preprocessor features like variable argument lists and token pasting.
+ * @kind problem
+ * @id cpp/power-of-10/undisciplined-macro
+ * @problem.severity warning
+ */
+
+import cpp
+
+from Macro m, string msg
+where (m.getHead().matches("%...%") and msg = "The macro " + m.getHead() + " is variadic, and hence not allowed.") or
+ (m.getBody().matches("%##%") and msg = "The macro " + m.getHead() + " uses token pasting and is not allowed.")
+select m, msg
diff --git a/cpp/ql/src/Power of 10/Rule 9/FunctionPointer.ql b/cpp/ql/src/Power of 10/Rule 9/FunctionPointer.ql
new file mode 100644
index 000000000000..ed1cf1973718
--- /dev/null
+++ b/cpp/ql/src/Power of 10/Rule 9/FunctionPointer.ql
@@ -0,0 +1,12 @@
+/**
+ * @name Function pointer call
+ * @description Function pointers are not permitted -- they make it impossible for a tool to prove the absence of recursion.
+ * @kind problem
+ * @id cpp/power-of-10/function-pointer
+ * @problem.severity warning
+ */
+
+import cpp
+
+from ExprCall e
+select e, "Calls through function pointers are not permitted."
diff --git a/cpp/ql/src/Power of 10/Rule 9/HiddenPointerIndirection.ql b/cpp/ql/src/Power of 10/Rule 9/HiddenPointerIndirection.ql
new file mode 100644
index 000000000000..5c827e3ad4af
--- /dev/null
+++ b/cpp/ql/src/Power of 10/Rule 9/HiddenPointerIndirection.ql
@@ -0,0 +1,13 @@
+/**
+ * @name Hidden pointer indirection
+ * @description Pointer indirection may not be hidden by typedefs -- "typedef int* IntPtr;" is not allowed.
+ * @kind problem
+ * @id cpp/power-of-10/hidden-pointer-indirection
+ * @problem.severity warning
+ */
+
+import cpp
+
+from TypedefType t
+where t.getBaseType().getPointerIndirectionLevel() > 0
+select t, "The typedef " + t.getName() + " hides pointer indirection."
diff --git a/cpp/ql/src/Power of 10/Rule 9/PointerNesting.ql b/cpp/ql/src/Power of 10/Rule 9/PointerNesting.ql
new file mode 100644
index 000000000000..64bd364ae162
--- /dev/null
+++ b/cpp/ql/src/Power of 10/Rule 9/PointerNesting.ql
@@ -0,0 +1,13 @@
+/**
+ * @name Pointer nesting too high
+ * @description No more than one level of pointer nesting/dereferencing should be used.
+ * @kind problem
+ * @id cpp/power-of-10/pointer-nesting
+ * @problem.severity warning
+ */
+
+import cpp
+
+from Variable v, int n
+where n = v.getType().(PointerType).getPointerIndirectionLevel() and n > 1
+select v, "The variable " + v.getName() + " uses " + n + " levels of pointer indirection."
diff --git a/cpp/ql/src/Security/CWE/CWE-022/TaintedPath.c b/cpp/ql/src/Security/CWE/CWE-022/TaintedPath.c
new file mode 100644
index 000000000000..63856888ebbc
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-022/TaintedPath.c
@@ -0,0 +1,22 @@
+int main(int argc, char** argv) {
+ char *userAndFile = argv[2];
+
+ {
+ char fileBuffer[FILENAME_MAX] = "/home/";
+ char *fileName = fileBuffer;
+ size_t len = strlen(fileName);
+ strncat(fileName+len, userAndFile, FILENAME_MAX-len-1);
+ // BAD: a string from the user is used in a filename
+ fopen(fileName, "wb+");
+ }
+
+ {
+ char fileBuffer[FILENAME_MAX] = "/home/";
+ char *fileName = fileBuffer;
+ size_t len = strlen(fileName);
+ // GOOD: use a fixed file
+ char* fixed = "jim/file.txt";
+ strncat(fileName+len, fixed, FILENAME_MAX-len-1);
+ fopen(fileName, "wb+");
+ }
+}
diff --git a/cpp/ql/src/Security/CWE/CWE-022/TaintedPath.qhelp b/cpp/ql/src/Security/CWE/CWE-022/TaintedPath.qhelp
new file mode 100644
index 000000000000..d7432369f0e8
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-022/TaintedPath.qhelp
@@ -0,0 +1,46 @@
+
+
+
+Accessing paths controlled by users can allow an attacker to access unexpected resources. This
+can result in sensitive information being revealed or deleted, or an attacker being able to influence
+behavior by modifying unexpected files.
+
+Paths that are naively constructed from data controlled by a user may contain unexpected special characters,
+such as "..". Such a path may potentially point to any directory on the filesystem.
+
+
+
+
+Validate user input before using it to construct a filepath. Ideally, follow these rules:
+
+
+- Do not allow more than a single "." character.
+- Do not allow directory separators such as "/" or "\" (depending on the filesystem).
+- Do not rely on simply replacing problematic sequences such as "../". For example, after applying this filter to
+".../...//" the resulting string would still be "../".
+- Ideally use a whitelist of known good patterns.
+
+
+
+
+
+In this example, a username and file are read from the arguments to main and then used to access a file in the
+user's home directory. However, a malicious user could enter a filename which contains special
+characters. For example, the string "../../etc/passwd" will result in the code reading the file located at
+"/home/[user]/../../etc/passwd", which is the system's password file. This could potentially allow them to
+access all the system's passwords.
+
+
+
+
+
+
+
+OWASP:
+Path Traversal.
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-022/TaintedPath.ql b/cpp/ql/src/Security/CWE/CWE-022/TaintedPath.ql
new file mode 100644
index 000000000000..3546b2bdbc22
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-022/TaintedPath.ql
@@ -0,0 +1,70 @@
+/**
+ * @name Uncontrolled data used in path expression
+ * @description Accessing paths influenced by users can allow an
+ * attacker to access unexpected resources.
+ * @kind problem
+ * @problem.severity warning
+ * @precision medium
+ * @id cpp/path-injection
+ * @tags security
+ * external/cwe/cwe-022
+ * external/cwe/cwe-023
+ * external/cwe/cwe-036
+ * external/cwe/cwe-073
+ */
+
+import cpp
+import semmle.code.cpp.security.FunctionWithWrappers
+import semmle.code.cpp.security.Security
+import semmle.code.cpp.security.TaintTracking
+
+/**
+ * A function for opening a file.
+ */
+class FileFunction extends FunctionWithWrappers {
+ FileFunction() {
+ exists(string nme | this.getQualifiedName() = nme |
+ nme = "fopen" or
+ nme = "_fopen" or
+ nme = "_wfopen" or
+ nme = "open" or
+ nme = "_open" or
+ nme = "_wopen" or
+
+ // create file function on windows
+ nme.matches("CreateFile%") or
+
+ // Objective C standard library
+ nme.matches("NSFileHandle%::+fileHandleFor%AtPath:")
+ )
+ or
+ (
+ // on any of the fstream classes, or filebuf
+ exists(string nme | this.getDeclaringType().getSimpleName() = nme |
+ nme = "basic_fstream" or
+ nme = "basic_ifstream" or
+ nme = "basic_ofstream" or
+ nme = "basic_filebuf"
+ )
+ and
+ // we look for either the open method or the constructor
+ (this.getName() = "open" or this instanceof Constructor)
+ )
+ }
+
+ // conveniently, all of these functions take the path as the first parameter!
+ override predicate interestingArg(int arg) {
+ arg = 0
+ }
+}
+
+from FileFunction fileFunction,
+ Expr taintedArg, Expr taintSource, string taintCause, string callChain
+where
+ fileFunction.outermostWrapperFunctionCall(taintedArg, callChain) and
+ tainted(taintSource, taintedArg) and
+ isUserInput(taintSource, taintCause)
+select
+ taintedArg,
+ "This argument to a file access function is derived from $@ and then passed to " + callChain,
+ taintSource, "user input (" + taintCause + ")"
diff --git a/cpp/ql/src/Security/CWE/CWE-078/ExecTainted.c b/cpp/ql/src/Security/CWE/CWE-078/ExecTainted.c
new file mode 100644
index 000000000000..da5950c5fe57
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-078/ExecTainted.c
@@ -0,0 +1,20 @@
+int main(int argc, char** argv) {
+ char *userName = argv[2];
+
+ {
+ // BAD: a string from the user is injected directly into
+ // a command line.
+ char command1[1000] = {0};
+ sprintf(command1, "userinfo -v \"%s\"", userName);
+ system(command1);
+ }
+
+ {
+ // GOOD: the user string is encoded by a library routine.
+ char userNameQuoted[1000] = {0};
+ encodeShellString(userNameQuoted, 1000, userName);
+ char command2[1000] = {0};
+ sprintf(command2, "userinfo -v %s", userNameQuoted);
+ system(command2);
+ }
+}
diff --git a/cpp/ql/src/Security/CWE/CWE-078/ExecTainted.qhelp b/cpp/ql/src/Security/CWE/CWE-078/ExecTainted.qhelp
new file mode 100644
index 000000000000..2e888bf80df5
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-078/ExecTainted.qhelp
@@ -0,0 +1,45 @@
+
+
+
+The code passes user input as part of a call to system
+or popen without escaping special elements. It generates
+a command line using sprintf, with the user-supplied data
+directly passed as a formatting argument. This leaves the code
+vulnerable to attack by command injection.
+
+
+
+
+Use a library routine to escape characters in the user-supplied
+string before passing it to a command shell.
+
+
+
+The following example runs an external command in two ways. The
+first way uses sprintf to build a command directly out of
+a user-supplied argument. As such, it is vulnerable to command
+injection. The second way quotes the user-provided value before
+embedding it in the command; assuming
+the encodeShellString utility is correct, this code
+should be safe against command injection.
+
+
+
+
+
+CERT C Coding Standard:
+STR02-C.
+Sanitize data passed to complex subsystems.
+
+OWASP:
+Command Injection.
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-078/ExecTainted.ql b/cpp/ql/src/Security/CWE/CWE-078/ExecTainted.ql
new file mode 100644
index 000000000000..17d5a62b2716
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-078/ExecTainted.ql
@@ -0,0 +1,26 @@
+/**
+ * @name Uncontrolled data used in OS command
+ * @description Using user-supplied data in an OS command, without
+ * neutralizing special elements, can make code vulnerable
+ * to command injection.
+ * @kind problem
+ * @problem.severity error
+ * @precision high
+ * @id cpp/command-line-injection
+ * @tags security
+ * external/cwe/cwe-078
+ * external/cwe/cwe-088
+ */
+import cpp
+import semmle.code.cpp.security.CommandExecution
+import semmle.code.cpp.security.Security
+import semmle.code.cpp.security.TaintTracking
+
+from Expr taintedArg, Expr taintSource, string taintCause, string callChain
+where shellCommand(taintedArg, callChain)
+ and tainted(taintSource, taintedArg)
+ and isUserInput(taintSource, taintCause)
+select
+ taintedArg,
+ "This argument to an OS command is derived from $@ and then passed to " + callChain,
+ taintSource, "user input (" + taintCause + ")"
diff --git a/cpp/ql/src/Security/CWE/CWE-079/CgiXss.c b/cpp/ql/src/Security/CWE/CWE-079/CgiXss.c
new file mode 100644
index 000000000000..20d93703ccd7
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-079/CgiXss.c
@@ -0,0 +1,20 @@
+void bad_server() {
+ char* query = getenv("QUERY_STRING");
+ puts("Query results for ");
+ // BAD: Printing out an HTTP parameter with no escaping
+ puts(query);
+ puts("\n
\n");
+ puts(do_search(query));
+}
+
+void good_server() {
+ char* query = getenv("QUERY_STRING");
+ puts("
Query results for ");
+ // GOOD: Escape HTML characters before adding to a page
+ char* query_escaped = escape_html(query);
+ puts(query_escaped);
+ free(query_escaped);
+
+ puts("\n
\n");
+ puts(do_search(query));
+}
diff --git a/cpp/ql/src/Security/CWE/CWE-079/CgiXss.qhelp b/cpp/ql/src/Security/CWE/CWE-079/CgiXss.qhelp
new file mode 100644
index 000000000000..ccd297c3b367
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-079/CgiXss.qhelp
@@ -0,0 +1,48 @@
+
+
+
+Directly writing an HTTP request parameter back to a web page
+allows for a cross-site scripting vulnerability. The data is displayed
+in a user's web browser as belonging to one site, but it is provided
+by some other site that the user browses to. In effect, such an attack
+allows one web site to insert content in the other one.
+
+For web servers implemented with the Common Gateway Interface
+(CGI), HTTP parameters are supplied via the QUERY_STRING
+environment variable.
+
+
+
+
+To guard against cross-site scripting, consider escaping special
+characters before writing the HTTP parameter back to the page.
+
+
+
+
+In the following example, the bad_server writes a
+parameter directly back to the HTML page that the user will
+see. The good_server first escapes any HTML special
+characters before writing to the HTML page.
+
+
+
+
+
+
+
+OWASP:
+XSS
+(Cross Site Scripting) Prevention Cheat Sheet.
+
+
+Wikipedia: Cross-site scripting.
+
+
+IETF Tools: The Common Gateway Specification (CGI).
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-079/CgiXss.ql b/cpp/ql/src/Security/CWE/CWE-079/CgiXss.ql
new file mode 100644
index 000000000000..217886ca8c39
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-079/CgiXss.ql
@@ -0,0 +1,35 @@
+/**
+ * @name CGI script vulnerable to cross-site scripting
+ * @description Writing user input directly to a web page
+ * allows for a cross-site scripting vulnerability.
+ * @kind problem
+ * @problem.severity error
+ * @precision high
+ * @id cpp/cgi-xss
+ * @tags security
+ * external/cwe/cwe-079
+ */
+import cpp
+import semmle.code.cpp.commons.Environment
+import semmle.code.cpp.security.TaintTracking
+
+/** A call that prints its arguments to `stdout`. */
+class PrintStdoutCall extends FunctionCall {
+ PrintStdoutCall() {
+ getTarget().hasQualifiedName("puts") or
+ getTarget().hasQualifiedName("printf")
+ }
+}
+
+/** A read of the QUERY_STRING environment variable */
+class QueryString extends EnvironmentRead {
+ QueryString() {
+ getEnvironmentVariable() = "QUERY_STRING"
+ }
+}
+
+from QueryString query, PrintStdoutCall call, Element printedArg
+where call.getAnArgument() = printedArg
+ and tainted(query, printedArg)
+select printedArg, "Cross-site scripting vulnerability due to $@.",
+ query, "this query data"
diff --git a/cpp/ql/src/Security/CWE/CWE-089/SqlTainted.c b/cpp/ql/src/Security/CWE/CWE-089/SqlTainted.c
new file mode 100644
index 000000000000..d207a2ca461c
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-089/SqlTainted.c
@@ -0,0 +1,15 @@
+int main(int argc, char** argv) {
+ char *userName = argv[2];
+
+ // BAD
+ char query1[1000] = {0};
+ sprintf(query1, "SELECT UID FROM USERS where name = \"%s\"", userName);
+ runSql(query1);
+
+ // GOOD
+ char userNameSql[1000] = {0};
+ encodeSqlString(userNameSql, 1000, userName);
+ char query2[1000] = {0};
+ sprintf(query2, "SELECT UID FROM USERS where name = \"%s\"", userNameSql);
+ runSql(query2);
+}
diff --git a/cpp/ql/src/Security/CWE/CWE-089/SqlTainted.qhelp b/cpp/ql/src/Security/CWE/CWE-089/SqlTainted.qhelp
new file mode 100644
index 000000000000..3d8f35fd483c
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-089/SqlTainted.qhelp
@@ -0,0 +1,31 @@
+
+
+
+The code passes user input as part of a SQL query without escaping special elements.
+It generates a SQL query using sprintf,
+with the user-supplied data directly passed as an argument
+to sprintf. This leaves the code vulnerable to attack by SQL Injection.
+
+
+
+
+Use a library routine to escape characters in the user-supplied
+string before converting it to SQL.
+
+
+
+
+
+
+
+
+Microsoft Developer Network: SQL Injection.
+
+
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-089/SqlTainted.ql b/cpp/ql/src/Security/CWE/CWE-089/SqlTainted.ql
new file mode 100644
index 000000000000..a2213ee084be
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-089/SqlTainted.ql
@@ -0,0 +1,36 @@
+/**
+ * @name Uncontrolled data in SQL query
+ * @description Including user-supplied data in a SQL query without
+ * neutralizing special elements can make code vulnerable
+ * to SQL Injection.
+ * @kind problem
+ * @problem.severity error
+ * @precision high
+ * @id cpp/sql-injection
+ * @tags security
+ * external/cwe/cwe-089
+ */
+import cpp
+import semmle.code.cpp.security.Security
+import semmle.code.cpp.security.FunctionWithWrappers
+import semmle.code.cpp.security.TaintTracking
+
+class SQLLikeFunction extends FunctionWithWrappers {
+ SQLLikeFunction() {
+ sqlArgument(this.getName(), _)
+ }
+
+ override predicate interestingArg(int arg) {
+ sqlArgument(this.getName(), arg)
+ }
+}
+
+from SQLLikeFunction runSql,
+ Expr taintedArg, Expr taintSource, string taintCause, string callChain
+where runSql.outermostWrapperFunctionCall(taintedArg, callChain)
+ and tainted(taintSource, taintedArg)
+ and isUserInput(taintSource, taintCause)
+select
+ taintedArg,
+ "This argument to a SQL query function is derived from $@ and then passed to " + callChain,
+ taintSource, "user input (" + taintCause + ")"
diff --git a/cpp/ql/src/Security/CWE/CWE-114/UncontrolledProcessOperation.c b/cpp/ql/src/Security/CWE/CWE-114/UncontrolledProcessOperation.c
new file mode 100644
index 000000000000..62c7f5d4c8e4
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-114/UncontrolledProcessOperation.c
@@ -0,0 +1,17 @@
+int main(int argc, char** argv) {
+ char *lib = argv[2];
+
+ // BAD: the user can cause arbitrary code to be loaded
+ void* handle = dlopen(lib, RTLD_LAZY);
+
+ // GOOD: only hard-coded libraries can be loaded
+ void* handle2;
+
+ if (!strcmp(lib, "inmem")) {
+ handle2 = dlopen("/usr/share/dbwrap/inmem", RTLD_LAZY);
+ } else if (!strcmp(lib, "mysql")) {
+ handle2 = dlopen("/usr/share/dbwrap/mysql", RTLD_LAZY);
+ } else {
+ die("Invalid library specified\n");
+ }
+}
diff --git a/cpp/ql/src/Security/CWE/CWE-114/UncontrolledProcessOperation.qhelp b/cpp/ql/src/Security/CWE/CWE-114/UncontrolledProcessOperation.qhelp
new file mode 100644
index 000000000000..fb0c7f03cb9b
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-114/UncontrolledProcessOperation.qhelp
@@ -0,0 +1,34 @@
+
+
+
+The code passes user input directly
+to system, dlopen, LoadLibrary
+or some other process or library routine. As a result, the user can
+cause execution of arbitrary code.
+
+
+
+
+If possible, use hard-coded string literals for the command to run
+or library to load. Instead of passing the user input directly to the
+process or library function, examine the user input and then choose
+among hard-coded string literals.
+
+If the applicable libraries or commands cannot be determined at
+compile time, then add code to verify that the user-input string is
+safe before using it.
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-114/UncontrolledProcessOperation.ql b/cpp/ql/src/Security/CWE/CWE-114/UncontrolledProcessOperation.ql
new file mode 100644
index 000000000000..408dedd943db
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-114/UncontrolledProcessOperation.ql
@@ -0,0 +1,26 @@
+/**
+ * @name Uncontrolled process operation
+ * @description Using externally controlled strings in a process
+ * operation can allow an attacker to execute malicious
+ * commands.
+ * @kind problem
+ * @problem.severity warning
+ * @precision medium
+ * @id cpp/uncontrolled-process-operation
+ * @tags security
+ * external/cwe/cwe-114
+ */
+
+import cpp
+import semmle.code.cpp.security.Security
+import semmle.code.cpp.security.TaintTracking
+
+from string processOperation, int processOperationArg,
+ FunctionCall call, Expr arg, Element source
+where isProcessOperationArgument(processOperation, processOperationArg)
+ and call.getTarget().getName() = processOperation
+ and call.getArgument(processOperationArg) = arg
+ and tainted(source, arg)
+select arg,
+ "The value of this argument may come from $@ and is being passed to " + processOperation,
+ source, source.toString()
diff --git a/cpp/ql/src/Security/CWE/CWE-119/OverflowBuffer.c b/cpp/ql/src/Security/CWE/CWE-119/OverflowBuffer.c
new file mode 100644
index 000000000000..9ce6d74afcb9
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-119/OverflowBuffer.c
@@ -0,0 +1,5 @@
+const char *message = "Hello";
+char password[32];
+char buffer[256];
+
+memcpy(buffer, message, 256);
diff --git a/cpp/ql/src/Security/CWE/CWE-119/OverflowBuffer.qhelp b/cpp/ql/src/Security/CWE/CWE-119/OverflowBuffer.qhelp
new file mode 100644
index 000000000000..2611bae27bef
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-119/OverflowBuffer.qhelp
@@ -0,0 +1,25 @@
+
+
+
+
+The software uses a function to access a memory buffer in a way that may read or write data past the end of that buffer. This may result in software instability, improper access to or corruption of sensitive information, or code execution by an attacker.
+
+
+
+When accessing buffers with functions such as memcpy, memset or strncpy, ensure that the size value for the operation is no greater than the amount of space available in the destination buffer. Failure to do this may permit a buffer overwrite to occur. Also ensure that the size value is no greater than the amount of data in the source buffer, to prevent a buffer overread from occurring.
+
+
+
+In the following example, memcpy is used to fill a buffer with data from a string.
+
+Although the size of the operation matches the destination buffer, the source is only 6 bytes long so an overread will occur. This could copy sensitive data from nearby areas of memory (such as the local variable password in this example) into the buffer as well, potentially making it visible to an attacker.
+
+To fix this issue, reduce the size of the memcpy to the smaller of the source and destination buffers, min(256, strlen(message) + 1). Alternatively in this case it would be more appropriate to use the strncpy function rather than memcpy.
+
+
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-119/OverflowBuffer.ql b/cpp/ql/src/Security/CWE/CWE-119/OverflowBuffer.ql
new file mode 100644
index 000000000000..c15552384e98
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-119/OverflowBuffer.ql
@@ -0,0 +1,48 @@
+/**
+ * @name Call to memory access function may overflow buffer
+ * @description Incorrect use of a function that accesses a memory
+ * buffer may read or write data past the end of that
+ * buffer.
+ * @kind problem
+ * @id cpp/overflow-buffer
+ * @problem.severity recommendation
+ * @tags security
+ * external/cwe/cwe-119
+ * external/cwe/cwe-121
+ * external/cwe/cwe-122
+ * external/cwe/cwe-126
+ */
+import semmle.code.cpp.security.BufferWrite
+import semmle.code.cpp.security.BufferAccess
+
+bindingset[num, singular, plural]
+string plural(int num, string singular, string plural) {
+ if (num = 1) then (
+ result = num + singular
+ ) else (
+ result = num + plural
+ )
+}
+
+from BufferAccess ba, string bufferDesc, int accessSize, int accessType,
+ Element bufferAlloc, int bufferSize, string message
+where accessSize = ba.getSize()
+ and bufferSize = getBufferSize(ba.getBuffer(bufferDesc, accessType),
+ bufferAlloc)
+ and accessSize > bufferSize
+ and if accessType = 1 then (
+ message = "This '" + ba.getName() + "' operation accesses "
+ + plural(accessSize, " byte", " bytes")
+ + " but the $@ is only "
+ + plural(bufferSize, " byte", " bytes") + "."
+ ) else if accessType = 2 then (
+ message = "This '" + ba.getName() + "' operation may access "
+ + plural(accessSize, " byte", " bytes")
+ + " but the $@ is only "
+ + plural(bufferSize, " byte", " bytes") + "."
+ ) else (
+ message = "This array indexing operation accesses byte offset "
+ + (accessSize - 1) + " but the $@ is only "
+ + plural(bufferSize, " byte", " bytes") + "."
+ )
+select ba, message, bufferAlloc, bufferDesc
diff --git a/cpp/ql/src/Security/CWE/CWE-120/BadlyBoundedWrite.c b/cpp/ql/src/Security/CWE/CWE-120/BadlyBoundedWrite.c
new file mode 100644
index 000000000000..1bce58ea9c05
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-120/BadlyBoundedWrite.c
@@ -0,0 +1,10 @@
+void congratulateUser(const char *userName)
+{
+ char buffer[80];
+
+ // BAD: even though snprintf is used, this could overflow the buffer
+ // because the size specified is too large.
+ snprintf(buffer, 256, "Congratulations, %s!", userName);
+
+ MessageBox(hWnd, buffer, "New Message", MB_OK);
+}
\ No newline at end of file
diff --git a/cpp/ql/src/Security/CWE/CWE-120/BadlyBoundedWrite.qhelp b/cpp/ql/src/Security/CWE/CWE-120/BadlyBoundedWrite.qhelp
new file mode 100644
index 000000000000..b8ae720a6626
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-120/BadlyBoundedWrite.qhelp
@@ -0,0 +1,25 @@
+
+
+
+The program performs a buffer copy or write operation with an incorrect upper limit on the size of the copy. A sufficiently long input will overflow the target buffer. In addition to causing program instability, techniques exist which may allow an attacker to use this vulnerability to execute arbitrary code.
+
+
+
+Use preprocessor defines to specify the size of buffers, and use the same defines as arguments to strncpy, snprintf etc. This technique will ensure that buffer sizes are always specified correctly so that no overflow occurs.
+
+
+
+
+
+In this example, the developer has used snprintf to control the maximum number of characters that can be written to buffer. Unfortunately, perhaps due to modifications since the code was first written, a limited buffer overrun can still occur because the size argument to snprintf is larger than the actual size of the buffer.
+
+To fix the problem, either the second argument to snprintf should be changed to 80, or the buffer extended to 256 characters. A further improvement is to use a preprocessor define so that the size is only specified in one place, potentially preventing future recurrence of this issue.
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-120/BadlyBoundedWrite.ql b/cpp/ql/src/Security/CWE/CWE-120/BadlyBoundedWrite.ql
new file mode 100644
index 000000000000..1638f14f15f9
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-120/BadlyBoundedWrite.ql
@@ -0,0 +1,24 @@
+/**
+ * @name Badly bounded write
+ * @description Buffer write operations with a length parameter that
+ * does not match the size of the destination buffer may
+ * overflow.
+ * @kind problem
+ * @problem.severity error
+ * @precision high
+ * @id cpp/badly-bounded-write
+ * @tags reliability
+ * security
+ * external/cwe/cwe-120
+ * external/cwe/cwe-787
+ * external/cwe/cwe-805
+ */
+import semmle.code.cpp.security.BufferWrite
+
+// see CWE-120UnboundedWrite.ql for a summary of CWE-120 violation cases
+
+from BufferWrite bw, int destSize
+where bw.hasExplicitLimit() // has an explicit size limit
+ and destSize = getBufferSize(bw.getDest(), _)
+ and (bw.getExplicitLimit() > destSize) // but it's larger than the destination
+select bw, "This '" + bw.getBWDesc() + "' operation is limited to " + bw.getExplicitLimit() + " bytes but the destination is only " + destSize + " bytes."
diff --git a/cpp/ql/src/Security/CWE/CWE-120/OverrunWrite.c b/cpp/ql/src/Security/CWE/CWE-120/OverrunWrite.c
new file mode 100644
index 000000000000..5ab3645753b0
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-120/OverrunWrite.c
@@ -0,0 +1,9 @@
+void sayHello()
+{
+ char buffer[10];
+
+ // BAD: this message overflows the buffer
+ strcpy(buffer, "Hello, world!");
+
+ MessageBox(hWnd, buffer, "New Message", MB_OK);
+}
\ No newline at end of file
diff --git a/cpp/ql/src/Security/CWE/CWE-120/OverrunWrite.qhelp b/cpp/ql/src/Security/CWE/CWE-120/OverrunWrite.qhelp
new file mode 100644
index 000000000000..1d3bda7d97e1
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-120/OverrunWrite.qhelp
@@ -0,0 +1,35 @@
+
+
+
+The program performs a buffer copy or write operation with no upper limit on the size of the copy, and it appears that certain inputs will cause a buffer overflow to occur in this case. In addition to causing program instability, techniques exist which may allow an attacker to use this vulnerability to execute arbitrary code.
+
+
+
+Always control the length of buffer copy and buffer write operations. strncpy should be used over strcpy, snprintf over sprintf, and in other cases 'n-variant' functions should be preferred.
+
+
+
+
+
+In this example, the call to strcpy copies a message of 14 characters (including the terminating null) into a buffer with space for just 10 characters. As such, the last four characters overflow the buffer resulting in undefined behavior.
+
+To fix this issue three changes should be made:
+
+ - Control the size of the buffer using a preprocessor define.
+ - Replace the call to
strcpy with strncpy, specifying the define as the maximum length to copy. This will prevent the buffer overflow.
+ - Consider increasing the buffer size, say to 20 characters, so that the message is displayed correctly.
+
+
+
+
+
+CERT C Coding Standard: STR31-C. Guarantee that storage for strings has sufficient space for character data and the null terminator.
+
+
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-120/OverrunWrite.ql b/cpp/ql/src/Security/CWE/CWE-120/OverrunWrite.ql
new file mode 100644
index 000000000000..d27bd80a8655
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-120/OverrunWrite.ql
@@ -0,0 +1,29 @@
+/**
+ * @name Potentially overrunning write
+ * @description Buffer write operations that do not control the length
+ * of data written may overflow.
+ * @kind problem
+ * @problem.severity error
+ * @precision medium
+ * @id cpp/overrunning-write
+ * @tags reliability
+ * security
+ * external/cwe/cwe-120
+ * external/cwe/cwe-787
+ * external/cwe/cwe-805
+ */
+import semmle.code.cpp.security.BufferWrite
+import semmle.code.cpp.commons.Alloc
+
+// see CWE-120UnboundedWrite.ql for a summary of CWE-120 violation cases
+
+from BufferWrite bw, Expr dest, int destSize
+where not bw.hasExplicitLimit() // has no explicit size limit
+ and dest = bw.getDest()
+ and destSize = getBufferSize(dest, _)
+ and // we can deduce that too much data may be copied (even without
+ // long '%f' conversions)
+ bw.getMaxDataLimited() > destSize
+select bw, "This '" + bw.getBWDesc() + "' operation requires "
+ + bw.getMaxData() + " bytes but the destination is only "
+ + destSize + " bytes."
diff --git a/cpp/ql/src/Security/CWE/CWE-120/OverrunWriteFloat.c b/cpp/ql/src/Security/CWE/CWE-120/OverrunWriteFloat.c
new file mode 100644
index 000000000000..a93a31dfb32c
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-120/OverrunWriteFloat.c
@@ -0,0 +1,9 @@
+void displayValue(double value)
+{
+ char buffer[256];
+
+ // BAD: extreme values may overflow the buffer
+ sprintf(buffer, "%f", value);
+
+ MessageBox(hWnd, buffer, "A Number", MB_OK);
+}
\ No newline at end of file
diff --git a/cpp/ql/src/Security/CWE/CWE-120/OverrunWriteFloat.qhelp b/cpp/ql/src/Security/CWE/CWE-120/OverrunWriteFloat.qhelp
new file mode 100644
index 000000000000..e88259c6fb3b
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-120/OverrunWriteFloat.qhelp
@@ -0,0 +1,35 @@
+
+
+
+The program performs a buffer copy or write operation that includes one or more float to string conversions (i.e. the %f format specifier), which may overflow the destination buffer if extreme inputs are given. In addition to causing program instability, techniques exist which may allow an attacker to use this vulnerability to execute arbitrary code.
+
+
+
+Always control the length of buffer copy and buffer write operations. strncpy should be used over strcpy, snprintf over sprintf, and in other cases 'n-variant' functions should be preferred.
+
+
+
+
+
+In this example, the call to sprintf contains a %f format specifier. Though a 256 character buffer has been allowed, it is not sufficient for the most extreme floating point inputs. For example the representation of double value 1e304 (that is 1 with 304 zeroes after it) will overflow a buffer of this length.
+
+To fix this issue three changes should be made:
+
+ - Control the size of the buffer using a preprocessor define.
+ - Replace the call to
sprintf with snprintf, specifying the define as the maximum length to copy. This will prevent the buffer overflow.
+ - Consider using the %g format specifier instead of %f.
+
+
+
+
+
+CERT C Coding
+Standard: STR31-C. Guarantee
+that storage for strings has sufficient space for character data and
+the null terminator.
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-120/OverrunWriteFloat.ql b/cpp/ql/src/Security/CWE/CWE-120/OverrunWriteFloat.ql
new file mode 100644
index 000000000000..be41c88fc205
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-120/OverrunWriteFloat.ql
@@ -0,0 +1,25 @@
+/**
+ * @name Potentially overrunning write with float to string conversion
+ * @description Buffer write operations that do not control the length
+ * of data written may overflow when floating point inputs
+ * take extreme values.
+ * @kind problem
+ * @problem.severity error
+ * @precision medium
+ * @id cpp/overrunning-write-with-float
+ * @tags reliability
+ * security
+ * external/cwe/cwe-120
+ * external/cwe/cwe-787
+ * external/cwe/cwe-805
+ */
+import semmle.code.cpp.security.BufferWrite
+
+// see CWE-120UnboundedWrite.ql for a summary of CWE-120 violation cases
+
+from BufferWrite bw, int destSize
+where (not bw.hasExplicitLimit()) // has no explicit size limit
+ and destSize = getBufferSize(bw.getDest(), _)
+ and (bw.getMaxData() > destSize) // and we can deduce that too much data may be copied
+ and (bw.getMaxDataLimited() <= destSize) // but it would fit without long '%f' conversions
+select bw, "This '" + bw.getBWDesc() + "' operation may require " + bw.getMaxData() + " bytes because of float conversions, but the target is only " + destSize + " bytes."
diff --git a/cpp/ql/src/Security/CWE/CWE-120/UnboundedWrite.c b/cpp/ql/src/Security/CWE/CWE-120/UnboundedWrite.c
new file mode 100644
index 000000000000..a9825c903626
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-120/UnboundedWrite.c
@@ -0,0 +1,9 @@
+void congratulateUser(const char *userName)
+{
+ char buffer[80];
+
+ // BAD: this could overflow the buffer if the UserName is long
+ sprintf(buffer, "Congratulations, %s!", userName);
+
+ MessageBox(hWnd, buffer, "New Message", MB_OK);
+}
\ No newline at end of file
diff --git a/cpp/ql/src/Security/CWE/CWE-120/UnboundedWrite.qhelp b/cpp/ql/src/Security/CWE/CWE-120/UnboundedWrite.qhelp
new file mode 100644
index 000000000000..d6bd626a08e3
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-120/UnboundedWrite.qhelp
@@ -0,0 +1,30 @@
+
+
+
+The program performs a buffer copy or write operation with no upper limit on the size of the copy. An unexpectedly long input that reaches this code will cause the buffer to overflow. In addition to causing program instability, techniques exist which may allow an attacker to use this vulnerability to execute arbitrary code.
+
+
+
+Always control the length of buffer copy and buffer write operations. strncpy should be used over strcpy, snprintf over sprintf etc. In general 'n-variant' functions should be preferred.
+
+
+
+
+
+In this example, the call to sprintf may overflow buffer. This occurs if the argument userName is very long, such that the resulting string is more than the 80 characters allowed.
+
+To fix the problem the call to sprintf should be replaced with snprintf, specifying a maximum length of 80 characters.
+
+
+
+
+CERT C++ Coding Standard: STR50-CPP. Guarantee that storage for strings has sufficient space for character data and the null terminator.
+
+
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-120/UnboundedWrite.ql b/cpp/ql/src/Security/CWE/CWE-120/UnboundedWrite.ql
new file mode 100644
index 000000000000..322669b3b3b8
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-120/UnboundedWrite.ql
@@ -0,0 +1,72 @@
+/**
+ * @name Unbounded write
+ * @description Buffer write operations that do not control the length
+ * of data written may overflow.
+ * @kind problem
+ * @problem.severity error
+ * @precision medium
+ * @id cpp/unbounded-write
+ * @tags reliability
+ * security
+ * external/cwe/cwe-120
+ * external/cwe/cwe-787
+ * external/cwe/cwe-805
+ */
+import semmle.code.cpp.security.BufferWrite
+import semmle.code.cpp.security.Security
+import semmle.code.cpp.security.TaintTracking
+
+// --- Summary of CWE-120 violations ---
+//
+// The essence of CWE-120 is that string / buffer copies that are
+// potentially unbounded, e.g. null terminated string copy,
+// should be controlled e.g. by using strncpy instead of strcpy.
+// In practice this is divided into several queries that
+// handle slightly different sub-cases, exclude some acceptable uses,
+// and produce reasonable messages to fit each issue.
+//
+// cases:
+// hasExplicitLimit() exists(getMaxData()) exists(getBufferSize(bw.getDest(), _))) handled by
+// NO NO either UnboundedWrite.ql isUnboundedWrite()
+// NO YES NO UnboundedWrite.ql isMaybeUnboundedWrite()
+// NO YES YES OverrunWrite.ql, OverrunWriteFloat.ql
+// YES either YES BadlyBoundedWrite.ql
+// YES either NO (assumed OK)
+
+// --- CWE-120UnboundedWrite ---
+
+predicate isUnboundedWrite(BufferWrite bw) {
+ not bw.hasExplicitLimit() // has no explicit size limit
+ and (not exists(bw.getMaxData())) // and we can't deduce an upper bound to the amount copied
+}
+
+/*predicate isMaybeUnboundedWrite(BufferWrite bw)
+{
+ not bw.hasExplicitLimit() // has no explicit size limit
+ and exists(bw.getMaxData()) // and we can deduce an upper bound to the amount copied
+ and (not exists(getBufferSize(bw.getDest(), _))) // but we can't work out the size of the destination to be sure
+}*/
+
+// --- user input reach ---
+
+/**
+ * Identifies expressions that are potentially tainted with user
+ * input. Most of the work for this is actually done by the
+ * TaintTracking library.
+ */
+predicate tainted2(Expr expr, Expr inputSource, string inputCause) {
+ (
+ taintedIncludingGlobalVars(inputSource, expr, _) and
+ inputCause = inputSource.toString()
+ ) or exists(Expr e | tainted2(e, inputSource, inputCause) |
+ // field accesses of a tainted struct are tainted
+ e = expr.(FieldAccess).getQualifier()
+ )
+}
+
+// --- put it together ---
+
+from BufferWrite bw, Expr inputSource, string inputCause
+where isUnboundedWrite(bw)
+ and tainted2(bw.getASource(), inputSource, inputCause)
+select bw, "This '" + bw.getBWDesc() + "' with input from $@ may overflow the destination.", inputSource, inputCause
diff --git a/cpp/ql/src/Security/CWE/CWE-121/UnterminatedVarargsCall.cpp b/cpp/ql/src/Security/CWE/CWE-121/UnterminatedVarargsCall.cpp
new file mode 100644
index 000000000000..96b013ba4b64
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-121/UnterminatedVarargsCall.cpp
@@ -0,0 +1,31 @@
+#include
+
+void pushStrings(char *firstString, ...)
+{
+ va_list args;
+ char *arg;
+
+ va_start(args, firstString);
+
+ // process inputs, beginning with firstString, ending when NULL is reached
+ arg = firstString;
+ while (arg != NULL)
+ {
+ // push the string
+ pushString(arg);
+
+ // move on to the next input
+ arg = va_arg(args, char *);
+ }
+
+ va_end(args);
+}
+
+void badFunction()
+{
+ pushStrings("hello", "world", NULL); // OK
+
+ pushStrings("apple", "pear", "banana", NULL); // OK
+
+ pushStrings("car", "bus", "train"); // BAD, not terminated with the expected NULL
+}
\ No newline at end of file
diff --git a/cpp/ql/src/Security/CWE/CWE-121/UnterminatedVarargsCall.qhelp b/cpp/ql/src/Security/CWE/CWE-121/UnterminatedVarargsCall.qhelp
new file mode 100644
index 000000000000..fbbc425500e5
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-121/UnterminatedVarargsCall.qhelp
@@ -0,0 +1,23 @@
+
+
+
+The program calls a function that expects the variable argument list to be terminated with a sentinel value (typically NULL, 0 or -1). In this case, the sentinel value has been omitted as a final argument. This defect may result in incorrect behavior of the function and unintended stack memory access, leading to incorrect program results, instability, and even vulnerability to buffer overflow style attacks.
+
+
+
+Each description of a defect highlighted by this rule includes a suggested value for the terminator. Check that this value is correct, then add it to the end of the call.
+
+
+
+
+
+In this example, the third call to pushStrings is not correctly terminated. This call should be updated to include NULL as the fourth and final argument to this call.
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-121/UnterminatedVarargsCall.ql b/cpp/ql/src/Security/CWE/CWE-121/UnterminatedVarargsCall.ql
new file mode 100644
index 000000000000..30872663b005
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-121/UnterminatedVarargsCall.ql
@@ -0,0 +1,88 @@
+/**
+ * @name Unterminated variadic call
+ * @description Calling a variadic function without a sentinel value
+ * may result in a buffer overflow if the function expects
+ * a specific value to terminate the argument list.
+ * @kind problem
+ * @problem.severity warning
+ * @precision medium
+ * @id cpp/unterminated-variadic-call
+ * @tags reliability
+ * security
+ * external/cwe/cwe-121
+ */
+
+import cpp
+
+/**
+ * Gets a normalized textual representation of `e`'s value.
+ * The result is the same as `Expr.getValue()`, except if there is a
+ * trailing `".0"` then it is removed. This means that, for example,
+ * the values of `-1` and `-1.0` would be considered the same.
+ */
+string normalisedExprValue(Expr e) {
+ result = e.getValue().regexpReplaceAll("\\.0$", "")
+}
+
+/**
+ * A variadic function which is not a formatting function.
+ */
+class VarargsFunction extends Function {
+ VarargsFunction() {
+ this.isVarargs() and
+ not this instanceof FormattingFunction
+ }
+
+ Expr trailingArgumentIn(FunctionCall fc) {
+ fc = this.getACallToThisFunction() and
+ result = fc.getArgument(fc.getNumberOfArguments() - 1)
+ }
+
+ string trailingArgValue(FunctionCall fc) {
+ result = normalisedExprValue(this.trailingArgumentIn(fc))
+ }
+
+ private
+ int trailingArgValueCount(string value) {
+ result = strictcount(FunctionCall fc | trailingArgValue(fc) = value)
+ }
+
+ string nonTrailingVarArgValue(FunctionCall fc, int index) {
+ fc = this.getACallToThisFunction() and
+ index >= this.getNumberOfParameters() and
+ index < fc.getNumberOfArguments() - 1 and
+ result = normalisedExprValue(fc.getArgument(index))
+ }
+
+ private
+ int totalCount() {
+ result = strictcount(FunctionCall fc | fc = this.getACallToThisFunction())
+ }
+
+ string normalTerminator(int cnt) {
+ (
+ result = "0" or result = "-1"
+ ) and (
+ cnt = trailingArgValueCount(result)
+ ) and (
+ 2 * cnt > totalCount()
+ ) and not exists(FunctionCall fc, int index |
+ // terminator value is used in a non-terminating position
+ nonTrailingVarArgValue(fc, index) = result
+ )
+ }
+
+ predicate isWhitelisted() {
+ this.hasQualifiedName("open") or
+ this.hasQualifiedName("fcntl") or
+ this.hasQualifiedName("ptrace")
+ }
+}
+
+from VarargsFunction f, FunctionCall fc, string terminator, int cnt
+where terminator = f.normalTerminator(cnt)
+ and fc = f.getACallToThisFunction()
+ and not normalisedExprValue(f.trailingArgumentIn(fc)) = terminator
+ and not f.isWhitelisted()
+select fc, "Calls to $@ should use the value " + terminator
+ + " as a terminator (" + cnt + " calls do).", f, f.getQualifiedName()
diff --git a/cpp/ql/src/Security/CWE/CWE-129/ImproperArrayIndexValidation.qhelp b/cpp/ql/src/Security/CWE/CWE-129/ImproperArrayIndexValidation.qhelp
new file mode 100644
index 000000000000..9cf4426231c5
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-129/ImproperArrayIndexValidation.qhelp
@@ -0,0 +1,37 @@
+
+
+
+C and C++ do not have built-in bounds checking for array indexing
+expressions such as x[i]. If i is out of
+bounds then the program will read/write whatever data happens to be at
+that address. An attacker who is able to control the value
+of i might be able to read or modify data which they are
+not authorized to access.
+
+
+
+
+Always check the bounds of array indexing expressions, especially
+if the index value is derived from user-controlled data.
+
+
+
+
+In this example, a string is read from a socket and converted to
+an int. This int is then used to index
+the data array. Because the index value is a
+user-controlled value, it could be out of bounds.
+
+
+
+Below, the problem has been fixed by adding a guard:
+
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-129/ImproperArrayIndexValidation.ql b/cpp/ql/src/Security/CWE/CWE-129/ImproperArrayIndexValidation.ql
new file mode 100644
index 000000000000..a50e164e8af5
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-129/ImproperArrayIndexValidation.ql
@@ -0,0 +1,40 @@
+/**
+ * @name Unclear validation of array index
+ * @description Accessing an array without first checking
+ * that the index is within the bounds of the array can
+ * cause undefined behavior and can also be a security risk.
+ * @kind problem
+ * @id cpp/unclear-array-index-validation
+ * @problem.severity warning
+ * @tags security
+ * external/cwe/cwe-129
+ */
+import cpp
+import semmle.code.cpp.controlflow.Guards
+private import semmle.code.cpp.rangeanalysis.RangeAnalysisUtils
+import semmle.code.cpp.security.TaintTracking
+
+predicate hasUpperBound(VariableAccess offsetExpr) {
+ exists(
+ BasicBlock controlled, LocalScopeVariable offsetVar, SsaDefinition def
+ | controlled.contains(offsetExpr) and
+ linearBoundControls(controlled, def, offsetVar) and
+ offsetExpr = def.getAUse(offsetVar))
+}
+
+pragma[noinline]
+predicate linearBoundControls(BasicBlock controlled, SsaDefinition def, LocalScopeVariable offsetVar) {
+ exists(GuardCondition guard, boolean branch |
+ guard.controls(controlled, branch) and
+ cmpWithLinearBound(guard, def.getAUse(offsetVar), Lesser(), branch)
+ )
+}
+
+from Expr origin, ArrayExpr arrayExpr, VariableAccess offsetExpr
+where tainted(origin, offsetExpr)
+ and offsetExpr = arrayExpr.getArrayOffset()
+ and not hasUpperBound(offsetExpr)
+select
+ offsetExpr,
+ "$@ flows to here and is used in an array indexing expression, potentially causing an invalid access.",
+ origin, "User-provided value"
diff --git a/cpp/ql/src/Security/CWE/CWE-129/ImproperArrayIndexValidationBad.c b/cpp/ql/src/Security/CWE/CWE-129/ImproperArrayIndexValidationBad.c
new file mode 100644
index 000000000000..76fbc588bf09
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-129/ImproperArrayIndexValidationBad.c
@@ -0,0 +1,17 @@
+int example(int socket, int data[]) {
+ char inputBuffer[CHAR_ARRAY_SIZE];
+ int recvResult;
+ int i;
+
+ recvResult = recv(socket, inputBuffer, CHAR_ARRAY_SIZE - 1, 0);
+ if (recvResult < 0)
+ {
+ return -1;
+ }
+
+ inputBuffer[recvResult] = '\0';
+ i = atoi(inputBuffer);
+
+ // BAD: i has not been validated.
+ return data[i];
+}
diff --git a/cpp/ql/src/Security/CWE/CWE-129/ImproperArrayIndexValidationGood.c b/cpp/ql/src/Security/CWE/CWE-129/ImproperArrayIndexValidationGood.c
new file mode 100644
index 000000000000..9e69d5986b32
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-129/ImproperArrayIndexValidationGood.c
@@ -0,0 +1,21 @@
+int example(int socket, int data[], int ndata) {
+ char inputBuffer[CHAR_ARRAY_SIZE];
+ int recvResult;
+ int i;
+
+ recvResult = recv(socket, inputBuffer, CHAR_ARRAY_SIZE - 1, 0);
+ if (recvResult < 0)
+ {
+ return -1;
+ }
+
+ inputBuffer[recvResult] = '\0';
+ i = atoi(inputBuffer);
+
+ if (i < 0 || ndata <= i) {
+ return -1;
+ }
+
+ // GOOD: i has been validated.
+ return data[i];
+}
diff --git a/cpp/ql/src/Security/CWE/CWE-131/NoSpaceForZeroTerminator.c b/cpp/ql/src/Security/CWE/CWE-131/NoSpaceForZeroTerminator.c
new file mode 100644
index 000000000000..0dc3255da6b9
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-131/NoSpaceForZeroTerminator.c
@@ -0,0 +1,11 @@
+
+void flawed_strdup(const char *input)
+{
+ char *copy;
+
+ /* Fail to allocate space for terminating '\0' */
+ copy = (char *)malloc(strlen(input));
+ strcpy(copy, input);
+ return copy;
+}
+
diff --git a/cpp/ql/src/Security/CWE/CWE-131/NoSpaceForZeroTerminator.qhelp b/cpp/ql/src/Security/CWE/CWE-131/NoSpaceForZeroTerminator.qhelp
new file mode 100644
index 000000000000..1bed6a59f523
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-131/NoSpaceForZeroTerminator.qhelp
@@ -0,0 +1,37 @@
+
+
+
+
+
+This rule identifies calls to malloc that call strlen to determine
+the required buffer size, but do not allocate space for the zero terminator.
+
+
+
+
+
+The expression highlighted by this rule creates a buffer that is of insufficient size to contain
+the data being copied. This makes the code vulnerable to buffer overflow which can result in anything from a segmentation fault to a security vulnerability (particularly if the array is on stack-allocated memory).
+
+
+
+Increase the size of the buffer being allocated by one or
+replace malloc, strcpy pairs with a call to strdup
+
+
+
+
+
+
+
+
+CERT C Coding
+Standard: MEM35-C. Allocate
+sufficient memory for an object.
+
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-131/NoSpaceForZeroTerminator.ql b/cpp/ql/src/Security/CWE/CWE-131/NoSpaceForZeroTerminator.ql
new file mode 100644
index 000000000000..20a90caa761c
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-131/NoSpaceForZeroTerminator.ql
@@ -0,0 +1,38 @@
+/**
+ * @name No space for zero terminator
+ * @description Allocating a buffer using 'malloc' without ensuring that
+ * there is always space for the entire string and a zero
+ * terminator can cause a buffer overrun.
+ * @kind problem
+ * @problem.severity error
+ * @precision high
+ * @id cpp/no-space-for-terminator
+ * @tags reliability
+ * security
+ * external/cwe/cwe-131
+ * external/cwe/cwe-120
+ * external/cwe/cwe-122
+ */
+import cpp
+
+class MallocCall extends FunctionCall {
+ MallocCall() { this.getTarget().hasGlobalName("malloc") }
+
+ Expr getAllocatedSize() {
+ if this.getArgument(0) instanceof VariableAccess then
+ exists(LocalScopeVariable v, ControlFlowNode def |
+ definitionUsePair(v, def, this.getArgument(0)) and
+ exprDefinition(v, def, result))
+ else
+ result = this.getArgument(0)
+ }
+}
+
+predicate terminationProblem(MallocCall malloc, string msg) {
+ malloc.getAllocatedSize() instanceof StrlenCall and
+ msg = "This allocation does not include space to null-terminate the string."
+}
+
+from Expr problem, string msg
+where terminationProblem(problem, msg)
+select problem, msg
diff --git a/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatString.c b/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatString.c
new file mode 100644
index 000000000000..c3733120fa0f
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatString.c
@@ -0,0 +1,16 @@
+#include
+
+void printWrapper(char *str) {
+ printf(str);
+}
+
+int main(int argc, char **argv) {
+ // This should be avoided
+ printf(argv[1]);
+
+ // This should be avoided too, because it has the same effect
+ printWrapper(argv[1]);
+
+ // This is fine
+ printf("%s", argv[1]);
+}
\ No newline at end of file
diff --git a/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatString.qhelp b/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatString.qhelp
new file mode 100644
index 000000000000..aec75e161fb4
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatString.qhelp
@@ -0,0 +1,27 @@
+
+
+
+The program uses input from the user as a format string for printf style functions. This can lead to buffer overflows or data representation problems. An attacker can exploit this weakness to crash the program, disclose information or even execute arbitrary code.
+
+The results of this rule do not include inputs from the user that are transferred through global variables.
+Those can be found in the related rule "Uncontrolled format string (through global variable)".
+
+
+
+Use constant expressions as the format strings. If you need to print a value from the user, use printf("%s", value_from_user).
+
+
+
+
+
+
+
+
+CERT C Coding
+Standard: FIO30-C. Exclude user input from format strings.
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatString.ql b/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatString.ql
new file mode 100644
index 000000000000..4fa6efb2d916
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatString.ql
@@ -0,0 +1,28 @@
+/**
+ * @name Uncontrolled format string
+ * @description Using externally-controlled format strings in
+ * printf-style functions can lead to buffer overflows
+ * or data representation problems.
+ * @kind problem
+ * @problem.severity warning
+ * @precision medium
+ * @id cpp/tainted-format-string
+ * @tags reliability
+ * security
+ * external/cwe/cwe-134
+ */
+
+import cpp
+import semmle.code.cpp.security.Security
+import semmle.code.cpp.security.FunctionWithWrappers
+import semmle.code.cpp.security.TaintTracking
+
+from PrintfLikeFunction printf, Expr arg, string printfFunction,
+ Expr userValue, string cause
+where
+ printf.outermostWrapperFunctionCall(arg, printfFunction)
+ and tainted(userValue, arg)
+ and isUserInput(userValue, cause)
+select arg,
+ "The value of this argument may come from $@ and is being used as a formatting argument to " + printfFunction,
+ userValue, cause
diff --git a/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatStringThroughGlobalVar.c b/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatStringThroughGlobalVar.c
new file mode 100644
index 000000000000..2700109a586c
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatStringThroughGlobalVar.c
@@ -0,0 +1,24 @@
+#include
+
+char *copy;
+
+void copyArgv(char **argv) {
+ copy = argv[1];
+}
+
+void printWrapper(char *str) {
+ printf(str);
+}
+
+int main(int argc, char **argv) {
+ copyArgv(argv);
+
+ // This should be avoided
+ printf(copy);
+
+ // This should be avoided too, because it has the same effect
+ printWrapper(copy);
+
+ // This is fine
+ printf("%s", copy);
+}
diff --git a/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatStringThroughGlobalVar.qhelp b/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatStringThroughGlobalVar.qhelp
new file mode 100644
index 000000000000..80b84580a57f
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatStringThroughGlobalVar.qhelp
@@ -0,0 +1,36 @@
+
+
+
+The program uses input from the user, propagated via a global variable, as a format string for printf style functions.
+This can lead to buffer overflows or data representation problems. An attacker can exploit this weakness to crash the program,
+disclose information or even execute arbitrary code.
+
+This rule only identifies inputs from the user that are transferred through global variables before being used in printf style functions.
+Analyzing the flow of data through global variables is more prone to errors and so this rule may identify some examples of code where
+the input is not really from the user. For example, when a global variable is set in two places, one that comes from the user and one that does not.
+In this case we would mark all usages of the global variable as input from the user, but the input from the user may always came after the call to the
+printf style functions.
+
+The results of this rule should be considered alongside the related rule "Uncontrolled format string" which tracks the flow of the
+values input by a user, excluding global variables, until the values are used as the format argument for a printf like function call.
+
+
+
+Use constant expressions as the format strings. If you need to print a value from the user, use printf("%s", value_from_user).
+
+
+
+
+
+
+
+
+CERT C Coding
+Standard: FIO30-C. Exclude
+user input from format strings.
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatStringThroughGlobalVar.ql b/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatStringThroughGlobalVar.ql
new file mode 100644
index 000000000000..e4beeb8c24b4
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-134/UncontrolledFormatStringThroughGlobalVar.ql
@@ -0,0 +1,28 @@
+/**
+ * @name Uncontrolled format string (through global variable)
+ * @description Using externally-controlled format strings in
+ * printf-style functions can lead to buffer overflows
+ * or data representation problems.
+ * @kind problem
+ * @problem.severity warning
+ * @precision medium
+ * @id cpp/tainted-format-string-through-global
+ * @tags reliability
+ * security
+ * external/cwe/cwe-134
+ */
+
+import cpp
+import semmle.code.cpp.security.FunctionWithWrappers
+import semmle.code.cpp.security.Security
+import semmle.code.cpp.security.TaintTracking
+
+from PrintfLikeFunction printf, Expr arg, string printfFunction,
+ Expr userValue, string cause, string globalVar
+where printf.outermostWrapperFunctionCall(arg, printfFunction)
+ and not tainted(_, arg)
+ and taintedIncludingGlobalVars(userValue, arg, globalVar)
+ and isUserInput(userValue, cause)
+select arg,
+ "This value may flow through $@, originating from $@, and is a formatting argument to " + printfFunction + ".",
+ globalVarFromId(globalVar), globalVar, userValue, cause
diff --git a/cpp/ql/src/Security/CWE/CWE-170/ImproperNullTerminationTainted.qhelp b/cpp/ql/src/Security/CWE/CWE-170/ImproperNullTerminationTainted.qhelp
new file mode 100644
index 000000000000..42c6719b8380
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-170/ImproperNullTerminationTainted.qhelp
@@ -0,0 +1,49 @@
+
+
+
+
+
+ Built-in C string functions such as strcpy require that their
+input string arguments are null terminated. If the input string arguments are
+not null terminated, these functions will read/write beyond the length of the
+buffer containing the string, resulting in either buffer over-read or buffer
+overflow, respectively.
+
+
+
+
+
+ Always guard against user-controlled strings that may not be null terminated.
+Otherwise, an attacker may be able to supply input without null termination.
+
+
+
+
+In this example, a string is read from a file using the read
+function. Because the value may be user-controlled, the string may not be
+null terminated, in which case the call to strcpy will perform
+a buffer overwrite on cpy, potentially resulting in a program
+crash.
+
+
+
+
+In the revised example, the number of bytes read is recorded in the variable
+count. In addition to checking that the read succeeds (the condition
+count >= 0), a null terminator is inserted before the call to
+strcpy.
+
+
+
+
+
+
+
+
+ B. Chess and J. West, Secure Programming with Static Analysis, 6.2 Maintaining the Null Terminator. Addison-Wesley. 2007.
+ Linux Programmer's Manual: READ(2), STRCPY(3).
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-170/ImproperNullTerminationTainted.ql b/cpp/ql/src/Security/CWE/CWE-170/ImproperNullTerminationTainted.ql
new file mode 100644
index 000000000000..0f93593cfd28
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-170/ImproperNullTerminationTainted.ql
@@ -0,0 +1,93 @@
+/**
+ * @name User-controlled data may not be null terminated
+ * @description String operations on user-controlled strings can result in
+ * buffer overflow or buffer over-read.
+ * @kind problem
+ * @id cpp/user-controlled-null-termination-tainted
+ * @problem.severity warning
+ * @tags security
+ * external/cwe/cwe-170
+ */
+
+import cpp
+import semmle.code.cpp.commons.NullTermination
+import semmle.code.cpp.security.TaintTracking
+
+/** A user-controlled expression that may not be null terminated. */
+class TaintSource extends VariableAccess {
+ TaintSource() {
+ exists(SecurityOptions x, string cause |
+ this.getTarget() instanceof SemanticStackVariable and
+ x.isUserInput(this, cause) |
+ cause = "read" or
+ cause = "fread" or
+ cause = "recv" or
+ cause = "recvfrom" or
+ cause = "recvmsg"
+ )
+ }
+
+ /**
+ * Holds if `sink` is a tainted variable access that must be null
+ * terminated.
+ */
+ private predicate isSink(VariableAccess sink) {
+ tainted(this, sink) and
+ variableMustBeNullTerminated(sink)
+ }
+
+ /**
+ * Holds if this source can reach `va`, possibly using intermediate
+ * reassignments.
+ */
+ private predicate sourceReaches(VariableAccess va) {
+ definitionUsePair(_, this, va)
+ or
+ exists(VariableAccess mid, Expr def |
+ sourceReaches(mid) and
+ exprDefinition(_, def, mid) and
+ definitionUsePair(_, def, va)
+ )
+ }
+
+ /**
+ * Holds if the sink `sink` is reachable both from this source and
+ * from `va`, possibly using intermediate reassignments.
+ */
+ private predicate reachesSink(VariableAccess va, VariableAccess sink) {
+ isSink(sink) and
+ va = sink
+ or
+ exists(VariableAccess mid, Expr def |
+ reachesSink(mid, sink) and
+ exprDefinition(_, def, va) and
+ definitionUsePair(_, def, mid)
+ )
+ }
+
+ /**
+ * Holds if `sink` is a tainted variable access that must be null
+ * terminated, and no access which null terminates its contents can
+ * either reach the sink or be reached from the source. (Ideally,
+ * we should instead look for such accesses only on the path from
+ * this source to `sink` found via `tainted(source, sink)`.)
+ * */
+ predicate reaches(VariableAccess sink) {
+ isSink(sink) and
+ not exists(VariableAccess va |
+ va != this and
+ va != sink and
+ mayAddNullTerminator(_, va) |
+ sourceReaches(va)
+ or
+ reachesSink(va, sink)
+ )
+ }
+}
+
+from TaintSource source, VariableAccess sink
+where source.reaches(sink)
+select
+ sink,
+ "$@ flows to here and may not be null terminated.",
+ source, "User-provided value"
diff --git a/cpp/ql/src/Security/CWE/CWE-170/ImproperNullTerminationTaintedBad.cpp b/cpp/ql/src/Security/CWE/CWE-170/ImproperNullTerminationTaintedBad.cpp
new file mode 100644
index 000000000000..094f9ceb9ac3
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-170/ImproperNullTerminationTaintedBad.cpp
@@ -0,0 +1,4 @@
+char buf[BUF_SIZE];
+read(fd, buf, BUF_SIZE);
+char cpy[BUF_SIZE];
+strcpy(cpy, buf);
\ No newline at end of file
diff --git a/cpp/ql/src/Security/CWE/CWE-170/ImproperNullTerminationTaintedGood.cpp b/cpp/ql/src/Security/CWE/CWE-170/ImproperNullTerminationTaintedGood.cpp
new file mode 100644
index 000000000000..8bf081029d6c
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-170/ImproperNullTerminationTaintedGood.cpp
@@ -0,0 +1,7 @@
+char buf[BUF_SIZE];
+int count = read(fd, buf, BUF_SIZE);
+if (count >= 0) {
+ buf[count < BUF_SIZE ? count : BUF_SIZE - 1] = '\0';
+ char cpy[BUF_SIZE];
+ strcpy(cpy, buf);
+}
\ No newline at end of file
diff --git a/cpp/ql/src/Security/CWE/CWE-190/ArithmeticTainted.c b/cpp/ql/src/Security/CWE/CWE-190/ArithmeticTainted.c
new file mode 100644
index 000000000000..2a108fbc6460
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-190/ArithmeticTainted.c
@@ -0,0 +1,18 @@
+int main(int argc, char** argv) {
+ char buffer[20];
+ fgets(buffer, 20, stdin);
+
+ int num = atoi(buffer);
+ // BAD: may overflow if input is very large
+ int scaled = num + 1000;
+
+ // ...
+
+ int num2 = atoi(buffer);
+ int scaled2;
+ // GOOD: use a guard to prevent overflow
+ if (num2 < INT_MAX-1000)
+ scaled2 = num2 + 1000;
+ else
+ scaled2 = INT_MAX;
+}
diff --git a/cpp/ql/src/Security/CWE/CWE-190/ArithmeticTainted.qhelp b/cpp/ql/src/Security/CWE/CWE-190/ArithmeticTainted.qhelp
new file mode 100644
index 000000000000..b09c84f7cfe8
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-190/ArithmeticTainted.qhelp
@@ -0,0 +1,44 @@
+
+
+
+Performing calculations on user-controlled data can result in integer overflows
+unless the input is validated.
+
+If the user is free to enter very large numbers, even arithmetic operations that would usually
+result in a small change in magnitude may result in overflows.
+
+
+
+
+Always guard against overflow in arithmetic operations on user-controlled data by doing one of the
+following:
+
+
+- Validate the user input.
+- Define a guard on the arithmetic expression, so that the operation is performed only if the
+result can be known to be less than, or equal to, the maximum value for the type, for example
INT_MAX.
+- Use a wider type, so that larger input values do not cause overflow.
+
+
+
+
+
+In this example, a value is read from standard input into an int. Because the value
+is a user-controlled value, it could be extremely large. Performing arithmetic operations on this
+value could therefore cause an overflow. To avoid this happening, the example shows how to perform
+a check before performing a multiplication.
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-190/ArithmeticTainted.ql b/cpp/ql/src/Security/CWE/CWE-190/ArithmeticTainted.ql
new file mode 100644
index 000000000000..16382cb86a77
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-190/ArithmeticTainted.ql
@@ -0,0 +1,33 @@
+/**
+ * @name User-controlled data in arithmetic expression
+ * @description Arithmetic operations on user-controlled data that is
+ * not validated can cause overflows.
+ * @kind problem
+ * @problem.severity warning
+ * @precision medium
+ * @id cpp/tainted-arithmetic
+ * @tags security
+ * external/cwe/cwe-190
+ * external/cwe/cwe-191
+ */
+import cpp
+
+import semmle.code.cpp.security.Overflow
+import semmle.code.cpp.security.Security
+import semmle.code.cpp.security.TaintTracking
+
+predicate taintedVarAccess(Expr origin, VariableAccess va) {
+ isUserInput(origin, _) and
+ tainted(origin, va)
+}
+
+from Expr origin, BinaryArithmeticOperation op, VariableAccess va, string effect
+where taintedVarAccess(origin, va)
+ and op.getAnOperand() = va
+ and
+ (
+ (missingGuardAgainstUnderflow(op, va) and effect = "underflow") or
+ (missingGuardAgainstOverflow(op, va) and effect = "overflow")
+ )
+select va, "$@ flows to here and is used in arithmetic, potentially causing an " + effect + ".",
+ origin, "User-provided value"
diff --git a/cpp/ql/src/Security/CWE/CWE-190/ArithmeticUncontrolled.c b/cpp/ql/src/Security/CWE/CWE-190/ArithmeticUncontrolled.c
new file mode 100644
index 000000000000..fee75d549188
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-190/ArithmeticUncontrolled.c
@@ -0,0 +1,15 @@
+int main(int argc, char** argv) {
+ int i = rand();
+ // BAD: potential overflow
+ int j = i + 1000;
+
+ // ...
+
+ int n = rand();
+ int k;
+ // GOOD: use a guard to prevent overflow
+ if (n < INT_MAX-1000)
+ k = n + 1000;
+ else
+ k = INT_MAX;
+}
diff --git a/cpp/ql/src/Security/CWE/CWE-190/ArithmeticUncontrolled.qhelp b/cpp/ql/src/Security/CWE/CWE-190/ArithmeticUncontrolled.qhelp
new file mode 100644
index 000000000000..265c6172efce
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-190/ArithmeticUncontrolled.qhelp
@@ -0,0 +1,44 @@
+
+
+
+Performing calculations on uncontrolled data can result in integer overflows
+unless the input is validated.
+
+If the data is not under your control, and can take extremely large values,
+even arithmetic operations that would usually result in a small change in magnitude may result in overflows.
+
+
+
+
+Always guard against overflow in arithmetic operations on uncontrolled data by doing one of the
+following:
+
+
+- Validate the data.
+- Define a guard on the arithmetic expression, so that the operation is performed only if the
+result can be known to be less than, or equal to, the maximum value for the type, for example
INT_MAX.
+- Use a wider type, so that larger input values do not cause overflow.
+
+
+
+
+
+In this example, a random integer is generated. Because the value
+is not controlled by the programmer, it could be extremely large. Performing arithmetic operations on this
+value could therefore cause an overflow. To avoid this happening, the example shows how to perform
+a check before performing an arithmetic operation.
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-190/ArithmeticUncontrolled.ql b/cpp/ql/src/Security/CWE/CWE-190/ArithmeticUncontrolled.ql
new file mode 100644
index 000000000000..a6d03dfe2d58
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-190/ArithmeticUncontrolled.ql
@@ -0,0 +1,59 @@
+/**
+ * @name Uncontrolled data in arithmetic expression
+ * @description Arithmetic operations on uncontrolled data that is not
+ * validated can cause overflows.
+ * @kind problem
+ * @problem.severity warning
+ * @precision medium
+ * @id cpp/uncontrolled-arithmetic
+ * @tags security
+ * external/cwe/cwe-190
+ * external/cwe/cwe-191
+ */
+import cpp
+
+import semmle.code.cpp.security.Overflow
+import semmle.code.cpp.security.Security
+import semmle.code.cpp.security.TaintTracking
+
+predicate isRandValue(Expr e) {
+ e.(FunctionCall).getTarget().getName() = "rand" or
+ exists(FunctionCall fc |
+ fc = e.(MacroInvocationExpr).getInvocation().getExpr().getAChild*()
+ | fc.getTarget().getName() = "rand"
+ )
+}
+
+class SecurityOptionsArith extends SecurityOptions {
+ override predicate isUserInput(Expr expr, string cause) {
+ isRandValue(expr) and cause = "rand"
+ and not expr.getParent*() instanceof DivExpr
+ }
+}
+
+predicate taintedVarAccess(Expr origin, VariableAccess va) {
+ isUserInput(origin, _) and
+ tainted(origin, va)
+}
+
+/**
+ * A value that undergoes division is likely to be bounded within a safe
+ * range.
+ */
+predicate guardedByAssignDiv(Expr origin) {
+ isUserInput(origin, _) and
+ exists(AssignDivExpr div, VariableAccess va |
+ tainted(origin, va) and div.getLValue() = va)
+}
+
+from Expr origin, BinaryArithmeticOperation op, VariableAccess va, string effect
+where taintedVarAccess(origin, va)
+ and op.getAnOperand() = va
+ and
+ (
+ (missingGuardAgainstUnderflow(op, va) and effect = "underflow") or
+ (missingGuardAgainstOverflow(op, va) and effect = "overflow")
+ )
+ and not guardedByAssignDiv(origin)
+select va, "$@ flows to here and is used in arithmetic, potentially causing an " + effect + ".",
+ origin, "Uncontrolled value"
diff --git a/cpp/ql/src/Security/CWE/CWE-190/ArithmeticWithExtremeValues.c b/cpp/ql/src/Security/CWE/CWE-190/ArithmeticWithExtremeValues.c
new file mode 100644
index 000000000000..69e22d2fc109
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-190/ArithmeticWithExtremeValues.c
@@ -0,0 +1,11 @@
+int main(int argc, char** argv) {
+ int i = INT_MAX;
+ // BAD: overflow
+ int j = i + 1;
+
+ // ...
+
+ int l = INT_MAX;
+ // GOOD: no overflow
+ long k = (long)l + 1;
+}
diff --git a/cpp/ql/src/Security/CWE/CWE-190/ArithmeticWithExtremeValues.qhelp b/cpp/ql/src/Security/CWE/CWE-190/ArithmeticWithExtremeValues.qhelp
new file mode 100644
index 000000000000..b5b490591fde
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-190/ArithmeticWithExtremeValues.qhelp
@@ -0,0 +1,33 @@
+
+
+
+Assigning the maximum or minimum value for a type to a variable of that type and then using the
+variable in calculations may cause overflows.
+
+
+
+
+Before using the variable, ensure that it is reassigned a value that does not cause an overflow,
+or use a wider type to do the arithmetic.
+
+
+
+
+In this example, assigning INT_MAX to a variable and adding one causes
+an overflow. However, casting to a long beforehand ensures that the arithmetic
+is done in the wider type, and so does not overflow.
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-190/ArithmeticWithExtremeValues.ql b/cpp/ql/src/Security/CWE/CWE-190/ArithmeticWithExtremeValues.ql
new file mode 100644
index 000000000000..f218328a19ea
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-190/ArithmeticWithExtremeValues.ql
@@ -0,0 +1,57 @@
+/**
+ * @name Use of extreme values in arithmetic expression
+ * @description If a variable is assigned the maximum or minimum value
+ * for that variable's type and is then used in an
+ * arithmetic expression, this may result in an overflow.
+ * @kind problem
+ * @id cpp/arithmetic-with-extreme-values
+ * @problem.severity warning
+ * @precision low
+ * @tags security
+ * reliability
+ * external/cwe/cwe-190
+ * external/cwe/cwe-191
+ */
+import cpp
+
+import semmle.code.cpp.security.Overflow
+import semmle.code.cpp.security.Security
+import semmle.code.cpp.security.TaintTracking
+
+predicate isMaxValue(MacroInvocationExpr mie) {
+ mie.getMacroName() = "CHAR_MAX" or
+ mie.getMacroName() = "LLONG_MAX" or
+ mie.getMacroName() = "INT_MAX" or
+ mie.getMacroName() = "SHRT_MAX" or
+ mie.getMacroName() = "UINT_MAX"
+}
+
+predicate isMinValue(MacroInvocationExpr mie) {
+ mie.getMacroName() = "CHAR_MIN" or
+ mie.getMacroName() = "LLONG_MIN" or
+ mie.getMacroName() = "INT_MIN" or
+ mie.getMacroName() = "SHRT_MIN"
+}
+
+class SecurityOptionsArith extends SecurityOptions {
+ override predicate isUserInput(Expr expr, string cause) {
+ (isMaxValue(expr) and cause = "max value") or
+ (isMinValue(expr) and cause = "min value")
+ }
+}
+
+predicate taintedVarAccess(Expr origin, VariableAccess va) {
+ isUserInput(origin, _) and
+ tainted(origin, va)
+}
+
+from Expr origin, BinaryArithmeticOperation op, VariableAccess va, string effect
+where taintedVarAccess(origin, va)
+ and op.getAnOperand() = va
+ and
+ (
+ (missingGuardAgainstUnderflow(op, va) and effect = "underflow") or
+ (missingGuardAgainstOverflow(op, va) and effect = "overflow")
+ )
+select va, "$@ flows to here and is used in arithmetic, potentially causing an " + effect + ".",
+ origin, "Extreme value"
diff --git a/cpp/ql/src/Security/CWE/CWE-190/ComparisonWithWiderType.c b/cpp/ql/src/Security/CWE/CWE-190/ComparisonWithWiderType.c
new file mode 100644
index 000000000000..4f3b0dd2cf49
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-190/ComparisonWithWiderType.c
@@ -0,0 +1,28 @@
+void main(int argc, char **argv) {
+ uint32_t big_num = INT32_MAX;
+ char buf[big_num];
+ int16_t bytes_received = 0;
+ int max_get = INT16_MAX + 1;
+
+ // BAD: 'bytes_received' is compared with a value of a wider type.
+ // 'bytes_received' overflows before reaching 'max_get',
+ // causing an infinite loop
+ while (bytes_received < max_get)
+ bytes_received += get_from_input(buf, bytes_received);
+ }
+
+ uint32_t bytes_received = 0;
+
+ // GOOD: 'bytes_received2' has a type at least as wide as 'max_get'
+ while (bytes_received < max_get) {
+ bytes_received += get_from_input(buf, bytes_received);
+ }
+
+}
+
+
+int getFromInput(char *buf, short pos) {
+ // write to buf
+ // ...
+ return 1;
+}
diff --git a/cpp/ql/src/Security/CWE/CWE-190/ComparisonWithWiderType.qhelp b/cpp/ql/src/Security/CWE/CWE-190/ComparisonWithWiderType.qhelp
new file mode 100644
index 000000000000..4506eb053cef
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-190/ComparisonWithWiderType.qhelp
@@ -0,0 +1,41 @@
+
+
+
+In a loop condition, comparison of a value of a narrow type with a value of a wide type may
+result in unexpected behavior if the wider value is sufficiently large (or small). This is because
+the narrower value may overflow. This can lead to an infinite loop.
+
+
+
+
+Change the types of the compared values so that the value on the narrower side of the
+comparison is at least as wide as the value it is being compared with.
+
+
+
+
+In this example, bytes_received is compared against max_get in a
+while loop. However, bytes_received is an int16_t, and
+max_get is an int32_t. Because max_get is larger than
+INT16_MAX, the loop condition is always true, so the loop never
+terminates.
+
+This problem is avoided in the 'GOOD' case because bytes_received2 is an
+int32_t, which is as wide as the type of max_get.
+
+
+
+
+
+
+
+ Data type ranges
+
+
+
+ INT18-C. Evaluate integer expressions in a larger size before comparing or assigning to that size
+
+
+
\ No newline at end of file
diff --git a/cpp/ql/src/Security/CWE/CWE-190/ComparisonWithWiderType.ql b/cpp/ql/src/Security/CWE/CWE-190/ComparisonWithWiderType.ql
new file mode 100644
index 000000000000..af343fc991f8
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-190/ComparisonWithWiderType.ql
@@ -0,0 +1,69 @@
+/**
+ * @name Comparison of narrow type with wide type in loop condition
+ * @description Comparisons between types of different widths in a loop
+ * condition can cause the loop to behave unexpectedly.
+ * @id cpp/comparison-with-wider-type
+ * @kind problem
+ * @problem.severity warning
+ * @precision medium
+ * @tags reliability
+ * security
+ * external/cwe/cwe-190
+ * external/cwe/cwe-197
+ * external/cwe/cwe-835
+ *
+*/
+
+import cpp
+import semmle.code.cpp.controlflow.Dominance
+import semmle.code.cpp.controlflow.SSA
+import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
+
+/**
+ * C++ references are all pointer width, but the comparison takes place with
+ * the pointed-to value
+ */
+int getComparisonSize(Expr e) {
+ if e.getType() instanceof ReferenceType
+ then result = e.getType().(ReferenceType).getBaseType().getSize()
+ else result = e.getType().getSize()
+}
+
+
+predicate loopVariant(VariableAccess e, Loop loop) {
+ exists (SsaDefinition d
+ | d.getAUse(e.getTarget()) = e
+ | d.getAnUltimateDefiningValue(e.getTarget()) = loop.getCondition().getAChild*()
+ or d.getAnUltimateDefiningValue(e.getTarget()).getEnclosingStmt().getParent*()
+ = loop.getStmt()
+ or d.getAnUltimateDefiningValue(e.getTarget())
+ = loop.(ForStmt).getUpdate().getAChild*())
+}
+
+Element friendlyLoc(Expr e) {
+ result = e.(Access).getTarget() or
+ result = e.(Call).getTarget() or
+ not e instanceof Access and not e instanceof Call and result = e
+}
+
+from Loop l, RelationalOperation rel, Expr small, Expr large
+where small = rel.getLesserOperand()
+ and large = rel.getGreaterOperand()
+ and rel = l.getCondition().getAChild*()
+ and upperBound(large).log2() > getComparisonSize(small) * 8
+ // Ignore cases where the smaller type is int or larger
+ // These are still bugs, but you should need a very large string or array to
+ // trigger them. We will want to disable this for some applications, but it's
+ // very noisy on codebases that started as 32-bit
+ and small.getExplicitlyConverted().getType().getSize() < 4
+ // Ignore cases where integer promotion has occurred on /, -, or >> expressions.
+ and not getComparisonSize(large.(DivExpr).getLeftOperand()
+ .getExplicitlyConverted()) <= getComparisonSize(small)
+ and not getComparisonSize(large.(SubExpr).getLeftOperand()
+ .getExplicitlyConverted()) <= getComparisonSize(small)
+ and not getComparisonSize(large.(RShiftExpr).getLeftOperand()
+ .getExplicitlyConverted()) <= getComparisonSize(small)
+ // ignore loop-invariant smaller variables
+ and loopVariant(small.getAChild*(), l)
+select rel, "Comparison between $@ of type " + small.getType().getName() + " and $@ of wider type " + large.getType().getName() + ".",
+ friendlyLoc(small), small.toString(), friendlyLoc(large), large.toString()
diff --git a/cpp/ql/src/Security/CWE/CWE-190/IntegerOverflowTainted.qhelp b/cpp/ql/src/Security/CWE/CWE-190/IntegerOverflowTainted.qhelp
new file mode 100644
index 000000000000..01bb78be887b
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-190/IntegerOverflowTainted.qhelp
@@ -0,0 +1,55 @@
+
+
+
+Performing calculations on user-controlled data can result in
+integer overflows unless the input is validated.
+
+Integer overflow occurs when the result of an arithmetic expression
+is too large to be represented by the (integer) output type of the
+expression. For example, if the result of the expression is 200, but
+the output type is a signed 8-bit integer, then overflow occurs
+because the largest value that can be represented is 127. The behavior
+of overflow is implementation defined, but the most common
+implementation is two's complement arithmetic, in which case the
+result is -56. Overflow can cause unexpected results, particularly
+when a large value overflows and the result is negative. It can also
+pose a security risk if the value of the expression is controllable by
+user, because it could enable an attacker to deliberately cause an
+overflow.
+
+Negative integer overflow is another form of integer overflow,
+in which a negative result cannot be represented in the output type.
+
+
+
+
+Always guard against overflow in arithmetic operations on
+user-controlled data by doing one of the following:
+
+
+- Validate the user input.
+- Define a guard on the arithmetic expression, so that the operation
+is performed only if the result can be known to be less than, or equal
+to, the maximum value for the type, for
+example
INT_MAX.
+- Use a wider type, so that larger input values do not cause
+overflow.
+
+
+
+
+
+In this example, a value is read from standard input into an int. Because the value
+is a user-controlled value, it could be extremely large. Performing arithmetic operations on this
+value could therefore cause an overflow. To avoid this happening, the example shows how to perform
+a check before performing a multiplication.
+
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-190/IntegerOverflowTainted.ql b/cpp/ql/src/Security/CWE/CWE-190/IntegerOverflowTainted.ql
new file mode 100644
index 000000000000..3bb064086d81
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-190/IntegerOverflowTainted.ql
@@ -0,0 +1,35 @@
+/**
+ * @name Potential integer arithmetic overflow
+ * @description A user-controlled integer arithmetic expression
+ * that is not validated can cause overflows.
+ * @kind problem
+ * @id cpp/integer-overflow-tainted
+ * @problem.severity warning
+ * @tags security
+ * external/cwe/cwe-190
+ * external/cwe/cwe-197
+ * external/cwe/cwe-681
+ */
+import cpp
+import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
+import semmle.code.cpp.security.TaintTracking
+
+/** Holds if `expr` might overflow. */
+predicate outOfBoundsExpr(Expr expr, string kind) {
+ if convertedExprMightOverflowPositively(expr) then
+ kind = "overflow"
+ else if convertedExprMightOverflowNegatively(expr) then
+ kind = "overflow negatively"
+ else
+ none()
+}
+
+from Expr use, Expr origin, string kind
+where outOfBoundsExpr(use, kind) and tainted(origin, use) and origin != use
+and not inSystemMacroExpansion(use)
+// Avoid double-counting: don't include all the conversions of `use`.
+and not (use instanceof Conversion)
+select
+ use,
+ "$@ flows to here and is used in an expression which might " + kind + ".",
+ origin, "User-provided value"
diff --git a/cpp/ql/src/Security/CWE/CWE-190/TaintedAllocationSize.c b/cpp/ql/src/Security/CWE/CWE-190/TaintedAllocationSize.c
new file mode 100644
index 000000000000..7a84a1aad13c
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-190/TaintedAllocationSize.c
@@ -0,0 +1,11 @@
+int factor = atoi(getenv("BRANCHING_FACTOR"));
+
+// GOOD: Prevent overflow by checking the input
+if (factor < 0 || factor > 1000) {
+ log("Factor out of range (%d)\n", factor);
+ return -1;
+}
+
+// This line can allocate too little memory if factor
+// is very large.
+char **root_node = (char **) malloc(factor * sizeof(char *));
diff --git a/cpp/ql/src/Security/CWE/CWE-190/TaintedAllocationSize.qhelp b/cpp/ql/src/Security/CWE/CWE-190/TaintedAllocationSize.qhelp
new file mode 100644
index 000000000000..3b8524608871
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-190/TaintedAllocationSize.qhelp
@@ -0,0 +1,46 @@
+
+
+
+This code calculates an allocation size by multiplying a user input
+by a sizeof expression. Since the user input has no
+apparent guard on its magnitude, this multiplication can
+overflow. When an integer multiply overflows in C, the result can wrap
+around and be much smaller than intended. A later attempt to put data
+into the allocated buffer can then overflow.
+
+
+
+
+Guard all integer parameters that come from an external
+user. Implement a guard with the expected range for the parameter and
+make sure that the input value meets both the minimum and maximum
+requirements for this range. If the input value fails this guard then
+reject the request before proceeding further. If the input value
+passes the guard then subsequent calculations should not overflow.
+
+
+
+
+
+
+This code shows one way to guard that an input value is within the
+expected range. If factor fails the guard, then an error
+is returned, and the value is not used as an argument to the
+subsequent call to malloc. Without this guard, the
+allocated buffer might be too small to hold the data intended for it.
+
+
+
+
+The CERT Oracle Secure Coding Standard for C:
+ INT04-C. Enforce
+ limits on integer values originating from tainted sources.
+
+
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-190/TaintedAllocationSize.ql b/cpp/ql/src/Security/CWE/CWE-190/TaintedAllocationSize.ql
new file mode 100644
index 000000000000..e91daca6a1e0
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-190/TaintedAllocationSize.ql
@@ -0,0 +1,28 @@
+/**
+ * @name Overflow in uncontrolled allocation size
+ * @description Allocating memory with a size controlled by an external
+ * user can result in integer overflow.
+ * @kind problem
+ * @problem.severity error
+ * @precision high
+ * @id cpp/uncontrolled-allocation-size
+ * @tags reliability
+ * security
+ * external/cwe/cwe-190
+ */
+
+import cpp
+import semmle.code.cpp.security.TaintTracking
+
+from Expr source, Expr tainted, BinaryArithmeticOperation oper,
+ SizeofOperator sizeof, string taintCause
+where tainted(source, tainted)
+ and oper.getAnOperand() = tainted
+ and oper.getOperator() = "*"
+ and oper.getAnOperand() = sizeof
+ and oper != tainted
+ and sizeof.getValue().toInt() > 1
+ and isUserInput(source, taintCause)
+select
+ oper, "This allocation size is derived from $@ and might overflow",
+ source, "user input (" + taintCause + ")"
diff --git a/cpp/ql/src/Security/CWE/CWE-290/AuthenticationBypass.cpp b/cpp/ql/src/Security/CWE/CWE-290/AuthenticationBypass.cpp
new file mode 100644
index 000000000000..825793f2f0c1
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-290/AuthenticationBypass.cpp
@@ -0,0 +1,32 @@
+
+#define BUFFER_SIZE (4 * 1024)
+
+void receiveData()
+{
+ int sock;
+ sockaddr_in addr, addr_from;
+ char buffer[BUFFER_SIZE];
+ int msg_size;
+ socklen_t addr_from_len;
+
+ // configure addr
+ memset(&addr, 0, sizeof(addr));
+ addr.sin_family = AF_INET;
+ addr.sin_port = htons(1234);
+ addr.sin_addr.s_addr = INADDR_ANY;
+
+ // create and bind the socket
+ sock = socket(AF_INET, SOCK_DGRAM, 0);
+ bind(sock, (sockaddr *)&addr, sizeof(addr));
+
+ // receive message
+ addr_from_len = sizeof(addr_from);
+ msg_size = recvfrom(sock, buffer, BUFFER_SIZE, 0, (sockaddr *)&addr_from, &addr_from_len);
+
+ // BAD: the address is controllable by the user, so it
+ // could be spoofed to bypass the security check below.
+ if ((msg_size > 0) && (strcmp("127.0.0.1", inet_ntoa(addr_from.sin_addr)) == 0))
+ {
+ // ...
+ }
+}
diff --git a/cpp/ql/src/Security/CWE/CWE-290/AuthenticationBypass.qhelp b/cpp/ql/src/Security/CWE/CWE-290/AuthenticationBypass.qhelp
new file mode 100644
index 000000000000..9ba69aaf005e
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-290/AuthenticationBypass.qhelp
@@ -0,0 +1,30 @@
+
+
+
+Code which relies on an IP address or domain name for authentication can be exploited
+by an attacker who spoofs their address.
+
+
+
+
+IP address verification can be a useful part of an authentication scheme,
+but it should not be the single factor required for authentication. Make sure
+that other authentication methods are also in place.
+
+
+
+
+In this example (taken from
+CWE-290: Authentication Bypass by Spoofing),
+the client is authenticated by checking that its IP address is 127.0.0.1. An attacker might be able to
+bypass this authentication by spoofing their IP address.
+
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-290/AuthenticationBypass.ql b/cpp/ql/src/Security/CWE/CWE-290/AuthenticationBypass.ql
new file mode 100644
index 000000000000..b744095bfe07
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-290/AuthenticationBypass.ql
@@ -0,0 +1,124 @@
+/**
+ * @name Authentication bypass by spoofing
+ * @description Authentication by checking that the peer's address
+ * matches a known IP or web address is unsafe as it is
+ * vulnerable to spoofing attacks.
+ * @kind problem
+ * @problem.severity warning
+ * @precision medium
+ * @id cpp/user-controlled-bypass
+ * @tags security
+ * external/cwe/cwe-290
+ */
+
+import semmle.code.cpp.security.TaintTracking
+
+predicate hardCodedAddressOrIP(StringLiteral txt) {
+ exists(string s
+ | s = txt.getValueText()
+ | // Hard-coded ip addresses, such as 127.0.0.1
+ s.regexpMatch("\"[0-9]+[.][0-9]+[.][0-9]+[.][0-9]+\"") or
+
+ // Hard-coded addresses such as www.mycompany.com
+ s.matches("\"www.%\"") or
+ s.matches("\"http:%\"") or
+ s.matches("\"https:%\"") or
+ s.matches("\"%.com\"") or
+ s.matches("\"%.ru\"") or
+ s.matches("\"%.net\"") or
+ s.matches("\"%.org\"") or
+ s.matches("\"%.de\"") or
+ s.matches("\"%.jp\"") or
+ s.matches("\"%.uk\"") or
+ s.matches("\"%.br\"") or
+ s.matches("\"%.pl\"") or
+ s.matches("\"%.in\"") or
+ s.matches("\"%.it\"") or
+ s.matches("\"%.fr\"") or
+ s.matches("\"%.au\"") or
+ s.matches("\"%.info\"") or
+ s.matches("\"%.nl\"") or
+ s.matches("\"%.cn\"") or
+ s.matches("\"%.ir\"") or
+ s.matches("\"%.es\"") or
+ s.matches("\"%.cz\"") or
+ s.matches("\"%.biz\"") or
+ s.matches("\"%.ca\"") or
+ s.matches("\"%.eu\"") or
+ s.matches("\"%.ua\"") or
+ s.matches("\"%.kr\"") or
+ s.matches("\"%.za\"") or
+ s.matches("\"%.co\"") or
+ s.matches("\"%.gr\"") or
+ s.matches("\"%.ro\"") or
+ s.matches("\"%.se\"") or
+ s.matches("\"%.tw\"") or
+ s.matches("\"%.vn\"") or
+ s.matches("\"%.mx\"") or
+ s.matches("\"%.ch\"") or
+ s.matches("\"%.tr\"") or
+ s.matches("\"%.at\"") or
+ s.matches("\"%.be\"") or
+ s.matches("\"%.hu\"") or
+ s.matches("\"%.tv\"") or
+ s.matches("\"%.dk\"") or
+ s.matches("\"%.me\"") or
+ s.matches("\"%.ar\"") or
+ s.matches("\"%.us\"") or
+ s.matches("\"%.no\"") or
+ s.matches("\"%.sk\"") or
+ s.matches("\"%.fi\"") or
+ s.matches("\"%.id\"") or
+ s.matches("\"%.cl\"") or
+ s.matches("\"%.nz\"") or
+ s.matches("\"%.by\"") or
+ s.matches("\"%.xyz\"") or
+ s.matches("\"%.pt\"") or
+ s.matches("\"%.ie\"") or
+ s.matches("\"%.il\"") or
+ s.matches("\"%.kz\"") or
+ s.matches("\"%.my\"") or
+ s.matches("\"%.hk\"") or
+ s.matches("\"%.lt\"") or
+ s.matches("\"%.cc\"") or
+ s.matches("\"%.sg\"") or
+ s.matches("\"%.io\"") or
+ s.matches("\"%.edu\"") or
+ s.matches("\"%.gov\""))
+}
+
+predicate useOfHardCodedAddressOrIP(Expr use) {
+ hardCodedAddressOrIP(use) or
+ exists(Expr def, Expr src, Variable v
+ | useOfHardCodedAddressOrIP(src) and
+ exprDefinition(v, def, src) and
+ definitionUsePair(v, def, use))
+}
+
+/*
+ * Find IfStmts that have a hard-coded IP or web address in
+ * their condition. If the condition also depends on an
+ * untrusted input then it might be vulnerable to a spoofing
+ * attack.
+ */
+predicate hardCodedAddressInCondition(Expr source, Expr condition) {
+ // One of the sub-expressions of the condition is tainted.
+ exists(Expr taintedExpr
+ | taintedExpr.getParent+() = condition
+ | tainted(source, taintedExpr)) and
+
+ // One of the sub-expressions of the condition is a hard-coded
+ // IP or web-address.
+ exists(Expr use
+ | use.getParent+() = condition
+ | useOfHardCodedAddressOrIP(use)) and
+
+ condition = any(IfStmt ifStmt).getCondition()
+}
+
+from Expr source, Expr condition
+where hardCodedAddressInCondition(source, condition)
+select
+ condition,
+ "Untrusted input $@ might be vulnerable to a spoofing attack.",
+ source, source.toString()
diff --git a/cpp/ql/src/Security/CWE/CWE-311/CleartextBufferWrite.qhelp b/cpp/ql/src/Security/CWE/CWE-311/CleartextBufferWrite.qhelp
new file mode 100644
index 000000000000..884b1dbdd4b4
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-311/CleartextBufferWrite.qhelp
@@ -0,0 +1,5 @@
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-311/CleartextBufferWrite.ql b/cpp/ql/src/Security/CWE/CWE-311/CleartextBufferWrite.ql
new file mode 100644
index 000000000000..d8002212824a
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-311/CleartextBufferWrite.ql
@@ -0,0 +1,27 @@
+/**
+ * @name Cleartext storage of sensitive information in buffer
+ * @description Storing sensitive information in cleartext can expose it
+ * to an attacker.
+ * @kind problem
+ * @problem.severity warning
+ * @precision medium
+ * @id cpp/cleartext-storage-buffer
+ * @tags security
+ * external/cwe/cwe-312
+ */
+
+import cpp
+import semmle.code.cpp.security.BufferWrite
+import semmle.code.cpp.security.TaintTracking
+import semmle.code.cpp.security.SensitiveExprs
+
+from BufferWrite w,
+ Expr taintedArg, Expr taintSource, string taintCause,
+ SensitiveExpr dest
+where tainted(taintSource, taintedArg)
+ and isUserInput(taintSource, taintCause)
+ and w.getASource() = taintedArg
+ and dest = w.getDest()
+select w, "This write into buffer '" + dest.toString()
+ + "' may contain unencrypted data from $@",
+ taintSource, "user input (" + taintCause + ")"
diff --git a/cpp/ql/src/Security/CWE/CWE-311/CleartextFileWrite.qhelp b/cpp/ql/src/Security/CWE/CWE-311/CleartextFileWrite.qhelp
new file mode 100644
index 000000000000..884b1dbdd4b4
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-311/CleartextFileWrite.qhelp
@@ -0,0 +1,5 @@
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-311/CleartextFileWrite.ql b/cpp/ql/src/Security/CWE/CWE-311/CleartextFileWrite.ql
new file mode 100644
index 000000000000..400088e2be0b
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-311/CleartextFileWrite.ql
@@ -0,0 +1,22 @@
+/**
+ * @name Cleartext storage of sensitive information in file
+ * @description Storing sensitive information in cleartext can expose it
+ * to an attacker.
+ * @kind problem
+ * @problem.severity warning
+ * @precision medium
+ * @id cpp/cleartext-storage-file
+ * @tags security
+ * external/cwe/cwe-313
+ */
+
+import cpp
+import semmle.code.cpp.security.SensitiveExprs
+import semmle.code.cpp.security.FileWrite
+
+from FileWrite w, SensitiveExpr source, Expr dest
+where source = w.getASource()
+ and dest = w.getDest()
+select w, "This write into file '" + dest.toString()
+ + "' may contain unencrypted data from $@",
+ source, "this source."
diff --git a/cpp/ql/src/Security/CWE/CWE-311/CleartextStorage.c b/cpp/ql/src/Security/CWE/CWE-311/CleartextStorage.c
new file mode 100644
index 000000000000..e0600cc4d2f2
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-311/CleartextStorage.c
@@ -0,0 +1,12 @@
+void writeCredentials() {
+ char *password = "cleartext password";
+ FILE* file = fopen("credentials.txt", "w");
+
+ // BAD: write password to disk in cleartext
+ fputs(password, file);
+
+ // GOOD: encrypt password first
+ char *encrypted = encrypt(password);
+ fputs(encrypted, file);
+}
+
diff --git a/cpp/ql/src/Security/CWE/CWE-311/CleartextStorage.qhelp b/cpp/ql/src/Security/CWE/CWE-311/CleartextStorage.qhelp
new file mode 100644
index 000000000000..eb9a6f8adce6
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-311/CleartextStorage.qhelp
@@ -0,0 +1,39 @@
+
+
+
+Sensitive information that is stored unencrypted is accessible to an attacker who gains access to the
+storage.
+
+
+
+
+Ensure that sensitive information is always encrypted before being stored, especially before writing to a file.
+It may be wise to encrypt information before it is put into a buffer that may be readable in memory.
+
+In general, decrypt sensitive information only at the point where it is necessary for it to be used in
+cleartext.
+
+
+
+
+The following example shows two ways of storing user credentials in a file. In the 'BAD' case,
+the credentials are simply stored in cleartext. In the 'GOOD' case, the credentials are encrypted before
+storing them.
+
+
+
+
+
+
+M. Dowd, J. McDonald and J. Schuhm, The Art of Software Security Assessment, 1st Edition, Chapter 2 - 'Common Vulnerabilities of Encryption', p. 43. Addison Wesley, 2006.
+M. Howard and D. LeBlanc, Writing Secure Code, 2nd Edition, Chapter 9 - 'Protecting Secret Data', p. 299. Microsoft, 2002.
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-313/CleartextSqliteDatabase.c b/cpp/ql/src/Security/CWE/CWE-313/CleartextSqliteDatabase.c
new file mode 100644
index 000000000000..f92aa8c38684
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-313/CleartextSqliteDatabase.c
@@ -0,0 +1,36 @@
+
+void bad(void) {
+ char *password = "cleartext password";
+ sqlite3 *credentialsDB;
+ sqlite3_stmt *stmt;
+
+ if (sqlite3_open("credentials.db", &credentialsDB) == SQLITE_OK) {
+ // BAD: database opened without encryption being enabled
+ sqlite3_exec(credentialsDB, "CREATE TABLE IF NOT EXISTS creds (password TEXT);", NULL, NULL, NULL);
+ if (sqlite3_prepare_v2(credentialsDB, "INSERT INTO creds(password) VALUES(?)", -1, &stmt, NULL) == SQLITE_OK) {
+ sqlite3_bind_text(stmt, 1, password, -1, SQLITE_TRANSIENT);
+ sqlite3_step(stmt);
+ sqlite3_finalize(stmt);
+ sqlite3_close(credentialsDB);
+ }
+ }
+}
+
+void good(void) {
+ char *password = "cleartext password";
+ sqlite3 *credentialsDB;
+ sqlite3_stmt *stmt;
+
+ if (sqlite3_open("credentials.db", &credentialsDB) == SQLITE_OK) {
+ // GOOD: database encryption enabled:
+ sqlite3_exec(credentialsDB, "PRAGMA key = 'secretKey!'", NULL, NULL, NULL);
+ sqlite3_exec(credentialsDB, "CREATE TABLE IF NOT EXISTS creds (password TEXT);", NULL, NULL, NULL);
+ if (sqlite3_prepare_v2(credentialsDB, "INSERT INTO creds(password) VALUES(?)", -1, &stmt, NULL) == SQLITE_OK) {
+ sqlite3_bind_text(stmt, 1, password, -1, SQLITE_TRANSIENT);
+ sqlite3_step(stmt);
+ sqlite3_finalize(stmt);
+ sqlite3_close(credentialsDB);
+ }
+ }
+}
+
diff --git a/cpp/ql/src/Security/CWE/CWE-313/CleartextSqliteDatabase.qhelp b/cpp/ql/src/Security/CWE/CWE-313/CleartextSqliteDatabase.qhelp
new file mode 100644
index 000000000000..c8edcccb92f5
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-313/CleartextSqliteDatabase.qhelp
@@ -0,0 +1,35 @@
+
+
+
+Sensitive information that is stored in an unencrypted SQLite database is accessible to an attacker who gains access to the
+database.
+
+
+
+
+Ensure that if sensitive information is stored in a database then the database is always encrypted.
+
+
+
+
+The following example shows two ways of storing information in an SQLite
+database. In the 'BAD' case, the credentials are simply stored in cleartext.
+In the 'GOOD' case, the database (and thus the credentials) are encrypted.
+
+
+
+
+
+
+M. Dowd, J. McDonald and J. Schuhm, The Art of Software Security Assessment, 1st Edition, Chapter 2 - 'Common Vulnerabilities of Encryption', p. 43. Addison Wesley, 2006.
+M. Howard and D. LeBlanc, Writing Secure Code, 2nd Edition, Chapter 9 - 'Protecting Secret Data', p. 299. Microsoft, 2002.
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-313/CleartextSqliteDatabase.ql b/cpp/ql/src/Security/CWE/CWE-313/CleartextSqliteDatabase.ql
new file mode 100644
index 000000000000..c5f3ae71a576
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-313/CleartextSqliteDatabase.ql
@@ -0,0 +1,45 @@
+/**
+ * @name Cleartext storage of sensitive information in an SQLite database
+ * @description Storing sensitive information in a non-encrypted
+ * database can expose it to an attacker.
+ * @kind problem
+ * @problem.severity warning
+ * @precision medium
+ * @id cpp/cleartext-storage-database
+ * @tags security
+ * external/cwe/cwe-313
+ */
+
+import cpp
+import semmle.code.cpp.security.SensitiveExprs
+import semmle.code.cpp.security.TaintTracking
+
+class UserInputIsSensitiveExpr extends SecurityOptions {
+ override predicate isUserInput(Expr expr, string cause) {
+ expr instanceof SensitiveExpr and cause = "sensitive information"
+ }
+}
+
+class SqliteFunctionCall extends FunctionCall {
+ SqliteFunctionCall() {
+ this.getTarget().getName().matches("sqlite%")
+ }
+
+ Expr getASource() {
+ result = this.getAnArgument()
+ }
+}
+
+predicate sqlite_encryption_used() {
+ any(StringLiteral l).getValue().toLowerCase().regexpMatch("pragma key.*") or
+ any(StringLiteral l).getValue().toLowerCase().matches("%attach%database%key%") or
+ any(FunctionCall fc).getTarget().getName().matches("sqlite%\\_key\\_%")
+}
+
+from SensitiveExpr taintSource, Expr taintedArg, SqliteFunctionCall sqliteCall
+where tainted(taintSource, taintedArg)
+ and taintedArg = sqliteCall.getASource()
+ and not sqlite_encryption_used()
+select sqliteCall, "This SQLite call may store $@ in a non-encrypted SQLite database",
+ taintSource, "sensitive information"
+
diff --git a/cpp/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.c b/cpp/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.c
new file mode 100644
index 000000000000..a804bf8becbc
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.c
@@ -0,0 +1,13 @@
+void advapi() {
+ HCRYPTPROV hCryptProv;
+ HCRYPTKEY hKey;
+ HCRYPTHASH hHash;
+ // other preparation goes here
+
+ // BAD: use 3DES for key
+ CryptDeriveKey(hCryptProv, CALG_3DES, hHash, 0, &hKey);
+
+ // GOOD: use AES
+ CryptDeriveKey(hCryptProv, CALG_AES_256, hHash, 0, &hKey);
+}
+
diff --git a/cpp/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.qhelp b/cpp/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.qhelp
new file mode 100644
index 000000000000..0fcbd89d8921
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.qhelp
@@ -0,0 +1,41 @@
+
+
+
+Using broken or weak cryptographic algorithms can leave data vulnerable to being decrypted.
+
+Many cryptographic algorithms provided by cryptography libraries are known to be weak, or
+flawed. Using such an algorithm means that an attacker may be able to easily decrypt the encrypted
+data.
+
+
+
+
+Ensure that you use a strong, modern cryptographic algorithm. Use at least AES-128 or RSA-2048.
+
+
+
+
+The following code shows an example of using the advapi windows API to decrypt some data.
+When creating a key, you must specify which algorithm to use. The first example uses DES
+which is an older algorithm that is now considered weak. The second example uses AES, which
+is a strong modern algorithm.
+
+
+
+
+
+
+NIST, FIPS 140 Annex a:
+Approved Security Functions.
+NIST, SP 800-131A:
+Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths.
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.ql b/cpp/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.ql
new file mode 100644
index 000000000000..53d6a7411529
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.ql
@@ -0,0 +1,42 @@
+/**
+ * @name Use of a broken or risky cryptographic algorithm
+ * @description Using broken or weak cryptographic algorithms can allow
+ * an attacker to compromise security.
+ * @kind problem
+ * @problem.severity error
+ * @precision medium
+ * @id cpp/weak-cryptographic-algorithm
+ * @tags security
+ * external/cwe/cwe-327
+ */
+import cpp
+import semmle.code.cpp.security.Encryption
+
+abstract class InsecureCryptoSpec extends Locatable {
+ abstract string description();
+}
+
+class InsecureFunctionCall extends InsecureCryptoSpec, FunctionCall {
+ InsecureFunctionCall() {
+ this.getTarget().getName().regexpMatch(algorithmBlacklistRegex())
+ }
+
+ override string description() { result = "function call" }
+
+ override string toString() { result = FunctionCall.super.toString() }
+ override Location getLocation() { result = FunctionCall.super.getLocation() }
+}
+
+class InsecureMacroSpec extends InsecureCryptoSpec, MacroInvocation {
+ InsecureMacroSpec() {
+ this.getMacro().getName().regexpMatch(algorithmBlacklistRegex())
+ }
+
+ override string description() { result = "macro invocation" }
+
+ override string toString() { result = MacroInvocation.super.toString() }
+ override Location getLocation() { result = MacroInvocation.super.getLocation() }
+}
+
+from InsecureCryptoSpec c
+select c, "This " + c.description() + " specifies a broken or weak cryptographic algorithm."
diff --git a/cpp/ql/src/Security/CWE/CWE-327/OpenSslHeartbleed.c b/cpp/ql/src/Security/CWE/CWE-327/OpenSslHeartbleed.c
new file mode 100644
index 000000000000..b78036b3f463
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-327/OpenSslHeartbleed.c
@@ -0,0 +1,26 @@
+int
+tls1_process_heartbeat(SSL *s)
+ {
+ unsigned char *p = &s->s3->rrec.data[0], *pl;
+ unsigned short hbtype;
+ unsigned int payload;
+
+ /* ... */
+
+ hbtype = *p++;
+ n2s(p, payload);
+ pl = p;
+
+ /* ... */
+
+ if (hbtype == TLS1_HB_REQUEST)
+ {
+ /* ... */
+ memcpy(bp, pl, payload); // BAD: overflow here
+ /* ... */
+ }
+
+
+ /* ... */
+
+ }
diff --git a/cpp/ql/src/Security/CWE/CWE-327/OpenSslHeartbleed.qhelp b/cpp/ql/src/Security/CWE/CWE-327/OpenSslHeartbleed.qhelp
new file mode 100644
index 000000000000..4ffee9708cf2
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-327/OpenSslHeartbleed.qhelp
@@ -0,0 +1,46 @@
+
+
+
+Earlier versions of the popular OpenSSL library suffer from a
+buffer overflow in its "heartbeat" code. Because of the location of
+the problematic code, this vulnerability is often called
+"Heartbleed".
+
+Software that includes a copy of OpenSSL should be sure to use a
+current version of the library. If it uses an older version, it will
+be vulnerable to any network site it connects with.
+
+
+
+
+Upgrade to the latest version of OpenSSL. This problem was fixed in
+version 1.0.1g.
+
+
+
+
+The following code is present in earlier versions of
+OpenSSL. The payload variable is the number of bytes that
+should be copied from the request back into the response. The call
+to memcpy does this copy. The problem is
+that payload is supplied as part of the remote request,
+and there is no code that checks the size of it. If the caller
+supplies a very large value, then the memcpy call will
+copy memory that is outside the request packet.
+
+
+
+
+
+
+Common Vulnerabilities and Exposures:
+ CVE-2014-0160.
+OpenSSL News:
+ OpenSSL
+ Security Advisory [07 Apr 2014].
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-327/OpenSslHeartbleed.ql b/cpp/ql/src/Security/CWE/CWE-327/OpenSslHeartbleed.ql
new file mode 100644
index 000000000000..a8c4336aa6ec
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-327/OpenSslHeartbleed.ql
@@ -0,0 +1,58 @@
+/**
+ * @name Use of a version of OpenSSL with Heartbleed
+ * @description Using an old version of OpenSSL can allow remote
+ * attackers to retrieve portions of memory.
+ * @kind problem
+ * @problem.severity error
+ * @precision very-high
+ * @id cpp/openssl-heartbleed
+ * @tags security
+ * external/cwe/cwe-327
+ * external/cwe/cwe-788
+ */
+
+import cpp
+
+/**
+ * Holds if `v` and `w` are ever compared to each other.
+ */
+predicate comparedTo(Variable v, Variable w) {
+ v.getAnAssignedValue() = w.getAnAccess() or
+ exists (ComparisonOperation comp |
+ comp = v.getAnAccess().getParent+() and
+ comp = w.getAnAccess().getParent+()
+ )
+}
+
+class DataVariable extends Variable {
+ DataVariable() {
+ exists(Struct ssl3_record_st |
+ ssl3_record_st.hasName("ssl3_record_st") and
+ this = ssl3_record_st.getAField() and
+ this.hasName("data"))
+ }
+}
+
+/**
+ * Holds if expression `e` might evaluate to a pointer
+ * into the memory region pointed to by `v`.
+ */
+predicate pointsInto(Expr e, DataVariable v) {
+ e = v.getAnAccess() or
+ e.(AddressOfExpr).getOperand().(ArrayExpr).getArrayBase() = v.getAnAccess() or
+ varPointsInto(e.(VariableAccess).getTarget(), v)
+}
+
+pragma[nomagic]
+predicate varPointsInto(Variable tainted, DataVariable src) {
+ pointsInto(tainted.getAnAssignedValue(), src)
+}
+
+from FunctionCall fc, Struct ssl3_record_st, Field data, Field length
+where fc.getTarget().getName().matches("%memcpy%") and
+ ssl3_record_st.hasName("ssl3_record_st") and
+ data = ssl3_record_st.getAField() and data.hasName("data") and
+ length = ssl3_record_st.getAField() and length.hasName("length") and
+ pointsInto(fc.getArgument(1), data) and
+ not comparedTo(fc.getArgument(2).(VariableAccess).getTarget(), length)
+select fc, "This call to memcpy is insecure (Heartbleed vulnerability)."
diff --git a/cpp/ql/src/Security/CWE/CWE-367/TOCTOUFilesystemRace.qhelp b/cpp/ql/src/Security/CWE/CWE-367/TOCTOUFilesystemRace.qhelp
new file mode 100644
index 000000000000..84f349ccf2ca
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-367/TOCTOUFilesystemRace.qhelp
@@ -0,0 +1,62 @@
+
+
+
+
+
+Often it is necessary to check the state of a file before using it. These checks usually take a file name
+to be checked, and if the check returns positively, then the file is opened or otherwise operated upon.
+
+
+
+However, in the time between the check and the operation, the underlying file referenced by the
+file name could be changed by an attacker, causing unexpected behavior.
+
+
+
+
+
+
+Wherever possible, use functions that operate on file descriptors rather than file names (for example, fchmod
+rather than chmod).
+
+
+
+For access checks, you can temporarily change the UID and GID to that of the user whose permissions are being checked, and then
+perform the operation. This has the effect of "atomically" combining a permissions check with the operation.
+
+
+
+If file-system locking tools are available on your platform, then locking the file before the check can prevent an unexpected update. However,
+note that on some platforms (for example, Unix) file-system locks are typically advisory, and so can be ignored by an attacker.
+
+
+
+
+
+The following example shows a case where a file is opened and then, if the opening was successful, its permissions are changed with
+chmod. However, an attacker might change the target of the file name between the initial opening and the permissions change,
+potentially changing the permissions of a different file.
+
+
+
+
+
+This can be avoided by using fchmod with the file descriptor that was received from opening the file. This ensures that the
+permissions change is applied to the very same file that was opened.
+
+
+
+
+
+
+
+The CERT Oracle Secure Coding Standard for C:
+
+ FIO01-C. Be careful using functions that use file names for identification
+ .
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-367/TOCTOUFilesystemRace.ql b/cpp/ql/src/Security/CWE/CWE-367/TOCTOUFilesystemRace.ql
new file mode 100644
index 000000000000..f8764b7358aa
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-367/TOCTOUFilesystemRace.ql
@@ -0,0 +1,128 @@
+/**
+ * @name Time-of-check time-of-use filesystem race condition
+ * @description Separately checking the state of a file before operating
+ * on it may allow an attacker to modify the file between
+ * the two operations.
+ * @kind problem
+ * @problem.severity warning
+ * @precision medium
+ * @id cpp/toctou-race-condition
+ * @tags security
+ * external/cwe/cwe-367
+ */
+import cpp
+import semmle.code.cpp.controlflow.Guards
+
+/**
+ * An operation on a filename.
+ *
+ * Note: we're not interested in operations on file descriptors, as they
+ * are better behaved.
+ */
+FunctionCall filenameOperation(Expr path) {
+ exists(string name | name = result.getTarget().getName() |
+ (
+ (
+ name = "remove" or
+ name = "unlink" or
+ name = "rmdir" or
+ name = "rename" or
+ name = "chmod" or
+ name = "chown" or
+ name = "fopen" or
+ name = "open" or
+ name = "freopen" or
+ name = "_open" or
+ name = "_wopen" or
+ name = "_wfopen"
+ )
+ and
+ result.getArgument(0) = path
+ )
+ or
+ (
+ (
+ name = "fopen_s" or
+ name = "wfopen_s"
+ )
+ and
+ result.getArgument(1) = path
+ )
+ )
+}
+
+/**
+ * A use of `access` (or similar) on a filename.
+ */
+FunctionCall accessCheck(Expr path) {
+ exists(string name | name = result.getTarget().getName() |
+ name = "access" or
+ name = "_access" or
+ name = "_waccess" or
+ name = "_access_s" or
+ name = "_waccess_s"
+ )
+ and
+ path = result.getArgument(0)
+}
+
+/**
+ * A use of `stat` (or similar) on a filename.
+ */
+FunctionCall stat(Expr path, Expr buf) {
+ exists(string name | name = result.getTarget().getName() |
+ name = "stat" or
+ name = "lstat" or
+ name = "fstat" or
+ name.matches("\\_stat%") or
+ name.matches("\\_wstat%")
+ )
+ and
+ path = result.getArgument(0)
+ and
+ buf = result.getArgument(1)
+}
+
+/**
+ * Holds if `use` points to `source`, either by being the same or by
+ * one step of variable indirection.
+ */
+predicate referenceTo(Expr source, Expr use) {
+ source = use
+ or
+ exists(SsaDefinition def, LocalScopeVariable v |
+ def.getAnUltimateDefiningValue(v) = source and def.getAUse(v) = use)
+}
+
+from FunctionCall fc, Expr check, Expr checkUse, Expr opUse
+where // checkUse looks like a check on a filename
+ (
+ // either:
+ // an access check
+ check = accessCheck(checkUse)
+ or
+ // a stat
+ check = stat(checkUse, _)
+ or
+ // another filename operation (null pointers can indicate errors)
+ check = filenameOperation(checkUse)
+ or
+ // access to a member variable on the stat buf
+ // (morally, this should be a use-use pair, but it seems unlikely
+ // that this variable will get reused in practice)
+ exists(Variable buf |
+ exists(stat(checkUse, buf.getAnAccess())) |
+ check.(VariableAccess).getQualifier() = buf.getAnAccess())
+ )
+ and // checkUse and opUse refer to the same SSA variable
+ exists(SsaDefinition def, LocalScopeVariable v |
+ def.getAUse(v) = checkUse and def.getAUse(v) = opUse)
+ and // opUse looks like an operation on a filename
+ fc = filenameOperation(opUse)
+ and // the return value of check is used (possibly with one step of
+ // variable indirection) in a guard which controls fc
+ exists(GuardCondition guard |
+ referenceTo(check, guard.getAChild*()) |
+ guard.controls(fc.(ControlFlowNode).getBasicBlock(), _)
+ )
+select fc, "The $@ being operated upon was previously $@, but the underlying file may have been changed since then.", opUse, "filename", check, "checked"
diff --git a/cpp/ql/src/Security/CWE/CWE-367/TOCTOUFilesystemRaceBad.c b/cpp/ql/src/Security/CWE/CWE-367/TOCTOUFilesystemRaceBad.c
new file mode 100644
index 000000000000..03e8a82a38c6
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-367/TOCTOUFilesystemRaceBad.c
@@ -0,0 +1,15 @@
+char *file_name;
+FILE *f_ptr;
+
+/* Initialize file_name */
+
+f_ptr = fopen(file_name, "w");
+if (f_ptr == NULL) {
+ /* Handle error */
+}
+
+/* ... */
+
+if (chmod(file_name, S_IRUSR) == -1) {
+ /* Handle error */
+}
\ No newline at end of file
diff --git a/cpp/ql/src/Security/CWE/CWE-367/TOCTOUFilesystemRaceGood.c b/cpp/ql/src/Security/CWE/CWE-367/TOCTOUFilesystemRaceGood.c
new file mode 100644
index 000000000000..bf14cffbd4d3
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-367/TOCTOUFilesystemRaceGood.c
@@ -0,0 +1,19 @@
+char *file_name;
+int fd;
+
+/* Initialize file_name */
+
+fd = open(
+ file_name,
+ O_WRONLY | O_CREAT | O_EXCL,
+ S_IRWXU
+);
+if (fd == -1) {
+ /* Handle error */
+}
+
+/* ... */
+
+if (fchmod(fd, S_IRUSR) == -1) {
+ /* Handle error */
+}
\ No newline at end of file
diff --git a/cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScaling.cpp b/cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScaling.cpp
new file mode 100644
index 000000000000..c0724bc1926f
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScaling.cpp
@@ -0,0 +1,14 @@
+int example1(int i) {
+ int intArray[10] = { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 };
+ int *intPointer = intArray;
+ // BAD: the offset is already automatically scaled by sizeof(int),
+ // so this code will compute the wrong offset.
+ return *(intPointer + (i * sizeof(int)));
+}
+
+int example2(int i) {
+ int intArray[10] = { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 };
+ int *intPointer = intArray;
+ // GOOD: the offset is automatically scaled by sizeof(int).
+ return *(intPointer + i);
+}
diff --git a/cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScaling.qhelp b/cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScaling.qhelp
new file mode 100644
index 000000000000..16052fc0ed8c
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScaling.qhelp
@@ -0,0 +1,44 @@
+
+
+
+Pointer arithmetic in C and C++ is automatically scaled according
+to the size of the data type. For example, if the type of p
+is T* and sizeof(T) == 4 then the
+expression p+1 adds 4 bytes to p. This can cause a
+buffer overflow condition if the programmer forgets that they are
+adding a multiple of sizeof(T), rather than a number of
+bytes.
+
+
+
+This query finds pointer arithmetic expressions where it appears
+likely that the programmer has forgotten that the offset is
+automatically scaled.
+
+
+
+
+
+
+- Whenever possible, use the array subscript operator rather than
+pointer arithmetic. For example, replace *(p+k)
+with p[k].
+- Cast to the correct type before using pointer arithmetic. For
+example, if the type of p is int* but it really
+points to an array of type double[] then use the syntax
+(double*)p + k to get a pointer to the k'th element
+of the array.
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScaling.ql b/cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScaling.ql
new file mode 100644
index 000000000000..6417d025e6cf
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScaling.ql
@@ -0,0 +1,155 @@
+/**
+ * @name Suspicious pointer scaling
+ * @description Implicit scaling of pointer arithmetic expressions
+ * can cause buffer overflow conditions.
+ * @kind problem
+ * @problem.severity warning
+ * @precision high
+ * @id cpp/suspicious-pointer-scaling
+ * @tags security
+ * external/cwe/cwe-468
+ */
+import cpp
+import semmle.code.cpp.controlflow.SSA
+import IncorrectPointerScalingCommon
+
+private predicate isPointerType(Type t) {
+ t instanceof PointerType or
+ t instanceof ArrayType
+}
+
+private Type baseType(Type t) {
+ (
+ exists (PointerType dt
+ | dt = t.getUnspecifiedType() and
+ result = dt.getBaseType().getUnspecifiedType()) or
+ exists (ArrayType at
+ | at = t.getUnspecifiedType() and
+ (not at.getBaseType().getUnspecifiedType() instanceof ArrayType) and
+ result = at.getBaseType().getUnspecifiedType()) or
+ exists (ArrayType at, ArrayType at2
+ | at = t.getUnspecifiedType() and
+ at2 = at.getBaseType().getUnspecifiedType() and
+ result = baseType(at2))
+ )
+ // Make sure that the type has a size and that it isn't ambiguous.
+ and strictcount(result.getSize()) = 1
+
+}
+
+/**
+ * Holds if there is a pointer expression with type `sourceType` at
+ * location `sourceLoc` which might be the source expression for `use`.
+ *
+ * For example, with
+ * ```
+ * int intArray[5] = { 1, 2, 3, 4, 5 };
+ * char *charPointer = (char *)intArray;
+ * return *(charPointer + i);
+ * ```
+ * the array initializer on the first line is a source expression
+ * for the use of `charPointer` on the third line.
+ *
+ * The source will either be an `Expr` or a `Parameter`.
+ */
+private
+predicate exprSourceType(Expr use, Type sourceType, Location sourceLoc) {
+ // Reaching definitions.
+ if exists (SsaDefinition def, LocalScopeVariable v | use = def.getAUse(v)) then
+ exists (SsaDefinition def, LocalScopeVariable v
+ | use = def.getAUse(v)
+ | defSourceType(def, v, sourceType, sourceLoc))
+
+ // Pointer arithmetic
+ else if use instanceof PointerAddExpr then
+ exprSourceType(use.(PointerAddExpr).getLeftOperand(), sourceType, sourceLoc)
+ else if use instanceof PointerSubExpr then
+ exprSourceType(use.(PointerSubExpr).getLeftOperand(), sourceType, sourceLoc)
+ else if use instanceof AddExpr then
+ exprSourceType(use.(AddExpr).getAnOperand(), sourceType, sourceLoc)
+ else if use instanceof SubExpr then
+ exprSourceType(use.(SubExpr).getAnOperand(), sourceType, sourceLoc)
+ else if use instanceof CrementOperation then
+ exprSourceType(use.(CrementOperation).getOperand(), sourceType, sourceLoc)
+
+ // Conversions are not in the AST, so ignore them.
+ else if use instanceof Conversion then
+ none()
+
+ // Source expressions
+ else
+ (sourceType = use.getType().getUnspecifiedType() and
+ isPointerType(sourceType) and
+ sourceLoc = use.getLocation())
+}
+
+/**
+ * Holds if there is a pointer expression with type `sourceType` at
+ * location `sourceLoc` which might define the value of `v` at `def`.
+ */
+private
+predicate defSourceType(SsaDefinition def, LocalScopeVariable v,
+ Type sourceType, Location sourceLoc) {
+ exprSourceType(def.getDefiningValue(v), sourceType, sourceLoc)
+ or
+ defSourceType(def.getAPhiInput(v), v, sourceType, sourceLoc)
+ or
+ exists (Parameter p
+ | p = v and
+ def.definedByParameter(p) and
+ sourceType = p.getType().getUnspecifiedType() and
+ isPointerType(sourceType) and
+ sourceLoc = p.getLocation())
+}
+
+/**
+ * Gets the pointer arithmetic expression that `e` is (directly) used
+ * in, if any.
+ *
+ * For example, in `(char*)(p + 1)`, for `p`, ths result is `p + 1`.
+ */
+private Expr pointerArithmeticParent(Expr e) {
+ e = result.(PointerAddExpr).getLeftOperand() or
+ e = result.(PointerSubExpr).getLeftOperand() or
+ e = result.(PointerDiffExpr).getAnOperand()
+}
+
+from Expr dest, Type destType, Type sourceType, Type sourceBase,
+ Type destBase, Location sourceLoc
+where exists(pointerArithmeticParent(dest))
+ and exprSourceType(dest, sourceType, sourceLoc)
+ and sourceBase = baseType(sourceType)
+ and destType = dest.getFullyConverted().getType()
+ and destBase = baseType(destType)
+ and destBase.getSize() != sourceBase.getSize()
+ and not dest.isInMacroExpansion()
+
+ // If the source type is a char* or void* then don't
+ // produce a result, because it is likely to be a false
+ // positive.
+ and not (sourceBase instanceof CharType)
+ and not (sourceBase instanceof VoidType)
+
+ // Low-level pointer tricks often involve casting a struct pointer to a
+ // char pointer, then accessing it at byte offsets. For example, this can
+ // be necessary in order to resume an interrupted `write(2)`.
+ and not (destBase instanceof CharType)
+
+ // Similarly, gcc and compilers emulating it will allow void pointer
+ // arithmetic as if void were a 1-byte type
+ and not (destBase instanceof VoidType)
+
+ // Don't produce an alert if the root expression computes
+ // an offset, rather than a pointer. For example:
+ // ```
+ // (p + 1) - q
+ // ```
+ and forall(Expr parent |
+ parent = pointerArithmeticParent+(dest) |
+ parent.getFullyConverted().getType().getUnspecifiedType() instanceof PointerType)
+select
+ dest,
+ "This pointer might have type $@ (size " + sourceBase.getSize() +
+ "), but the pointer arithmetic here is done with type " +
+ destType + " (size " + destBase.getSize() + ").",
+ sourceLoc, sourceBase.toString()
diff --git a/cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScalingChar.cpp b/cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScalingChar.cpp
new file mode 100644
index 000000000000..b7e82e02dfb1
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScalingChar.cpp
@@ -0,0 +1,14 @@
+char example1(int i) {
+ int intArray[5] = { 1, 2, 3, 4, 5 };
+ char *charPointer = (char *)intArray;
+ // BAD: the pointer arithmetic uses type char*, so the offset
+ // is not scaled by sizeof(int).
+ return *(charPointer + i);
+}
+
+int example2(int i) {
+ int intArray[10] = { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 };
+ int *intPointer = intArray;
+ // GOOD: the offset is automatically scaled by sizeof(int).
+ return *(intPointer + i);
+}
diff --git a/cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScalingChar.qhelp b/cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScalingChar.qhelp
new file mode 100644
index 000000000000..b81174b85220
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScalingChar.qhelp
@@ -0,0 +1,38 @@
+
+
+
+Casting arbitrary pointers into char* and then accessing their
+contents should be done with care. The results may not be portable.
+
+
+This query finds pointer arithmetic expressions where a pointer to
+char (or similar) is dereferenced even though the underlying value is
+of a type larger than char.
+
+
+
+
+
+
+- Whenever possible, use the array subscript operator rather than
+pointer arithmetic. For example, replace *(p+k)
+with p[k].
+- Cast to the correct type before using pointer arithmetic. For
+example, if the type of p is char* but it really
+points to an array of type double[] then use the syntax
+(double*)p + k to get a pointer to the k'th element
+of the array.
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScalingChar.ql b/cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScalingChar.ql
new file mode 100644
index 000000000000..fa921e2beb42
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScalingChar.ql
@@ -0,0 +1,153 @@
+/**
+ * @name Suspicious pointer scaling to char
+ * @description Implicit scaling of pointer arithmetic expressions
+ * can cause buffer overflow conditions.
+ * @kind problem
+ * @id cpp/incorrect-pointer-scaling-char
+ * @problem.severity warning
+ * @precision low
+ * @tags security
+ * external/cwe/cwe-468
+ */
+import cpp
+import semmle.code.cpp.controlflow.SSA
+import IncorrectPointerScalingCommon
+
+private predicate isPointerType(Type t) {
+ t instanceof PointerType or
+ t instanceof ArrayType
+}
+
+private Type baseType(Type t) {
+ exists (DerivedType dt
+ | dt = t.getUnspecifiedType() and
+ isPointerType(dt) and
+ result = dt.getBaseType().getUnspecifiedType())
+
+ // Make sure that the type has a size and that it isn't ambiguous.
+ and strictcount(result.getSize()) = 1
+}
+
+/**
+ * Holds if there is a pointer expression with type `sourceType` at
+ * location `sourceLoc` which might be the source expression for `use`.
+ *
+ * For example, with
+ * ```
+ * int intArray[5] = { 1, 2, 3, 4, 5 };
+ * char *charPointer = (char *)intArray;
+ * return *(charPointer + i);
+ * ```
+ * the array initializer on the first line is a source expression
+ * for the use of `charPointer` on the third line.
+ *
+ * The source will either be an `Expr` or a `Parameter`.
+ */
+private
+predicate exprSourceType(Expr use, Type sourceType, Location sourceLoc) {
+ // Reaching definitions.
+ if exists (SsaDefinition def, LocalScopeVariable v | use = def.getAUse(v)) then
+ exists (SsaDefinition def, LocalScopeVariable v
+ | use = def.getAUse(v)
+ | defSourceType(def, v, sourceType, sourceLoc))
+
+ // Pointer arithmetic
+ else if use instanceof PointerAddExpr then
+ exprSourceType(use.(PointerAddExpr).getLeftOperand(), sourceType, sourceLoc)
+ else if use instanceof PointerSubExpr then
+ exprSourceType(use.(PointerSubExpr).getLeftOperand(), sourceType, sourceLoc)
+ else if use instanceof AddExpr then
+ exprSourceType(use.(AddExpr).getAnOperand(), sourceType, sourceLoc)
+ else if use instanceof SubExpr then
+ exprSourceType(use.(SubExpr).getAnOperand(), sourceType, sourceLoc)
+ else if use instanceof CrementOperation then
+ exprSourceType(use.(CrementOperation).getOperand(), sourceType, sourceLoc)
+
+ // Conversions are not in the AST, so ignore them.
+ else if use instanceof Conversion then
+ none()
+
+ // Source expressions
+ else
+ (sourceType = use.getType().getUnspecifiedType() and
+ isPointerType(sourceType) and
+ sourceLoc = use.getLocation())
+}
+
+/**
+ * Holds if there is a pointer expression with type `sourceType` at
+ * location `sourceLoc` which might define the value of `v` at `def`.
+ */
+private
+predicate defSourceType(SsaDefinition def, LocalScopeVariable v,
+ Type sourceType, Location sourceLoc) {
+ exprSourceType(def.getDefiningValue(v), sourceType, sourceLoc)
+ or
+ defSourceType(def.getAPhiInput(v), v, sourceType, sourceLoc)
+ or
+ exists (Parameter p
+ | p = v and
+ def.definedByParameter(p) and
+ sourceType = p.getType().getUnspecifiedType() and
+ isPointerType(sourceType) and
+ sourceLoc = p.getLocation())
+}
+
+/**
+ * Gets the pointer arithmetic expression that `e` is (directly) used
+ * in, if any.
+ *
+ * For example, in `(char*)(p + 1)`, for `p`, ths result is `p + 1`.
+ */
+private Expr pointerArithmeticParent(Expr e) {
+ e = result.(PointerAddExpr).getLeftOperand() or
+ e = result.(PointerSubExpr).getLeftOperand() or
+ e = result.(PointerDiffExpr).getAnOperand()
+}
+
+from Expr dest, Type destType, Type sourceType, Type sourceBase,
+ Type destBase, Location sourceLoc
+where exists(pointerArithmeticParent(dest))
+ and exprSourceType(dest, sourceType, sourceLoc)
+ and sourceBase = baseType(sourceType)
+ and destType = dest.getFullyConverted().getType()
+ and destBase = baseType(destType)
+ and destBase.getSize() != sourceBase.getSize()
+ and not dest.isInMacroExpansion()
+
+ // If the source type is a char* or void* then don't
+ // produce a result, because it is likely to be a false
+ // positive.
+ and not (sourceBase instanceof CharType)
+ and not (sourceBase instanceof VoidType)
+
+ // Don't produce an alert if the dest type is `char *` but the
+ // expression contains a `sizeof`, which is probably correct. For
+ // example:
+ // ```
+ // int x[3] = {1,2,3};
+ // char* p = (char*)x;
+ // return *(int*)(p + (2 * sizeof(int)))
+ // ```
+ and not (
+ destBase instanceof CharType and
+ dest.getParent().(Expr).getAChild*() instanceof SizeofOperator
+ )
+
+ // Don't produce an alert if the root expression computes
+ // an offset, rather than a pointer. For example:
+ // ```
+ // (p + 1) - q
+ // ```
+ and forall(Expr parent |
+ parent = pointerArithmeticParent+(dest) |
+ parent.getFullyConverted().getType().getUnspecifiedType() instanceof PointerType)
+
+ // Only produce alerts that are not produced by `IncorrectPointerScaling.ql`.
+ and (destBase instanceof CharType)
+select
+ dest,
+ "This pointer might have type $@ (size " + sourceBase.getSize() +
+ "), but the pointer arithmetic here is done with type " +
+ destType + " (size " + destBase.getSize() + ").",
+ sourceLoc, sourceBase.toString()
diff --git a/cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScalingCommon.qll b/cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScalingCommon.qll
new file mode 100644
index 000000000000..1d3f20ea946f
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScalingCommon.qll
@@ -0,0 +1,48 @@
+/**
+ * Shared utilities for the CWE-468 queries.
+ */
+import cpp
+
+/**
+ * Gets the type parameter of `sizeof` expression `e`.
+ */
+private
+Type sizeofParam(Expr e) {
+ result = e.(SizeofExprOperator).getExprOperand().getFullyConverted().getType()
+ or
+ result = e.(SizeofTypeOperator).getTypeOperand()
+}
+
+/**
+ * Holds if `e` is `sizeof` expression `sizeofExpr`, possibly multiplied
+ * by another expression, and `sizeofParam` is `sizeofExpr`'s type
+ * parameter.
+ *
+ * For example, if `e` is `4 * sizeof(T)` then `sizeofExpr` is
+ * `sizeof(T)` and `sizeofParam` is `T`.
+ */
+private
+predicate multiplyWithSizeof(Expr e, Expr sizeofExpr, Type sizeofParam) {
+ (e = sizeofExpr and sizeofParam = sizeofParam(e).getUnspecifiedType())
+ or
+ multiplyWithSizeof(e.(MulExpr).getAnOperand(), sizeofExpr, sizeofParam)
+}
+
+/**
+ * Holds if the pointer `e` is added to the `sizeof` expression
+ * `sizeofExpr` (which may first be multiplied by another expression),
+ * and `sizeofParam` is `sizeofExpr`'s type parameter.
+
+ * For example, if the program contains the expression
+ * `p - (i * sizeof(T))` then `e` would be `p`, `sizeofExpr` would be
+ * `sizeof(T)`, and `sizeofParam` would be `T`.
+ */
+predicate addWithSizeof(Expr e, Expr sizeofExpr, Type sizeofParam) {
+ exists (PointerAddExpr addExpr
+ | e = addExpr.getLeftOperand() and
+ multiplyWithSizeof(addExpr.getRightOperand(), sizeofExpr, sizeofParam))
+ or
+ exists (PointerSubExpr subExpr
+ | e = subExpr.getLeftOperand() and
+ multiplyWithSizeof(subExpr.getRightOperand(), sizeofExpr, sizeofParam))
+}
diff --git a/cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScalingVoid.cpp b/cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScalingVoid.cpp
new file mode 100644
index 000000000000..321a5f287fe4
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScalingVoid.cpp
@@ -0,0 +1,14 @@
+char example1(int i) {
+ int intArray[5] = { 1, 2, 3, 4, 5 };
+ void *voidPointer = (void *)intArray;
+ // BAD: the pointer arithmetic uses type void*, so the offset
+ // is not scaled by sizeof(int).
+ return *(voidPointer + i);
+}
+
+int example2(int i) {
+ int intArray[10] = { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 };
+ int *intPointer = intArray;
+ // GOOD: the offset is automatically scaled by sizeof(int).
+ return *(intPointer + i);
+}
diff --git a/cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScalingVoid.qhelp b/cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScalingVoid.qhelp
new file mode 100644
index 000000000000..358cf538f3c1
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScalingVoid.qhelp
@@ -0,0 +1,40 @@
+
+
+
+Casting arbitrary pointers into void* and then accessing their
+contents should be done with care. The results may not be portable.
+
+
+This query finds pointer arithmetic expressions where a pointer to
+void (or similar) is then cast to another type and dereferenced.
+
+
+
+
+
+
+- Whenever possible, use the array subscript operator rather than
+pointer arithmetic. For example, replace *(p+k)
+with p[k].
+- Cast to the correct type before using pointer arithmetic. For
+example, if the type of p is void* but it really
+points to an array of type double[] then use the syntax
+(double*)p + k to get a pointer to the k'th element
+of the array.
+- If pointer arithmetic must be done with a single-byte width, prefer
+
char * to void *, as pointer arithmetic on
+void * is a nonstandard GNU extension.
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScalingVoid.ql b/cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScalingVoid.ql
new file mode 100644
index 000000000000..c91c9a83e9f1
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScalingVoid.ql
@@ -0,0 +1,124 @@
+/**
+ * @name Suspicious pointer scaling to void
+ * @description Implicit scaling of pointer arithmetic expressions
+ * can cause buffer overflow conditions.
+ * @kind problem
+ * @problem.severity warning
+ * @precision medium
+ * @id cpp/suspicious-pointer-scaling-void
+ * @tags security
+ * external/cwe/cwe-468
+ */
+import cpp
+import semmle.code.cpp.controlflow.SSA
+import IncorrectPointerScalingCommon
+
+private predicate isPointerType(Type t) {
+ t instanceof PointerType or
+ t instanceof ArrayType
+}
+
+private Type baseType(Type t) {
+ exists (DerivedType dt
+ | dt = t.getUnspecifiedType() and
+ isPointerType(dt) and
+ result = dt.getBaseType().getUnspecifiedType())
+
+ // Make sure that the type has a size and that it isn't ambiguous.
+ and strictcount(result.getSize()) = 1
+}
+
+/**
+ * Holds if there is a pointer expression with type `sourceType` at
+ * location `sourceLoc` which might be the source expression for `use`.
+ *
+ * For example, with
+ * ```
+ * int intArray[5] = { 1, 2, 3, 4, 5 };
+ * char *charPointer = (char *)intArray;
+ * return *(charPointer + i);
+ * ```
+ * the array initializer on the first line is a source expression
+ * for the use of `charPointer` on the third line.
+ *
+ * The source will either be an `Expr` or a `Parameter`.
+ */
+private
+predicate exprSourceType(Expr use, Type sourceType, Location sourceLoc) {
+ // Reaching definitions.
+ if exists (SsaDefinition def, LocalScopeVariable v | use = def.getAUse(v)) then
+ exists (SsaDefinition def, LocalScopeVariable v
+ | use = def.getAUse(v)
+ | defSourceType(def, v, sourceType, sourceLoc))
+
+ // Pointer arithmetic
+ else if use instanceof PointerAddExpr then
+ exprSourceType(use.(PointerAddExpr).getLeftOperand(), sourceType, sourceLoc)
+ else if use instanceof PointerSubExpr then
+ exprSourceType(use.(PointerSubExpr).getLeftOperand(), sourceType, sourceLoc)
+ else if use instanceof AddExpr then
+ exprSourceType(use.(AddExpr).getAnOperand(), sourceType, sourceLoc)
+ else if use instanceof SubExpr then
+ exprSourceType(use.(SubExpr).getAnOperand(), sourceType, sourceLoc)
+ else if use instanceof CrementOperation then
+ exprSourceType(use.(CrementOperation).getOperand(), sourceType, sourceLoc)
+
+ // Conversions are not in the AST, so ignore them.
+ else if use instanceof Conversion then
+ none()
+
+ // Source expressions
+ else
+ (sourceType = use.getType().getUnspecifiedType() and
+ isPointerType(sourceType) and
+ sourceLoc = use.getLocation())
+}
+
+/**
+ * Holds if there is a pointer expression with type `sourceType` at
+ * location `sourceLoc` which might define the value of `v` at `def`.
+ */
+private
+predicate defSourceType(SsaDefinition def, LocalScopeVariable v,
+ Type sourceType, Location sourceLoc) {
+ exprSourceType(def.getDefiningValue(v), sourceType, sourceLoc)
+ or
+ defSourceType(def.getAPhiInput(v), v, sourceType, sourceLoc)
+ or
+ exists (Parameter p
+ | p = v and
+ def.definedByParameter(p) and
+ sourceType = p.getType().getUnspecifiedType() and
+ isPointerType(sourceType) and
+ sourceLoc = p.getLocation())
+}
+
+/**
+ * Gets the pointer arithmetic expression that `e` is (directly) used
+ * in, if any.
+ *
+ * For example, in `(char*)(p + 1)`, for `p`, ths result is `p + 1`.
+ */
+private Expr pointerArithmeticParent(Expr e) {
+ e = result.(PointerAddExpr).getLeftOperand() or
+ e = result.(PointerSubExpr).getLeftOperand() or
+ e = result.(PointerDiffExpr).getAnOperand()
+}
+
+from Expr dest, Type destType, Type sourceType, Type sourceBase,
+ Type destBase, Location sourceLoc
+where exists(pointerArithmeticParent(dest))
+ and exprSourceType(dest, sourceType, sourceLoc)
+ and sourceBase = baseType(sourceType)
+ and destType = dest.getFullyConverted().getType()
+ and destBase = baseType(destType)
+ and destBase.getSize() != sourceBase.getSize()
+ and not dest.isInMacroExpansion()
+
+ // Only produce alerts that are not produced by `IncorrectPointerScaling.ql`.
+ and (destBase instanceof VoidType)
+select
+ dest,
+ "This pointer might have type $@ (size " + sourceBase.getSize() +
+ "), but the pointer arithmetic here is done with type void",
+ sourceLoc, sourceBase.toString()
diff --git a/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.cpp b/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.cpp
new file mode 100644
index 000000000000..c0724bc1926f
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.cpp
@@ -0,0 +1,14 @@
+int example1(int i) {
+ int intArray[10] = { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 };
+ int *intPointer = intArray;
+ // BAD: the offset is already automatically scaled by sizeof(int),
+ // so this code will compute the wrong offset.
+ return *(intPointer + (i * sizeof(int)));
+}
+
+int example2(int i) {
+ int intArray[10] = { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 };
+ int *intPointer = intArray;
+ // GOOD: the offset is automatically scaled by sizeof(int).
+ return *(intPointer + i);
+}
diff --git a/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.qhelp b/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.qhelp
new file mode 100644
index 000000000000..f88dfd1bda9a
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.qhelp
@@ -0,0 +1,41 @@
+
+
+
+Pointer arithmetic in C and C++ is automatically scaled according
+to the size of the data type. For example, if the type of p
+is T* and sizeof(T) == 4 then the
+expression p+1 adds 4 bytes to p.
+
+
+
+This query finds code of the form p + k*sizeof(T). Such code
+is usually a mistake because there is no need to manually scale the
+offset by sizeof(T).
+
+
+
+
+
+
+- Whenever possible, use the array subscript operator rather than
+pointer arithmetic. For example, replace *(p+k)
+with p[k].
+- Cast to the correct type before using pointer arithmetic. For
+example, if the type of p is char* but it really
+points to an array of type double[] then use the syntax
+(double*)p + k to get a pointer to the k'th element
+of the array.
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql b/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql
new file mode 100644
index 000000000000..75c02b5e8c7f
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-468/SuspiciousAddWithSizeof.ql
@@ -0,0 +1,32 @@
+/**
+ * @name Suspicious add with sizeof
+ * @description Explicitly scaled pointer arithmetic expressions
+ * can cause buffer overflow conditions if the offset is also
+ * implicitly scaled.
+ * @kind problem
+ * @problem.severity warning
+ * @precision high
+ * @id cpp/suspicious-add-sizeof
+ * @tags security
+ * external/cwe/cwe-468
+ */
+import cpp
+import IncorrectPointerScalingCommon
+
+private predicate isCharPtrExpr(Expr e) {
+ exists (PointerType pt
+ | pt = e.getFullyConverted().getUnderlyingType()
+ | pt.getBaseType().getUnspecifiedType() instanceof CharType)
+}
+
+from Expr sizeofExpr, Expr e
+where
+ // If we see an addWithSizeof then we expect the type of
+ // the pointer expression to be char*. Otherwise it is probably
+ // a mistake.
+ addWithSizeof(e, sizeofExpr, _) and not isCharPtrExpr(e)
+select
+ sizeofExpr,
+ "Suspicious sizeof offset in a pointer arithmetic expression. " +
+ "The type of the pointer is " +
+ e.getFullyConverted().getType().toString() + "."
diff --git a/cpp/ql/src/Security/CWE/CWE-497/ExposedSystemData.qhelp b/cpp/ql/src/Security/CWE/CWE-497/ExposedSystemData.qhelp
new file mode 100644
index 000000000000..2daa683f4839
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-497/ExposedSystemData.qhelp
@@ -0,0 +1,28 @@
+
+
+
+Exposing system data or debugging information may help an adversary to learn about the system and form an attack plan. An attacker can use error messages that reveal technologies, operating systems, and product versions to tune their attack against known vulnerabilities in these technologies.
+
+This query finds locations where system configuration information might be revealed to a user.
+
+
+
+Do not expose system configuration information to users. Be wary of the difference between information that could be helpful to users, and unnecessary details that could be useful to an adversary.
+
+
+
+In this example the value of the PATH environment variable is revealed in full to the user when a particular error occurs. This might reveal information such as the software installed on your system to an adversary who does not have legitimate access to that information.
+
+
+
+The message should be rephrased without this information, for example:
+
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-497/ExposedSystemData.ql b/cpp/ql/src/Security/CWE/CWE-497/ExposedSystemData.ql
new file mode 100644
index 000000000000..ef804061e975
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-497/ExposedSystemData.ql
@@ -0,0 +1,492 @@
+/**
+ * @name Exposure of system data to an unauthorized control sphere
+ * @description Exposing system data or debugging information helps
+ * an adversary learn about the system and form an
+ * attack plan.
+ * @kind problem
+ * @problem.severity warning
+ * @precision medium
+ * @id cpp/system-data-exposure
+ * @tags security
+ * external/cwe/cwe-497
+ */
+
+import cpp
+import semmle.code.cpp.commons.Environment
+import semmle.code.cpp.security.OutputWrite
+
+/**
+ * An element that should not be exposed to an adversary.
+ */
+abstract class SystemData extends Element {
+ /**
+ * Gets an expression that is part of this `SystemData`.
+ */
+ abstract Expr getAnExpr();
+
+ /**
+ * Gets an expression whose value originates from, or is used by,
+ * this `SystemData`.
+ */
+ Expr getAnExprIndirect() {
+ // direct SystemData
+ result = getAnExpr() or
+
+ // flow via global or member variable (conservative approximation)
+ exists(Variable var |
+ (
+ var.getAnAssignedValue() = getAnExprIndirect() or
+ var.getAnAccess() = getAnExprIndirect()
+ ) and
+ result = var.getAnAccess() and
+ not var instanceof LocalScopeVariable
+ ) or
+
+ // flow via stack variable
+ definitionUsePair(_, getAnExprIndirect(), result) or
+ useUsePair(_, getAnExprIndirect(), result) or
+ useUsePair(_, result, getAnExprIndirect()) or
+
+ // flow from assigned value to assignment expression
+ result.(AssignExpr).getRValue() = getAnExprIndirect()
+ }
+}
+
+/**
+ * Data originating from the environment.
+ */
+class EnvData extends SystemData {
+ EnvData() {
+ this instanceof EnvironmentRead
+ }
+
+ override Expr getAnExpr() {
+ result = this
+ }
+}
+
+/**
+ * Data originating from a call to `mysql_get_client_info()`.
+ */
+class SQLClientInfo extends SystemData {
+ SQLClientInfo() {
+ this.(FunctionCall).getTarget().hasName("mysql_get_client_info")
+ }
+
+ override Expr getAnExpr() {
+ result = this
+ }
+}
+
+private predicate sqlConnectInfo(FunctionCall source, VariableAccess use) {
+ (
+ source.getTarget().hasName("mysql_connect") or
+ source.getTarget().hasName("mysql_real_connect")
+ ) and (
+ use = source.getAnArgument()
+ )
+}
+
+/**
+ * Data passed into an SQL connect function.
+ */
+class SQLConnectInfo extends SystemData {
+ SQLConnectInfo() {
+ sqlConnectInfo(this, _)
+ }
+
+ override Expr getAnExpr() {
+ sqlConnectInfo(this, result)
+ }
+}
+
+private predicate posixSystemInfo(FunctionCall source, Element use) {
+ (
+ // long sysconf(int name)
+ // - various OS / system values and limits
+ source.getTarget().hasName("sysconf") and
+ use = source
+ ) or (
+ // size_t confstr(int name, char *buf, size_t len)
+ // - various OS / system strings, such as the libc version
+ // int statvfs(const char *__path, struct statvfs *__buf)
+ // int fstatvfs(int __fd, struct statvfs *__buf)
+ // - various filesystem parameters
+ // int uname(struct utsname *buf)
+ // - OS name and version
+ (
+ source.getTarget().hasName("confstr") or
+ source.getTarget().hasName("statvfs") or
+ source.getTarget().hasName("fstatvfs") or
+ source.getTarget().hasName("uname")
+ ) and (
+ use = source.getArgument(1)
+ )
+ )
+}
+
+/**
+ * Data obtained from a POSIX system information call.
+ */
+class PosixSystemInfo extends SystemData {
+ PosixSystemInfo() {
+ posixSystemInfo(this, _)
+ }
+
+ override Expr getAnExpr() {
+ posixSystemInfo(this, result)
+ }
+}
+
+private predicate posixPWInfo(FunctionCall source, Element use) {
+ (
+ // struct passwd *getpwnam(const char *name);
+ // struct passwd *getpwuid(uid_t uid);
+ // struct passwd *getpwent(void);
+ // struct group *getgrnam(const char *name);
+ // struct group *getgrgid(gid_t);
+ // struct group *getgrent(void);
+ (
+ source.getTarget().hasName("getpwnam") or
+ source.getTarget().hasName("getpwuid") or
+ source.getTarget().hasName("getpwent") or
+ source.getTarget().hasName("getgrnam") or
+ source.getTarget().hasName("getgrgid") or
+ source.getTarget().hasName("getgrent")
+ ) and
+ use = source
+ ) or (
+ // int getpwnam_r(const char *name, struct passwd *pwd,
+ // char *buf, size_t buflen, struct passwd **result);
+ // int getpwuid_r(uid_t uid, struct passwd *pwd,
+ // char *buf, size_t buflen, struct passwd **result);
+ // int getgrgid_r(gid_t gid, struct group *grp,
+ // char *buf, size_t buflen, struct group **result);
+ // int getgrnam_r(const char *name, struct group *grp,
+ // char *buf, size_t buflen, struct group **result);
+ (
+ source.getTarget().hasName("getpwnam_r") or
+ source.getTarget().hasName("getpwuid_r") or
+ source.getTarget().hasName("getgrgid_r") or
+ source.getTarget().hasName("getgrnam_r")
+ ) and (
+ use = source.getArgument(1) or
+ use = source.getArgument(2) or
+ use = source.getArgument(4)
+ )
+ ) or (
+ // int getpwent_r(struct passwd *pwd, char *buffer, size_t bufsize,
+ // struct passwd **result);
+ // int getgrent_r(struct group *gbuf, char *buf,
+ // size_t buflen, struct group **gbufp);
+ (
+ source.getTarget().hasName("getpwent_r") or
+ source.getTarget().hasName("getgrent_r")
+ ) and (
+ use = source.getArgument(0) or
+ use = source.getArgument(1) or
+ use = source.getArgument(3)
+ )
+ )
+}
+
+/**
+ * Data obtained from a POSIX user/password/group database information call.
+ */
+class PosixPWInfo extends SystemData {
+ PosixPWInfo() {
+ posixPWInfo(this, _)
+ }
+
+ override Expr getAnExpr() {
+ posixPWInfo(this, result)
+ }
+}
+
+private predicate windowsSystemInfo(FunctionCall source, Element use) {
+ (
+ // DWORD WINAPI GetVersion(void);
+ (
+ source.getTarget().hasGlobalName("GetVersion")
+ ) and
+ use = source
+ ) or (
+ // BOOL WINAPI GetVersionEx(_Inout_ LPOSVERSIONINFO lpVersionInfo);
+ // void WINAPI GetSystemInfo(_Out_ LPSYSTEM_INFO lpSystemInfo);
+ // void WINAPI GetNativeSystemInfo(_Out_ LPSYSTEM_INFO lpSystemInfo);
+ (
+ source.getTarget().hasName("GetVersionEx") or
+ source.getTarget().hasName("GetVersionExA") or
+ source.getTarget().hasName("GetVersionExW") or
+ source.getTarget().hasName("GetSystemInfo") or
+ source.getTarget().hasName("GetNativeSystemInfo")
+ ) and
+ use = source.getArgument(0)
+ )
+}
+
+/**
+ * Data obtained from a Windows system information call.
+ */
+class WindowsSystemInfo extends SystemData {
+ WindowsSystemInfo() {
+ windowsSystemInfo(this, _)
+ }
+
+ override Expr getAnExpr() {
+ windowsSystemInfo(this, result)
+ }
+}
+
+private predicate windowsFolderPath(FunctionCall source, Element use) {
+ (
+ // BOOL SHGetSpecialFolderPath(
+ // HWND hwndOwner,
+ // _Out_ LPTSTR lpszPath,
+ // _In_ int csidl,
+ // _In_ BOOL fCreate
+ // );
+ (
+ source.getTarget().hasName("SHGetSpecialFolderPath") or
+ source.getTarget().hasName("SHGetSpecialFolderPathA") or
+ source.getTarget().hasName("SHGetSpecialFolderPathW")
+ ) and
+ use = source.getArgument(1)
+ ) or (
+ // HRESULT SHGetKnownFolderPath(
+ // _In_ REFKNOWNFOLDERID rfid,
+ // _In_ DWORD dwFlags,
+ // _In_opt_ HANDLE hToken,
+ // _Out_ PWSTR *ppszPath
+ // );
+ source.getTarget().hasName("SHGetKnownFolderPath") and
+ use = source.getArgument(3)
+ ) or (
+ // HRESULT SHGetFolderPath(
+ // _In_ HWND hwndOwner,
+ // _In_ int nFolder,
+ // _In_ HANDLE hToken,
+ // _In_ DWORD dwFlags,
+ // _Out_ LPTSTR pszPath
+ // );
+ (
+ source.getTarget().hasName("SHGetFolderPath") or
+ source.getTarget().hasName("SHGetFolderPathA") or
+ source.getTarget().hasName("SHGetFolderPathW")
+ ) and
+ use = source.getArgument(4)
+ ) or (
+ // HRESULT SHGetFolderPathAndSubDir(
+ // _In_ HWND hwnd,
+ // _In_ int csidl,
+ // _In_ HANDLE hToken,
+ // _In_ DWORD dwFlags,
+ // _In_ LPCTSTR pszSubDir,
+ // _Out_ LPTSTR pszPath
+ // );
+ (
+ source.getTarget().hasName("SHGetFolderPathAndSubDir") or
+ source.getTarget().hasName("SHGetFolderPathAndSubDirA") or
+ source.getTarget().hasName("SHGetFolderPathAndSubDirW")
+ ) and
+ use = source.getArgument(5)
+ )
+}
+
+/**
+ * Data obtained about Windows special paths (for example, the
+ * location of `System32`).
+ */
+class WindowsFolderPath extends SystemData {
+ WindowsFolderPath() {
+ windowsFolderPath(this, _)
+ }
+
+ override Expr getAnExpr() {
+ windowsFolderPath(this, result)
+ }
+}
+
+private predicate logonUser(FunctionCall source, VariableAccess use) {
+ (
+ source.getTarget().hasName("LogonUser") or
+ source.getTarget().hasName("LogonUserW") or
+ source.getTarget().hasName("LogonUserA")
+ ) and (
+ use = source.getAnArgument()
+ )
+}
+
+/**
+ * Data passed into a `LogonUser` (Windows) function.
+ */
+class LogonUser extends SystemData {
+ LogonUser() {
+ logonUser(this, _)
+ }
+
+ override Expr getAnExpr() {
+ logonUser(this, result)
+ }
+}
+
+private predicate regQuery(FunctionCall source, VariableAccess use) {
+ (
+ // LONG WINAPI RegQueryValue(
+ // _In_ HKEY hKey,
+ // _In_opt_ LPCTSTR lpSubKey,
+ // _Out_opt_ LPTSTR lpValue,
+ // _Inout_opt_ PLONG lpcbValue
+ // );
+ (
+ source.getTarget().hasName("RegQueryValue") or
+ source.getTarget().hasName("RegQueryValueA") or
+ source.getTarget().hasName("RegQueryValueW")
+ ) and (
+ use = source.getArgument(2)
+ )
+ ) or (
+ // LONG WINAPI RegQueryMultipleValues(
+ // _In_ HKEY hKey,
+ // _Out_ PVALENT val_list,
+ // _In_ DWORD num_vals,
+ // _Out_opt_ LPTSTR lpValueBuf,
+ // _Inout_opt_ LPDWORD ldwTotsize
+ // );
+ (
+ source.getTarget().hasName("RegQueryMultipleValues") or
+ source.getTarget().hasName("RegQueryMultipleValuesA") or
+ source.getTarget().hasName("RegQueryMultipleValuesW")
+ ) and (
+ use = source.getArgument(3)
+ )
+ ) or (
+ // LONG WINAPI RegQueryValueEx(
+ // _In_ HKEY hKey,
+ // _In_opt_ LPCTSTR lpValueName,
+ // _Reserved_ LPDWORD lpReserved,
+ // _Out_opt_ LPDWORD lpType,
+ // _Out_opt_ LPBYTE lpData,
+ // _Inout_opt_ LPDWORD lpcbData
+ // );
+ (
+ source.getTarget().hasName("RegQueryValueEx") or
+ source.getTarget().hasName("RegQueryValueExA") or
+ source.getTarget().hasName("RegQueryValueExW")
+ ) and (
+ use = source.getArgument(4)
+ )
+ ) or (
+ // LONG WINAPI RegGetValue(
+ // _In_ HKEY hkey,
+ // _In_opt_ LPCTSTR lpSubKey,
+ // _In_opt_ LPCTSTR lpValue,
+ // _In_opt_ DWORD dwFlags,
+ // _Out_opt_ LPDWORD pdwType,
+ // _Out_opt_ PVOID pvData,
+ // _Inout_opt_ LPDWORD pcbData
+ // );
+ (
+ source.getTarget().hasName("RegGetValue") or
+ source.getTarget().hasName("RegGetValueA") or
+ source.getTarget().hasName("RegGetValueW")
+ ) and (
+ use = source.getArgument(5)
+ )
+ )
+}
+
+/**
+ * Data read from the Windows registry.
+ */
+class RegQuery extends SystemData {
+ RegQuery() {
+ regQuery(this, _)
+ }
+
+ override Expr getAnExpr() {
+ regQuery(this, result)
+ }
+}
+/**
+ * Somewhere data is output.
+ */
+abstract class DataOutput extends Element {
+ /**
+ * Get an expression containing data that is output.
+ */
+ abstract Expr getASource();
+}
+
+/**
+ * Data that is output via standard output or standard error.
+ */
+class StandardOutput extends DataOutput {
+ StandardOutput() {
+ this instanceof OutputWrite
+ }
+
+ override Expr getASource() {
+ result = this.(OutputWrite).getASource()
+ }
+}
+
+private predicate socketCallOrIndirect(FunctionCall call) {
+ (
+ // direct socket call
+ // int socket(int domain, int type, int protocol);
+ call.getTarget().getName() = "socket"
+ ) or exists(ReturnStmt rtn |
+ // indirect socket call
+ call.getTarget() = rtn.getEnclosingFunction() and
+ (
+ socketCallOrIndirect(rtn.getExpr()) or
+ socketCallOrIndirect(rtn.getExpr().(VariableAccess).getTarget().getAnAssignedValue())
+ )
+ )
+}
+
+private predicate socketFileDescriptor(Expr e) {
+ exists(Variable var, FunctionCall socket |
+ socketCallOrIndirect(socket) and
+ var.getAnAssignedValue() = socket and
+ e = var.getAnAccess()
+ )
+}
+
+private predicate socketOutput(FunctionCall call, Expr data) {
+ (
+ // ssize_t send(int sockfd, const void *buf, size_t len, int flags);
+ // ssize_t sendto(int sockfd, const void *buf, size_t len, int flags,
+ // const struct sockaddr *dest_addr, socklen_t addrlen);
+ // ssize_t sendmsg(int sockfd, const struct msghdr *msg, int flags);
+ // int write(int handle, void *buffer, int nbyte);
+ (
+ call.getTarget().hasGlobalName("send") or
+ call.getTarget().hasGlobalName("sendto") or
+ call.getTarget().hasGlobalName("sendmsg") or
+ call.getTarget().hasGlobalName("write")
+ ) and
+ data = call.getArgument(1) and
+ socketFileDescriptor(call.getArgument(0))
+ )
+}
+
+/**
+ * Data that is output via a socket.
+ */
+class SocketOutput extends DataOutput {
+ SocketOutput() {
+ socketOutput(this, _)
+ }
+
+ override Expr getASource() {
+ socketOutput(this, result)
+ }
+}
+
+from SystemData sd, DataOutput ow
+where
+ sd.getAnExprIndirect() = ow.getASource() or
+ sd.getAnExprIndirect() = ow.getASource().(Expr).getAChild*()
+select ow, "This operation exposes system data from $@.", sd, sd.toString()
diff --git a/cpp/ql/src/Security/CWE/CWE-497/ExposedSystemDataCorrect.cpp b/cpp/ql/src/Security/CWE/CWE-497/ExposedSystemDataCorrect.cpp
new file mode 100644
index 000000000000..ac885f425dcf
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-497/ExposedSystemDataCorrect.cpp
@@ -0,0 +1,7 @@
+char* path = getenv("PATH");
+
+//...
+
+fprintf(stderr, "A required executable file could not be found. " \
+ "Please ensure that the software has been installed " \
+ "correctly or contact a system administrator.\n");
\ No newline at end of file
diff --git a/cpp/ql/src/Security/CWE/CWE-497/ExposedSystemDataIncorrect.cpp b/cpp/ql/src/Security/CWE/CWE-497/ExposedSystemDataIncorrect.cpp
new file mode 100644
index 000000000000..fec622a5f7f4
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-497/ExposedSystemDataIncorrect.cpp
@@ -0,0 +1,5 @@
+char* path = getenv("PATH");
+
+//...
+
+fprintf(stderr, "cannot find exe on path %s\n", path);
\ No newline at end of file
diff --git a/cpp/ql/src/Security/CWE/CWE-676/DangerousUseOfCin.cpp b/cpp/ql/src/Security/CWE/CWE-676/DangerousUseOfCin.cpp
new file mode 100644
index 000000000000..59435c531236
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-676/DangerousUseOfCin.cpp
@@ -0,0 +1,18 @@
+#define BUFFER_SIZE 20
+
+void bad()
+{
+ char buffer[BUFFER_SIZE];
+ // BAD: Use of 'cin' without specifying the length of the input.
+ cin >> buffer;
+ buffer[BUFFER_SIZE-1] = '\0';
+}
+
+void good()
+{
+ char buffer[BUFFER_SIZE];
+ // GOOD: Specifying the length of the input before using 'cin'.
+ cin.width(BUFFER_SIZE);
+ cin >> buffer;
+ buffer[BUFFER_SIZE-1] = '\0';
+}
diff --git a/cpp/ql/src/Security/CWE/CWE-676/DangerousUseOfCin.qhelp b/cpp/ql/src/Security/CWE/CWE-676/DangerousUseOfCin.qhelp
new file mode 100644
index 000000000000..9cfa4cd79214
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-676/DangerousUseOfCin.qhelp
@@ -0,0 +1,29 @@
+
+
+
+This rule finds calls to std::istream::operator>> on
+std::cin without a preceding call to cin.width.
+Consuming input from cin without specifying the length
+of the input is dangerous due to the possibility of buffer overflows.
+
+
+
+
+Always specify the length of any input expected from cin
+by calling cin.width before consuming the input.
+
+
+
+The following example shows both a dangerous and a safe way to consume
+input from cin.
+
+
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-676/DangerousUseOfCin.ql b/cpp/ql/src/Security/CWE/CWE-676/DangerousUseOfCin.ql
new file mode 100644
index 000000000000..43ff0e6b8a34
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-676/DangerousUseOfCin.ql
@@ -0,0 +1,259 @@
+/**
+ * @name Dangerous use of 'cin'
+ * @description Using `cin` without specifying the length of the input
+ * may be dangerous.
+ * @kind problem
+ * @problem.severity error
+ * @precision high
+ * @id cpp/dangerous-cin
+ * @tags reliability
+ * security
+ * external/cwe/cwe-676
+ * external/cwe/cwe-242
+ */
+import cpp
+
+/**
+ * A C/C++ `char*` or `wchar_t*` type.
+ */
+class AnyCharPointerType extends PointerType {
+ AnyCharPointerType() {
+ this.getBaseType().getUnderlyingType() instanceof CharType or
+ this.getBaseType().getUnderlyingType() instanceof WideCharType
+ }
+}
+
+/**
+ * A C/C++ `char[]` or `wchar_t[]` type.
+ */
+class AnyCharArrayType extends ArrayType {
+ AnyCharArrayType() {
+ this.getBaseType().getUnderlyingType() instanceof CharType or
+ this.getBaseType().getUnderlyingType() instanceof WideCharType
+ }
+}
+
+/**
+ * A C++ `std::basic_string` type (the underlying type of `std::string`
+ * and `std::wstring`).
+ */
+class AnyStdStringType extends Type {
+ AnyStdStringType() {
+ exists(Namespace std |
+ std.getName() = "std" and
+ std.getADeclaration() = this
+ ) and
+ this.getName().matches("basic\\_string<%")
+ }
+}
+
+/**
+ * A C++ `std::basic_ifstream` type (the underlying type of
+ * `std::ifstream` and `std::wifstream`).
+ */
+class IFStream extends Type {
+ IFStream() {
+ exists(Namespace std |
+ std.getName() = "std" and
+ std.getADeclaration() = this
+ ) and
+ this.getName().matches("basic\\_ifstream<%")
+ }
+}
+
+/**
+ * The variable `std::cin` or `std::wcin`.
+ */
+class CinVariable extends NamespaceVariable {
+ CinVariable() {
+ (
+ getName() = "cin" or
+ getName() = "wcin"
+ ) and
+ getNamespace().getName() = "std"
+ }
+}
+
+/** A call to `std::operator>>`. */
+class OperatorRShiftCall extends FunctionCall {
+ OperatorRShiftCall() {
+ getTarget().getNamespace().getName() = "std" and
+ getTarget().hasName("operator>>")
+ }
+
+ /*
+ This is complicated by the fact this overload can be made
+ in two ways:
+ - as a member of the `std::istream` class, with one parameter.
+ - as an independent function, with two parameters.
+ */
+
+ Expr getSource() {
+ if (getTarget() instanceof MemberFunction) then (
+ result = getQualifier()
+ ) else (
+ result = getArgument(0)
+ )
+ }
+
+ Expr getDest() {
+ if (getTarget() instanceof MemberFunction) then (
+ result = getArgument(0)
+ ) else (
+ result = getArgument(1)
+ )
+ }
+}
+
+/**
+ * A potentially dangerous `std::istream` or `std::wistream`, for
+ * example, an access to `std::cin`.
+ */
+abstract class PotentiallyDangerousInput extends Expr {
+ /**
+ * Gets the variable that is the source of this input stream, if
+ * it can be determined.
+ */
+ abstract Variable getStreamVariable();
+
+ /**
+ * Gets the previous access to the same input stream, if any.
+ */
+ abstract PotentiallyDangerousInput getPreviousAccess();
+
+ /**
+ * Gets the width restriction that applies to the input stream
+ * for this expression, if any.
+ */
+ Expr getWidth() {
+ result = getPreviousAccess().getWidthAfter()
+ }
+
+ private Expr getWidthSetHere() {
+ exists(FunctionCall widthCall |
+ // std::istream.width or std::wistream.width
+ widthCall.getQualifier() = this and
+ widthCall.getTarget().getName() = "width" and
+ result = widthCall.getArgument(0)
+ ) or exists(FunctionCall setwCall, Function setw |
+ // >> std::setw
+ setwCall = this.(OperatorRShiftCall).getDest() and
+ setw = setwCall.getTarget() and
+ setw.getNamespace().getName() = "std" and
+ setw.hasName("setw") and
+ result = setwCall.getArgument(0)
+ )
+ }
+
+ private predicate isWidthConsumedHere() {
+ // std::cin >> s, where s is a char*, char[] or std::string type
+ // or wide character equivalent
+ exists(Type t |
+ t = this.(OperatorRShiftCall).getDest().getUnderlyingType() |
+ t instanceof AnyCharPointerType or
+ t instanceof AnyCharArrayType or
+ t instanceof AnyStdStringType)
+ }
+
+ /**
+ * Gets the width restriction that applies to the input stream
+ * after this expression, if any.
+ */
+ Expr getWidthAfter() {
+ result = getWidthSetHere()
+ or
+ (
+ not exists(getWidthSetHere()) and
+ not isWidthConsumedHere() and
+ result = getWidth()
+ )
+ }
+}
+
+predicate nextPotentiallyDangerousInput(ControlFlowNode cfn, PotentiallyDangerousInput next, Variable streamVariable) {
+ (
+ // this node
+ next = cfn and
+ next.getStreamVariable() = streamVariable
+ ) or (
+ // flow
+ not cfn.(PotentiallyDangerousInput).getStreamVariable() = streamVariable and
+ nextPotentiallyDangerousInput(cfn.getASuccessor(), next, streamVariable)
+ )
+}
+
+/**
+ * A direct access to `std::cin` or `std::wcin`.
+ */
+class CinAccess extends PotentiallyDangerousInput {
+ CinAccess() {
+ this.(VariableAccess).getTarget() instanceof CinVariable
+ }
+
+ override Variable getStreamVariable() {
+ result = this.(VariableAccess).getTarget()
+ }
+
+ override PotentiallyDangerousInput getPreviousAccess() {
+ nextPotentiallyDangerousInput(result.getASuccessor(), this, result.getStreamVariable())
+ }
+}
+
+/**
+ * A direct access to a variable of type `std::ifstream` or `std::wifstream`.
+ */
+class IFStreamAccess extends PotentiallyDangerousInput {
+ IFStreamAccess() {
+ this.(VariableAccess).getTarget().getUnderlyingType() instanceof IFStream
+ }
+
+ override Variable getStreamVariable() {
+ result = this.(VariableAccess).getTarget()
+ }
+
+ override PotentiallyDangerousInput getPreviousAccess() {
+ nextPotentiallyDangerousInput(result.getASuccessor(), this, result.getStreamVariable())
+ }
+}
+
+/**
+ * A chained call to `std::operator>>` on a potentially dangerous input.
+ */
+class ChainedInput extends PotentiallyDangerousInput {
+ ChainedInput() {
+ this.(OperatorRShiftCall).getSource() instanceof PotentiallyDangerousInput
+ }
+
+ override Variable getStreamVariable() {
+ result = this.(OperatorRShiftCall).getSource().(PotentiallyDangerousInput).getStreamVariable()
+ }
+
+ override PotentiallyDangerousInput getPreviousAccess() {
+ result = this.(OperatorRShiftCall).getSource()
+ }
+}
+
+from PotentiallyDangerousInput input, OperatorRShiftCall rshift, Expr dest
+where
+ // a call to operator>> on a potentially dangerous input
+ input = rshift.getSource() and
+ dest = rshift.getDest() and
+ (
+ (
+ // destination is char* or wchar_t*
+ dest.getUnderlyingType() instanceof AnyCharPointerType and
+
+ // assume any width setting makes this safe
+ not exists(input.getWidthAfter())
+ ) or exists(int arraySize |
+ // destination is char[] or wchar_t* or a wide character equivalent.
+ arraySize = dest.getUnderlyingType().(AnyCharArrayType).getArraySize() and
+
+ // assume any width setting makes this safe, unless we know
+ // it to be larger than the array.
+ forall(Expr w | w = input.getWidthAfter() |
+ w.getValue().toInt() > arraySize
+ )
+ )
+ )
+select rshift, "Use of 'cin' without specifying the length of the input may be dangerous."
diff --git a/cpp/ql/src/Security/CWE/CWE-676/PotentiallyDangerousFunction.c b/cpp/ql/src/Security/CWE/CWE-676/PotentiallyDangerousFunction.c
new file mode 100644
index 000000000000..d455bb102b08
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-676/PotentiallyDangerousFunction.c
@@ -0,0 +1,12 @@
+// BAD: using gmtime
+int is_morning_bad() {
+ struct tm *now = gmtime(time(NULL));
+ return (now->tm_hour < 12);
+}
+
+// GOOD: using gmtime_r
+int is_morning_good() {
+ struct tm now;
+ gmtime_r(time(NULL), &now);
+ return (now.tm_hour < 12);
+}
diff --git a/cpp/ql/src/Security/CWE/CWE-676/PotentiallyDangerousFunction.qhelp b/cpp/ql/src/Security/CWE/CWE-676/PotentiallyDangerousFunction.qhelp
new file mode 100644
index 000000000000..40b82e9310ac
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-676/PotentiallyDangerousFunction.qhelp
@@ -0,0 +1,54 @@
+
+
+
+This rule finds calls to functions that are dangerous to
+use. Currently, it checks for calls
+to gmtime. See Related rules
+below for rules that identify other dangerous functions.
+
+The gmtime function fills data into a tm
+struct in shared memory and then returns a pointer to that struct. If
+the function is called from multiple places in the same program, and
+especially if it is called from multiple threads in the same program,
+then the calls will overwrite each other's data.
+
+
+
+
+It is safer to use gmtime_r.
+With gmtime_r, the application code manages allocation of
+the tm struct. That way, separate calls to the function
+can use their own storage.
+
+
+
+The following example checks the local time in two ways:
+
+
+The first version uses gmtime, so it is vulnerable to
+its data being overwritten by another thread. Even if this code is not
+used in a multi-threaded context right now, future changes may
+make the program multi-threaded. The second version of the code
+uses gmtime_r. Since it allocates a new tm
+struct on every call, it is immune to other calls to gmtime
+or gmtime_r.
+
+
+
+Other dangerous functions identified by CWE-676 ("Use of
+Potentially Dangerous Function") include strcpy
+and strcat. Use of these functions is highlighted by
+rules for the following CWEs:
+
+- CWE-120 Classic Buffer Overflow
+
- CWE-131 Incorrect Calculation of Buffer Size
+
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-676/PotentiallyDangerousFunction.ql b/cpp/ql/src/Security/CWE/CWE-676/PotentiallyDangerousFunction.ql
new file mode 100644
index 000000000000..d529adc278c1
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-676/PotentiallyDangerousFunction.ql
@@ -0,0 +1,24 @@
+/**
+ * @name Use of potentially dangerous function
+ * @description Certain standard library functions are dangerous to call.
+ * @kind problem
+ * @problem.severity error
+ * @precision high
+ * @id cpp/potentially-dangerous-function
+ * @tags reliability
+ * security
+ * external/cwe/cwe-676
+ */
+import cpp
+
+
+predicate dangerousFunction(Function function) {
+ exists (string name | name = function.getQualifiedName() |
+ name = "gmtime")
+}
+
+
+from FunctionCall call, Function target
+where call.getTarget() = target
+ and dangerousFunction(target)
+select call, "Call to " + target.getQualifiedName() + " is potentially dangerous"
diff --git a/cpp/ql/src/Security/CWE/CWE-732/DoNotCreateWorldWritable.c b/cpp/ql/src/Security/CWE/CWE-732/DoNotCreateWorldWritable.c
new file mode 100644
index 000000000000..3c984aa6a62e
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-732/DoNotCreateWorldWritable.c
@@ -0,0 +1,11 @@
+int write_default_config_bad() {
+ // BAD - this is world-writable so any user can overwrite the config
+ FILE* out = creat(OUTFILE, 0666);
+ fprintf(out, DEFAULT_CONFIG);
+}
+
+int write_default_config_good() {
+ // GOOD - this allows only the current user to modify the file
+ FILE* out = creat(OUTFILE, S_IWUSR | S_IRUSR);
+ fprintf(out, DEFAULT_CONFIG);
+}
diff --git a/cpp/ql/src/Security/CWE/CWE-732/DoNotCreateWorldWritable.qhelp b/cpp/ql/src/Security/CWE/CWE-732/DoNotCreateWorldWritable.qhelp
new file mode 100644
index 000000000000..6ee951490414
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-732/DoNotCreateWorldWritable.qhelp
@@ -0,0 +1,50 @@
+
+
+
+
+When you create a file, take care to give it the most restrictive permissions possible. A typical
+mistake is to create the file with world-writable permissions. This can allow an attacker to write to the file, which can give them
+unexpected control over the program.
+
+
+
+
+Files should usually be created with write permissions only for the current user. If broader permissions are needed, including
+the users' group should be sufficient. It is very rare that a file needs to be world-writable, and care should be taken not
+to make assumptions about the contents of any such file.
+
+
+
+On Unix systems, it is possible for the user who runs the program to restrict file creation permissions using umask. However,
+a program should not assume that the user will set an umask, and should still set restrictive permissions by default.
+
+
+
+
+This example shows two ways of writing a default configuration file. Software often does this to provide the user with a convenient
+starting point for defining their own configuration. However, configuration files can also control important aspects of the software's behavior,
+so it is important that they cannot be controlled by an attacker.
+
+
+
+The first example creates the default configuration file with the usual "default" Unix permissions, 0666. This makes the
+file world-writable, so that an attacker could write in their own configuration that would be read by the program. The second example uses
+more restrictive permissions: a combination of the standard Unix constants S_IWUSR and S_IRUSR which means that
+only the current user will have read and write access to the file.
+
+
+
+
+
+
+
+The CERT Oracle Secure Coding Standard for C:
+
+ FIO06-C. Create files with appropriate access permissions
+ .
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-732/DoNotCreateWorldWritable.ql b/cpp/ql/src/Security/CWE/CWE-732/DoNotCreateWorldWritable.ql
new file mode 100644
index 000000000000..5d1480f59c5f
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-732/DoNotCreateWorldWritable.ql
@@ -0,0 +1,40 @@
+/**
+ * @name File created without restricting permissions
+ * @description Creating a file that is world-writable can allow an attacker to write to the file.
+ * @kind problem
+ * @problem.severity warning
+ * @precision medium
+ * @id cpp/world-writable-file-creation
+ * @tags security
+ * external/cwe/cwe-732
+ */
+
+import cpp
+import FilePermissions
+import semmle.code.cpp.commons.unix.Constants
+
+predicate worldWritableCreation(FileCreationExpr fc, int mode) {
+ mode = localUmask(fc).mask(fc.getMode())
+ and
+ sets(mode, s_iwoth())
+}
+
+predicate setWorldWritable(FunctionCall fc, int mode) {
+ exists(string name | fc.getTarget().getName() = name |
+ name = "chmod" or
+ name = "fchmod" or
+ name = "_chmod" or
+ name = "_wchmod"
+ )
+ and
+ mode = fc.getArgument(1).getValue().toInt()
+ and
+ sets(mode, s_iwoth())
+}
+
+from Expr fc, int mode, string message
+where
+ worldWritableCreation(fc, mode) and message = "A file may be created here with mode "+octalFileMode(mode)+", which would make it world-writable."
+ or
+ setWorldWritable(fc, mode) and message = "This sets a file's permissions to "+octalFileMode(mode)+", which would make it world-writable."
+select fc, message
diff --git a/cpp/ql/src/Security/CWE/CWE-732/FilePermissions.qll b/cpp/ql/src/Security/CWE/CWE-732/FilePermissions.qll
new file mode 100644
index 000000000000..3f89093fb046
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-732/FilePermissions.qll
@@ -0,0 +1,181 @@
+import cpp
+import semmle.code.cpp.commons.unix.Constants
+
+bindingset[n, digit]
+private string octalDigit(int n, int digit) {
+ result = n.bitShiftRight(digit * 3).bitAnd(7).toString()
+}
+
+bindingset[n, digit]
+private string octalDigitOpt(int n, int digit) {
+ exists(string s | s = octalDigit(n, digit) |
+ if s = "0" then result = "" else result = s
+ )
+}
+
+bindingset[mode]
+string octalFileMode(int mode) {
+ if mode >= 0 and mode <= 4095 /* octal 07777 */ then
+ result =
+ "0" +
+ octalDigitOpt(mode, 3) +
+ octalDigit(mode, 2) +
+ octalDigit(mode, 1) +
+ octalDigit(mode, 0)
+ else
+ result = "[non-standard mode: decimal "+ mode +"]"
+}
+
+/**
+ * Holds if the bitmask `mask` sets any of the bit fields in `fields`.
+ */
+bindingset[mask, fields]
+predicate sets(int mask, int fields) {
+ mask.bitAnd(fields) != 0
+}
+
+/**
+ * Gets the value that `fc` sets the umask to, if `fc` is a call to
+ * one of the `umask` family of functions.
+ */
+private int umask(FunctionCall fc) {
+ exists(string name |
+ name = fc.getTarget().getName() |
+ name = "umask" or
+ name = "_umask" or
+ name = "_umask_s")
+ and
+ result = fc.getArgument(0).getValue().toInt()
+}
+
+class Umask extends int {
+ Umask() { this = 0 or this = umask(_) }
+
+ bindingset[mode,this]
+ int mask(int mode) {
+ result = mode.bitAnd(this.bitNot())
+ }
+}
+
+Umask defaultUmask() { result = 0 }
+
+/**
+ * Gets the last umask set in `block`.
+ */
+private Umask lastUmask(BasicBlock block) {
+ exists(int i | result = umask(block.getNode(i))
+ and not exists(int j | j > i | exists(umask(block.getNode(j)))))
+}
+
+private Umask umaskStrictlyReaches(BasicBlock block) {
+ exists(BasicBlock pred | pred = block.getAPredecessor() |
+ if exists(umask(pred.getNode(_)))
+ then
+ result = lastUmask(pred)
+ else
+ result = umaskStrictlyReaches(pred)
+ )
+}
+
+private Umask localDefinedUmask(FileCreationExpr e) {
+ exists(BasicBlock b, int i | e = b.getNode(i) |
+ (not exists(umask(b.getNode(_))) and result = umaskStrictlyReaches(b))
+ or
+ exists(Expr um, int j | um = b.getNode(j) and j <= i |
+ result = umask(um)
+ and
+ not exists(int k | k in [j+1 .. i] | exists(umask(b.getNode(k))))
+ )
+ )
+}
+
+Umask localUmask(FileCreationExpr e) {
+ if exists(localDefinedUmask(e))
+ then
+ result = localDefinedUmask(e)
+ else
+ result = defaultUmask()
+}
+
+abstract class FileCreationExpr extends FunctionCall {
+ abstract Expr getPath();
+ abstract int getMode();
+}
+
+class OpenCreationExpr extends FileCreationExpr {
+ OpenCreationExpr() {
+ exists(string name |
+ name = this.getTarget().getName() |
+ name = "open" or
+ name = "_open" or
+ name = "_wopen")
+ and
+ sets(this.getArgument(1).getValue().toInt(), o_creat())
+ }
+ override Expr getPath() { result = this.getArgument(0) }
+ override int getMode() {
+ if exists(this.getArgument(2))
+ then result = this.getArgument(2).getValue().toInt()
+ else // assume anything is permitted
+ result = 0.bitNot()
+ }
+}
+
+class CreatCreationExpr extends FileCreationExpr {
+ CreatCreationExpr() { this.getTarget().getName() = "creat" }
+ override Expr getPath() { result = this.getArgument(0) }
+ override int getMode() { result = this.getArgument(1).getValue().toInt() }
+}
+
+class OpenatCreationExpr extends FileCreationExpr {
+ OpenatCreationExpr() {
+ this.getTarget().getName() = "openat" and
+ this.getNumberOfArguments() = 4
+ }
+ override Expr getPath() { result = this.getArgument(1) }
+ override int getMode() { result = this.getArgument(3).getValue().toInt() }
+}
+
+private int fopenMode() {
+ result = s_irusr().bitOr(s_irgrp()).bitOr(s_iroth()).bitOr(s_iwusr()).bitOr(s_iwgrp()).bitOr(s_iwoth())
+}
+
+class FopenCreationExpr extends FileCreationExpr {
+ FopenCreationExpr() {
+ exists(string name |
+ name = this.getTarget().getName() |
+ name = "fopen" or
+ name = "_wfopen" or
+ name = "fsopen" or
+ name = "_wfsopen")
+ and
+ exists(string mode |
+ (mode = "w" or mode = "a")
+ and
+ this.getArgument(1).getValue().matches(mode+"%"))
+ }
+ override Expr getPath() { result = this.getArgument(0) }
+ override int getMode() { result = fopenMode() }
+}
+
+class FopensCreationExpr extends FileCreationExpr {
+ FopensCreationExpr() {
+ exists(string name |
+ name = this.getTarget().getName() |
+ name = "fopen_s" or
+ name = "_wfopen_s")
+ and
+ exists(string mode |
+ (mode = "w" or mode = "a")
+ and
+ this.getArgument(2).getValue().matches(mode+"%")
+ )
+ }
+ override Expr getPath() { result = this.getArgument(1) }
+ override int getMode() {
+ // fopen_s has restrictive permissions unless you have "u" in the mode
+ if this.getArgument(2).getValue().charAt(_) = "u"
+ then result = fopenMode()
+ else result = s_irusr().bitOr(s_iwusr())
+ }
+}
diff --git a/cpp/ql/src/Security/CWE/CWE-764/LockFlow.qll b/cpp/ql/src/Security/CWE/CWE-764/LockFlow.qll
new file mode 100644
index 000000000000..a370b2a83f50
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-764/LockFlow.qll
@@ -0,0 +1,151 @@
+/**
+ * Provides classes and predicates for analyzing mutexes and the control
+ * flow regions where they might be locked.
+ */
+import cpp
+import semmle.code.cpp.commons.Synchronization
+
+/**
+ * Holds if `cond` is a test for whether locking `access` succeeded,
+ * and `failNode` is the control flow node we continue with if it did
+ * not. Suitable locking statements may look like `if(tryLock(m))` or
+ * like `if(lock(m) != 0)`.
+ */
+cached
+predicate tryLockCondition(VariableAccess access,
+ ControlFlowNode cond,
+ ControlFlowNode failNode) {
+ exists (FunctionCall call
+ | lockCall(access, call)
+ | (cond = call and call.getAFalseSuccessor() = failNode)
+
+ // Look for code like this:
+ //
+ // if (pthread_mutex_lock(mtx) != 0) return -1;
+ //
+ or
+ (cond = call.getParent*() and
+ cond.isCondition() and
+ failNode = cond.getASuccessor() and
+ failNode instanceof BasicBlockWithReturn))
+}
+
+/**
+ * A basic block that ends with a return statement.
+ */
+class BasicBlockWithReturn extends BasicBlock {
+ BasicBlockWithReturn() {
+ this.contains(any(ReturnStmt r))
+ }
+}
+
+/**
+ * Holds if mutex variable `v` might be locked or unlocked during
+ * function call `call`?
+ */
+private predicate lockedOrUnlockedInCall(Variable v, FunctionCall call) {
+ lockCall(v.getAnAccess(), call) or
+ unlockCall(v.getAnAccess(), call) or
+
+ // Interprocedural analysis: look for mutexes which are locked or
+ // unlocked in the body of the callee.
+ exists (Function fcn, Variable x
+ | fcn = call.getTarget() and
+ lockedOrUnlockedInFunction(x, fcn)
+ | // If `x` is one of the function's parameters, then map it to the
+ // corresponding argument.
+ if x = fcn.getAParameter()
+ then exists (int i |
+ x = fcn.getParameter(i) |
+ v.getAnAccess() = call.getArgument(i))
+ else v = x)
+}
+
+/**
+ * Holds if mutex variable `v` might be locked or unlocked by this
+ * function, either directly or indirectly (through a call to another
+ * function).
+ */
+private predicate lockedOrUnlockedInFunction(Variable v, Function fcn) {
+ exists (FunctionCall call |
+ lockedOrUnlockedInCall(v, call) and
+ call.getEnclosingFunction() = fcn)
+}
+
+/**
+ * Holds if the mutex locked at `access` might still be locked after
+ * control flow node `node` has executed. That is, the lock which was
+ * obtained at `access` has not been canceled by a matching unlock or
+ * superseded by a more recent call to the lock method.
+ */
+predicate lockedOnExit(VariableAccess access, ControlFlowNode node) {
+ lockCall(access, node)
+ or
+ (lockedOnEntry(access, node) and
+ // Remove mutexes which are either unlocked by this statement or
+ // superseded by a another call to the lock method.
+ not lockedOrUnlockedInCall(access.getTarget(), node))
+ or
+ // Interprocedural analysis: if the node is a function call and a mutex
+ // is still locked at the end of the function body, then it is also
+ // locked after the function returns. Note that the Function object is
+ // used to represent the exit node in the control flow graph.
+ exists (Function fcn, Variable x, VariableAccess xAccess |
+ fcn = node.(FunctionCall).getTarget() and
+ lockedOnEntry(xAccess, fcn) and
+ x = xAccess.getTarget() |
+ // If `x` is one of the function's parameters, then map it to the
+ // corresponding argument.
+ if x = fcn.getAParameter()
+ then exists (int i |
+ x = fcn.getParameter(i) |
+ access = node.(FunctionCall).getArgument(i))
+ else access = xAccess)
+}
+
+/**
+ * Holds if the mutex locked at `access` might still be locked before
+ * control flow node `node` executes. That is, if it might be locked
+ * after a predecessor of `node` has executed.
+ */
+predicate lockedOnEntry(VariableAccess access, ControlFlowNode node) {
+ exists (ControlFlowNode prev
+ | lockedOnExit(access, prev) and
+ node = prev.getASuccessor() and
+ // If we are on the false branch of a call to `try_lock` then the
+ // mutex is not locked.
+ not tryLockCondition(access, prev, node))
+}
+
+/**
+ * Holds if mutex `access` is locked either directly or indirectly by
+ * this function call. This is a generalization of `lockCall`.
+ */
+predicate lockedInCall(VariableAccess access, FunctionCall call) {
+ lockCall(access, call)
+ or
+ // Interprocedural analysis: look for mutexes which are locked in the
+ // body of the callee.
+ exists (Function fcn, Variable x, VariableAccess xAccess
+ | fcn = call.getTarget() and
+ pathToLock(xAccess, fcn.getEntryPoint()) and
+ x = xAccess.getTarget()
+ | // If `x` is one of the function's parameters, then map it to the
+ // corresponding argument.
+ if x = fcn.getAParameter()
+ then exists (int i
+ | x = fcn.getParameter(i)
+ | access = call.getArgument(i))
+ else access = xAccess)
+}
+
+/**
+ * Holds if mutex `access` might be locked at `node` or one of its
+ * successors.
+ */
+predicate pathToLock(VariableAccess access, ControlFlowNode node) {
+ lockedInCall(access, node)
+ or
+ (pathToLock(access, node.getASuccessor()) and
+ not lockedOrUnlockedInCall(access.getTarget(), node))
+}
diff --git a/cpp/ql/src/Security/CWE/CWE-764/LockOrderCycle.qhelp b/cpp/ql/src/Security/CWE/CWE-764/LockOrderCycle.qhelp
new file mode 100644
index 000000000000..bdeae6731f4b
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-764/LockOrderCycle.qhelp
@@ -0,0 +1,64 @@
+
+
+
+
+
+Deadlock can occur when two or more threads each attempt to lock
+multiple mutexes, but not in the same order. A famous example of this
+is the "Dining Philosophers Problem" (see references below). In this
+example, deadlock occurs when all five philosophers simultaneously
+pick up the fork to their left because then none of them can pick up
+the fork to their right. A simple solution is to assign an order to
+the mutexes. If the philosophers always pick up the lower numbered
+fork first, rather than the fork to their left, then deadlock cannot
+occur.
+
+
+
+In general, we can build a graph of the order in which the mutexes are
+locked. For example, if one of the threads locks mutex A first and B
+second (while A is still locked), then we add a graph edge from A to
+B. If the resulting graph contains a cycle then there is a possibility
+of deadlock. The graph for the dining philosophers example contains a
+cycle because each philosopher creates a graph edge from their left
+fork to their right fork.
+
+
+
+
+
+If multiple mutexes need to be locked simultaneously, then make sure
+that all threads lock them in the same order.
+
+
+
+
+
+
+In this example, f1 locks mtx1 first and
+mtx2 second, but f2 locks them in the
+opposite order. If f1 and f2 are run
+simultaneously in separate threads then they could cause a deadlock.
+
+
+
+
+
+
+
+Dijkstra, E. W., EWD-310:
+Hierarchical
+Ordering of Sequential Processes. E. W. Dijkstra
+Archive. Center for American History, University of Texas at Austin.
+
+
+Hoare, C. A. R.,
+Communicating
+Sequential Processes,
+Section 2.5 - 'Example: The Dining Philosophers,' p. 55,
+2004 (originally published in 1985 by Prentice Hall International).
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-764/LockOrderCycle.ql b/cpp/ql/src/Security/CWE/CWE-764/LockOrderCycle.ql
new file mode 100644
index 000000000000..964eb1a7563f
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-764/LockOrderCycle.ql
@@ -0,0 +1,39 @@
+/**
+ * @name Cyclic lock order dependency
+ * @description Locking mutexes in different orders in different
+ * threads can cause deadlock.
+ * @kind problem
+ * @id cpp/lock-order-cycle
+ * @problem.severity error
+ * @tags security
+ * external/cwe/cwe-764
+ * external/cwe/cwe-833
+ */
+import cpp
+import semmle.code.cpp.commons.Synchronization
+import LockFlow
+
+/**
+ * Gets a variable that might be locked while a lock on `v` is held.
+ *
+ * For example, with
+ * ```
+ * x.lock()
+ * y.lock()
+ * x.unlock()
+ * y.unlock()
+ *```
+ * `x` is already locked when `y.lock()` is called, so `y` is a result
+ * of `lockSuccessor(x)`. If you consider this an edge from `x` to `y`
+ * in a directed graph, then a cycle in the graph indicates a potential
+ * source of deadlock. The dining philosophers are the classic example.
+ */
+Variable lockSuccessor(Variable v) {
+ exists (FunctionCall call
+ | lockedOnEntry(v.getAnAccess(), call) and
+ lockedInCall(result.getAnAccess(), call))
+}
+
+from Variable v1, Variable v2
+where v1 != v2 and lockSuccessor+(v1) = v2 and lockSuccessor+(v2) = v1
+select v1, "Mutex " + v1 + " has a cyclic lock order dependency with $@.", v2, "mutex " + v2
diff --git a/cpp/ql/src/Security/CWE/CWE-764/LockOrderCycleExample.cpp b/cpp/ql/src/Security/CWE/CWE-764/LockOrderCycleExample.cpp
new file mode 100644
index 000000000000..13067b06061c
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-764/LockOrderCycleExample.cpp
@@ -0,0 +1,20 @@
+std::mutex mtx1;
+std::mutex mtx2;
+
+void f1() {
+ // GOOD: lock mtx1 before mtx2.
+ mtx1.lock();
+ mtx2.lock();
+ printf("f1");
+ mtx2.unlock();
+ mtx1.unlock();
+}
+
+void f2() {
+ // BAD: lock mtx2 before mtx1.
+ mtx2.lock();
+ mtx1.lock();
+ printf("f2");
+ mtx1.unlock();
+ mtx2.unlock();
+}
diff --git a/cpp/ql/src/Security/CWE/CWE-764/TwiceLocked.qhelp b/cpp/ql/src/Security/CWE/CWE-764/TwiceLocked.qhelp
new file mode 100644
index 000000000000..2c09c4fffe09
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-764/TwiceLocked.qhelp
@@ -0,0 +1,49 @@
+
+
+
+
+
+Mutexes come in two flavors: recursive and non-recursive. For example,
+the C++ mutex library provides both std::mutex
+and std::recursive_mutex. A non-recursive mutex cannot
+be locked until it has been unlocked by its previous owner, even if it
+is already owned by the current thread. Deadlock is often caused by a
+thread attempting to lock the same mutex twice, usually in a recursive
+algorithm.
+
+
+
+
+
+If a recursive method needs to acquire a lock, then split it into two
+methods. The first method is public and is responsible for locking and
+unlocking the mutex. It delegates the rest of the work to a second
+private method. The second method does not need to lock or unlock the
+mutex because that is done by the first method.
+
+
+
+
+
+
+In this example, the method f is recursive, so it causes
+a deadlock by attempting to lock the mutex twice.
+
+
+
+
+
+In this second example, the recursion is delegated to an internal
+method so the mutex is only locked once.
+
+
+
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-764/TwiceLocked.ql b/cpp/ql/src/Security/CWE/CWE-764/TwiceLocked.ql
new file mode 100644
index 000000000000..6e33fb0d5f42
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-764/TwiceLocked.ql
@@ -0,0 +1,54 @@
+/**
+ * @name Mutex locked twice
+ * @description Calling the lock method of a mutex twice in succession
+ * might cause a deadlock.
+ * @kind problem
+ * @id cpp/twice-locked
+ * @problem.severity error
+ * @precision low
+ * @tags security
+ * external/cwe/cwe-764
+ * external/cwe/cwe-833
+ */
+import cpp
+import semmle.code.cpp.commons.Synchronization
+import LockFlow
+
+/**
+ * Holds if `call` locks `v`, via the access `a`, but `v` might already
+ * be locked when we reach `call`. The access `a` might be in a function
+ * which is called indirectly from `call`.
+ */
+cached private predicate twiceLocked(
+ FunctionCall call, Variable v, VariableAccess a) {
+ lockedOnEntry(v.getAnAccess(), call) and
+ lockedInCall(a, call)
+}
+
+/*
+ * When this query finds a result, there are often multiple call sites
+ * associated with one instance of the problem. For this reason, we do not
+ * include `call` in the result. However, it is sometimes helpful to
+ * include `call.getLocation()` in the result, because it can help to find
+ * the control flow path which might be responsible.
+ */
+from FunctionCall call, Variable v, VariableAccess access2
+where
+ twiceLocked(call, v, access2) and
+ v = access2.getTarget() and
+
+ // If the second lock is a `try_lock` then it won't cause a deadlock.
+ // We want to be extra sure that the second lock is not a `try_lock`
+ // to make sure that we don't generate too many false positives, so
+ // we use three heuristics:
+ //
+ // 1. The call is to a function named "try_lock".
+ // 2. The result of the call is used in a condition. For example:
+ // if (pthread_mutex_lock(mtx) != 0) return -1;
+ // 3. The call is a condition. Because the analysis is interprocedural,
+ // `call` might be an indirect call to `lock`, so this heuristic
+ // catches some cases which the second heuristic does not.
+ not (trylockCall(access2, _) or
+ tryLockCondition(access2, _, _) or
+ call.isCondition())
+select access2, "Mutex " + v + " might be locked already, which could cause a deadlock."
diff --git a/cpp/ql/src/Security/CWE/CWE-764/TwiceLockedBad.cpp b/cpp/ql/src/Security/CWE/CWE-764/TwiceLockedBad.cpp
new file mode 100644
index 000000000000..718bfdda8a03
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-764/TwiceLockedBad.cpp
@@ -0,0 +1,11 @@
+class C {
+ std::mutex mutex;
+public:
+ // BAD: recursion causes deadlock.
+ int f(int n) {
+ mutex.lock();
+ int result = (n == 0) ? 1 : n*f(n-1);
+ mutex.unlock();
+ return result;
+ }
+};
diff --git a/cpp/ql/src/Security/CWE/CWE-764/TwiceLockedGood.cpp b/cpp/ql/src/Security/CWE/CWE-764/TwiceLockedGood.cpp
new file mode 100644
index 000000000000..ff6868a00774
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-764/TwiceLockedGood.cpp
@@ -0,0 +1,14 @@
+class C {
+ std::mutex mutex;
+ int f_impl(int n) {
+ return (n == 0) ? 1 : n*f_impl(n-1);
+ }
+public:
+ // GOOD: recursion is delegated to f_impl.
+ int f(int n) {
+ mutex.lock();
+ int result = f_impl(n);
+ mutex.unlock();
+ return result;
+ }
+};
diff --git a/cpp/ql/src/Security/CWE/CWE-764/UnreleasedLock.qhelp b/cpp/ql/src/Security/CWE/CWE-764/UnreleasedLock.qhelp
new file mode 100644
index 000000000000..5d91f18932eb
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-764/UnreleasedLock.qhelp
@@ -0,0 +1,45 @@
+
+
+
+
+
+When a thread acquires a lock it must make sure to unlock it again;
+failing to do so can lead to deadlocks. If a lock allows a thread to acquire
+it multiple times, for example std::recursive_mutex,
+then the number of locks must match the number of unlocks in order to fully
+release the lock.
+
+
+
+
+
+The best way to ensure that locks are always unlocked is to use RAII (Resource Acquisition Is Initialization).
+That means acquiring the lock in the constructor of a class, and releasing it in its destructor.
+A local-scoped instance of that class will then be destroyed when it leaves scope, even if an exception is thrown,
+ensuring that the lock is released.
+
+
+
+
+
+
+In this example, the mutex may not be unlocked if the function returns early.
+
+
+
+
+
+In this second example, we show a simple RAII wrapper class for std::mutex. Using this ensures
+that even in the case of the early return, the mutex is released.
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/cpp/ql/src/Security/CWE/CWE-764/UnreleasedLock.ql b/cpp/ql/src/Security/CWE/CWE-764/UnreleasedLock.ql
new file mode 100644
index 000000000000..27486e2f7334
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-764/UnreleasedLock.ql
@@ -0,0 +1,79 @@
+/**
+ * @name Lock may not be released
+ * @description A lock that is acquired one or more times without a
+ * matching number of unlocks may cause a deadlock.
+ * @kind problem
+ * @id cpp/unreleased-lock
+ * @problem.severity error
+ * @precision low
+ * @tags security
+ * external/cwe/cwe-764
+ * external/cwe/cwe-833
+ */
+import cpp
+import semmle.code.cpp.commons.Synchronization
+
+predicate lockBlock(MutexType t, BasicBlock b, int locks) {
+ locks = strictcount(int i | b.getNode(i) = t.getLockAccess())
+}
+
+predicate unlockBlock(MutexType t, BasicBlock b, int unlocks) {
+ unlocks = strictcount(int i | b.getNode(i) = t.getUnlockAccess())
+}
+
+/**
+ * Holds if there is a call to `lock` or `tryLock` on `t` in
+ * `lockblock`, and `failblock` is the successor if it fails.
+ */
+predicate failedLock(MutexType t, BasicBlock lockblock, BasicBlock failblock) {
+ exists (ControlFlowNode lock |
+ lock = lockblock.getEnd() and
+ lock = t.getLockAccess() and
+ lock.getAFalseSuccessor() = failblock
+ )
+}
+
+/**
+ * Holds if `b` locks `t` a net `netlocks` times. For example, if `b`
+ * locks `t` twice and unlocks `t` four times, then `netlocks` will be
+ * `-2`.
+ */
+predicate lockUnlockBlock(MutexType t, BasicBlock b, int netlocks) {
+ lockBlock(t, b, netlocks) and not unlockBlock(t, b, _) or
+ exists (int unlocks |
+ not lockBlock(t, b, _) and unlockBlock(t, b, unlocks) and netlocks = -unlocks
+ ) or
+ exists (int locks, int unlocks |
+ lockBlock(t, b, locks) and unlockBlock(t, b, unlocks) and netlocks = locks - unlocks
+ )
+}
+
+/**
+ * Holds if there is a control flow path from `src` to `b` such that
+ * on that path the net number of locks is `locks`, and `locks` is
+ * positive.
+ */
+predicate blockIsLocked(MutexType t, BasicBlock src, BasicBlock b, int locks) {
+ lockUnlockBlock(t, b, locks) and src = b and locks > 0
+ or
+ exists (BasicBlock pred, int predlocks, int curlocks, int failedlock |
+ pred = b.getAPredecessor() |
+ blockIsLocked(t, src, pred, predlocks) and
+ ( if failedLock(t, pred, b) then failedlock = 1 else failedlock = 0 ) and // count a failed lock as an unlock so the net is zero
+ ( not lockUnlockBlock(t, b, _) and curlocks = 0 or
+ lockUnlockBlock(t, b, curlocks)
+ ) and
+ locks = predlocks + curlocks -failedlock and locks > 0 and
+ locks < 10 // arbitrary bound to fail gracefully in case of locking in a loop
+ )
+}
+
+from Function c, MutexType t, BasicBlock src, BasicBlock exit, FunctionCall lock
+where // restrict results to those methods that actually attempt to unlock
+ t.getUnlockAccess().getEnclosingFunction() = c
+ and blockIsLocked(t, src, exit, _)
+ and exit.getEnd() = c
+ and lock = src.getANode()
+ and lock = t.getLockAccess()
+select
+ lock, "This lock might not be unlocked or might be locked more times than it is unlocked."
diff --git a/cpp/ql/src/Security/CWE/CWE-764/UnreleasedLockBad.cpp b/cpp/ql/src/Security/CWE/CWE-764/UnreleasedLockBad.cpp
new file mode 100644
index 000000000000..4a97eb8028a7
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-764/UnreleasedLockBad.cpp
@@ -0,0 +1,11 @@
+std::mutex mutex;
+int fun() {
+ mutex.lock();
+ bool succeeded = doWork();
+ if (!succeeded) {
+ // BAD: this does not release the mutex
+ return -1
+ }
+ mutex.unlock();
+ return 1;
+}
diff --git a/cpp/ql/src/Security/CWE/CWE-764/UnreleasedLockGood.cpp b/cpp/ql/src/Security/CWE/CWE-764/UnreleasedLockGood.cpp
new file mode 100644
index 000000000000..41f0469ba8b6
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-764/UnreleasedLockGood.cpp
@@ -0,0 +1,28 @@
+class RAII_Mutex
+{
+ std::mutex lock;
+public:
+ RAII_Mutex(mutex m) : lock(m)
+ {
+ lock.lock();
+ }
+
+ ~RAII_Mutex()
+ {
+ lock.unlock();
+ }
+};
+
+
+std::mutex mutex;
+int fun() {
+ RAII_Mutex(mutex);
+
+ bool succeeded = doWork();
+ if (!succeeded) {
+ // GOOD: the RAII_Mutex is destroyed, releasing the lock
+ return -1
+ }
+
+ return 1;
+}
\ No newline at end of file
diff --git a/cpp/ql/src/Security/CWE/CWE-807/TaintedCondition.c b/cpp/ql/src/Security/CWE/CWE-807/TaintedCondition.c
new file mode 100644
index 000000000000..8664d491d950
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-807/TaintedCondition.c
@@ -0,0 +1,10 @@
+struct hostent *hp;struct in_addr myaddr;
+char* tHost = "trustme.example.com";
+myaddr.s_addr=inet_addr(ip_addr_string);
+
+hp = gethostbyaddr((char *) &myaddr, sizeof(struct in_addr), AF_INET);
+if (hp && !strncmp(hp->h_name, tHost, sizeof(tHost))) {
+ trusted = true;
+} else {
+ trusted = false;
+}
diff --git a/cpp/ql/src/Security/CWE/CWE-807/TaintedCondition.qhelp b/cpp/ql/src/Security/CWE/CWE-807/TaintedCondition.qhelp
new file mode 100644
index 000000000000..80e51ec08a30
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-807/TaintedCondition.qhelp
@@ -0,0 +1,47 @@
+
+
+
+This rule finds code where untrusted inputs are used in
+an if statement, and the body of that statement makes a
+security decision. This is an example of CWE-807 and makes the program
+vulnerable to attack. An attacker might be able to gain unauthorized
+access to the system by manipulating external inputs to the system.
+
+
+
+In most cases, you need to add or strengthen the checks made on the
+user-supplied data to ensure its integrity. The user-supplied data can
+then be used as a trusted input to the security decision. For example,
+instead of checking an HTTP cookie against a predictable fixed string,
+check a cookie against a randomly generated session key.
+
+This rule may highlight a few conditions where user-supplied
+data has been checked and can be trusted. It is not always possible
+to determine if the checks applied to data are enough to ensure security.
+
+
+
+The following example is included in CWE 807.
+
+
+In this example, the result of a reverse DNS query is compared
+against a fixed string. An attacker can return an incorrect reverse
+DNS entry for the requesting IP and thus gain the same access as a
+legitimate user from trustme.example.com.
+
+To fix the problem in this example, you need to add an additional
+mechanism to test the user-supplied data. For example,
+numeric IP addresses could be used.
+
+
+
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-807/TaintedCondition.ql b/cpp/ql/src/Security/CWE/CWE-807/TaintedCondition.ql
new file mode 100644
index 000000000000..68a9c7d5a53c
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-807/TaintedCondition.ql
@@ -0,0 +1,36 @@
+/**
+ * @name Untrusted input for a condition
+ * @description Using untrusted inputs in a statement that makes a
+ * security decision makes code vulnerable to
+ * attack.
+ * @kind problem
+ * @problem.severity warning
+ * @precision medium
+ * @id cpp/tainted-permissions-check
+ * @tags security
+ * external/cwe/cwe-807
+ */
+
+import semmle.code.cpp.security.TaintTracking
+
+
+/**
+ * Holds if there is an 'if' statement whose condition `condition`
+ * is influenced by tainted data `source`, and the body contains
+ * `raise` which escalates privilege.
+ */
+predicate cwe807violation(Expr source, Expr condition, Expr raise) {
+ tainted(source, condition)
+ and raisesPrivilege(raise)
+ and exists (IfStmt ifstmt |
+ ifstmt.getCondition() = condition
+ and raise.getEnclosingStmt().getParentStmt*() = ifstmt)
+}
+
+from Expr source, Expr condition, Expr raise
+where cwe807violation(source, condition, raise)
+select
+ condition,
+ "Reliance on untrusted input $@ to raise privilege at $@",
+ source, source.toString(),
+ raise, raise.toString()
diff --git a/cpp/ql/src/Security/CWE/CWE-835/InfiniteLoopBad.c b/cpp/ql/src/Security/CWE/CWE-835/InfiniteLoopBad.c
new file mode 100644
index 000000000000..6ab1c6d375f8
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-835/InfiniteLoopBad.c
@@ -0,0 +1,12 @@
+void test(int n) {
+ int i = 0;
+ if (n <= 0) {
+ return;
+ }
+ while (1) {
+ // BAD: condition is never true, so loop will not terminate.
+ if (i == n) {
+ break;
+ }
+ }
+}
diff --git a/cpp/ql/src/Security/CWE/CWE-835/InfiniteLoopGood.c b/cpp/ql/src/Security/CWE/CWE-835/InfiniteLoopGood.c
new file mode 100644
index 000000000000..a688ff0c2d52
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-835/InfiniteLoopGood.c
@@ -0,0 +1,13 @@
+void test(int n) {
+ int i = 0;
+ if (n <= 0) {
+ return;
+ }
+ while (1) {
+ // GOOD: condition is true after n iterations.
+ if (i == n) {
+ break;
+ }
+ i++;
+ }
+}
diff --git a/cpp/ql/src/Security/CWE/CWE-835/InfiniteLoopWithUnsatisfiableExitCondition.qhelp b/cpp/ql/src/Security/CWE/CWE-835/InfiniteLoopWithUnsatisfiableExitCondition.qhelp
new file mode 100644
index 000000000000..0ab7d1c334b5
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-835/InfiniteLoopWithUnsatisfiableExitCondition.qhelp
@@ -0,0 +1,44 @@
+
+
+
+
+
+Loops can contain multiple exit conditions, either directly in the loop
+condition or as guards around break or return
+statements. If none of the exit conditions can ever be satisfied, then
+the loop will never terminate. A program containing an infinite loop
+could be vulnerable to a denial of service attack if it is possible for
+an attacker to trigger the loop.
+
+
+
+
+
+When writing a loop that is intended to terminate, make sure that all the
+necessary exit conditions can be satisfied and that loop termination is clear.
+
+
+
+
+
+
+The following example shows an infinite loop. The value of
+variable i is always zero, so the condition guarding the
+break is always false.
+
+
+
+
+The error has been fixed below by incrementing i in
+the body of the loop.
+
+
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/Security/CWE/CWE-835/InfiniteLoopWithUnsatisfiableExitCondition.ql b/cpp/ql/src/Security/CWE/CWE-835/InfiniteLoopWithUnsatisfiableExitCondition.ql
new file mode 100644
index 000000000000..df13779f8c11
--- /dev/null
+++ b/cpp/ql/src/Security/CWE/CWE-835/InfiniteLoopWithUnsatisfiableExitCondition.ql
@@ -0,0 +1,64 @@
+/**
+ * @name Infinite loop with unsatisfiable exit condition
+ * @description A loop with an unsatisfiable exit condition could
+ * prevent the program from terminating, making it
+ * vulnerable to a denial of service attack.
+ * @kind problem
+ * @id cpp/infinite-loop-with-unsatisfiable-exit-condition
+ * @problem.severity warning
+ * @tags security
+ * external/cwe/cwe-835
+ */
+import cpp
+import semmle.code.cpp.controlflow.BasicBlocks
+private import semmle.code.cpp.rangeanalysis.PointlessComparison
+import semmle.code.cpp.controlflow.internal.ConstantExprs
+
+/**
+ * Holds if there is a control flow edge from `src` to `dst`, but
+ * it can never be taken due to `cmp` always having value `value`.
+ */
+predicate impossibleEdge(
+ ComparisonOperation cmp, boolean value, BasicBlock src, BasicBlock dst) {
+ cmp = src.getEnd() and
+ reachablePointlessComparison(cmp, _, _, value, _) and
+ if value = true
+ then dst = src.getAFalseSuccessor()
+ else dst = src.getATrueSuccessor()
+}
+
+BasicBlock enhancedSucc(BasicBlock bb) {
+ result = bb.getASuccessor() and not impossibleEdge(_, _, bb, result)
+}
+
+/**
+ * Holds if `cmp` always has value `value`, and if that will cause
+ * non-termination.
+ *
+ * It only holds if the function exit is reachable using
+ * the standard `getASuccessor` relation, but not using
+ * `enhancedSucc`. This means that it does not hold for
+ * comparison operations which are trivially true or false, such as
+ * ```
+ * while (1) { ... }
+ * ```
+ * Since this loop is obviously infinite, we assume that it was written
+ * intentionally.
+ */
+predicate impossibleEdgeCausesNonTermination(
+ ComparisonOperation cmp, boolean value) {
+ exists (BasicBlock src
+ | impossibleEdge(cmp, value, src, _) and
+ src.getASuccessor+() instanceof ExitBasicBlock and
+ not (enhancedSucc+(src) instanceof ExitBasicBlock) and
+ // Make sure that the source is reachable to reduce
+ // false positives.
+ exists (EntryBasicBlock entry | src = enhancedSucc+(entry)))
+}
+
+from ComparisonOperation cmp, boolean value
+where impossibleEdgeCausesNonTermination(cmp, value)
+select
+ cmp,
+ "Function exit is unreachable because this condition is always " +
+ value.toString() + "."
diff --git a/cpp/ql/src/cpp.qll b/cpp/ql/src/cpp.qll
new file mode 100644
index 000000000000..bc60dd0ec59e
--- /dev/null
+++ b/cpp/ql/src/cpp.qll
@@ -0,0 +1,89 @@
+/**
+ * Provides classes and predicates for working with C/C++/ObjC/ObjC++
+ * code.
+ *
+ * Where the documentation refers to the standards, it gives
+ * references to the freely-available drafts.
+ *
+ * For C++11, these references are of the form [N3337 5.3.2/1], and the
+ * corresponding draft of the standard can be downloaded from
+ * https://github.com/cplusplus/draft/raw/master/papers/n3337.pdf
+ *
+ * For C++14, these references are of the form [N4140 5.3.2/1], and the
+ * corresponding draft of the standard can be downloaded from
+ * https://github.com/cplusplus/draft/raw/master/papers/n4140.pdf
+ */
+
+import semmle.code.cpp.File
+import semmle.code.cpp.Linkage
+import semmle.code.cpp.Location
+
+import semmle.code.cpp.Compilation
+import semmle.code.cpp.Element
+import semmle.code.cpp.Namespace
+import semmle.code.cpp.Specifier
+import semmle.code.cpp.Declaration
+import semmle.code.cpp.Include
+import semmle.code.cpp.Macro
+import semmle.code.cpp.Type
+import semmle.code.cpp.TypedefType
+import semmle.code.cpp.Class
+import semmle.code.cpp.Struct
+import semmle.code.cpp.Union
+import semmle.code.cpp.Enum
+import semmle.code.cpp.Member
+import semmle.code.cpp.Field
+import semmle.code.cpp.Function
+import semmle.code.cpp.Parameter
+import semmle.code.cpp.Variable
+import semmle.code.cpp.Initializer
+
+import semmle.code.cpp.FriendDecl
+
+import semmle.code.cpp.exprs.Expr
+import semmle.code.cpp.exprs.ArithmeticOperation
+import semmle.code.cpp.exprs.BitwiseOperation
+import semmle.code.cpp.exprs.LogicalOperation
+import semmle.code.cpp.exprs.ComparisonOperation
+import semmle.code.cpp.exprs.Assignment
+import semmle.code.cpp.exprs.Cast
+import semmle.code.cpp.exprs.Access
+import semmle.code.cpp.exprs.Call
+import semmle.code.cpp.exprs.Lambda
+import semmle.code.cpp.exprs.Literal
+import semmle.code.cpp.exprs.BuiltInOperations
+
+import semmle.code.cpp.stmts.Stmt
+import semmle.code.cpp.stmts.Block
+
+import semmle.code.cpp.metrics.MetricNamespace
+import semmle.code.cpp.metrics.MetricClass
+import semmle.code.cpp.metrics.MetricFile
+import semmle.code.cpp.metrics.MetricFunction
+
+import semmle.code.cpp.commons.CommonType
+import semmle.code.cpp.commons.Printf
+import semmle.code.cpp.commons.VoidContext
+import semmle.code.cpp.commons.NULL
+import semmle.code.cpp.commons.PolymorphicClass
+import semmle.code.cpp.commons.Alloc
+import semmle.code.cpp.commons.StructLikeClass
+
+import semmle.code.cpp.controlflow.ControlFlowGraph
+
+import semmle.code.cpp.XML
+
+import semmle.code.cpp.Diagnostics
+
+import semmle.code.cpp.Comments
+import semmle.code.cpp.Preprocessor
+
+import semmle.code.cpp.Iteration
+
+import semmle.code.cpp.NameQualifiers
+
+import semmle.code.cpp.ObjectiveC
+import semmle.code.cpp.exprs.ObjectiveC
+
+import DefaultOptions
+
diff --git a/cpp/ql/src/default.qll b/cpp/ql/src/default.qll
new file mode 100644
index 000000000000..4996ace84523
--- /dev/null
+++ b/cpp/ql/src/default.qll
@@ -0,0 +1 @@
+import cpp
diff --git a/cpp/ql/src/definitions.ql b/cpp/ql/src/definitions.ql
new file mode 100644
index 000000000000..117e7512a68a
--- /dev/null
+++ b/cpp/ql/src/definitions.ql
@@ -0,0 +1,13 @@
+/**
+ * @name Jump-to-definition links
+ * @description Generates use-definition pairs that provide the data
+ * for jump-to-definition in the code viewer.
+ * @kind definitions
+ * @id cpp/jump-to-definition
+ */
+
+import definitions
+
+from Top e, Top def, string kind
+where def = definitionOf(e, kind)
+select e, def, kind
diff --git a/cpp/ql/src/definitions.qll b/cpp/ql/src/definitions.qll
new file mode 100644
index 000000000000..754037953123
--- /dev/null
+++ b/cpp/ql/src/definitions.qll
@@ -0,0 +1,212 @@
+/**
+ * Provides classes and predicates related to jump-to-definition links
+ * in the code viewer.
+ */
+
+import cpp
+
+/**
+ * Any element that might be the source or target of a jump-to-definition
+ * link.
+ *
+ * In some cases it is preferable to modify locations (the
+ * `hasLocationInfo()` predicate) so that they are short, and
+ * non-overlapping with other locations that might be highlighted in
+ * the LGTM interface.
+ *
+ * We need to give locations that may not be in the database, so
+ * we use `hasLocationInfo()` rather than `getLocation()`.
+ */
+class Top extends Element {
+ /**
+ * Holds if this element is at the specified location.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `filepath`.
+ * For more information, see
+ * [LGTM locations](https://lgtm.com/help/ql/locations).
+ */
+ predicate hasLocationInfo(string filepath,
+ int startline, int startcolumn,
+ int endline, int endcolumn) {
+ exists(Location l | l = this.getLocation()
+ and filepath = l.getFile().getAbsolutePath()
+ and startline = l.getStartLine()
+ and startcolumn = l.getStartColumn()
+ and endline = l.getEndLine()
+ and endcolumn = l.getEndColumn())
+ }
+}
+
+/**
+ * A `MacroAccess` with a `hasLocationInfo` predicate.
+ *
+ * This has a location that covers only the name of the accessed
+ * macro, not its arguments (which are included by `MacroAccess`'s
+ * `getLocation()`).
+ */
+class MacroAccessWithHasLocationInfo extends Top {
+ MacroAccessWithHasLocationInfo() {
+ this instanceof MacroAccess
+ }
+
+ override
+ predicate hasLocationInfo(string path, int sl, int sc, int el, int ec) {
+ exists(MacroAccess ma, Location l |
+ ma = this
+ and l = ma.getLocation()
+ and path = l.getFile().getAbsolutePath()
+ and sl = l.getStartLine()
+ and sc = l.getStartColumn()
+ and el = sl
+ and ec = sc + ma.getMacroName().length() - 1)
+ }
+}
+
+/**
+ * An `Include` with a `hasLocationInfo` predicate.
+ *
+ * This has a location that covers only the name of the included
+ * file, not the `#include` text or whitespace before it.
+ */
+class IncludeWithHasLocationInfo extends Top {
+ IncludeWithHasLocationInfo() {
+ this instanceof Include
+ }
+
+ override
+ predicate hasLocationInfo(string path, int sl, int sc, int el, int ec) {
+ exists(Include i, Location l |
+ i = this and
+ l = i.getLocation() and
+ path = l.getFile().getAbsolutePath() and
+ sl = l.getEndLine() and
+ sc = l.getEndColumn() + 1 - i.getIncludeText().length() and
+ el = l.getEndLine() and
+ ec = l.getEndColumn()
+ )
+ }
+}
+
+/**
+ * Holds if `f`, `line`, `column` indicate the start character
+ * of `cc`.
+ */
+private predicate constructorCallStartLoc(ConstructorCall cc, File f, int line, int column) {
+ exists(Location l |
+ l = cc.getLocation() and
+ l.getFile() = f and
+ l.getStartLine() = line and
+ l.getStartColumn() = column
+ )
+}
+
+/**
+ * Holds if `f`, `line`, `column` indicate the start character
+ * of `tm`.
+ */
+private predicate typeMentionStartLoc(TypeMention tm, File f, int line, int column) {
+ exists(Location l |
+ l = tm.getLocation() and
+ l.getFile() = f and
+ l.getStartLine() = line and
+ l.getStartColumn() = column
+ )
+}
+
+/**
+ * Holds if `cc` and `tm` begin at the same character.
+ */
+private cached predicate constructorCallTypeMention(ConstructorCall cc, TypeMention tm) {
+ exists(File f, int line, int column |
+ constructorCallStartLoc(cc, f, line, column) and
+ typeMentionStartLoc(tm, f, line, column)
+ )
+}
+
+/**
+ * Gets an element, of kind `kind`, that element `e` uses, if any.
+ *
+ * The `kind` is a string representing what kind of use it is:
+ * - `"M"` for function and method calls
+ * - `"T"` for uses of types
+ * - `"V"` for variable accesses
+ * - `"X"` for macro accesses
+ * - `"I"` for import / include directives
+ */
+Top definitionOf(Top e, string kind) {
+ (
+ (
+ // call -> function called
+ kind = "M" and
+ result = e.(Call).getTarget() and
+ not e.(Expr).isCompilerGenerated() and
+ not e instanceof ConstructorCall // handled elsewhere
+ ) or (
+ // access -> function, variable or enum constant accessed
+ kind = "V" and
+ result = e.(Access).getTarget() and
+ not e.(Expr).isCompilerGenerated()
+ ) or (
+ // macro access -> macro accessed
+ kind = "X" and
+ result = e.(MacroAccess).getMacro()
+ ) or (
+ // type mention -> type
+ kind = "T" and
+ e.(TypeMention).getMentionedType() = result and
+ not constructorCallTypeMention(_, e) and // handled elsewhere
+
+ // multiple mentions can be generated when a typedef is used. Exclude
+ // all but the originating typedef.
+ not exists(TypeMention tm, File f, int startline, int startcol |
+ typeMentionStartLoc(e, f, startline, startcol) and
+ typeMentionStartLoc(tm, f, startline, startcol) and
+ (
+ e.(TypeMention).getMentionedType() = tm.getMentionedType().(TypedefType).getBaseType() or
+ e.(TypeMention).getMentionedType() = tm.getMentionedType().(TypedefType).getBaseType().(SpecifiedType).getBaseType()
+ )
+ )
+ ) or (
+ // constructor call -> function called
+ // - but only if there is a corresponding type mention, since
+ // we don't want links for implicit conversions.
+ // - using the location of the type mention, since it's
+ // tighter that the location of the function call.
+ kind = "M" and
+ exists(ConstructorCall cc |
+ constructorCallTypeMention(cc, e) and
+ result = cc.getTarget()
+ )
+ ) or (
+ // include -> included file
+ kind = "I" and
+ result = e.(Include).getIncludedFile() and
+
+ // exclude `#include` directives containing macros
+ not exists(MacroInvocation mi, Location l1, Location l2 |
+ l1 = e.(Include).getLocation() and
+ l2 = mi.getLocation() and
+ l1.getFile() = l2.getFile() and
+ l1.getStartLine() = l2.getStartLine()
+ // (an #include directive must be always on it's own line)
+ )
+ )
+ ) and (
+ // exclude things inside macro invocations, as they will overlap
+ // with the macro invocation.
+ not e.(Element).isInMacroExpansion() and
+
+ // exclude nested macro invocations, as they will overlap with
+ // the top macro invocation.
+ not exists(e.(MacroAccess).getParentInvocation()) and
+
+ // exclude results from template instantiations, as:
+ // (1) these dependencies will often be caused by a choice of
+ // template parameter, which is non-local to this part of code; and
+ // (2) overlapping results pointing to different locations will
+ // be very common.
+ // It's possible we could allow a subset of these dependencies
+ // in future, if we're careful to ensure the above don't apply.
+ not e.isFromTemplateInstantiation(_)
+ )
+}
diff --git a/cpp/ql/src/external/CodeDuplication.qll b/cpp/ql/src/external/CodeDuplication.qll
new file mode 100644
index 000000000000..7815751dccce
--- /dev/null
+++ b/cpp/ql/src/external/CodeDuplication.qll
@@ -0,0 +1,279 @@
+import cpp
+
+private
+string relativePath(File file) {
+ result = file.getRelativePath().replaceAll("\\", "/")
+}
+
+private cached
+predicate tokenLocation(string path, int sl, int sc, int ec, int el, Copy copy, int index) {
+ path = copy.sourceFile().getAbsolutePath() and
+ tokens(copy, index, sl, sc, ec, el)
+}
+
+class Copy extends @duplication_or_similarity
+{
+ private
+ int lastToken() {
+ result = max(int i | tokens(this, i, _, _, _, _) | i)
+ }
+
+ int tokenStartingAt(Location loc) {
+ exists(string filepath, int startline, int startcol |
+ loc.hasLocationInfo(filepath, startline, startcol, _, _) and
+ tokenLocation(filepath, startline, startcol, _, _, this, result)
+ )
+ }
+
+ int tokenEndingAt(Location loc) {
+ exists(string filepath, int endline, int endcol |
+ loc.hasLocationInfo(filepath, _, _, endline, endcol) and
+ tokenLocation(filepath, _, _, endline, endcol, this, result)
+ )
+ }
+
+ int sourceStartLine() {
+ tokens(this, 0, result, _, _, _)
+ }
+
+ int sourceStartColumn() {
+ tokens(this, 0, _, result, _, _)
+ }
+
+ int sourceEndLine() {
+ tokens(this, lastToken(), _, _, result, _)
+ }
+
+ int sourceEndColumn() {
+ tokens(this, lastToken(), _, _, _, result)
+ }
+
+ int sourceLines() {
+ result = this.sourceEndLine() + 1 - this.sourceStartLine()
+ }
+
+ int getEquivalenceClass() {
+ duplicateCode(this, _, result) or similarCode(this, _, result)
+ }
+
+ File sourceFile() {
+ exists(string name |
+ duplicateCode(this, name, _) or similarCode(this, name, _) |
+ name.replaceAll("\\", "/") = relativePath(result))
+ }
+
+ predicate hasLocationInfo(string filepath, int startline, int startcolumn, int endline, int endcolumn) {
+ sourceFile().getAbsolutePath() = filepath and
+ startline = sourceStartLine() and
+ startcolumn = sourceStartColumn() and
+ endline = sourceEndLine() and
+ endcolumn = sourceEndColumn()
+ }
+
+ string toString() { none() }
+}
+
+class DuplicateBlock extends Copy, @duplication
+{
+ override string toString() {
+ result = "Duplicate code: " + sourceLines() + " duplicated lines."
+ }
+}
+
+class SimilarBlock extends Copy, @similarity
+{
+ override string toString() {
+ result = "Similar code: " + sourceLines() + " almost duplicated lines."
+ }
+}
+
+
+
+FunctionDeclarationEntry sourceMethod() {
+ result.isDefinition() and
+ exists(result.getLocation()) and numlines(result.getFunction(),_,_,_)
+}
+
+int numberOfSourceMethods(Class c) {
+ result = count(FunctionDeclarationEntry m |
+ m = sourceMethod() and
+ m.getFunction().getDeclaringType() = c)
+}
+
+private
+predicate blockCoversStatement(int equivClass, int first, int last, Stmt stmt) {
+ exists(DuplicateBlock b, Location loc |
+ stmt.getLocation() = loc and
+ first = b.tokenStartingAt(loc) and
+ last = b.tokenEndingAt(loc) and
+ b.getEquivalenceClass() = equivClass)
+}
+
+private
+Stmt statementInMethod(FunctionDeclarationEntry m) {
+ result.getParent+() = m.getBlock() and
+ not result.getLocation() instanceof UnknownStmtLocation and
+ not result instanceof Block
+}
+
+private
+predicate duplicateStatement(FunctionDeclarationEntry m1, FunctionDeclarationEntry m2, Stmt s1, Stmt s2) {
+ exists(int equivClass, int first, int last |
+ s1 = statementInMethod(m1) and
+ s2 = statementInMethod(m2) and
+ blockCoversStatement(equivClass, first, last, s1) and
+ blockCoversStatement(equivClass, first, last, s2) and
+ s1 != s2 and m1 != m2
+ )
+}
+
+predicate duplicateStatements(FunctionDeclarationEntry m1, FunctionDeclarationEntry m2, int duplicate, int total) {
+ duplicate = strictcount(Stmt s | duplicateStatement(m1, m2, s, _)) and
+ total = strictcount(statementInMethod(m1))
+}
+
+/**
+ * Find pairs of methods are identical
+ */
+predicate duplicateMethod(FunctionDeclarationEntry m, FunctionDeclarationEntry other) {
+ exists(int total | duplicateStatements(m, other, total, total))
+}
+
+predicate similarLines(File f, int line) {
+ exists(SimilarBlock b |
+ b.sourceFile() = f and line in [b.sourceStartLine() .. b.sourceEndLine()]
+ )
+}
+
+private
+predicate similarLinesPerEquivalenceClass(int equivClass, int lines, File f)
+{
+ lines = strictsum(SimilarBlock b, int toSum | (b.sourceFile() = f and b.getEquivalenceClass() = equivClass) and (toSum = b.sourceLines()) | toSum)
+}
+
+private predicate similarLinesCoveredFiles(File f, File otherFile) {
+ exists(int numLines | numLines = f.getMetrics().getNumberOfLines() |
+ exists(int coveredApprox |
+ coveredApprox = strictsum(int num |
+ exists(int equivClass |
+ similarLinesPerEquivalenceClass(equivClass, num, f) and
+ similarLinesPerEquivalenceClass(equivClass, num, otherFile) and
+ f != otherFile
+ )
+ ) and
+ ((coveredApprox * 100) / numLines > 75)
+ )
+ )
+}
+
+predicate similarLinesCovered(File f, int coveredLines, File otherFile) {
+ exists(int numLines | numLines = f.getMetrics().getNumberOfLines() |
+ similarLinesCoveredFiles(f, otherFile) and
+ exists(int notCovered |
+ notCovered = count(int j |
+ j in [1 .. numLines] and
+ not similarLines(f, j)
+ ) and
+ coveredLines = numLines - notCovered
+ )
+ )
+}
+
+predicate duplicateLines(File f, int line) {
+ exists(DuplicateBlock b |
+ b.sourceFile() = f and line in [b.sourceStartLine() .. b.sourceEndLine()]
+ )
+}
+
+private
+predicate duplicateLinesPerEquivalenceClass(int equivClass, int lines, File f)
+{
+ lines = strictsum(DuplicateBlock b, int toSum | (b.sourceFile() = f and b.getEquivalenceClass() = equivClass) and (toSum = b.sourceLines()) | toSum)
+}
+
+predicate duplicateLinesCovered(File f, int coveredLines, File otherFile) {
+ exists(int numLines | numLines = f.getMetrics().getNumberOfLines() |
+ exists(int coveredApprox |
+ coveredApprox = strictsum(int num |
+ exists(int equivClass |
+ duplicateLinesPerEquivalenceClass(equivClass, num, f) and
+ duplicateLinesPerEquivalenceClass(equivClass, num, otherFile) and
+ f != otherFile
+ )
+ ) and
+ ((coveredApprox * 100) / numLines > 75)
+ ) and
+ exists(int notCovered |
+ notCovered = count(int j |
+ j in [1 .. numLines] and
+ not duplicateLines(f, j)
+ ) and
+ coveredLines = numLines - notCovered
+ )
+ )
+}
+
+predicate similarFiles(File f, File other, int percent) {
+ exists(int covered, int total |
+ similarLinesCovered(f, covered, other) and
+ total = f.getMetrics().getNumberOfLines() and
+ covered * 100 / total = percent and
+ percent > 80
+ ) and
+ not duplicateFiles(f, other, _)
+}
+
+predicate duplicateFiles(File f, File other, int percent) {
+ exists(int covered, int total |
+ duplicateLinesCovered(f, covered, other) and
+ total = f.getMetrics().getNumberOfLines() and
+ covered * 100 / total = percent and
+ percent > 70
+ )
+}
+
+predicate mostlyDuplicateClassBase(Class c, Class other, int numDup, int total) {
+ numDup = strictcount(FunctionDeclarationEntry m1 |
+ exists(FunctionDeclarationEntry m2 |
+ duplicateMethod(m1, m2) and
+ m1 = sourceMethod() and
+ exists(Function f | f = m1.getFunction() and f.getDeclaringType() = c) and
+ exists(Function f | f = m2.getFunction() and f.getDeclaringType() = other) and
+ c != other
+ )
+ ) and
+ total = numberOfSourceMethods(c) and
+ ((numDup * 100) / total > 80)
+}
+
+predicate mostlyDuplicateClass(Class c, Class other, string message) {
+ exists(int numDup, int total |
+ mostlyDuplicateClassBase(c,other,numDup,total) and
+ (
+ (total != numDup
+ and exists(string s1, string s2, string s3, string name | s1 = " out of " and s2 = " methods in " and s3 = " are duplicated in $@." and name = c.getName() |
+ message = numDup + s1 + total + s2 + name + s3
+ )
+ )
+ or
+ (total = numDup
+ and exists(string s1, string s2, string name | s1 = "All methods in " and s2 = " are identical in $@." and name = c.getName() |
+ message = s1 + name + s2
+ )
+ )
+ )
+ )
+}
+
+predicate fileLevelDuplication(File f, File other) {
+ similarFiles(f, other, _) or duplicateFiles(f, other, _)
+}
+
+predicate classLevelDuplication(Class c, Class other) {
+ mostlyDuplicateClass(c, other, _)
+}
+
+predicate whitelistedLineForDuplication(File f, int line) {
+ exists(Include i | i.getFile() = f and i.getLocation().getStartLine() = line)
+}
+
diff --git a/cpp/ql/src/external/DefectFilter.qll b/cpp/ql/src/external/DefectFilter.qll
new file mode 100644
index 000000000000..54182636a0ca
--- /dev/null
+++ b/cpp/ql/src/external/DefectFilter.qll
@@ -0,0 +1,27 @@
+import cpp
+
+external predicate defectResults(int id, string queryPath, string file, int startline, int startcol, int endline, int endcol, string message);
+
+class DefectResult extends int {
+
+ DefectResult() { defectResults(this, _, _, _, _, _, _, _) }
+
+ string getQueryPath() { defectResults(this, result, _, _, _, _, _, _) }
+
+ File getFile() { exists(string path | defectResults(this, _, path, _, _, _, _, _) and result.getAbsolutePath() = path) }
+
+ int getStartLine() { defectResults(this, _, _, result, _, _, _, _) }
+
+ int getStartColumn() { defectResults(this, _, _, _, result, _, _, _) }
+
+ int getEndLine() { defectResults(this, _, _, _, _, result, _, _) }
+
+ int getEndColumn() { defectResults(this, _, _, _, _, _, result, _) }
+
+ string getMessage() { defectResults(this, _, _, _, _, _, _, result) }
+
+ string getURL() {
+ result = "file://" + getFile().getAbsolutePath() + ":" + getStartLine() + ":" + getStartColumn() + ":" + getEndLine() + ":" + getEndColumn()
+ }
+
+}
diff --git a/cpp/ql/src/external/DuplicateBlock.ql b/cpp/ql/src/external/DuplicateBlock.ql
new file mode 100644
index 000000000000..a4d418315432
--- /dev/null
+++ b/cpp/ql/src/external/DuplicateBlock.ql
@@ -0,0 +1,19 @@
+/**
+ * @name Duplicate code
+ * @description This block of code is duplicated elsewhere. If possible, the shared code should be refactored so there is only one occurrence left. It may not always be possible to address these issues; other duplicate code checks (such as duplicate function, duplicate class) give subsets of the results with higher confidence.
+ * @kind problem
+ * @id cpp/duplicate-block
+ * @problem.severity recommendation
+ */
+import CodeDuplication
+
+from DuplicateBlock d, DuplicateBlock other, int lines, File otherFile, int otherLine
+where lines = d.sourceLines() and
+ lines > 10 and
+ other.getEquivalenceClass() = d.getEquivalenceClass() and
+ other != d and
+ otherFile = other.sourceFile() and
+ otherLine = other.sourceStartLine()
+select
+ d,
+ "Duplicate code: " + lines + " lines are duplicated at " + otherFile.getBaseName() + ":" + otherLine
diff --git a/cpp/ql/src/external/DuplicateFunction.qhelp b/cpp/ql/src/external/DuplicateFunction.qhelp
new file mode 100644
index 000000000000..8e81c11e5e67
--- /dev/null
+++ b/cpp/ql/src/external/DuplicateFunction.qhelp
@@ -0,0 +1,43 @@
+
+
+
+
+
+A function should never be duplicated verbatim in several places in the code. Of course
+the severity of this anti-pattern is higher for longer functions than for extremely short
+functions of one or two statements, but there are usually better ways of achieving the same
+effect.
+
+
+
+Code duplication in general is highly undesirable for a range of reasons: The artificially
+inflated amount of code hinders comprehension, and ranges of similar but subtly different lines
+can mask the real purpose or intention behind a function. There is also a risk of
+update anomalies, where only one of several copies of the code is updated to address a defect or
+add a feature.
+
+In the case of function duplication, how to address the issue depends on the functions themselves
+and on the precise classes in which the duplication occurs. At its simplest, the duplication can
+be addressed by removing all but one of the duplicate function definitions and making
+callers of the removed functions refer to the (now canonical) single remaining definition
+instead.
+
+This may not be possible for reasons of visibility or accessibility. A common example might
+be where two classes implement the same functionality but neither is a subtype of the other,
+so it is not possible to inherit a single function definition. In such cases, introducing a
+common superclass to share the duplicated code is a viable option. Alternatively, if the functions
+don't need access to private object state, they can be moved to a shared utility class that
+just provides the functionality itself.
+
+
+
+
+Elmar Juergens, Florian Deissenboeck, Benjamin Hummel, and Stefan Wagner. 2009.
+Do code clones matter? In Proceedings of the 31st International Conference on
+Software Engineering (ICSE '09). IEEE Computer Society, Washington, DC, USA,
+485-495.
+
+
+
diff --git a/cpp/ql/src/external/DuplicateFunction.ql b/cpp/ql/src/external/DuplicateFunction.ql
new file mode 100644
index 000000000000..ceaac8d3cf6d
--- /dev/null
+++ b/cpp/ql/src/external/DuplicateFunction.ql
@@ -0,0 +1,36 @@
+/**
+ * @name Duplicate function
+ * @description There is another identical implementation of this function. Extract the code to a common file or superclass or delegate to improve sharing.
+ * @kind problem
+ * @id cpp/duplicate-function
+ * @problem.severity recommendation
+ * @precision medium
+ * @tags testability
+ * maintainability
+ * duplicate-code
+ * non-attributable
+ */
+import cpp
+import CodeDuplication
+
+predicate relevant(FunctionDeclarationEntry m) {
+ exists(Location loc |
+ loc = m.getBlock().getLocation() and
+ (
+ loc.getStartLine() + 5 < loc.getEndLine() and not m.getName().matches("get%")
+ or
+ loc.getStartLine() + 10 < loc.getEndLine()
+ )
+ )
+}
+
+from FunctionDeclarationEntry m, FunctionDeclarationEntry other
+where duplicateMethod(m, other)
+ and relevant(m)
+ and not m.getFunction().isConstructedFrom(_)
+ and not other.getFunction().isConstructedFrom(_)
+ and not fileLevelDuplication(m.getFile(), other.getFile())
+ and not classLevelDuplication(m.getFunction().getDeclaringType(), other.getFunction().getDeclaringType())
+select m, "Function " + m.getName() + " is duplicated at $@.",
+ other,
+ other.getFile().getBaseName() + ":" + other.getLocation().getStartLine().toString()
diff --git a/cpp/ql/src/external/ExternalArtifact.qll b/cpp/ql/src/external/ExternalArtifact.qll
new file mode 100644
index 000000000000..be6730948986
--- /dev/null
+++ b/cpp/ql/src/external/ExternalArtifact.qll
@@ -0,0 +1,44 @@
+import cpp
+
+class ExternalData extends @externalDataElement {
+
+ string getDataPath() { externalData(this, result, _, _) }
+
+ string getQueryPath() { result = getDataPath().regexpReplaceAll("\\.[^.]*$", ".ql") }
+
+ int getNumFields() { result = 1 + max(int i | externalData(this, _, i, _) | i) }
+
+ string getField(int index) { externalData(this, _, index, result) }
+
+ int getFieldAsInt(int index) { result = getField(index).toInt() }
+
+ float getFieldAsFloat(int index) { result = getField(index).toFloat() }
+
+ date getFieldAsDate(int index) { result = getField(index).toDate() }
+
+ string toString() {
+ result = getQueryPath() + ": " + buildTupleString(0)
+ }
+
+ private string buildTupleString(int start) {
+ (start = getNumFields() - 1 and result = getField(start))
+ or
+ (start < getNumFields() - 1 and result = getField(start) + "," + buildTupleString(start+1))
+ }
+
+}
+
+/**
+ * External data with a location, and a message, as produced by tools that used to produce QLDs.
+ */
+class DefectExternalData extends ExternalData {
+ DefectExternalData() {
+ this.getField(0).regexpMatch("\\w+://.*:[0-9]+:[0-9]+:[0-9]+:[0-9]+$") and
+ this.getNumFields() = 2
+ }
+
+ string getURL() { result = getField(0) }
+
+ string getMessage() { result = getField(1) }
+}
+
diff --git a/cpp/ql/src/external/MetricFilter.qll b/cpp/ql/src/external/MetricFilter.qll
new file mode 100644
index 000000000000..68cd2eba962e
--- /dev/null
+++ b/cpp/ql/src/external/MetricFilter.qll
@@ -0,0 +1,37 @@
+import cpp
+
+external predicate metricResults(int id, string queryPath, string file, int startline, int startcol, int endline, int endcol, float value);
+
+class MetricResult extends int {
+
+ MetricResult() { metricResults(this, _, _, _, _, _, _, _) }
+
+ string getQueryPath() { metricResults(this, result, _, _, _, _, _, _) }
+
+ File getFile() { exists(string path | metricResults(this, _, path, _, _, _, _, _) and result.getAbsolutePath() = path) }
+
+ int getStartLine() { metricResults(this, _, _, result, _, _, _, _) }
+
+ int getStartColumn() { metricResults(this, _, _, _, result, _, _, _) }
+
+ int getEndLine() { metricResults(this, _, _, _, _, result, _, _) }
+
+ int getEndColumn() { metricResults(this, _, _, _, _, _, result, _) }
+
+ predicate hasMatchingLocation() { exists(this.getMatchingLocation()) }
+
+ Location getMatchingLocation() {
+ result.getFile() = this.getFile() and
+ result.getStartLine() = this.getStartLine() and
+ result.getEndLine() = this.getEndLine() and
+ result.getStartColumn() = this.getStartColumn() and
+ result.getEndColumn() = this.getEndColumn()
+ }
+
+ float getValue() { metricResults(this, _, _, _, _, _, _, result) }
+
+ string getURL() {
+ result = "file://" + getFile().getAbsolutePath() + ":" + getStartLine() + ":" + getStartColumn() + ":" + getEndLine() + ":" + getEndColumn()
+ }
+
+}
diff --git a/cpp/ql/src/external/MostlyDuplicateClass.qhelp b/cpp/ql/src/external/MostlyDuplicateClass.qhelp
new file mode 100644
index 000000000000..113eb6bf243f
--- /dev/null
+++ b/cpp/ql/src/external/MostlyDuplicateClass.qhelp
@@ -0,0 +1,45 @@
+
+
+
+
+
+In cases where several methods are duplicated between two (or more) classes,
+the classes themselves are highlighted as "mostly duplicate", rather than creating a large
+number of method-level warnings. The same caveats apply here, too.
+
+
+
+Code duplication in general is highly undesirable for a range of reasons: The artificially
+inflated amount of code hinders comprehension, and ranges of similar but subtly different lines
+can mask the real purpose or intention behind a method. There's also an omnipresent risk of
+update anomalies, where only one of several copies of the code is updated to address a defect or
+add a feature.
+
+While completely duplicated classes are rare, they are usually a sign of a simple
+oversight (or deliberate copy/paste) on a developer's part. Usually the required remedy
+action is to remove all but one of them.
+
+It is far more common to see duplication of many methods between two classes, leaving just
+a few that are actually different. Such situations warrant close inspection. Are the differences
+deliberate or a result of an inconsistent update to one of the clones? If the latter, then
+treating the classes as completely duplicate and eliminating all but one (while preserving any
+corrections or new features that may have been introduced) is the best course. If two classes serve
+genuinely different purposes but almost all of their methods are the same, that can be a sign
+that there is a missing level of abstraction. Introducing a common superclass to define the
+common methods and sharing the code is likely to prevent many problems in the long term.
+
+Modern IDEs may provide refactoring support for this sort of transformation, usually
+under the names of "Pull up" or "Extract supertype".
+
+
+
+
+Elmar Juergens, Florian Deissenboeck, Benjamin Hummel, and Stefan Wagner. 2009.
+Do code clones matter? In Proceedings of the 31st International Conference on
+Software Engineering (ICSE '09). IEEE Computer Society, Washington, DC, USA,
+485-495.
+
+
+
diff --git a/cpp/ql/src/external/MostlyDuplicateClass.ql b/cpp/ql/src/external/MostlyDuplicateClass.ql
new file mode 100644
index 000000000000..a1420f3e6050
--- /dev/null
+++ b/cpp/ql/src/external/MostlyDuplicateClass.ql
@@ -0,0 +1,21 @@
+/**
+ * @name Mostly duplicate class
+ * @description More than 80% of the methods in this class are duplicated in another class. Create a common supertype to improve code sharing.
+ * @kind problem
+ * @id cpp/duplicate-class
+ * @problem.severity recommendation
+ * @precision medium
+ * @tags testability
+ * maintainability
+ * duplicate-code
+ * non-attributable
+ */
+import cpp
+import CodeDuplication
+
+from Class c, Class other, string message
+where mostlyDuplicateClass(c, other, message)
+ and not c.isConstructedFrom(_)
+ and not other.isConstructedFrom(_)
+ and not fileLevelDuplication(c.getFile(), _)
+select c, message, other, other.getQualifiedName()
diff --git a/cpp/ql/src/external/MostlyDuplicateFile.qhelp b/cpp/ql/src/external/MostlyDuplicateFile.qhelp
new file mode 100644
index 000000000000..b3b319f346b9
--- /dev/null
+++ b/cpp/ql/src/external/MostlyDuplicateFile.qhelp
@@ -0,0 +1,46 @@
+
+
+
+
+
+In cases where most of a file's lines have been duplicated in one or more other
+files, the files themselves are highlighted as "mostly duplicate", rather than
+creating a large number of method-level or class-level warnings. The same caveats
+apply here, too.
+
+
+
+Code duplication in general is highly undesirable for a range of reasons: The artificially
+inflated amount of code hinders comprehension, and ranges of similar but subtly different lines
+can mask the real purpose or intention behind a method. There's also an omnipresent risk of
+update anomalies, where only one of several copies of the code is updated to address a defect or
+add a feature.
+
+While completely duplicated files are rare, they are usually a sign of a simple
+oversight (or deliberate copy/paste) on a developer's part. Usually the required remedy
+action is to remove all but one of them. A common exception may arise from generated code
+that simply occurs in several places in the source tree; the check can be adapted to
+exclude such results.
+
+It is far more common to see duplication of many lines between two files, leaving just
+a few that are actually different. Such situations warrant close inspection. Are the differences
+deliberate or a result of an inconsistent update to one of the clones? If the latter, then
+treating the files as completely duplicate and eliminating all but one (while preserving any
+corrections or new features that may have been introduced) is the best course. If two files serve
+genuinely different purposes but almost all of their lines are the same, that can be a sign
+that there is a missing level of abstraction. Look for ways to share the functionality, either
+by extracting a utility class for parts of it or by encapsulating the common parts into a new
+super class of any classes involved.
+
+
+
+
+Elmar Juergens, Florian Deissenboeck, Benjamin Hummel, and Stefan Wagner. 2009.
+Do code clones matter? In Proceedings of the 31st International Conference on
+Software Engineering (ICSE '09). IEEE Computer Society, Washington, DC, USA,
+485-495.
+
+
+
diff --git a/cpp/ql/src/external/MostlyDuplicateFile.ql b/cpp/ql/src/external/MostlyDuplicateFile.ql
new file mode 100644
index 000000000000..55016a88e912
--- /dev/null
+++ b/cpp/ql/src/external/MostlyDuplicateFile.ql
@@ -0,0 +1,18 @@
+/**
+ * @name Mostly duplicate file
+ * @description There is another file that shares a lot of the code with this file. Merge the two files to improve maintainability.
+ * @kind problem
+ * @id cpp/duplicate-file
+ * @problem.severity recommendation
+ * @precision medium
+ * @tags testability
+ * maintainability
+ * duplicate-code
+ * non-attributable
+ */
+import cpp
+import CodeDuplication
+
+from File f, File other, int percent
+where duplicateFiles(f, other, percent)
+select f, percent + "% of the lines in " + f.getBaseName() + " are copies of lines in $@.", other, other.getBaseName()
diff --git a/cpp/ql/src/external/MostlyDuplicateFunction.qhelp b/cpp/ql/src/external/MostlyDuplicateFunction.qhelp
new file mode 100644
index 000000000000..a981eef6e87b
--- /dev/null
+++ b/cpp/ql/src/external/MostlyDuplicateFunction.qhelp
@@ -0,0 +1,55 @@
+
+
+
+
+A "mostly duplicate function" is a function for which there is at least one
+almost exact duplicate somewhere else in the code, but for which there are no
+exact duplicates. There will be minor typographical differences between this
+function and any "mostly duplicate function" to which it corresponds (for
+example, comments and small code changes), preventing an exact match. Pairs of
+such functions are sometimes referred to as "similar".
+
+This class of problem can often be more insidious than mere duplication, because the two
+implementations have diverged. This may be on purpose (when a function is copy-and-pasted
+and adapted to a new context) or accidentally (when a correction is only introduced in one of
+several identical pieces of code), and to address the problem one needs to understand which
+of the two situations applies.
+
+
+
+Code duplication in general is highly undesirable for a range of reasons: The artificially
+inflated amount of code hinders comprehension, and ranges of similar but subtly different lines
+can mask the real purpose or intention behind a function. There's also a risk of
+update anomalies, where only one of several copies of the code is updated to address a defect or
+add a feature.
+
+In the case of function similarity, how to address the issue depends on the functions
+themselves and on the precise classes in which they occur. At its simplest, if the differences
+are accidental, the problem can be addressed by unifying the functions to behave identically.
+Then, we can remove all but one of the duplicate function definitions and make
+callers of the removed functions refer to the (now canonical) single remaining definition
+instead.
+
+In more complex cases, look for ways of encapsulating the commonality and sharing it while
+retaining the differences in functionality. Perhaps the function can be moved to a single place
+and given an additional parameter, allowing it to cover all use cases? Alternatively, there
+may be a common preprocessing or postprocessing step which can be extracted to its own (shared)
+function, leaving only the specific parts in the existing functions.
+
+Modern IDEs may provide refactoring support for this sort of transformation. Relevant
+refactorings might be "Extract function", "Change function signature", "Pull up" or "Extract
+supertype".
+
+
+
+
+Elmar Juergens, Florian Deissenboeck, Benjamin Hummel, and Stefan Wagner. 2009.
+Do code clones matter? In Proceedings of the 31st International Conference on
+Software Engineering (ICSE '09). IEEE Computer Society, Washington, DC, USA,
+485-495.
+
+
+
+
diff --git a/cpp/ql/src/external/MostlyDuplicateFunction.ql b/cpp/ql/src/external/MostlyDuplicateFunction.ql
new file mode 100644
index 000000000000..f991b0692ed5
--- /dev/null
+++ b/cpp/ql/src/external/MostlyDuplicateFunction.ql
@@ -0,0 +1,27 @@
+/**
+ * @name Mostly duplicate function
+ * @description There is another function that shares a lot of the code with this one. Extract the code to a common file/superclass or delegate to improve sharing.
+ * @kind problem
+ * @id cpp/mostly-duplicate-function
+ * @problem.severity recommendation
+ * @precision medium
+ * @tags testability
+ * duplicate-code
+ * non-attributable
+ */
+import cpp
+import CodeDuplication
+
+from FunctionDeclarationEntry m, int covered, int total, FunctionDeclarationEntry other, int percent
+where
+ duplicateStatements(m, other, covered, total) and
+ covered != total and
+ total > 5 and
+ covered * 100 / total = percent and
+ percent > 80 and
+ not m.getFunction().isConstructedFrom(_) and
+ not other.getFunction().isConstructedFrom(_) and
+ not duplicateMethod(m, other) and
+ not classLevelDuplication(m.getFunction().getDeclaringType(), other.getFunction().getDeclaringType()) and
+ not fileLevelDuplication(m.getFile(), other.getFile())
+select m, percent + "% of the statements in " + m.getName() + " are duplicated in $@.", other, other.getFunction().getQualifiedName()
diff --git a/cpp/ql/src/external/MostlySimilarFile.qhelp b/cpp/ql/src/external/MostlySimilarFile.qhelp
new file mode 100644
index 000000000000..e1a41a16321f
--- /dev/null
+++ b/cpp/ql/src/external/MostlySimilarFile.qhelp
@@ -0,0 +1,39 @@
+
+
+
+
+
+Two lines are defined as similar if they are either identical or contain only very minor
+differences. In cases where most of the lines in a file have corresponding "similar" lines in another file,
+the files themselves are highlighted as "mostly similar", instead of creating a large number of method-level or class-level
+warnings. The same caveats apply here, too.
+
+
+
+Code duplication in general is highly undesirable for a range of reasons: The artificially
+inflated amount of code hinders comprehension, and ranges of similar but subtly different lines
+can mask the real purpose or intention behind a method. There's also an omnipresent risk of
+update anomalies, where only one of several copies of the code is updated to address a defect or
+add a feature.
+
+With files that are marked as mostly similar, special care should be taken. Why are
+they almost the same, and why are there differences? If the differences are accidental (for
+example from corrections that were only applied to one copy), then unifying the files and removing
+all but one is the best thing to do. If the files have genuinely different tasks, it is worth
+thinking about the reasons for the similarity. Can some of the shared code be extracted into
+methods (perhaps with additional parameters, to cover the differences in behavior)? Should it
+be moved into a utility class or file that is accessible to all current implementations, or
+should a new level of abstraction be introduced?
+
+
+
+
+Elmar Juergens, Florian Deissenboeck, Benjamin Hummel, and Stefan Wagner. 2009.
+Do code clones matter? In Proceedings of the 31st International Conference on
+Software Engineering (ICSE '09). IEEE Computer Society, Washington, DC, USA,
+485-495.
+
+
+
diff --git a/cpp/ql/src/external/MostlySimilarFile.ql b/cpp/ql/src/external/MostlySimilarFile.ql
new file mode 100644
index 000000000000..64338c71d5d5
--- /dev/null
+++ b/cpp/ql/src/external/MostlySimilarFile.ql
@@ -0,0 +1,18 @@
+/**
+ * @name Mostly similar file
+ * @description There is another file that shares a lot of the code with this file. Notice that names of variables and types may have been changed. Merge the two files to improve maintainability.
+ * @kind problem
+ * @id cpp/similar-file
+ * @problem.severity recommendation
+ * @precision medium
+ * @tags testability
+ * maintainability
+ * duplicate-code
+ * non-attributable
+ */
+import cpp
+import CodeDuplication
+
+from File f, File other, int percent
+where similarFiles(f, other, percent)
+select f, percent + "% of the lines in " + f.getBaseName() + " are similar to lines in $@.", other, other.getBaseName()
diff --git a/cpp/ql/src/external/VCS.qll b/cpp/ql/src/external/VCS.qll
new file mode 100644
index 000000000000..cae2379cab51
--- /dev/null
+++ b/cpp/ql/src/external/VCS.qll
@@ -0,0 +1,104 @@
+import cpp
+
+class Commit extends @svnentry {
+
+ Commit() {
+ svnaffectedfiles(this, _, _) and
+ exists(date svnDate, date snapshotDate |
+ svnentries(this, _, _, svnDate, _) and
+ snapshotDate(snapshotDate) and
+ svnDate <= snapshotDate
+ )
+ }
+
+ string toString() { result = this.getRevisionName() }
+
+ string getRevisionName() { svnentries(this, result, _, _, _) }
+
+ string getAuthor() { svnentries(this, _, result, _, _) }
+
+ date getDate() { svnentries(this, _, _, result, _) }
+
+ int getChangeSize() { svnentries(this, _, _, _, result) }
+
+ string getMessage() { svnentrymsg(this, result) }
+
+ string getAnAffectedFilePath(string action) {
+ exists(File rawFile | svnaffectedfiles(this, rawFile, action) |
+ result = rawFile.getAbsolutePath()
+ )
+ }
+
+ string getAnAffectedFilePath() { result = getAnAffectedFilePath(_) }
+
+ File getAnAffectedFile(string action) {
+ // Workaround for incorrect keys in SVN data
+ exists(File svnFile | svnFile.getAbsolutePath() = result.getAbsolutePath() |
+ svnaffectedfiles(this,svnFile,action)
+ )
+ and exists(result.getMetrics().getNumberOfLinesOfCode())
+ }
+
+ File getAnAffectedFile() { exists(string action | result = this.getAnAffectedFile(action)) }
+
+ private predicate churnForFile(File f, int added, int deleted) {
+ // Workaround for incorrect keys in SVN data
+ exists(File svnFile | svnFile.getAbsolutePath() = f.getAbsolutePath() |
+ svnchurn(this,svnFile,added,deleted)
+ )
+ and exists(f.getMetrics().getNumberOfLinesOfCode())
+ }
+
+ int getRecentChurnForFile(File f) {
+ exists (int added, int deleted | churnForFile(f, added, deleted) and result = added + deleted)
+ }
+
+ int getRecentAdditionsForFile(File f) {
+ churnForFile(f, result, _)
+ }
+
+ int getRecentDeletionsForFile(File f) {
+ churnForFile(f, _, result)
+ }
+
+ predicate isRecent() { recentCommit(this) }
+
+ int daysToNow() {
+ exists(date now | snapshotDate(now) |
+ result = getDate().daysTo(now) and result >= 0
+ )
+ }
+
+}
+
+class Author extends string {
+ Author() { exists(Commit e | this = e.getAuthor()) }
+
+ Commit getACommit() { result.getAuthor() = this }
+
+ File getAnEditedFile() { result = this.getACommit().getAnAffectedFile() }
+
+}
+
+predicate recentCommit(Commit e) {
+ exists(date snapshotDate, date commitDate, int days |
+ snapshotDate(snapshotDate) and
+ e.getDate() = commitDate and
+ days = commitDate.daysTo(snapshotDate) and
+ days >= 0 and days <= 60
+ )
+}
+
+date firstChange(File f) {
+ result = min(Commit e, date toMin | (f = e.getAnAffectedFile()) and (toMin = e.getDate()) | toMin)
+}
+
+predicate firstCommit(Commit e) {
+ not exists(File f | f = e.getAnAffectedFile() |
+ firstChange(f) < e.getDate()
+ )
+}
+
+predicate artificialChange(Commit e) {
+ firstCommit(e) or e.getChangeSize() >= 50000
+}
diff --git a/cpp/ql/src/external/examples/filters/BumpMetricBy10.ql b/cpp/ql/src/external/examples/filters/BumpMetricBy10.ql
new file mode 100644
index 000000000000..b0939153a323
--- /dev/null
+++ b/cpp/ql/src/external/examples/filters/BumpMetricBy10.ql
@@ -0,0 +1,12 @@
+/**
+ * @name Metric filter: increase the value of a metric by 10
+ * @description This filter demonstrates how to change the value
+ * computed by the metric that it is filtering. In this
+ * example the value is increased by 10.
+ */
+import cpp
+import external.MetricFilter
+
+from MetricResult res
+select res,
+ res.getValue() + 10
diff --git a/cpp/ql/src/external/examples/filters/EditDefectMessage.ql b/cpp/ql/src/external/examples/filters/EditDefectMessage.ql
new file mode 100644
index 000000000000..01c10f6443d9
--- /dev/null
+++ b/cpp/ql/src/external/examples/filters/EditDefectMessage.ql
@@ -0,0 +1,13 @@
+/**
+ * @name Filter: alter the message generated by a query
+ * @description This filter demonstrates how to edit the message
+ * generated by the query that it is filtering. In this
+ * example the string `Filtered query result: ` is
+ * prepended to the message.
+ */
+import cpp
+import external.DefectFilter
+
+from DefectResult res
+select res,
+ "Filtered query result: " + res.getMessage()
diff --git a/cpp/ql/src/external/examples/filters/ExcludeGeneratedCode.ql b/cpp/ql/src/external/examples/filters/ExcludeGeneratedCode.ql
new file mode 100644
index 000000000000..4a12003f8090
--- /dev/null
+++ b/cpp/ql/src/external/examples/filters/ExcludeGeneratedCode.ql
@@ -0,0 +1,18 @@
+/**
+ * @name Filter: exclude results from generated code
+ * @description This filter demonstrates how to return results only if
+ * they meet certain criteria. In this example, results are
+ * only returned if they do not come from a file which
+ * contains 'generated' anywhere in its path.
+ */
+import cpp
+import external.DefectFilter
+
+predicate generatedFile(File f) {
+ f.getAbsolutePath().matches("%generated%")
+}
+
+from DefectResult res
+where not generatedFile(res.getFile())
+select res,
+ res.getMessage()
diff --git a/cpp/ql/src/external/tests/DefectFilter.ql b/cpp/ql/src/external/tests/DefectFilter.ql
new file mode 100644
index 000000000000..7c9459f64ced
--- /dev/null
+++ b/cpp/ql/src/external/tests/DefectFilter.ql
@@ -0,0 +1,11 @@
+/**
+ * @name Defect filter
+ * @description Only include results in large files (200) lines of code, and change the message.
+ */
+import cpp
+import external.DefectFilter
+import external.VCS
+
+from DefectResult res
+where res.getFile().getMetrics().getNumberOfLinesOfCode() > 200
+select res, "Large files: " + res.getMessage()
diff --git a/cpp/ql/src/external/tests/DefectFromExternalData.ql b/cpp/ql/src/external/tests/DefectFromExternalData.ql
new file mode 100644
index 000000000000..1164d4498d93
--- /dev/null
+++ b/cpp/ql/src/external/tests/DefectFromExternalData.ql
@@ -0,0 +1,15 @@
+/**
+ * @name Defect from external data
+ * @description Insert description here...
+ * @kind problem
+ * @problem.severity warning
+ */
+
+import cpp
+
+import external.ExternalArtifact
+
+from ExternalData d, File u
+where d.getQueryPath() = "external-data.ql"
+ and u.getShortName() = d.getField(0)
+select u, d.getField(5) + ", " + d.getFieldAsDate(1) + ", " +d.getField(2) + ", " + d.getFieldAsFloat(3) + ", " + d.getFieldAsInt(4) + ": " + d.getNumFields()
diff --git a/cpp/ql/src/external/tests/DefectFromSVN.ql b/cpp/ql/src/external/tests/DefectFromSVN.ql
new file mode 100644
index 000000000000..f58a6482ebc8
--- /dev/null
+++ b/cpp/ql/src/external/tests/DefectFromSVN.ql
@@ -0,0 +1,26 @@
+/**
+ * @name Defect from SVN
+ * @description A test case for creating a defect from SVN data.
+ * @kind problem
+ * @problem.severity warning
+ */
+
+import cpp
+
+import external.ExternalArtifact
+import external.VCS
+
+predicate numCommits(File f, int i) {
+ i = count(Commit e | e.getAnAffectedFile() = f)
+}
+
+predicate maxCommits(int i) {
+ i = max(File f, int j | numCommits(f, j) | j)
+}
+
+from File f, int i
+where numCommits(f,i) and maxCommits(i)
+select f, "This file has " + i + " commits."
+
+
+
diff --git a/cpp/ql/src/external/tests/MetricFilter.ql b/cpp/ql/src/external/tests/MetricFilter.ql
new file mode 100644
index 000000000000..99dbd16f0ecb
--- /dev/null
+++ b/cpp/ql/src/external/tests/MetricFilter.ql
@@ -0,0 +1,10 @@
+/**
+ * @name Metric filter
+ * @description Only include results in large files (200) lines of code.
+ */
+import cpp
+import external.MetricFilter
+
+from MetricResult res
+where res.getFile().getMetrics().getNumberOfLinesOfCode() > 200
+select res, res.getValue()
diff --git a/cpp/ql/src/external/tests/MetricFromSVN.ql b/cpp/ql/src/external/tests/MetricFromSVN.ql
new file mode 100644
index 000000000000..32d27c7deafc
--- /dev/null
+++ b/cpp/ql/src/external/tests/MetricFromSVN.ql
@@ -0,0 +1,18 @@
+/**
+ * @name Metric from SVN
+ * @description Find number of commits for a file
+ * @treemap.warnOn lowValues
+ * @metricType file
+ */
+
+import cpp
+
+import external.VCS
+
+predicate numCommits(File f, int i) {
+ i = count(Commit e | e.getAnAffectedFile() = f)
+}
+
+from File f, int i
+where numCommits(f, i)
+select f, i
diff --git a/cpp/ql/src/filters/ClassifyFiles.ql b/cpp/ql/src/filters/ClassifyFiles.ql
new file mode 100644
index 000000000000..8f486e63fa7b
--- /dev/null
+++ b/cpp/ql/src/filters/ClassifyFiles.ql
@@ -0,0 +1,25 @@
+/**
+ * @name Classify files
+ * @description This query produces a list of all files in a snapshot
+ * that are classified as generated code or test code.
+ * @kind file-classifier
+ * @id cpp/file-classifier
+ */
+
+import cpp
+import semmle.code.cpp.AutogeneratedFile
+import semmle.code.cpp.TestFile
+
+predicate classify(File f, string tag) {
+ (
+ f instanceof AutogeneratedFile and
+ tag = "generated"
+ ) or (
+ f instanceof TestFile and
+ tag = "test"
+ )
+}
+
+from File f, string tag
+where classify(f, tag)
+select f, tag
diff --git a/cpp/ql/src/filters/FilterAutogenerated.ql b/cpp/ql/src/filters/FilterAutogenerated.ql
new file mode 100644
index 000000000000..a6577aa7c115
--- /dev/null
+++ b/cpp/ql/src/filters/FilterAutogenerated.ql
@@ -0,0 +1,16 @@
+/**
+ * @name Filter: exclude results from files that are autogenerated
+ * @description Use this filter to return results only if they are
+ * located in files that are maintained manually.
+ * @kind problem
+ * @id cpp/autogenerated-filter
+ */
+
+import cpp
+import semmle.code.cpp.AutogeneratedFile
+import external.DefectFilter
+
+from DefectResult res
+where not res.getFile() instanceof AutogeneratedFile
+select res,
+ res.getMessage()
diff --git a/cpp/ql/src/filters/FilterAutogeneratedForMetric.ql b/cpp/ql/src/filters/FilterAutogeneratedForMetric.ql
new file mode 100644
index 000000000000..2b0ff58e0655
--- /dev/null
+++ b/cpp/ql/src/filters/FilterAutogeneratedForMetric.ql
@@ -0,0 +1,16 @@
+/**
+ * @name Metric filter: exclude results from files that are autogenerated
+ * @description Use this filter to return results only if they are
+ * located in files that are maintained manually.
+ * @kind treemap
+ * @id cpp/autogenerated-for-metric-filter
+ */
+
+import cpp
+import semmle.code.cpp.AutogeneratedFile
+import external.MetricFilter
+
+from MetricResult res
+where not res.getFile() instanceof AutogeneratedFile
+select res,
+ res.getValue()
diff --git a/cpp/ql/src/filters/FromSource.ql b/cpp/ql/src/filters/FromSource.ql
new file mode 100644
index 000000000000..6323d3c9ec40
--- /dev/null
+++ b/cpp/ql/src/filters/FromSource.ql
@@ -0,0 +1,16 @@
+/**
+ * @name Filter: exclude results from files for which we do not have
+ * source code
+ * @description Use this filter to return results only if they are
+ * located in files for which we have source code.
+ * @kind problem
+ * @id cpp/from-source-filter
+ */
+
+import cpp
+import external.DefectFilter
+
+from DefectResult res
+where res.getFile().fromSource()
+select res,
+ res.getMessage()
diff --git a/cpp/ql/src/filters/ImportAdditionalLibraries.ql b/cpp/ql/src/filters/ImportAdditionalLibraries.ql
new file mode 100644
index 000000000000..1d54da5f6e75
--- /dev/null
+++ b/cpp/ql/src/filters/ImportAdditionalLibraries.ql
@@ -0,0 +1,20 @@
+/**
+ * @name (Import additional libraries)
+ * @description This query produces no results but imports some libraries we
+ * would like to make available in the LGTM query console even
+ * if they are not used by any queries.
+ * @kind file-classifier
+ * @id cpp/lgtm/import-additional-libraries
+ */
+
+import cpp
+
+import semmle.code.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow2
+import semmle.code.cpp.dataflow.DataFlow3
+import semmle.code.cpp.dataflow.DataFlow4
+import semmle.code.cpp.dataflow.TaintTracking
+
+from File f, string tag
+where none()
+select f, tag
diff --git a/cpp/ql/src/filters/Macros.ql b/cpp/ql/src/filters/Macros.ql
new file mode 100644
index 000000000000..567461fb9117
--- /dev/null
+++ b/cpp/ql/src/filters/Macros.ql
@@ -0,0 +1,35 @@
+/**
+ * @name Filter: exclude results on lines covered by a macro expansion
+ * @description Use this filter to return results only when there is no
+ * macro expansion whose location spans all the lines of
+ * the result's location.
+ * @kind problem
+ * @id cpp/macros-filter
+ */
+import cpp
+import external.DefectFilter
+
+predicate macroLocation(File f, int startLine, int endLine) {
+ exists(MacroInvocation mi, Location l |
+ l = mi.getLocation() and
+ l.getFile() = f and
+ l.getStartLine() = startLine and
+ l.getEndLine() = endLine
+ )
+}
+
+predicate macroCovering(DefectResult r) {
+ exists(File f, int macroStart, int macroEnd, int defectStart, int defectEnd |
+ f = r.getFile() and
+ defectStart = r.getStartLine() and
+ defectEnd = r.getEndLine() and
+ macroLocation(f, macroStart, macroEnd) and
+ macroStart <= defectStart and
+ macroEnd >= defectEnd
+ )
+}
+
+from DefectResult res
+where not macroCovering(res)
+select res,
+ res.getMessage()
diff --git a/cpp/ql/src/filters/RecentDefects.ql b/cpp/ql/src/filters/RecentDefects.ql
new file mode 100644
index 000000000000..cf904d602ad1
--- /dev/null
+++ b/cpp/ql/src/filters/RecentDefects.ql
@@ -0,0 +1,23 @@
+/**
+ * @name Filter: exclude results from files that have not recently been
+ * edited
+ * @description Use this filter to return results only if they are
+ * located in files that have been modified in the 60 days
+ * before the date of the snapshot.
+ * @kind problem
+ * @id cpp/recent-defects-filter
+ */
+import cpp
+import external.DefectFilter
+import external.VCS
+
+private pragma[noopt]
+predicate recent(File file) {
+ exists(Commit e | file = e.getAnAffectedFile() |
+ e.isRecent() and not artificialChange(e)
+ )
+}
+
+from DefectResult res
+where recent(res.getFile())
+select res, res.getMessage()
diff --git a/cpp/ql/src/filters/RecentDefectsForMetric.ql b/cpp/ql/src/filters/RecentDefectsForMetric.ql
new file mode 100644
index 000000000000..295155383880
--- /dev/null
+++ b/cpp/ql/src/filters/RecentDefectsForMetric.ql
@@ -0,0 +1,23 @@
+/**
+ * @name Metric filter: exclude results from files that have not
+ * recently been edited
+ * @description Use this filter to return results only if they are
+ * located in files that have been modified in the 60 days
+ * before the snapshot.
+ * @kind treemap
+ * @id cpp/recent-defects-for-metric-filter
+ */
+import cpp
+import external.MetricFilter
+import external.VCS
+
+private pragma[noopt]
+predicate recent(File file) {
+ exists(Commit e | file = e.getAnAffectedFile() |
+ e.isRecent() and not artificialChange(e)
+ )
+}
+
+from MetricResult res
+where recent(res.getFile())
+select res, res.getValue()
diff --git a/cpp/ql/src/jsf/3.02 Code Size and Complexity/AV Rule 1.ql b/cpp/ql/src/jsf/3.02 Code Size and Complexity/AV Rule 1.ql
new file mode 100644
index 000000000000..d0ce8aff05b3
--- /dev/null
+++ b/cpp/ql/src/jsf/3.02 Code Size and Complexity/AV Rule 1.ql
@@ -0,0 +1,12 @@
+/**
+ * @name AV Rule 1
+ * @description Any one function (or method) will contain no more than 200 logical source lines of code.
+ * @kind problem
+ * @id cpp/jsf/av-rule-1
+ * @problem.severity warning
+ */
+import cpp
+
+from Function f
+where f.getMetrics().getNumberOfLinesOfCode() > 200
+select f, "AV Rule 1: any one function (or method) will contain no more than 200 logical source lines of code."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/3.02 Code Size and Complexity/AV Rule 2.ql b/cpp/ql/src/jsf/3.02 Code Size and Complexity/AV Rule 2.ql
new file mode 100644
index 000000000000..81441a548fc3
--- /dev/null
+++ b/cpp/ql/src/jsf/3.02 Code Size and Complexity/AV Rule 2.ql
@@ -0,0 +1,25 @@
+/**
+ * @name AV Rule 2
+ * @description There shall not be any self-modifying code.
+ * @kind problem
+ * @id cpp/jsf/av-rule-2
+ * @problem.severity error
+ */
+import cpp
+
+/* We look for code that converts between function pointers and non-function, non-void
+ pointers. This will obviously not catch code that uses inline assembly to achieve
+ self-modification, nor will it spot the use of OS mechanisms to write into process
+ memory (such as WriteProcessMemory under Windows). */
+predicate maybeSMCConversion(Type t1, Type t2) {
+ t1 instanceof FunctionPointerType and
+ t2 instanceof PointerType and
+ not t2 instanceof FunctionPointerType and
+ not t2 instanceof VoidPointerType
+ or maybeSMCConversion(t2, t1)
+}
+
+from Expr e
+where e.fromSource() and
+ maybeSMCConversion(e.getUnderlyingType(), e.getActualType())
+select e, "AV Rule 2: There shall not be any self-modifying code."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/3.02 Code Size and Complexity/AV Rule 3.ql b/cpp/ql/src/jsf/3.02 Code Size and Complexity/AV Rule 3.ql
new file mode 100644
index 000000000000..41aea8836d79
--- /dev/null
+++ b/cpp/ql/src/jsf/3.02 Code Size and Complexity/AV Rule 3.ql
@@ -0,0 +1,14 @@
+/**
+ * @name AV Rule 3
+ * @description All functions shall have a cyclomatic complexity number of 20 or less.
+ * @kind problem
+ * @id cpp/jsf/av-rule-3
+ * @problem.severity error
+ */
+import cpp
+
+from Function f, int c
+where c = f.getMetrics().getCyclomaticComplexity() and
+ c > 20
+select f, c as CyclomaticComplexity,
+ "AV Rule 3: All functions shall have a cyclomatic complexity number of 20 or less."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.04 Environment/AV Rule 11.ql b/cpp/ql/src/jsf/4.04 Environment/AV Rule 11.ql
new file mode 100644
index 000000000000..c7ff2e29cd55
--- /dev/null
+++ b/cpp/ql/src/jsf/4.04 Environment/AV Rule 11.ql
@@ -0,0 +1,13 @@
+/**
+ * @name AV Rule 11
+ * @description Trigraphs will not be used.
+ * @kind problem
+ * @id cpp/jsf/av-rule-11
+ * @problem.severity warning
+ */
+import cpp
+import external.ExternalArtifact
+
+from DefectExternalData d
+where d.getQueryPath() = "jsf/4.04 Environment/AV Rule 11.ql"
+select d, d.getMessage()
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.04 Environment/AV Rule 12.ql b/cpp/ql/src/jsf/4.04 Environment/AV Rule 12.ql
new file mode 100644
index 000000000000..704a605f7ad3
--- /dev/null
+++ b/cpp/ql/src/jsf/4.04 Environment/AV Rule 12.ql
@@ -0,0 +1,14 @@
+/**
+ * @name AV Rule 12
+ * @description Digraphs will not be used.
+ * @kind problem
+ * @id cpp/jsf/av-rule-12
+ * @problem.severity warning
+ */
+
+import cpp
+import external.ExternalArtifact
+
+from DefectExternalData d
+where d.getQueryPath() = "jsf/4.04 Environment/AV Rule 12.ql"
+select d, d.getMessage()
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.04 Environment/AV Rule 13.ql b/cpp/ql/src/jsf/4.04 Environment/AV Rule 13.ql
new file mode 100644
index 000000000000..1eeb9f0ef3e0
--- /dev/null
+++ b/cpp/ql/src/jsf/4.04 Environment/AV Rule 13.ql
@@ -0,0 +1,13 @@
+/**
+ * @name AV Rule 13
+ * @description Multi-byte characters and wide string literals will not be used.
+ * @kind problem
+ * @id cpp/jsf/av-rule-13
+ * @problem.severity error
+ */
+import cpp
+
+from Literal l
+where l.getType() instanceof Wchar_t or
+ l.getType().(ArrayType).getBaseType().getUnspecifiedType() instanceof Wchar_t
+select l, "AV Rule 13: Multi-byte characters and wide string literals will not be used."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.04 Environment/AV Rule 14.ql b/cpp/ql/src/jsf/4.04 Environment/AV Rule 14.ql
new file mode 100644
index 000000000000..f9da62380f66
--- /dev/null
+++ b/cpp/ql/src/jsf/4.04 Environment/AV Rule 14.ql
@@ -0,0 +1,13 @@
+/**
+ * @name AV Rule 14
+ * @description Literal suffixes shall use uppercase rather than lowercase letters.
+ * @kind problem
+ * @id cpp/jsf/av-rule-14
+ * @problem.severity error
+ */
+import cpp
+
+from Literal l
+where l.fromSource() and
+ l.getValueText().regexpMatch(".*[ul][uUlL]*\\s*")
+select l, "AV Rule 14: Literal suffixes shall use uppercase rather than lowercase letters."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.04 Environment/AV Rule 9.ql b/cpp/ql/src/jsf/4.04 Environment/AV Rule 9.ql
new file mode 100644
index 000000000000..5ac20cfc5a65
--- /dev/null
+++ b/cpp/ql/src/jsf/4.04 Environment/AV Rule 9.ql
@@ -0,0 +1,14 @@
+/**
+ * @name AV Rule 9
+ * @description Only those characters specified in the C++ basic source character set will be used.
+ * @kind problem
+ * @id cpp/jsf/av-rule-9
+ * @problem.severity warning
+ */
+
+import cpp
+import external.ExternalArtifact
+
+from DefectExternalData d
+where d.getQueryPath() = "jsf/4.04 Environment/AV Rule 9.ql"
+select d, d.getMessage()
diff --git a/cpp/ql/src/jsf/4.05 Libraries/AV Rule 17.ql b/cpp/ql/src/jsf/4.05 Libraries/AV Rule 17.ql
new file mode 100644
index 000000000000..30a36d0ad960
--- /dev/null
+++ b/cpp/ql/src/jsf/4.05 Libraries/AV Rule 17.ql
@@ -0,0 +1,14 @@
+/**
+ * @name AV Rule 17
+ * @description The error indicator errno shall not be used.
+ * @kind problem
+ * @id cpp/jsf/av-rule-17
+ * @problem.severity error
+ */
+import cpp
+
+from Locatable errno, Locatable use
+where ( errno.(Macro).getHead() = "errno" and use = errno.(Macro).getAnInvocation()
+ or errno.(Variable).hasName("errno") and use = errno.(Variable).getAnAccess()) and
+ errno.getFile().getAbsolutePath().matches("%errno.h")
+select use, "AV Rule 17: The error indicator errno shall not be used."
diff --git a/cpp/ql/src/jsf/4.05 Libraries/AV Rule 18.ql b/cpp/ql/src/jsf/4.05 Libraries/AV Rule 18.ql
new file mode 100644
index 000000000000..8045b2bb604d
--- /dev/null
+++ b/cpp/ql/src/jsf/4.05 Libraries/AV Rule 18.ql
@@ -0,0 +1,13 @@
+/**
+ * @name AV Rule 18
+ * @description The macro offsetof, in library , shall not be used.
+ * @kind problem
+ * @id cpp/jsf/av-rule-18
+ * @problem.severity error
+ */
+import cpp
+
+from Macro offsetof
+where offsetof.getHead().matches("offsetof(%,%)") and
+ offsetof.getFile().getAbsolutePath().matches("%stddef.h")
+select offsetof.getAnInvocation(), "AV Rule 18: The macro offsetof, in library , shall not be used."
diff --git a/cpp/ql/src/jsf/4.05 Libraries/AV Rule 19.ql b/cpp/ql/src/jsf/4.05 Libraries/AV Rule 19.ql
new file mode 100644
index 000000000000..ea4885b13a33
--- /dev/null
+++ b/cpp/ql/src/jsf/4.05 Libraries/AV Rule 19.ql
@@ -0,0 +1,12 @@
+/**
+ * @name AV Rule 19
+ * @description and the setlocale function shall not be used.
+ * @kind problem
+ * @id cpp/jsf/av-rule-19
+ * @problem.severity error
+ */
+import cpp
+
+from Include incl
+where incl.getIncludedFile().getAbsolutePath().matches("%locale.h")
+select incl, "AV Rule 19: and the setlocale function shall not be used."
diff --git a/cpp/ql/src/jsf/4.05 Libraries/AV Rule 20.ql b/cpp/ql/src/jsf/4.05 Libraries/AV Rule 20.ql
new file mode 100644
index 000000000000..f5658511c13f
--- /dev/null
+++ b/cpp/ql/src/jsf/4.05 Libraries/AV Rule 20.ql
@@ -0,0 +1,28 @@
+/**
+ * @name AV Rule 20
+ * @description The setjmp macro and the longjmp function shall not be used.
+ * @kind problem
+ * @id cpp/jsf/av-rule-20
+ * @problem.severity error
+ */
+import cpp
+
+class Setjmp extends Macro {
+ Setjmp() {
+ super.getHead().matches("setjmp(%)") and
+ super.getFile().getAbsolutePath().matches("%setjmp.h")
+ }
+}
+
+class Longjmp extends Function {
+ Longjmp() {
+ super.hasName("longjmp") and
+ super.getNumberOfParameters() = 2 and
+ super.getFile().getAbsolutePath().matches("%setjmp.h")
+ }
+}
+
+from Setjmp setjmp, Longjmp longjmp, Locatable use
+where use = setjmp.getAnInvocation()
+ or use = longjmp.getACallToThisFunction()
+select use, "AV Rule 20: The setjmp macro and the longjmp function shall not be used."
diff --git a/cpp/ql/src/jsf/4.05 Libraries/AV Rule 21.ql b/cpp/ql/src/jsf/4.05 Libraries/AV Rule 21.ql
new file mode 100644
index 000000000000..388a717eebbf
--- /dev/null
+++ b/cpp/ql/src/jsf/4.05 Libraries/AV Rule 21.ql
@@ -0,0 +1,12 @@
+/**
+ * @name AV Rule 21
+ * @description The signal handling facilities of shall not be used.
+ * @kind problem
+ * @id cpp/jsf/av-rule-21
+ * @problem.severity error
+ */
+import cpp
+
+from Include incl
+where incl.getIncludedFile().getAbsolutePath().matches("%signal.h")
+select incl, "AV Rule 21: The signal handling facilities of shall not be used."
diff --git a/cpp/ql/src/jsf/4.05 Libraries/AV Rule 22.ql b/cpp/ql/src/jsf/4.05 Libraries/AV Rule 22.ql
new file mode 100644
index 000000000000..4a8f075a7bd8
--- /dev/null
+++ b/cpp/ql/src/jsf/4.05 Libraries/AV Rule 22.ql
@@ -0,0 +1,12 @@
+/**
+ * @name AV Rule 22
+ * @description The input/output library shall not be used.
+ * @kind problem
+ * @id cpp/jsf/av-rule-22
+ * @problem.severity error
+ */
+import cpp
+
+from Include incl
+where incl.getIncludedFile().getAbsolutePath().matches("%stdio.h")
+select incl, "AV Rule 22: The input/output library shall not be used."
diff --git a/cpp/ql/src/jsf/4.05 Libraries/AV Rule 23.ql b/cpp/ql/src/jsf/4.05 Libraries/AV Rule 23.ql
new file mode 100644
index 000000000000..62b3b4c6539e
--- /dev/null
+++ b/cpp/ql/src/jsf/4.05 Libraries/AV Rule 23.ql
@@ -0,0 +1,13 @@
+/**
+ * @name AV Rule 23
+ * @description The library functions atof, atoi and atol from library shall not be used.
+ * @kind problem
+ * @id cpp/jsf/av-rule-23
+ * @problem.severity error
+ */
+import cpp
+
+from Function f
+where f.getName().regexpMatch("atof|atoi|atol") and
+ f.getFile().getAbsolutePath().matches("%stdlib.h")
+select f.getACallToThisFunction(), "AV Rule 23: The library functions atof, atoi and atol from library shall not be used."
diff --git a/cpp/ql/src/jsf/4.05 Libraries/AV Rule 24.cpp b/cpp/ql/src/jsf/4.05 Libraries/AV Rule 24.cpp
new file mode 100644
index 000000000000..dd6d0bce8bd4
--- /dev/null
+++ b/cpp/ql/src/jsf/4.05 Libraries/AV Rule 24.cpp
@@ -0,0 +1,19 @@
+class LibraryClass {
+public:
+ void f() {
+ ...
+ if (error) {
+ abort(); //immediately terminates program, especially
+ //bad since the class is in a library and not in the main
+ //logic of the application.
+ }
+ }
+
+ char* diff(string file1, string file2) {
+ string command;
+ command = "diff " + file1 + " " + file2;
+ system(command); //call to system, may not be supported in all platforms
+ ...
+ return cmd_out;
+ }
+};
diff --git a/cpp/ql/src/jsf/4.05 Libraries/AV Rule 24.qhelp b/cpp/ql/src/jsf/4.05 Libraries/AV Rule 24.qhelp
new file mode 100644
index 000000000000..1a6404486ec9
--- /dev/null
+++ b/cpp/ql/src/jsf/4.05 Libraries/AV Rule 24.qhelp
@@ -0,0 +1,35 @@
+
+
+
+
+
+
+This rule finds calls to the standard library functions abort, exit, getenv and system.
+The functions abort and exit should not be called as they immediately terminate the program
+and will bypass all the normal error and exception handling routines in the software. This is especially important in
+software which is run on systems without an interactive OS, as restarting the software may require a complete reboot
+of the system. getenv and system will usually not work at all on systems that do not have a
+command processor.
+
+
+
+
+
+
+Do not use any of the functions mentioned above. Use the error/exception handling mechanism of the software system you are using
+instead of exit or abort, or write your own functions to emulate the functionality provided
+by running OS commands through system and getenv.
+
+
+
+
+
+
+
+
+
+
+AV Rule 24, Joint Strike Fighter Air Vehicle C++ Coding Standards. Lockheed Martin Corporation, 2005.
+
diff --git a/cpp/ql/src/jsf/4.05 Libraries/AV Rule 24.ql b/cpp/ql/src/jsf/4.05 Libraries/AV Rule 24.ql
new file mode 100644
index 000000000000..1cec97180f7e
--- /dev/null
+++ b/cpp/ql/src/jsf/4.05 Libraries/AV Rule 24.ql
@@ -0,0 +1,14 @@
+/**
+ * @name Dangerous system functions
+ * @description The library functions abort, exit, getenv and system from library should not be used.
+ * @kind problem
+ * @id cpp/jsf/av-rule-24
+ * @problem.severity warning
+ * @tags portability
+ */
+import cpp
+
+from Function f
+where f.getName().regexpMatch("abort|exit|getenv|system") and
+ f.getFile().getAbsolutePath().matches("%stdlib.h")
+select f.getACallToThisFunction(), "The library functions abort, exit, getenv and system from library should not be used."
diff --git a/cpp/ql/src/jsf/4.05 Libraries/AV Rule 25.ql b/cpp/ql/src/jsf/4.05 Libraries/AV Rule 25.ql
new file mode 100644
index 000000000000..659afa17cf48
--- /dev/null
+++ b/cpp/ql/src/jsf/4.05 Libraries/AV Rule 25.ql
@@ -0,0 +1,12 @@
+/**
+ * @name AV Rule 25
+ * @description The time handling functions of library shall not be used.
+ * @kind problem
+ * @id cpp/jsf/av-rule-25
+ * @problem.severity error
+ */
+import cpp
+
+from Include incl
+where incl.getIncludedFile().getAbsolutePath().matches("%time.h")
+select incl, "AV Rule 25: The time handling functions of library shall not be used."
diff --git a/cpp/ql/src/jsf/4.06 Pre-Processing Directives/AV Rule 26.ql b/cpp/ql/src/jsf/4.06 Pre-Processing Directives/AV Rule 26.ql
new file mode 100644
index 000000000000..095b7ecb80ab
--- /dev/null
+++ b/cpp/ql/src/jsf/4.06 Pre-Processing Directives/AV Rule 26.ql
@@ -0,0 +1,15 @@
+/**
+ * @name AV Rule 26
+ * @description Only the #ifndef, #define, #endif and #include preprocessor directives shall be used.
+ * @kind problem
+ * @id cpp/jsf/av-rule-26
+ * @problem.severity error
+ */
+import cpp
+
+from PreprocessorDirective directive
+where not directive instanceof PreprocessorIfndef and
+ not directive instanceof PreprocessorEndif and
+ not directive instanceof Macro and
+ not directive instanceof Include
+select directive, "AV Rule 26: only the #ifndef, #endif, #define and #include directives shall be used."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.06 Pre-Processing Directives/AV Rule 27.ql b/cpp/ql/src/jsf/4.06 Pre-Processing Directives/AV Rule 27.ql
new file mode 100644
index 000000000000..43b483caa48b
--- /dev/null
+++ b/cpp/ql/src/jsf/4.06 Pre-Processing Directives/AV Rule 27.ql
@@ -0,0 +1,12 @@
+/**
+ * @name AV Rule 27
+ * @description The #ifndef, #define and #endif directives will be used to prevent multiple inclusions of the same header files. Other techniques to prevent multiple inclusion will not be used.
+ * @kind problem
+ * @id cpp/jsf/av-rule-27
+ * @problem.severity warning
+ */
+import cpp
+import semmle.code.cpp.headers.MultipleInclusion
+
+from BadIncludeGuard bad
+select bad.blame(), "AV Rule 27: techniques other than #ifndef/#define/#endif will not be used to prevent multiple inclusions of header files."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.06 Pre-Processing Directives/AV Rule 28.ql b/cpp/ql/src/jsf/4.06 Pre-Processing Directives/AV Rule 28.ql
new file mode 100644
index 000000000000..8b044fdfc0ed
--- /dev/null
+++ b/cpp/ql/src/jsf/4.06 Pre-Processing Directives/AV Rule 28.ql
@@ -0,0 +1,14 @@
+/**
+ * @name AV Rule 28
+ * @description The #ifndef and #endif directives will only be used as defined in AV Rule 27 to prevent multiple inclusions of the same header file.
+ * @kind problem
+ * @id cpp/jsf/av-rule-28
+ * @problem.severity warning
+ */
+import cpp
+import semmle.code.cpp.headers.MultipleInclusion
+
+from PreprocessorDirective directive
+where (directive instanceof PreprocessorIfndef or directive instanceof PreprocessorEndif) and
+ not exists(CorrectIncludeGuard cig | directive = cig.getIfndef() or directive = cig.getEndif())
+select directive, "AV Rule 28: the #ifndef and #endif directives will only be used as defined in AV Rule 27."
diff --git a/cpp/ql/src/jsf/4.06 Pre-Processing Directives/AV Rule 29.ql b/cpp/ql/src/jsf/4.06 Pre-Processing Directives/AV Rule 29.ql
new file mode 100644
index 000000000000..c6229e118b66
--- /dev/null
+++ b/cpp/ql/src/jsf/4.06 Pre-Processing Directives/AV Rule 29.ql
@@ -0,0 +1,12 @@
+/**
+ * @name AV Rule 29
+ * @description The #define pre-processor directive shall not be used to create inline macros. Inline functions shall be used instead.
+ * @kind problem
+ * @id cpp/jsf/av-rule-29
+ * @problem.severity error
+ */
+import cpp
+
+from Macro m
+where m.getHead().matches("%(%") // Macro functions are simply macros with brackets in the head
+select m, "The #define pre-processor directive shall not be used to create inline macros"
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.06 Pre-Processing Directives/AV Rule 30.ql b/cpp/ql/src/jsf/4.06 Pre-Processing Directives/AV Rule 30.ql
new file mode 100644
index 000000000000..dff8e58367b7
--- /dev/null
+++ b/cpp/ql/src/jsf/4.06 Pre-Processing Directives/AV Rule 30.ql
@@ -0,0 +1,33 @@
+/**
+ * @name AV Rule 30
+ * @description The #define pre-processor directive shall not be used to define constant values. Instead, the const qualifier shall be applied to variable declarations to specify constant values.
+ * @kind problem
+ * @id cpp/jsf/av-rule-30
+ * @problem.severity error
+ */
+import cpp
+
+/** A macro defining a simple constant. */
+class ConstantDefMacro extends Macro {
+ ConstantDefMacro() {
+ // Exclude functions
+ not (this.getHead().matches("%(%")) and
+ exists(string body | body = this.getBody() and
+ // Empty defines are allowed (rule 31 restricts their use though)
+ body != "" and
+ // No special characters in the body
+ not (body.matches("%(%")) and
+ not (body.matches("%{%"))
+ )
+ }
+}
+
+/** List macros that are 'common' and should be excluded */
+predicate commonMacro(string name) {
+ name = "NULL" // TODO
+}
+
+from ConstantDefMacro m
+where not commonMacro(m.getHead())
+ and m.fromSource()
+select m, "The #define pre-processor directive shall not be used to define constant values."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.06 Pre-Processing Directives/AV Rule 31.ql b/cpp/ql/src/jsf/4.06 Pre-Processing Directives/AV Rule 31.ql
new file mode 100644
index 000000000000..74b5eb9697b0
--- /dev/null
+++ b/cpp/ql/src/jsf/4.06 Pre-Processing Directives/AV Rule 31.ql
@@ -0,0 +1,13 @@
+/**
+ * @name AV Rule 31
+ * @description The #define directive will only be used as part of the technique to prevent multiple inclusions of the same header file.
+ * @kind problem
+ * @id cpp/jsf/av-rule-31
+ * @problem.severity warning
+ */
+import cpp
+import semmle.code.cpp.headers.MultipleInclusion
+
+from Macro macro
+where not exists(CorrectIncludeGuard cig | macro = cig.getDefine())
+select macro, "AV Rule 31: The #define directive will only be used as part of the technique to prevent multiple inclusions of the same header file."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.06 Pre-Processing Directives/AV Rule 32.cpp b/cpp/ql/src/jsf/4.06 Pre-Processing Directives/AV Rule 32.cpp
new file mode 100644
index 000000000000..9f5573ab44cf
--- /dev/null
+++ b/cpp/ql/src/jsf/4.06 Pre-Processing Directives/AV Rule 32.cpp
@@ -0,0 +1,4 @@
+#include //correct: iostream.h is a header file
+#include "implementation.c" //wrong: include header files only
+...
+
diff --git a/cpp/ql/src/jsf/4.06 Pre-Processing Directives/AV Rule 32.qhelp b/cpp/ql/src/jsf/4.06 Pre-Processing Directives/AV Rule 32.qhelp
new file mode 100644
index 000000000000..01df6ec28e2e
--- /dev/null
+++ b/cpp/ql/src/jsf/4.06 Pre-Processing Directives/AV Rule 32.qhelp
@@ -0,0 +1,46 @@
+
+
+
+
+
+
+This rule finds #include pre-processor directives that include a non-header (*.h, *.hpp) file. The exception is
+header files that define template classes or functions. These header files can include the implementation files, which are then
+considered to be part of the header file. Including source files can create unnecessarily large object files, and would also expose
+the entirety of the implementation instead of just its interface (especially in C with its limited set of scoping keywords).
+
+
+
+An exception to these rules are files that contain template definitions. These files can include .c and .cpp
+files that contain the implementation of the template. No code is actually generated for templates until they are used, and so their
+definition (not just the declaration) has to be included in any file that uses the template.
+
+
+
+
+
+Only include header files. Refactor the code to put class declarations and function prototypes into header files, and their
+definitions in source files (*.c, *.cpp) files.
+
+
+
+
+
+
+
+
+
+ AV Rule 32, Joint Strike Fighter Air Vehicle C++ Coding Standards. Lockheed Martin Corporation, 2005.
+
+
+ Scott Meyers. Item 38, Effective C++: 50 Specific Ways to Improve Your Programs and Design, 2nd Edition. Addison-Wesley, 1998.
+
+
+ Header files
+
+
+
+
+
diff --git a/cpp/ql/src/jsf/4.06 Pre-Processing Directives/AV Rule 32.ql b/cpp/ql/src/jsf/4.06 Pre-Processing Directives/AV Rule 32.ql
new file mode 100644
index 000000000000..9dd2e5bfc223
--- /dev/null
+++ b/cpp/ql/src/jsf/4.06 Pre-Processing Directives/AV Rule 32.ql
@@ -0,0 +1,23 @@
+/**
+ * @name Include header files only
+ * @description The #include pre-processor directive should only be used to include header files.
+ * @kind problem
+ * @problem.severity recommendation
+ * @precision high
+ * @id cpp/include-non-header
+ * @tags maintainability
+ * modularity
+ */
+import cpp
+import semmle.code.cpp.AutogeneratedFile
+
+from Include i, File f, string extension
+where f = i.getIncludedFile() and extension = f.getExtension().toLowerCase()
+ and extension != "inl"
+ and extension != "tcc"
+ and extension != "tpp"
+ and extension != "txx"
+ and extension != "xpm"
+ and not (f instanceof AutogeneratedFile)
+ and not (f instanceof HeaderFile)
+select i, "The #include pre-processor directive should only be used to include header files."
diff --git a/cpp/ql/src/jsf/4.07 Header Files/AV Rule 33.ql b/cpp/ql/src/jsf/4.07 Header Files/AV Rule 33.ql
new file mode 100644
index 000000000000..bdf802a85f78
--- /dev/null
+++ b/cpp/ql/src/jsf/4.07 Header Files/AV Rule 33.ql
@@ -0,0 +1,12 @@
+/**
+ * @name AV Rule 33
+ * @description The #include directive shall use the notation to include header files.
+ * @kind problem
+ * @id cpp/jsf/av-rule-33
+ * @problem.severity error
+ */
+import cpp
+
+from Include i
+where i.getIncludeText().matches("<%")
+select i, "AV Rule 33: the #include notation shall be used."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.07 Header Files/AV Rule 35.qhelp b/cpp/ql/src/jsf/4.07 Header Files/AV Rule 35.qhelp
new file mode 100644
index 000000000000..23f4e62e8f4c
--- /dev/null
+++ b/cpp/ql/src/jsf/4.07 Header Files/AV Rule 35.qhelp
@@ -0,0 +1,74 @@
+
+
+
+
+Some header files, such as those which define structures or classes, cannot be included more than once within a translation unit, as doing so would
+cause a redefinition error. Such headers must be guarded to prevent ill-effects from multiple inclusion. Simlarly, if header files include other
+header files, and this inclusion graph contains a cycle, then at least one file within the cycle must contain header guards in order to break the
+cycle. Because of cases like these, all headers should be guarded as a matter of good practice, even if they do not strictly need to be.
+
+
+Furthermore, most modern compilers contain optimisations which are triggered by header guards. If the header guard strictly conforms to the pattern
+that compilers expect, then inclusions of that header other than the first have absolutely no effect: the file isn't re-read from disk, nor is it
+re-tokenised or re-preprocessed. This can result in a noticeable, albeit minor, improvement to compilation time.
+
+
+
+
+
+Add one of the following forms of header guard to the file (where HEADER_NAME is a unique identifier derived from the name of the file):
+
+
+ #ifndef HEADER_NAME followed by #define HEADER_NAME at the very start of the header, and a matching #endif at the very end.#if !defined(HEADER_NAME) followed by #define HEADER_NAME at the very start of the header, and a matching #endif at the very end.#pragma once anywhere within the header.
+
+Note that if you are updating code to match the Joint Strike Fighter Air Vehicle coding standard, then the first option is the only appropriate form.
+
+
+
+
+The author of the following header tried to use header guards, but made a typo:
+
+In scenarios like this, MY_HAEDER_H should be replaced by MY_HEADER_H (note the transposed A and E):
+
+
+
+
+The following header would seem to be guarded, but doesn't strictly abide to the rules:
+
+Although the preprocessor directives in the preceding header will prevent errors from repeated inclusion, not all compilers are intelligent enough
+to recognise it as being guarded. Consequently compiler optimization will be limited. To ensure that the guard is recognized by compilers, change the
+header so that the guard is the outermost directive:
+
+
+
+
+The following header evolved over time, with different authors adding function declarations in different places:
+
+Unfortunately, the result is that some declarations are before the initial #ifndef, some are between the #ifndef and the #define, and
+some are after the final #endif. All three of these things must be addressed to turn the file into a correctly guarded header:
+
+
+
+
+
+
+ AV Rules 27 and 35, Joint Strike Fighter Air Vehicle C++ Coding Standards. Lockheed Martin Corporation, 2005.
+
+
+ PRE06-C. Enclose header files in an inclusion guard
+
+
+ Header files
+
+
+ Headers and Includes: Why and How
+
+
+
+
+
diff --git a/cpp/ql/src/jsf/4.07 Header Files/AV Rule 35.ql b/cpp/ql/src/jsf/4.07 Header Files/AV Rule 35.ql
new file mode 100644
index 000000000000..b4eabe1f175f
--- /dev/null
+++ b/cpp/ql/src/jsf/4.07 Header Files/AV Rule 35.ql
@@ -0,0 +1,143 @@
+/**
+ * @name Missing header guard
+ * @description Header files should contain header guards (#defines to prevent
+ * the file from being included twice). This prevents errors and
+ * inefficiencies caused by repeated inclusion.
+ * @kind problem
+ * @problem.severity warning
+ * @precision high
+ * @id cpp/missing-header-guard
+ * @tags efficiency
+ * maintainability
+ * modularity
+ */
+import cpp
+import semmle.code.cpp.headers.MultipleInclusion
+
+string possibleGuard(HeaderFile hf, string body) {
+ exists(Macro m | m.getFile() = hf and m.getBody() = body | result = m.getHead())
+}
+
+/**
+ * Option type for preprocessor directives so we can produce a variable number
+ * of links in the result
+ */
+newtype TMaybePreprocessorDirective =
+ TSomePreprocessorDirective(PreprocessorDirective pd) or
+ TNoPreprocessorDirective()
+
+abstract class MaybePreprocessorDirective extends TMaybePreprocessorDirective {
+ abstract string toString();
+ abstract Location getLocation();
+}
+
+class NoPreprocessorDirective extends TNoPreprocessorDirective, MaybePreprocessorDirective {
+ override string toString() {
+ result = ""
+ }
+
+ override Location getLocation() {
+ result instanceof UnknownDefaultLocation
+ }
+}
+
+class SomePreprocessorDirective extends TSomePreprocessorDirective, MaybePreprocessorDirective {
+ PreprocessorDirective pd;
+
+ SomePreprocessorDirective() {
+ this = TSomePreprocessorDirective(pd)
+ }
+
+ override string toString() {
+ result = pd.toString()
+ }
+
+ override Location getLocation() {
+ result = pd.getLocation()
+ }
+
+ PreprocessorDirective getPreprocessorDirective() {
+ result = pd
+ }
+}
+
+/**
+ * Provides additional detail when there is an incorrect header guard.
+ * The second and third parameters are option typed, and are only present
+ * when there are additional links in the detail string.
+ */
+string extraDetail(HeaderFile hf, SomePreprocessorDirective detail1, SomePreprocessorDirective detail2) {
+ exists(string s, PreprocessorEndif endif, PreprocessorDirective ifndef | startsWithIfndef(hf, ifndef, s) and endif.getIf() = ifndef |
+ detail1.getPreprocessorDirective() = endif and
+ detail2.getPreprocessorDirective() = ifndef and
+ if not endsWithEndif(hf, endif) then
+ result = " ($@ matching $@ occurs before the end of the file)."
+ else if exists(Macro m | m.getFile() = hf and m.getHead() = s) then
+ result = " (#define " + s + " needs to appear immediately after #ifndef " + s + ")."
+ else if strictcount(possibleGuard(hf, _)) = 1 then
+ result = " (" + possibleGuard(hf, _) + " should appear in the #ifndef rather than " + s + ")."
+ else if strictcount(possibleGuard(hf, "")) = 1 then
+ result = " (" + possibleGuard(hf, "") + " should appear in the #ifndef rather than " + s + ")."
+ else
+ result = " (the macro " + s + " is checked for, but is not defined)."
+ )
+}
+
+/**
+ * Header file `hf` uses a macro called `macroName`.
+ */
+predicate usesMacro(HeaderFile hf, string macroName) {
+ exists(MacroAccess ma |
+ ma.getFile() = hf and
+ ma.getMacro().getName() = macroName
+ )
+}
+
+/**
+ * File `f` both defines and un-defines a macro called `macroName`.
+ */
+predicate defUndef(File f, string macroName) {
+ exists(Macro m |
+ m.getFile() = f and
+ m.getName() = macroName
+ ) and exists(PreprocessorUndef ud |
+ ud.getFile() = f and
+ ud.getName() = macroName
+ )
+}
+
+/**
+ * Header file `hf` looks like it contains an x-macro called
+ * `macroName`. That is, a macro that is used to interpret the
+ * data in `hf`, usually defined just before including that file
+ * and undefined immediately afterwards.
+ */
+predicate hasXMacro(HeaderFile hf, string macroName) {
+ usesMacro(hf, macroName) and
+ forex(Include i | i.getIncludedFile() = hf |
+ defUndef(i.getFile(), macroName)
+ )
+}
+
+from HeaderFile hf, string detail, MaybePreprocessorDirective detail1, MaybePreprocessorDirective detail2
+where not hf instanceof IncludeGuardedHeader
+ and (if exists(extraDetail(hf, _, _))
+ then detail = extraDetail(hf, detail1, detail2)
+ else (detail = "." and
+ detail1 instanceof NoPreprocessorDirective and
+ detail2 instanceof NoPreprocessorDirective))
+ // Exclude files which contain no declaration entries or top level
+ // declarations (e.g. just preprocessor directives; or non-top level
+ // code).
+ and (
+ exists(DeclarationEntry de | de.getFile() = hf) or
+ exists(Declaration d | d.getFile() = hf and d.isTopLevel()) or
+ exists(UsingEntry ue | ue.getFile() = hf)
+ )
+ // Exclude files which look like they contain 'x-macros'
+ and not hasXMacro(hf, _)
+ // Exclude files which are always #imported.
+ and not forex(Include i | i.getIncludedFile() = hf | i instanceof Import)
+ // Exclude files which are only included once.
+ and not strictcount(Include i | i.getIncludedFile() = hf) = 1
+select hf, "This header file should contain a header guard to prevent multiple inclusion" + detail, detail1, detail1.toString(), detail2, detail2.toString()
diff --git a/cpp/ql/src/jsf/4.07 Header Files/AV Rule 39.ql b/cpp/ql/src/jsf/4.07 Header Files/AV Rule 39.ql
new file mode 100644
index 000000000000..4a38b3807b61
--- /dev/null
+++ b/cpp/ql/src/jsf/4.07 Header Files/AV Rule 39.ql
@@ -0,0 +1,18 @@
+/**
+ * @name AV Rule 39
+ * @description Header files (*.h) will not contain non-const variable definitions or function definitions.
+ * @kind problem
+ * @id cpp/jsf/av-rule-39
+ * @problem.severity warning
+ */
+import cpp
+
+predicate forbidden(Declaration d) {
+ d instanceof Variable and not d.(Variable).isConst()
+ or (d instanceof Function and not d.hasSpecifier("inline"))
+}
+
+from Declaration d
+where d.getDefinitionLocation().getFile() instanceof HeaderFile
+ and forbidden(d)
+select d.getDefinitionLocation(), "AV Rule 38: header files will not contain non-const variable definitions or function definitions."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.07 Header Files/JSF35-encompassing-bad.cpp b/cpp/ql/src/jsf/4.07 Header Files/JSF35-encompassing-bad.cpp
new file mode 100644
index 000000000000..541b7eb0a9c3
--- /dev/null
+++ b/cpp/ql/src/jsf/4.07 Header Files/JSF35-encompassing-bad.cpp
@@ -0,0 +1,15 @@
+void alpha();
+
+#ifndef MY_FUNCTIONS_H
+
+void beta();
+
+#define MY_FUNCTIONS_H
+
+void gamma();
+void delta();
+void epsilon();
+
+#endif
+
+void omega();
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.07 Header Files/JSF35-encompassing-good.cpp b/cpp/ql/src/jsf/4.07 Header Files/JSF35-encompassing-good.cpp
new file mode 100644
index 000000000000..ecfe71122e88
--- /dev/null
+++ b/cpp/ql/src/jsf/4.07 Header Files/JSF35-encompassing-good.cpp
@@ -0,0 +1,11 @@
+#ifndef MY_FUNCTIONS_H
+#define MY_FUNCTIONS_H
+
+void alpha();
+void beta();
+void gamma();
+void delta();
+void epsilon();
+void omega();
+
+#endif
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.07 Header Files/JSF35-outermost-bad.cpp b/cpp/ql/src/jsf/4.07 Header Files/JSF35-outermost-bad.cpp
new file mode 100644
index 000000000000..ea5eab30994c
--- /dev/null
+++ b/cpp/ql/src/jsf/4.07 Header Files/JSF35-outermost-bad.cpp
@@ -0,0 +1,8 @@
+#ifdef __linux__
+#ifndef MY_LINUX_ONLY_HEADER_H
+#define MY_LINUX_ONLY_HEADER_H
+
+/* ... contents of my_linux_only_header.h ... */
+
+#endif // MY_LINUX_ONLY_HEADER_H
+#endif // __linux__
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.07 Header Files/JSF35-outermost-good.cpp b/cpp/ql/src/jsf/4.07 Header Files/JSF35-outermost-good.cpp
new file mode 100644
index 000000000000..d592bbffa63d
--- /dev/null
+++ b/cpp/ql/src/jsf/4.07 Header Files/JSF35-outermost-good.cpp
@@ -0,0 +1,8 @@
+#ifndef MY_LINUX_ONLY_HEADER_H
+#define MY_LINUX_ONLY_HEADER_H
+#ifdef __linux__
+
+/* ... contents of my_linux_only_header.h ... */
+
+#endif // __linux__
+#endif // MY_LINUX_ONLY_HEADER_H
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.07 Header Files/JSF35-typo-bad.cpp b/cpp/ql/src/jsf/4.07 Header Files/JSF35-typo-bad.cpp
new file mode 100644
index 000000000000..cb56ee195ca2
--- /dev/null
+++ b/cpp/ql/src/jsf/4.07 Header Files/JSF35-typo-bad.cpp
@@ -0,0 +1,6 @@
+#ifndef MY_HAEDER_H
+#define MY_HEADER_H
+
+/* ... contents of my_header.h ... */
+
+#endif
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.07 Header Files/JSF35-typo-good.cpp b/cpp/ql/src/jsf/4.07 Header Files/JSF35-typo-good.cpp
new file mode 100644
index 000000000000..7bb2b4bf590f
--- /dev/null
+++ b/cpp/ql/src/jsf/4.07 Header Files/JSF35-typo-good.cpp
@@ -0,0 +1,6 @@
+#ifndef MY_HEADER_H
+#define MY_HEADER_H
+
+/* ... contents of my_header.h ... */
+
+#endif
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.08 Implementation Files/AV Rule 40.ql b/cpp/ql/src/jsf/4.08 Implementation Files/AV Rule 40.ql
new file mode 100644
index 000000000000..fbc245545477
--- /dev/null
+++ b/cpp/ql/src/jsf/4.08 Implementation Files/AV Rule 40.ql
@@ -0,0 +1,47 @@
+/**
+ * @name AV Rule 40
+ * @description Every implementation file shall include the header files that uniquely define the inline functions, types, and templates used.
+ * @kind problem
+ * @id cpp/jsf/av-rule-40
+ * @problem.severity error
+ */
+import cpp
+
+/*
+ * The rule appears a bit under-specified, but looking at the rationale and examples
+ * it is quite straightforward: the rule is intended to require the one-definition rule.
+ * We check for types, inline functions and templates:
+ * - The definition is in a header file (not an implementation file)
+ * - There is only one definition
+ *
+ * Note: non-defining declarations are allowed to be repeated.
+ *
+ * LIMITATION: currently templates are not checked (extractor limitation)
+ */
+
+predicate relevant(Declaration d) {
+ d instanceof UserType or
+ d.(Function).hasSpecifier("inline")
+}
+
+predicate hasTwoDefinitions(Declaration d) {
+ exists(Location l1, Location l2 |
+ l1 = d.getDefinitionLocation() and
+ l2 = d.getDefinitionLocation() and
+ l1 != l2
+ )
+}
+
+predicate definedInImplementationFile(Declaration d) {
+ d.getDefinitionLocation().getFile() instanceof CppFile or
+ d.getDefinitionLocation().getFile() instanceof CFile
+}
+
+from Declaration d, string message
+where relevant(d) and
+ ((hasTwoDefinitions(d) and message = " should not have several definitions.")
+ or definedInImplementationFile(d) and message = " should be defined in a header file.")
+ // Don't count member functions - the only way they can match this rule is by
+ // being in a class definition that already matches, so it would be redundant
+ and not d instanceof MemberFunction
+select d.getDefinitionLocation(), "AV Rule 40: " + d.getName() + message
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.09 Style/AV Rule 41.ql b/cpp/ql/src/jsf/4.09 Style/AV Rule 41.ql
new file mode 100644
index 000000000000..e3f6ce995c1e
--- /dev/null
+++ b/cpp/ql/src/jsf/4.09 Style/AV Rule 41.ql
@@ -0,0 +1,14 @@
+/**
+ * @name AV Rule 41
+ * @description Source lines will be kept to a length of 120 characters or less.
+ * @kind problem
+ * @id cpp/jsf/av-rule-41
+ * @problem.severity warning
+ */
+
+import cpp
+import external.ExternalArtifact
+
+from DefectExternalData d
+where d.getQueryPath() = "jsf/4.09 Style/AV Rule 41.ql"
+select d, d.getMessage()
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.09 Style/AV Rule 42.ql b/cpp/ql/src/jsf/4.09 Style/AV Rule 42.ql
new file mode 100644
index 000000000000..170ed0a44588
--- /dev/null
+++ b/cpp/ql/src/jsf/4.09 Style/AV Rule 42.ql
@@ -0,0 +1,28 @@
+/**
+ * @name AV Rule 42
+ * @description Each expression-statement will be on a separate line.
+ * @kind problem
+ * @id cpp/jsf/av-rule-42
+ * @problem.severity warning
+ */
+import cpp
+
+predicate exprInStmtContext(Expr e, Location l, File f) {
+ e.getParent() instanceof ExprStmt
+ and l = e.getLocation()
+ and f = l.getFile()
+}
+
+predicate overlappingExprs(Expr e1, Expr e2) {
+ exists(Location l1, File f, Location l2 |
+ exprInStmtContext(e1, l1, f) and
+ exprInStmtContext(e2, l2, f) and
+ e1 != e2 and
+ (l1.getEndLine() >= l2.getStartLine()) and
+ (l1.getStartLine() <= l2.getEndLine())
+ )
+}
+
+from Expr e
+where overlappingExprs(e, _) and not e.isInMacroExpansion()
+select e, "AV Rule 42: Each expression-statement will be on a separate line."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.09 Style/AV Rule 43.ql b/cpp/ql/src/jsf/4.09 Style/AV Rule 43.ql
new file mode 100644
index 000000000000..c2094226871f
--- /dev/null
+++ b/cpp/ql/src/jsf/4.09 Style/AV Rule 43.ql
@@ -0,0 +1,14 @@
+/**
+ * @name AV Rule 43
+ * @description Tabs should be avoided.
+ * @kind problem
+ * @id cpp/jsf/av-rule-43
+ * @problem.severity recommendation
+ */
+
+import cpp
+import external.ExternalArtifact
+
+from DefectExternalData d
+where d.getQueryPath() = "jsf/4.09 Style/AV Rule 43.ql"
+select d, d.getMessage()
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.09 Style/AV Rule 44.ql b/cpp/ql/src/jsf/4.09 Style/AV Rule 44.ql
new file mode 100644
index 000000000000..7b842e4edd72
--- /dev/null
+++ b/cpp/ql/src/jsf/4.09 Style/AV Rule 44.ql
@@ -0,0 +1,14 @@
+/**
+ * @name AV Rule 44
+ * @description All indentations will be at least two spaces and be consistent within the same source file.
+ * @kind problem
+ * @id cpp/jsf/av-rule-44
+ * @problem.severity warning
+ */
+
+import cpp
+import external.ExternalArtifact
+
+from DefectExternalData d
+where d.getQueryPath() = "jsf/4.09 Style/AV Rule 44.ql"
+select d, d.getMessage()
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.09 Style/AV Rule 45.ql b/cpp/ql/src/jsf/4.09 Style/AV Rule 45.ql
new file mode 100644
index 000000000000..79bdad085b8f
--- /dev/null
+++ b/cpp/ql/src/jsf/4.09 Style/AV Rule 45.ql
@@ -0,0 +1,20 @@
+/**
+ * @name AV Rule 45
+ * @description All words in an identifier will be separated by the underscore character.
+ * @kind problem
+ * @id cpp/jsf/av-rule-45
+ * @problem.severity warning
+ */
+import cpp
+
+// INTERPRETATION: just check for the absence of camel-case, ie
+// forbid 'aB' in identifier names
+
+from Declaration d, string name, string lowerCase, string upperCase, int pos
+where name = d.getName() and
+ d.fromSource() and
+ lowerCase = name.charAt(pos) and
+ upperCase = name.charAt(pos+1) and
+ lowerCase.regexpMatch("[a-z]") and
+ upperCase.regexpMatch("[A-Z]")
+select d, "AV Rule 45: All words in an identifier will be separated by the underscore character. Camel-case is not allowed."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.09 Style/AV Rule 46.ql b/cpp/ql/src/jsf/4.09 Style/AV Rule 46.ql
new file mode 100644
index 000000000000..4511cbfe1f04
--- /dev/null
+++ b/cpp/ql/src/jsf/4.09 Style/AV Rule 46.ql
@@ -0,0 +1,39 @@
+/**
+ * @name AV Rule 46
+ * @description User-specified identifiers (internal and external) will not rely on significance of more than 64 characters.
+ * @kind problem
+ * @id cpp/jsf/av-rule-46
+ * @problem.severity warning
+ */
+import cpp
+
+// This is a bit off, because the two nameables could be in different scopes
+// or in different name ranges entirely. However it is infrequent enough to
+// require > 64 chars significance, and it would be bad practice in any case
+
+predicate longNameSignificance(Element e, string significance) {
+ exists(string name |
+ elementName(e, name) and
+ name.length() > 64 and
+ significance = name.substring(0, 64)
+ )
+}
+
+predicate elementName(Element e, string name) {
+ name = e.(Declaration).getName() or name = e.(Namespace).getName()
+ }
+
+predicate clash(Element e1, Element e2) {
+ exists(string significance, string n1, string n2 |
+ longNameSignificance(e1, significance) and
+ longNameSignificance(e2, significance) and
+ elementName(e1, n1) and
+ elementName(e2, n2) and
+ n1 != n2
+ )
+}
+
+from Element e1, Element e2, string name
+where clash(e1, e2)
+ and elementName(e2, name)
+select e1, "AV Rule 46: relies on more than 64 characters to separate from " + name
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.09 Style/AV Rule 47.ql b/cpp/ql/src/jsf/4.09 Style/AV Rule 47.ql
new file mode 100644
index 000000000000..49255f8347f8
--- /dev/null
+++ b/cpp/ql/src/jsf/4.09 Style/AV Rule 47.ql
@@ -0,0 +1,13 @@
+/**
+ * @name AV Rule 47
+ * @description Identifiers will not begin with the underscore character.
+ * @kind problem
+ * @id cpp/jsf/av-rule-47
+ * @problem.severity warning
+ */
+import cpp
+
+from Declaration d
+where d.fromSource() and
+ d.getName().matches("\\_%")
+select d, "Identifiers will not begin with the underscore character."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.09 Style/AV Rule 48.ql b/cpp/ql/src/jsf/4.09 Style/AV Rule 48.ql
new file mode 100644
index 000000000000..890245aafcda
--- /dev/null
+++ b/cpp/ql/src/jsf/4.09 Style/AV Rule 48.ql
@@ -0,0 +1,86 @@
+/**
+ * @name AV Rule 48
+ * @description Indentifiers will not differ by: (a) only case, (b) only underscores, (c) O vs 0 and D, (d) I vs 1 and l, (e) S vs 5, (f) Z vs 2, (g) n vs h
+ * @kind problem
+ * @id cpp/jsf/av-rule-48
+ * @problem.severity warning
+ */
+import cpp
+
+// The rule applies in an almost completely global way since that is the way it appears to be phrased, and
+// it may be sufficiently rare to be okay that way. We make a small exception: two locals in separate scopes
+// cannot trigger the rule
+
+// Note: rule (a) interferes with the others, since H=h by (a) and h=n by (g) but surely H != n
+// For implementation it's important that this can be viewed as canonicalisation of names to avoid a quadratic
+// test but that would imply transitivity
+// To resolve this we interpret the rule as: it is a violation if
+// - a combination of (a)-(b) makes the names identical OR
+// - a combination of (b)-(g) makes the names identical
+
+// Implement rules (a) and (b)
+predicate canonicalName1(Declaration d, string canonical) {
+ canonical = d.getName().replaceAll("_", "").toLowerCase()
+}
+
+predicate canonicalName2(Declaration d, string canonical) {
+ canonical = d.getName()
+ .replaceAll("_", "")
+ .replaceAll("0", "O")
+ .replaceAll("D", "O")
+ .replaceAll("1", "I")
+ .replaceAll("l", "I")
+ .replaceAll("S", "5")
+ .replaceAll("Z", "2")
+ .replaceAll("n", "h")
+}
+
+predicate same(Declaration d1, Declaration d2) {
+ exists (string common | canonicalName1(d1, common) and canonicalName1(d2, common))
+ or
+ exists (string common | canonicalName2(d1, common) and canonicalName2(d2, common))
+}
+
+/** Is the declaration local to that function? */
+predicate local(Declaration d, Function f) {
+ d.(Parameter).getFunction() = f
+ or exists(DeclStmt ds | d = ds.getADeclaration().(LocalVariable) and ds.getEnclosingFunction() = f)
+}
+
+/** Is the declaration local to that struct? Reduce false warning by taking into
+ * account struct lookup rules - since a struct members can never be referred to
+ * other than in a qualified way it doesn't really count.*/
+predicate structLocal(Declaration d, Struct s) {
+ d = s.getAMemberVariable()
+}
+
+predicate compatibleScopes(Declaration d1, Declaration d2) {
+ // Either they're both local to the same struct, or
+ exists (Struct s | structLocal(d1,s) and structLocal(d2,s))
+ or
+ (
+ // Neither of them is a struct member and ...
+ not(structLocal(d1,_)) and not(structLocal(d2,_)) and
+ same(d1, d2) and
+ (
+ // d2 is global and d1 is either, or
+ not local(d2, _) or
+ // both are local to the same function
+ exists (Function f | local(d1,f) and local(d2,f))
+ )
+ )
+}
+
+from Declaration d1, Declaration d2
+where d1.fromSource() and d2.fromSource() and
+ // Test that the names are confusing according to the above criteria
+ same(d1, d2) and
+ d1.getName() != d2.getName() and
+ (
+ // either they are both type names, or
+ (d1 instanceof UserType and d2 instanceof UserType)
+ or
+ // they are both variable names in close enough scopes for the confusion to matter
+ (d1 instanceof Variable and d2 instanceof Variable and compatibleScopes(d1, d2))
+ )
+select d1, "AV Rule 48: this identifier is too close to another identifier (" + d2.getName() + ")"
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.09 Style/AV Rule 49.ql b/cpp/ql/src/jsf/4.09 Style/AV Rule 49.ql
new file mode 100644
index 000000000000..68301d12c279
--- /dev/null
+++ b/cpp/ql/src/jsf/4.09 Style/AV Rule 49.ql
@@ -0,0 +1,21 @@
+/**
+ * @name AV Rule 49
+ * @description All acronyms in an identifier will be composed of uppercase letters.
+ * @kind problem
+ * @id cpp/jsf/av-rule-49
+ * @problem.severity warning
+ */
+import cpp
+import Naming
+
+// //
+// // CUSTOMIZATION: see Naming to add custom acronyms
+// //
+
+from Declaration d, Name n, Word w
+where d.fromSource() and
+ n = d.getName() and
+ w = n.getAWord() and
+ w.isDefiniteAcronym() and
+ not w.isUppercase()
+select d, "AV Rule 49: acronyms in identifiers will be uppercase. Incorrect case for acronym " + w.toString() + "."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.09 Style/AV Rule 50.ql b/cpp/ql/src/jsf/4.09 Style/AV Rule 50.ql
new file mode 100644
index 000000000000..5ead6fe0236d
--- /dev/null
+++ b/cpp/ql/src/jsf/4.09 Style/AV Rule 50.ql
@@ -0,0 +1,27 @@
+/**
+ * @name AV Rule 50
+ * @description The first word of the name of a class, structure, namespace, enumeration, or type created with typedef will begin with an uppercase letter. All other letters will be lowercase.
+ * @kind problem
+ * @id cpp/jsf/av-rule-50
+ * @problem.severity warning
+ */
+import cpp
+import Naming
+
+predicate relevant(Element elem, Element blame, string kind, string name) {
+ exists(Class c | elem = c and blame = c and kind = "class or struct" and name = c.getName()) or // includes struct
+ exists(Namespace n | elem = n and blame = n.getADeclarationEntry() and kind = "namespace" and name = n.getName()) or
+ exists(Enum e | elem = e and blame = e and kind = "enumeration" and name = e.getName()) or
+ exists(TypedefType t | elem = t and blame = t and kind = "typedef" and name = t.getName())
+}
+
+from Element d, Element blame, Word w, int pos, string kind, string name
+where relevant(d, blame, kind, name) and
+ w = name.(Name).getWord(pos) and
+ not (w.couldBeUppercaseAcronym() and w != name) and
+ (
+ (pos = 0 and not w.isCapitalized())
+ or
+ (pos > 0 and not w.isLowercase())
+ )
+select blame, "AV Rule 50: The first word of a " + kind + " will begin with an uppercase letter, and all other letters will be lowercase."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.09 Style/AV Rule 51.ql b/cpp/ql/src/jsf/4.09 Style/AV Rule 51.ql
new file mode 100644
index 000000000000..346e9c3ee4c2
--- /dev/null
+++ b/cpp/ql/src/jsf/4.09 Style/AV Rule 51.ql
@@ -0,0 +1,21 @@
+/**
+ * @name AV Rule 51
+ * @description All letters contained in function and variable names will be lowercase.
+ * @kind problem
+ * @id cpp/jsf/av-rule-51
+ * @problem.severity warning
+ */
+import cpp
+import Naming
+
+predicate relevant(Declaration d, string kind) {
+ (d instanceof Function and kind = "function") or
+ (d instanceof Variable and kind = "variable")
+}
+
+from Declaration d, Word w, string kind
+where relevant(d, kind) and
+ w = d.getName().(Name).getAWord() and
+ not (w.couldBeUppercaseAcronym() and w != d.getName()) and
+ not w.isLowercase()
+select d, "AV Rule 51: All letters contained in " + kind + " names will be lowercase."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.09 Style/AV Rule 52.ql b/cpp/ql/src/jsf/4.09 Style/AV Rule 52.ql
new file mode 100644
index 000000000000..93218392e92a
--- /dev/null
+++ b/cpp/ql/src/jsf/4.09 Style/AV Rule 52.ql
@@ -0,0 +1,21 @@
+/**
+ * @name AV Rule 52
+ * @description Identifiers for constant and enumerator values shall be lowercase.
+ * @kind problem
+ * @id cpp/jsf/av-rule-52
+ * @problem.severity error
+ */
+import cpp
+import Naming
+
+predicate relevant(Declaration d, string kind) {
+ (d instanceof EnumConstant and kind = "enumerator") or
+ (d.(Variable).isConst() and kind = "constant")
+}
+
+from Declaration d, Word w, string kind
+where relevant(d, kind) and
+ w = d.getName().(Name).getAWord() and
+ not (w.couldBeUppercaseAcronym() and w != d.getName()) and
+ not w.isLowercase()
+select d, "AV Rule 52: identifiers for " + kind + " values shall be lowercase."
diff --git a/cpp/ql/src/jsf/4.09 Style/AV Rule 53.1.ql b/cpp/ql/src/jsf/4.09 Style/AV Rule 53.1.ql
new file mode 100644
index 000000000000..77953c40c6d8
--- /dev/null
+++ b/cpp/ql/src/jsf/4.09 Style/AV Rule 53.1.ql
@@ -0,0 +1,18 @@
+/**
+ * @name AV Rule 53.1
+ * @description The following character sequences shall not appear in header file names: ', \, /*, //, or ".
+ * @kind problem
+ * @id cpp/jsf/av-rule-53-1
+ * @problem.severity error
+ */
+import cpp
+
+from Include i, string name
+where name = i.getIncludeText()
+ and (name.matches("%'%") or
+ name.matches("%\\\\%") or
+ name.matches("%/*%") or
+ name.matches("%//%") or
+ name.matches("%\"%\"%\"%") or
+ name.matches("%<%\"%>%"))
+select i, "AV Rule 53.1: Invalid character sequence in header file name '" + name + "'"
diff --git a/cpp/ql/src/jsf/4.09 Style/AV Rule 53.ql b/cpp/ql/src/jsf/4.09 Style/AV Rule 53.ql
new file mode 100644
index 000000000000..862d9028de3b
--- /dev/null
+++ b/cpp/ql/src/jsf/4.09 Style/AV Rule 53.ql
@@ -0,0 +1,15 @@
+/**
+ * @name AV Rule 53
+ * @description Header files will always have a file name extension of .h.
+ * @kind problem
+ * @id cpp/jsf/av-rule-53
+ * @problem.severity warning
+ */
+import cpp
+
+// Interpretation: use .h, never .H, .hpp or other variants. What else could be meant by 'header file'?
+
+from File f
+where (f.getExtension().toLowerCase() = "h" or f.getExtension().toLowerCase() = "hpp")
+ and f.getExtension() != "h"
+select f, "AV Rule 53: Header files will always have a file name extension of .h."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.09 Style/AV Rule 54.ql b/cpp/ql/src/jsf/4.09 Style/AV Rule 54.ql
new file mode 100644
index 000000000000..cb40d30d51db
--- /dev/null
+++ b/cpp/ql/src/jsf/4.09 Style/AV Rule 54.ql
@@ -0,0 +1,12 @@
+/**
+ * @name AV Rule 54
+ * @description Implementation files will always have a file name extension of .cpp.
+ * @kind problem
+ * @id cpp/jsf/av-rule-54
+ * @problem.severity warning
+ */
+import cpp
+
+from CppFile f
+where f.getExtension() != "cpp"
+select f, "AV Rule 53: Implementation files will always have a file name extension of .cpp."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.09 Style/AV Rule 57.ql b/cpp/ql/src/jsf/4.09 Style/AV Rule 57.ql
new file mode 100644
index 000000000000..2c205cc009f0
--- /dev/null
+++ b/cpp/ql/src/jsf/4.09 Style/AV Rule 57.ql
@@ -0,0 +1,17 @@
+/**
+ * @name AV Rule 57
+ * @description The public, protected, and private sections of a class will be declared in that order.
+ * @kind problem
+ * @id cpp/jsf/av-rule-57
+ * @problem.severity warning
+ */
+import cpp
+
+from Class c, Declaration m1, Declaration m2, int pos1, int pos2
+where m1 = c.getCanonicalMember(pos1) and
+ m2 = c.getCanonicalMember(pos2) and
+ pos1 < pos2 and
+ ( (m1.hasSpecifier("private") and m2.hasSpecifier("protected"))
+ or (m1.hasSpecifier("private") and m2.hasSpecifier("public"))
+ or (m1.hasSpecifier("protected") and m2.hasSpecifier("public")))
+select c, "AV Rule 57: The public, protected, and private sections of a class will be declared in that order."
diff --git a/cpp/ql/src/jsf/4.09 Style/AV Rule 58.ql b/cpp/ql/src/jsf/4.09 Style/AV Rule 58.ql
new file mode 100644
index 000000000000..08a6e2c81b3b
--- /dev/null
+++ b/cpp/ql/src/jsf/4.09 Style/AV Rule 58.ql
@@ -0,0 +1,31 @@
+/**
+ * @name AV Rule 58
+ * @description When declaring and defining functions with more than two parameters, the leading parenthesis and the first argument will be written on the same line as the function name. Each additional argument will be written on a separate line (with the closing parenthesis directly after the last argument).
+ * @kind problem
+ * @id cpp/jsf/av-rule-58
+ * @problem.severity warning
+ */
+import cpp
+
+class ParamLoc extends Parameter {
+ int getValidLine() { result = this.getLocation().getStartLine() and result = this.getLocation().getEndLine() }
+}
+
+predicate valid(Function f) {
+ // Check that the first parameter is okay
+ f.getParameter(0).(ParamLoc).getValidLine() = f.getLocation().getStartLine() and
+ // Check that each subsequent parameter is on its own line
+ not exists(ParamLoc p1, ParamLoc p2 |
+ p1 = f.getAParameter() and p2 = f.getAParameter() and
+ p1 != p2 and
+ p1.getValidLine() = p2.getValidLine()
+ ) and
+ // Check that there are no parameters on two lines
+ forall (ParamLoc p | p = f.getAParameter() | exists(p.getValidLine()))
+}
+
+from Function f
+where f.getNumberOfParameters() > 2
+ and f.hasDefinition()
+ and not valid(f)
+select f, "AV Rule 58: functions with more than two parameters will conform to style rules for declaring parameters"
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.09 Style/AV Rule 59.ql b/cpp/ql/src/jsf/4.09 Style/AV Rule 59.ql
new file mode 100644
index 000000000000..ca598d20b2e4
--- /dev/null
+++ b/cpp/ql/src/jsf/4.09 Style/AV Rule 59.ql
@@ -0,0 +1,19 @@
+/**
+ * @name AV Rule 59
+ * @description The statements forming the body of an if, else if, else, while, do-while or for statement shall always be enclosed in braces, even if the braces form an empty block.
+ * @kind problem
+ * @id cpp/jsf/av-rule-59
+ * @problem.severity error
+ */
+import cpp
+
+from Stmt parent, Stmt child
+where not child instanceof Block
+ and
+ (child = parent.(IfStmt).getThen() or
+ child = parent.(WhileStmt).getStmt() or
+ child = parent.(DoStmt).getStmt() or
+ child = parent.(ForStmt).getStmt() or
+ (child = parent.(IfStmt).getElse() and not child instanceof IfStmt)
+ )
+select child.findRootCause(), "The statements forming the body of an if, else if, else, while, do...while or for statement shall always be enclosed in braces, even if the braces form an empty block."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.09 Style/AV Rule 60.ql b/cpp/ql/src/jsf/4.09 Style/AV Rule 60.ql
new file mode 100644
index 000000000000..206eb7c5d99e
--- /dev/null
+++ b/cpp/ql/src/jsf/4.09 Style/AV Rule 60.ql
@@ -0,0 +1,14 @@
+/**
+ * @name AV Rule 60
+ * @description Braces which enclose a block will be placed in the same column, on separate lines directly before and after the block.
+ * @kind problem
+ * @id cpp/jsf/av-rule-60
+ * @problem.severity warning
+ */
+
+import cpp
+import external.ExternalArtifact
+
+from DefectExternalData d
+where d.getQueryPath() = "jsf/4.09 Style/AV Rule 60.ql"
+select d, d.getMessage()
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.09 Style/AV Rule 61.ql b/cpp/ql/src/jsf/4.09 Style/AV Rule 61.ql
new file mode 100644
index 000000000000..e31e844a3a53
--- /dev/null
+++ b/cpp/ql/src/jsf/4.09 Style/AV Rule 61.ql
@@ -0,0 +1,14 @@
+/**
+ * @name AV Rule 61
+ * @description Braces which enclose a block will have nothing else on the line except comments (if necessary).
+ * @kind problem
+ * @id cpp/jsf/av-rule-61
+ * @problem.severity warning
+ */
+
+import cpp
+import external.ExternalArtifact
+
+from DefectExternalData d
+where d.getQueryPath() = "jsf/4.09 Style/AV Rule 61.ql"
+select d, d.getMessage()
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.09 Style/AV Rule 63.ql b/cpp/ql/src/jsf/4.09 Style/AV Rule 63.ql
new file mode 100644
index 000000000000..2f65ce9ec834
--- /dev/null
+++ b/cpp/ql/src/jsf/4.09 Style/AV Rule 63.ql
@@ -0,0 +1,87 @@
+/**
+ * @name AV Rule 63
+ * @description Spaces will not be used around '.' or '->', nor between unary operators and operands.
+ * @kind problem
+ * @id cpp/jsf/av-rule-63
+ * @problem.severity error
+ */
+import cpp
+
+predicate hasLocation(Expr e) {
+ e.getLocation().getStartLine() != 0
+}
+
+predicate outermostConvWithLocation(Expr e, Expr res) {
+ if(exists(Expr p | e.getConversion+() = p and hasLocation(p))) then
+ outermostConvWithLocation(e.getConversion(), res)
+ else
+ res = e
+}
+
+predicate diffEndBegin(Expr lhs, Expr rhs, int length) {
+ exists(Location l, Location r |
+ l = lhs.getLocation() and r = rhs.getLocation()
+ and length = r.getStartColumn() - l.getEndColumn()
+ and l.getEndLine() = r.getStartLine()
+ )
+}
+predicate diffEndEnd(Expr lhs, Expr rhs, int length) {
+ exists(Location l, Location r |
+ l = lhs.getLocation() and r = rhs.getLocation()
+ and length = r.getEndColumn() - l.getEndColumn()
+ and l.getEndLine() = r.getEndLine()
+ )
+}
+predicate diffBeginBegin(Expr lhs, Expr rhs, int length) {
+ exists(Location l, Location r |
+ l = lhs.getLocation() and r = rhs.getLocation()
+ and length = r.getStartColumn() - l.getStartColumn()
+ and l.getStartLine() = r.getStartLine()
+ )
+}
+
+
+/*
+ * Unary postfix operations: PostfixDecrExpr, PostfixIncrExpr
+ * Unary prefix operations: PrefixIncrExpr, PrefixDecrExpr, ComplementExpr, NotExpr,
+ UnaryMinusExpr, UnaryPlusExpr, AddressOfExpr, PointerDereferenceExpr
+ */
+
+from Expr err
+where
+ not err.isInMacroExpansion() and hasLocation(err)
+ and
+ (
+ exists(Call c, Expr e | c = err and outermostConvWithLocation(c.getQualifier(), e)
+ and e.getType() instanceof PointerType and not diffEndBegin(e, c, 3))
+ or
+ exists(Call c, Expr e | c = err and outermostConvWithLocation(c.getQualifier(), e)
+ and not e.getType() instanceof PointerType and not diffEndBegin(e, c, 2))
+ or
+ exists(VariableAccess c, Expr e | c = err and outermostConvWithLocation(c.getQualifier(), e)
+ and e.getType() instanceof PointerType and not diffEndBegin(e, c, 3))
+ or
+ exists(VariableAccess c, Expr e | c = err and outermostConvWithLocation(c.getQualifier(), e)
+ and not e.getType() instanceof PointerType and not diffEndBegin(e, c, 2))
+ or
+ exists(UnaryOperation c, Expr e | c = err and outermostConvWithLocation(c.getOperand(), e)
+ and (c instanceof ComplementExpr or c instanceof NotExpr or c instanceof UnaryMinusExpr
+ or c instanceof UnaryPlusExpr or c instanceof AddressOfExpr)
+ and not diffBeginBegin(c, e, 1))
+ or
+ exists(PrefixIncrExpr c, Expr e | c = err and outermostConvWithLocation(c.getOperand(), e)
+ and not diffBeginBegin(c, e, 2))
+ or
+ exists(PrefixDecrExpr c, Expr e | c = err and outermostConvWithLocation(c.getOperand(), e)
+ and not diffBeginBegin(c, e, 2))
+ or
+ exists(PointerDereferenceExpr c, Expr e | c = err and outermostConvWithLocation(c.getChild(0), e)
+ and not diffBeginBegin(c, e, 1))
+ or
+ exists(PostfixIncrExpr c, Expr e | c = err and outermostConvWithLocation(c.getOperand(), e)
+ and not diffEndEnd(e, c, 2))
+ or
+ exists(PostfixDecrExpr c, Expr e | c = err and outermostConvWithLocation(c.getOperand(), e)
+ and not diffEndEnd(e, c, 2))
+ )
+ select err, "AV Rule 63: Spaces will not be used around '.' or '->', nor between unary operators and operands."
diff --git a/cpp/ql/src/jsf/4.09 Style/Naming.qll b/cpp/ql/src/jsf/4.09 Style/Naming.qll
new file mode 100644
index 000000000000..4fa283259695
--- /dev/null
+++ b/cpp/ql/src/jsf/4.09 Style/Naming.qll
@@ -0,0 +1,113 @@
+/*
+ Common functions for implementing naming conventions
+
+ Naming rules are the following:
+
+ [45] All words in an ident will be separated by '_'
+ [46] Idents will not rely on significance of more than 64 characters
+ [47] Idents will not begin with '_'
+ [48] Idents will not differ in certain confusing ways (listed)
+ [49] All acronyms in an ident will be uppercase
+ [50] Classes, namespaces, enums, structs, typedefs:
+ begin first word with uppercase, all other lowercase
+ [51] Functions and variables:
+ lowercase
+ [52] Constants and enum values:
+ lowercase
+
+The tricky rules are: 45, 49, 50, 51, 52. There are two reasons:
+
+ - Reference to 'words'. We ignore this (beyond the scope). For 45,
+ detect camel-case and any other bad conventions. For 50 this just
+ means the first letter should be uppercase.
+ - Acronyms. [49] has a comment that it applies to *all* identifiers,
+ even if some other rule specified that they should be lowercase or
+ differently capitalized.
+
+The strategy is as follows:
+ - apart from 45, 'words' are just _-separated parts of the identifier
+ - apart from 49, always allow a 'word' to be entirely in uppercase (URL),
+ but make sure that the whole identifier is not in uppercase.
+ - 49: check common acronyms and allow extensibility to check that they are
+ uppercase.
+*/
+
+import cpp
+
+/** The name of an identifier, for the purpose of JSF naming conventions */
+class Name extends string {
+
+ Name() {
+ exists(Declaration d | this = d.getName() )
+ or exists(Namespace n | this = n.getName() )
+ }
+
+ /**
+ * Gets a word in this identifier. Words are just portions separated by underscores.
+ */
+ Word getAWord() { exists(int index | result = this.splitAt("_", index)) }
+
+ /**
+ * Gets the `index`th word (starting at zero) in an identifier. Words are
+ * just portions separated by underscores.
+ */
+ Word getWord(int index) { result = this.splitAt("_", index) }
+
+}
+
+/** A (nonempty) word in an identifier, for JSF naming conventions */
+class Word extends string {
+
+ Word() { exists(Name n | this = n.splitAt("_") and this != "") }
+
+ /**
+ * Gets the 0-based position of this word in the identifier.
+ */
+ int getIndex() { exists (Name n | this = n.getWord(result)) }
+
+ /**
+ * Holds if this word is capitalized (for example 'Word', not 'word'
+ * or 'WORD').
+ */
+ predicate isCapitalized() {
+ this.prefix(1).isUppercase() and
+ this.suffix(1).isLowercase()
+ }
+
+ /**
+ * Holds if this word looks like an acronym, and is written entirely
+ * in uppercase. This is a permissive heuristic; anything that could
+ * just possibly be an acronym is included.
+ *
+ * It is there for the purpose of excluding acronyms from other rules.
+ */
+ predicate couldBeUppercaseAcronym() {
+ // 1-letter acronyms do not make sense
+ this.length() > 1 and
+ // few acronyms are more than 5 characters long...
+ this.length() <= 5 and
+ // Must be uppercase
+ this.isUppercase()
+ }
+
+ /**
+ * Holds if this word is definitely an acronym. This is the dual of
+ * `couldBeUppercaseAcronym` - it underestimates rather than overestimates.
+ */
+ predicate isDefiniteAcronym() {
+ // Don't look at case
+ exists(string s | s = this.toLowerCase() |
+ // A few standard acronyms
+ s = "url"
+ or s = "http"
+ or s = "html"
+
+ // //
+ // // CUSTOMIZATION:
+ // // ANY ACRONYMS TO ENFORCE IN A PROJECT CAN BE ADDED HERE
+ // //
+ // eg. 'or s = "myacronym"'
+ )
+ }
+
+}
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 68.ql b/cpp/ql/src/jsf/4.10 Classes/AV Rule 68.ql
new file mode 100644
index 000000000000..1ef9a49bb23a
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 68.ql
@@ -0,0 +1,67 @@
+/**
+ * @name AV Rule 68
+ * @description Unneeded implicitly generated member functions shall be explicitly disallowed.
+ * @kind problem
+ * @id cpp/jsf/av-rule-68
+ * @problem.severity error
+ */
+import cpp
+
+/*
+ * Implicitly generated member functions are:
+ * - default constructor, created if there is no explicit constructor and
+ * the class is instantiated (using new or by declaring a variable of that type)
+ * - copy constructor, created if there is no explicit copy constructor and
+ * the class is copied
+ * - copy assignment operator if there is no explicit copy assignment operator
+ * and the class is assigned from
+ * - destructor if no destructor is defined and the object is destroyed (goes out
+ * of scope as an automatic variable or delete is called
+ */
+
+/*
+ * Now for disallowing generated member functions. There are two ways to do this:
+ * define them as private, or inherit from a class that defines them as private.
+ * It's okay if the class actually defines those members as public; so long as they
+ * are not implicitly generated
+ */
+
+predicate definesDefaultConstructor(Class c) {
+ exists(Constructor constr |
+ constr.getDeclaringType() = c and constr.isDefault())
+ or definesDefaultConstructor(c.getABaseClass())
+}
+
+predicate definesCopyConstructor(Class c) {
+ exists(CopyConstructor constr |
+ constr.getDeclaringType() = c)
+ or definesCopyConstructor(c.getABaseClass())
+}
+
+predicate definesCopyAssignmentOperator(Class c) {
+ exists(CopyAssignmentOperator op |
+ op.getDeclaringType() = c)
+ or definesCopyAssignmentOperator(c.getABaseClass())
+}
+
+predicate definesDestructor(Class c) {
+ exists(Destructor op |
+ op.getDeclaringType() = c)
+ or definesDestructor(c.getABaseClass())
+}
+
+class ProperClass extends Class {
+ ProperClass() { not this instanceof Struct }
+}
+
+/*
+ * The query now checks for each case whether: (a) it is not needed, (b) it is not already defined,
+ * and (c) it will be generated (ie for default constructors, if there is any constructor at all then default
+ * constructors will not be generated)
+ */
+from ProperClass c, string msg
+where (not definesDefaultConstructor(c) and not c.hasConstructor() and msg="AV Rule 68: class " + c.getName() + " does not need a default constructor and should explicitly disallow it.") or
+ (not definesCopyConstructor(c) and msg="AV Rule 68: class " + c.getName() + " does not need a copy constructor and should explicitly disallow it.") or
+ (not definesCopyAssignmentOperator(c) and msg="AV Rule 68: class " + c.getName() + " does not need a copy assignment operator and should explicitly disallow it.") or
+ (not definesDestructor(c) and msg="AV Rule 68: class " + c.getName() + " does not need a destructor and should explicitly disallow it.")
+select c, msg
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 69.ql b/cpp/ql/src/jsf/4.10 Classes/AV Rule 69.ql
new file mode 100644
index 000000000000..1daec9c9cecc
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 69.ql
@@ -0,0 +1,21 @@
+/**
+ * @name AV Rule 69
+ * @description A member function that does not affect the state of an object will be
+ * declared const.
+ * @kind problem
+ * @id cpp/jsf/av-rule-69
+ * @problem.severity warning
+ */
+import cpp
+
+from MemberFunction mf
+where mf.fromSource() and
+ mf.hasDefinition() and
+ not mf instanceof Constructor and
+ not exists(VariableAccess va | va.isLValue() and
+ va.getEnclosingFunction() = mf and
+ (va.getTarget() instanceof MemberVariable
+ or va.getTarget() instanceof GlobalVariable)) and
+ forall(Call c | c.getEnclosingFunction() = mf | c.isPure()) and
+ not mf.hasSpecifier("const")
+select mf, "AV Rule 69: A member function that does not affect the state of an object will be declared const."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 70.ql b/cpp/ql/src/jsf/4.10 Classes/AV Rule 70.ql
new file mode 100644
index 000000000000..af544ae46109
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 70.ql
@@ -0,0 +1,36 @@
+/**
+ * @name AV Rule 70
+ * @description A class will have friends only when a function or object requires access to
+ * the private elements of the class, but is unable to be a member of the class
+ * for logical or efficiency reasons.
+ * @kind problem
+ * @id cpp/jsf/av-rule-70
+ * @problem.severity warning
+ */
+import cpp
+
+// whether b is the same as a, or b is "const a&"
+predicate isTypeOrConstRef(Type a, Type b) {
+ a=b
+ or exists(ReferenceType r, SpecifiedType s | b=r and s=r.getBaseType() and s.hasSpecifier("const") and a=s.getUnspecifiedType())
+}
+
+// whether the first parameter of f may be subject to implicit conversions
+predicate implicitConvOnFirstParm(Function f) {
+ exists(ImplicitConversionFunction conv |
+ isTypeOrConstRef(conv.getDestType(), f.getParameter(0).getUnderlyingType()))
+}
+
+// whether f is declared as a friend by all its parameter types
+predicate multiFriend(Function f) {
+ f.getNumberOfParameters() > 1 and
+ forall(Parameter p | p = f.getAParameter() |
+ exists(FriendDecl fd |
+ fd.getFriend() = f and
+ p.getType().refersTo(fd.getDeclaringClass())))
+}
+
+from FriendDecl fd
+where not implicitConvOnFirstParm(fd.getFriend()) and
+ not multiFriend(fd.getFriend())
+select fd, "AV Rule 70: Friend declarations will only be used if the friend is unable to be a member of the class for logical or efficiency reasons."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 71.1.cpp b/cpp/ql/src/jsf/4.10 Classes/AV Rule 71.1.cpp
new file mode 100644
index 000000000000..8c2fb3a4e172
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 71.1.cpp
@@ -0,0 +1,35 @@
+class Base {
+protected:
+ Resource* resource;
+public:
+ virtual void init() {
+ resource = createResource();
+ }
+ virtual void release() {
+ freeResource(resource);
+ }
+};
+
+class Derived: public Base {
+ virtual void init() {
+ resource = createResourceV2();
+ }
+ virtual void release() {
+ freeResourceV2(resource);
+ }
+};
+
+Base::Base() {
+ this->init();
+}
+Base::~Base() {
+ this->release();
+}
+
+int f() {
+ // this will call Base::Base() and then Derived::Derived(), but this->init()
+ // inBase::Base() will resolve to Base::init(), not Derived::init()
+ // The reason for this is that when Base::Base is called, the object being
+ // created is still of type Base (including the vtable)
+ Derived* d = new Derived();
+}
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 71.1.qhelp b/cpp/ql/src/jsf/4.10 Classes/AV Rule 71.1.qhelp
new file mode 100644
index 000000000000..9467b5dbbb22
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 71.1.qhelp
@@ -0,0 +1,57 @@
+
+
+
+
+
+
+This rule finds calls to virtual functions from a constructor or destructor
+that may resolve to a different function than was intended. When instantiating
+a derived class, the resolution of a virtual function call depends on the type
+that defines the constructor/destructor that is currently running, not
+the class that is being instantiated. This is to prevent the calling of
+functions in the derived class that rely on fields declared in the derived
+class. The values of such fields are undefined until the constructor of the
+derived class is invoked after the constructor of the base class. Values
+declared in the derived class are likewise destructed prior to
+invocation of the destructor of the base class.
+
+
+
+The indicated function call is a call to a virtual function in a constructor or destructor, which will most
+likely not call the intended function, or if correct would be difficult to interpret without knowledge of the class'
+inheritance graph.
+
+
+
+
+
+Do not call virtual functions from the constructor or destructor. Change the virtual function in the base into a non-virtual function and pass
+any required parameters from the derived classes, or simply perform initialization that requires a virtual function after construction/before destruction.
+
+
+
+
+
+
+
+
+
+
+
+ AV Rule 71.1, Joint Strike Fighter Air Vehicle C++ Coding Standards. Lockheed Martin Corporation, 2005.
+
+
+ S. Meyers. Effective C++ 3d ed. pp 48-52. Addison-Wesley Professional, 2005.
+
+
+ OOP50-CPP. Do not invoke virtual functions from constructors or destructors
+
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 71.1.ql b/cpp/ql/src/jsf/4.10 Classes/AV Rule 71.1.ql
new file mode 100644
index 000000000000..354c165a5e9f
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 71.1.ql
@@ -0,0 +1,69 @@
+/**
+ * @name Virtual call from constructor or destructor
+ * @description Virtual functions should not be invoked from a constructor or destructor of the same class. Confusingly, virtual functions are resolved statically (not dynamically) in constructors and destructors for the same class. The call should be made explicitly static by qualifying it using the scope resolution operator.
+ * @kind problem
+ * @problem.severity warning
+ * @precision high
+ * @id cpp/virtual-call-in-constructor
+ * @tags reliability
+ * readability
+ * language-features
+ */
+import cpp
+
+predicate thisCall(FunctionCall c) {
+ c.getQualifier() instanceof ThisExpr or
+ c.getQualifier().(PointerDereferenceExpr).getChild(0) instanceof ThisExpr
+}
+
+predicate virtualThisCall(FunctionCall c, Function overridingFunction) {
+ c.isVirtual() and
+ thisCall(c) and
+ overridingFunction = c.getTarget().(VirtualFunction).getAnOverridingFunction()
+}
+
+// Catch most cases: go into functions in the same class, but only catch direct references to "this"
+
+predicate nonVirtualMember(MemberFunction mf, Class c) {
+ mf = c.getAMemberFunction() and
+ not (mf instanceof Constructor) and not (mf instanceof Destructor) and
+ not mf.isVirtual()
+}
+
+predicate callFromNonVirtual(MemberFunction source, Class c, MemberFunction targ) {
+ exists (FunctionCall fc | fc.getEnclosingFunction() = source and fc.getTarget() = targ and thisCall(fc)) and
+ targ = c.getAMemberFunction() and
+ nonVirtualMember(source, c)
+}
+
+pragma[noopt]
+predicate indirectlyCallsVirtualFunction(MemberFunction caller, Function target, Class c) {
+ exists (FunctionCall fc |
+ virtualThisCall(fc,_) and
+ fc.getEnclosingFunction() = caller and
+ fc.getTarget() = target and
+ nonVirtualMember(caller, c)
+ ) or
+ exists (MemberFunction mid |
+ indirectlyCallsVirtualFunction(mid, target, c) and
+ callFromNonVirtual(caller, c, mid)
+ )
+}
+
+from FunctionCall call, string explanation, Function virtFunction, Function overridingFunction
+where (call.getEnclosingFunction() instanceof Constructor or call.getEnclosingFunction() instanceof Destructor) and
+ (
+ (virtualThisCall(call, overridingFunction) and explanation = "Call to virtual function $@ which is overridden in $@. If you intend to statically call this virtual function, it should be qualified with " + virtFunction.getDeclaringType().toString() + "::.")
+ and virtFunction = call.getTarget()
+ and overridingFunction.getDeclaringType().getABaseClass+() = call.getEnclosingFunction().getDeclaringType()
+ or
+ exists(VirtualFunction target | thisCall(call) and indirectlyCallsVirtualFunction(call.getTarget(), target, _) |
+ explanation = "Call to function " + call.getTarget().getName() + " that calls virtual function $@ (overridden in $@)."
+ and virtFunction = target
+ and overridingFunction = target.getAnOverridingFunction()
+ and overridingFunction.getDeclaringType().getABaseClass+() = call.getEnclosingFunction().getDeclaringType()
+ )
+ )
+select call, explanation,
+ virtFunction, virtFunction.getName(),
+ overridingFunction, overridingFunction.getDeclaringType().getName()
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 71.ql b/cpp/ql/src/jsf/4.10 Classes/AV Rule 71.ql
new file mode 100644
index 000000000000..8a1cc05eb728
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 71.ql
@@ -0,0 +1,114 @@
+/**
+ * @name AV Rule 71
+ * @description Calls to an externally visible operation of an object, other than its constructors, shall not be allowed until the object has been fully initialized.
+ * @kind problem
+ * @id cpp/jsf/av-rule-71
+ * @problem.severity error
+ */
+import cpp
+
+/*
+ * Implementation of the rule: partial, bug-finding approach based on the cases listed as
+ * examples in the JSF spec. Of those,
+ *
+ * (1) is checked by 71.1 (no virtual calls in ctors)
+ * (2) is approximated. We cannot know about preconditions of methods, but we make sure
+ * that no public or protected method that reads a member M is called before M is
+ * initialised in the constructor
+ * (3) make sure that constructors initialise all fields
+ *
+ * Incomplete on (2): take transitive chains only through public member functions. Context-insensitive
+ * except inside the constructor itself
+ */
+
+// Part 1: call chains of public/protected member functions and the variables they need
+
+predicate memberDirectlyNeedsVariable(MemberFunction mf, Class c, MemberVariable mv) {
+ (mf.isPublic() or mf.isProtected()) and
+ c = mf.getDeclaringType() and
+ c = mv.getDeclaringType() and
+ exists(VariableAccess va | va = mv.getAnAccess() and
+ not exists(Assignment a | va = a.getLValue()) and
+ va.getEnclosingFunction() = mf)
+}
+
+predicate memberNeedsVariable(MemberFunction mf, Class c, MemberVariable mv) {
+ memberDirectlyNeedsVariable(mf, c, mv) or
+ exists(MemberFunction mf2 |
+ memberNeedsVariable(mf2, c, mv) and
+ mf.getDeclaringType() = c and
+ (mf.isPublic() or mf.isProtected()) and
+ mf.calls(mf2)
+ )
+}
+
+// Part 2: call chains of members of the class and the variables they initialise (include private members)
+
+predicate memberDirectlyInitialisesVariable(MemberFunction mf, Class c, MemberVariable mv) {
+ c = mf.getDeclaringType() and
+ c = mv.getDeclaringType() and
+ mv.getAnAssignedValue().getEnclosingFunction() = mf
+}
+
+predicate memberInitialisesVariable(MemberFunction mf, Class c, MemberVariable mv) {
+ memberDirectlyInitialisesVariable(mf, c, mv) or
+ exists(MemberFunction mf2 |
+ memberInitialisesVariable(mf2, c, mv) and
+ mf.getDeclaringType() = c and
+ mf.calls(mf2)
+ )
+}
+
+// Part 3: which variable a constructor initialises through assignment, calls or initialisers
+
+predicate preInitialises(Constructor c, MemberVariable mv) {
+ exists(ConstructorFieldInit cfi | cfi = c.getAnInitializer() | cfi.getTarget() = mv)
+}
+
+predicate exprInitialises(Constructor c, ControlFlowNode cf, MemberVariable mv) {
+ cf.getControlFlowScope() = c and
+ (
+ cf.(Assignment).getLValue() = mv.getAnAccess()
+ or memberInitialisesVariable(cf.(FunctionCall).getTarget(), c.getDeclaringType(), mv)
+ )
+}
+
+predicate initialises(Constructor c, MemberVariable mv) {
+ exprInitialises(c, _, mv)
+ or preInitialises(c, mv)
+}
+
+predicate doesNotInitialise(Constructor c, MemberVariable mv) {
+ mv.getDeclaringType() = c.getDeclaringType() and
+ not initialises(c, mv)
+}
+
+// Part 4: flow-sensitive analysis of the constructor (only) to check the order: only make public/protected
+// calls that require the value of a variable after it has been initialised.
+
+predicate reachableWithoutInitialising(Constructor c, ControlFlowNode cf, MemberVariable mv) {
+ not (preInitialises(c, mv))
+ and
+ (
+ cf = c.getBlock() or
+ exists(ControlFlowNode mid |
+ reachableWithoutInitialising(c, mid, mv) and
+ cf = mid.getASuccessor() and
+ not exprInitialises(c, cf, mv)
+ )
+ )
+}
+
+predicate badCall(Constructor c, FunctionCall call, MemberVariable mv) {
+ reachableWithoutInitialising(c, call, mv) and
+ memberNeedsVariable(call.getTarget(), c.getDeclaringType(), mv)
+}
+
+//
+// Query
+//
+
+from Element e, MemberVariable mv, string message
+where (doesNotInitialise(e, mv) and message = "Constructor does not initialize member variable " + mv.getName() + ".") or
+ (badCall(_, e, mv) and message = "Constructor calls function using " + mv.getName() + " before it is initialized.")
+select e, "AV Rule 71: " + message
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 73.ql b/cpp/ql/src/jsf/4.10 Classes/AV Rule 73.ql
new file mode 100644
index 000000000000..2cce8b266461
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 73.ql
@@ -0,0 +1,36 @@
+/**
+ * @name AV Rule 73
+ * @description Unnecessary default constructors shall not be defined.
+ * @kind problem
+ * @id cpp/jsf/av-rule-73
+ * @problem.severity error
+ * @precision low
+ */
+import cpp
+
+/* bug finding approach: look for no-argument constructors that set a certain field x,
+ such that every member function reading x also contains a comparison involving x as
+ part of an if statement; the host class should not be used in an array type or as
+ part of an array new, it should not be used in a template instantiation, and it should
+ not be a virtual base class */
+
+from Constructor c, MemberVariable f
+where c.fromSource() and
+ c.isDefault() and
+ not c.isCompilerGenerated() and
+ f = c.getAWrittenVariable() and
+ forall(MemberFunction m, VariableAccess va |
+ va = f.getAnAccess() and
+ m = va.getEnclosingFunction() and
+ not m instanceof Constructor and
+ not va.getEnclosingStmt() instanceof IfStmt |
+ exists(VariableAccess va2 | va2 = f.getAnAccess() and m = va2.getEnclosingFunction() |
+ va != va2 and
+ va2.getEnclosingStmt() instanceof IfStmt)) and
+ not (exists(ArrayType at | at.getBaseType+() = c.getDeclaringType())
+ or
+ exists(NewArrayExpr nae | nae.getType().(ArrayType).getBaseType+() = c.getDeclaringType())
+ or
+ exists(ClassDerivation cd | cd.hasSpecifier("virtual") and cd.getBaseClass() = c.getDeclaringType()))
+select c, "This default constructor possibly doesn't put the object in a usable state, indicated by the member variable $@.",
+ f, f.toString()
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 74.ql b/cpp/ql/src/jsf/4.10 Classes/AV Rule 74.ql
new file mode 100644
index 000000000000..7828fc028499
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 74.ql
@@ -0,0 +1,19 @@
+/**
+ * @name AV Rule 74
+ * @description Initialization of nonstatic class members will be performed through the
+ * member initialization list rather than through assignment in the body of
+ * a constructor.
+ * @kind problem
+ * @id cpp/jsf/av-rule-74
+ * @problem.severity warning
+ */
+import cpp
+
+// find assignment to non-static member variable in constructor, where that variable is
+// not also initialised through the member initialisation list
+from Assignment ass, Field mv, Constructor ctor
+where ass.getEnclosingFunction() = ctor and
+ mv.getDeclaringType() = ctor.getDeclaringType() and
+ ass.getLValue().(Access).getTarget() = mv and
+ not exists(ConstructorFieldInit cfi | cfi = ctor.getAnInitializer() | cfi.getTarget() = mv)
+select ass, "AV Rule 74: Nonstatic members will be initialized through the member initialization list, not through assignment."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 75.ql b/cpp/ql/src/jsf/4.10 Classes/AV Rule 75.ql
new file mode 100644
index 000000000000..ba78dec64861
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 75.ql
@@ -0,0 +1,12 @@
+/**
+ * @name AV Rule 75
+ * @description Members of the initialization list shall be listed in the order in which they are declared in the class.
+ * @kind problem
+ * @id cpp/jsf/av-rule-75
+ * @problem.severity error
+ */
+import cpp
+
+from Diagnostic d
+where d.hasTag("out_of_order_ctor_init")
+select d, "AV Rule 75: Members of the initialization list shall be listed in the order in which they are declared in the class."
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 76.ql b/cpp/ql/src/jsf/4.10 Classes/AV Rule 76.ql
new file mode 100644
index 000000000000..9ab2a892b65f
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 76.ql
@@ -0,0 +1,39 @@
+/**
+ * @name AV Rule 76
+ * @description A copy constructor and an assignment operator shall be declared for classes that contain pointers to data items or nontrivial destructors. If the copy constructor and assignment operators are not required, they should be explicitly disallowed.
+ * @kind problem
+ * @id cpp/jsf/av-rule-76
+ * @problem.severity error
+ */
+import cpp
+
+predicate hasPointerMember(Class c) {
+ // Note: any function pointers are fine
+ exists (MemberVariable v, Type t |
+ v.getDeclaringType() = c and
+ t = v.getType().getUnderlyingType() and
+ (t instanceof PointerType or t instanceof PointerToMemberType) and
+ not (t instanceof FunctionPointerType) and
+ not t.(PointerToMemberType).getBaseType() instanceof RoutineType
+ )
+}
+
+class TrivialStmt extends Stmt {
+ TrivialStmt() {
+ this instanceof EmptyStmt
+ or this instanceof ReturnStmt and not this.(ReturnStmt).hasExpr()
+ }
+}
+
+// What is a nontrivial destructor? JSF is unclear about that. We'll just
+// take any nonempty destructor as nontrivial. Exclude the generated 'return' stmt
+predicate hasNontrivialDestructor(Class c) {
+ exists (Stmt s | s = c.getDestructor().getBlock().getAStmt() | not s instanceof TrivialStmt)
+}
+
+from Class c
+where (hasPointerMember(c) or hasNontrivialDestructor(c)) and
+ not (c.getAMemberFunction() instanceof CopyConstructor and
+ c.getAMemberFunction() instanceof CopyAssignmentOperator) and
+ not (c instanceof Struct)
+select c, "AV Rule 76: A copy constructor and an assignment operator shall be declared for classes that contain pointers to data items or nontrivial destructors."
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 77.1.cpp b/cpp/ql/src/jsf/4.10 Classes/AV Rule 77.1.cpp
new file mode 100644
index 000000000000..76a6a0772e20
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 77.1.cpp
@@ -0,0 +1,14 @@
+struct X {
+ //This struct will have a compiler-generated copy constructor
+ X(const X&, int);
+ ...
+};
+
+//However, if this is declared later, it will override the compiler-generated
+//constructor
+X::X(const X& x, int i =0) {
+ this-> i = i; //uses the i parameter, instead of x.i
+}
+
+C c(1);
+C cCopy = c; //would take i to be 0, instead of just copying c(1)
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 77.1.qhelp b/cpp/ql/src/jsf/4.10 Classes/AV Rule 77.1.qhelp
new file mode 100644
index 000000000000..f76c96d36d08
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 77.1.qhelp
@@ -0,0 +1,35 @@
+
+
+
+
+
+
+Multi-parameter constructors with default arguments can be signature-compatible with a copy constructor
+when their default arguments are taken into account. An example would be a constructor for X
+of the form X(const X& rhs, int i = 0). A compiler will use such a constructor as a copy
+constructor in preference to the default member-wise copy constructor that it would otherwise generate.
+Since this is usually not what was intended, constructors of the form often do not provide the right
+semantics for copying objects of the class, making them potentially dangerous. Even when this sort of
+thing has been done intentionally, it is confusing and in bad taste, and should be avoided.
+
+
+
+
+
+
+Do not declare constructors with default arguments that are signature-compatible with a copy constructor
+when their default arguments are taken into account.
+
+
+
+
+
+
+
+
+
+AV Rule 77.1, Joint Strike Fighter Air Vehicle C++ Coding Standards. Lockheed Martin Corporation, 2005.
+
+
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 77.1.ql b/cpp/ql/src/jsf/4.10 Classes/AV Rule 77.1.ql
new file mode 100644
index 000000000000..c268d3c4f7f1
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 77.1.ql
@@ -0,0 +1,17 @@
+/**
+ * @name Constructor with default arguments will be used as a copy constructor
+ * @description Constructors with default arguments should not be signature-compatible with a copy constructor when their default arguments are taken into account.
+ * @kind problem
+ * @problem.severity error
+ * @precision high
+ * @id cpp/constructor-used-as-copy-constructor
+ * @tags reliability
+ * readability
+ * language-features
+ */
+import cpp
+
+from CopyConstructor f
+where f.getNumberOfParameters() > 1
+ and not f.mayNotBeCopyConstructorInInstantiation()
+select f, f.getName() + " is signature-compatible with a copy constructor when its default arguments are taken into account."
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 78.cpp b/cpp/ql/src/jsf/4.10 Classes/AV Rule 78.cpp
new file mode 100644
index 000000000000..dcdc264cc49a
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 78.cpp
@@ -0,0 +1,34 @@
+class Base {
+public:
+ Resource *p;
+ Base() {
+ p = createResource();
+ }
+ virtual void f() { //has virtual function
+ //...
+ }
+ //...
+ ~Base() { //wrong: is non-virtual
+ freeResource(p);
+ }
+};
+
+class Derived: public Base {
+public:
+ Resource *dp;
+ Derived() {
+ dp = createResource2();
+ }
+ ~Derived() {
+ freeResource2(dp);
+ }
+};
+
+int f() {
+ Base *b = new Derived(); //creates resources for both Base::p and Derived::dp
+ //...
+
+ //will only call Base::~Base(), leaking the resource dp.
+ //Change both destructors to virtual to ensure they are both called.
+ delete b;
+}
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 78.qhelp b/cpp/ql/src/jsf/4.10 Classes/AV Rule 78.qhelp
new file mode 100644
index 000000000000..0d25ce90c968
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 78.qhelp
@@ -0,0 +1,41 @@
+
+
+
+
+
+
+This rule finds classes with virtual functions but no virtual destructor. Deleting a class without a virtual destructor will
+only call the destructor of the type of the pointer being deleted. This can cause a defect if the pointer type is a base
+type while the object instance is a derived type.
+
+
+
+
+
+
+Make sure that all classes with virtual functions also have a virtual destructor, especially if other classes derive from them.
+
+
+
+
+
+
+
+
+
+
+
+ AV Rule 78, Joint Strike Fighter Air Vehicle C++ Coding Standards. Lockheed Martin Corporation, 2005.
+
+
+ S. Meyers. Effective C++ 3d ed. pp 40-44. Addison-Wesley Professional, 2005.
+
+
+ When should your destructor be virtual?
+
+
+
+
+
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 78.ql b/cpp/ql/src/jsf/4.10 Classes/AV Rule 78.ql
new file mode 100644
index 000000000000..945c50d037cc
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 78.ql
@@ -0,0 +1,24 @@
+/**
+ * @name No virtual destructor
+ * @description All base classes with a virtual function should define a virtual destructor. If an application attempts to delete a derived class object through a base class pointer, the result is undefined if the base class destructor is non-virtual.
+ * @kind problem
+ * @problem.severity warning
+ * @precision high
+ * @id cpp/virtual-destructor
+ * @tags reliability
+ * readability
+ * language-features
+ */
+import cpp
+
+// find classes with virtual functions that have a destructor that is not virtual and for which there exists a derived class
+// when calling the destructor of a derived class the destructor in the base class may not be called
+
+from Class c
+where exists(VirtualFunction f | f.getDeclaringType() = c)
+ and exists(Destructor d | d.getDeclaringType() = c and
+ not d.isVirtual() and
+ not d.isDeleted() and
+ not d.isCompilerGenerated())
+ and exists(ClassDerivation d | d.getBaseClass() = c)
+select c, "Base classes with a virtual function must define a virtual destructor."
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 79.cpp b/cpp/ql/src/jsf/4.10 Classes/AV Rule 79.cpp
new file mode 100644
index 000000000000..6d47fd142480
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 79.cpp
@@ -0,0 +1,54 @@
+// This class opens a file but never closes it. Even its clients
+// cannot close the file
+class ResourceLeak {
+private:
+ int sockfd;
+ FILE* file;
+public:
+ C() {
+ sockfd = socket(AF_INET, SOCK_STREAM, 0);
+ }
+
+ void f() {
+ file = fopen("foo.txt", "r");
+ ...
+ }
+};
+
+// This class relies on its client to release any stream it
+// allocates. Note that this means the client must have
+// intimate knowledge of the implementation of the class to
+// decide whether it is safe to release the stream.
+class StreamPool {
+private:
+ Stream *instance;
+public:
+ Stream *createStream(char *name) {
+ if (!instance)
+ instance = new Stream(name);
+ return instance;
+ }
+}
+
+// This class handles its resources, but does not do that in
+// the constructor/destructor. It can be rewritten easily to
+// be safer to use.
+class StreamHandler {
+private:
+ char *_name;
+ Stream *stream;
+public:
+ C(char *name) {
+ _name = strdup(name):
+ }
+ void open() {
+ stream = new Stream();
+ }
+ void close() {
+ delete stream;
+ }
+ ~StreamHandler() {
+ free(_name);
+ // stream should be deleted here, not in close()
+ }
+}
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 79.qhelp b/cpp/ql/src/jsf/4.10 Classes/AV Rule 79.qhelp
new file mode 100644
index 000000000000..a5b94460d43b
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 79.qhelp
@@ -0,0 +1,95 @@
+
+
+
+
+
+
+This rule finds resources that are allocated by a class, but not released in the destructor of that class.
+Allocating a resource includes:
+
+ - Allocating memory with
malloc
+ - Creating objects using
new
+ - Opening files
+ - Opening network sockets
+
+
+
+Resource management can be a complex task, so a standard best practice is the pattern of Resource Acquisition is Initialization
+(RAII). In an RAII class, the constructor allocates all required resources, and the destructor frees all resources.
+This guarantees that simply deleting an instance of the class is enough to free resources, and benefits from C++'s
+automatic object lifetime management. A well-designed RAII class cannot be a source of resource leaks as long as its
+lifetime is properly managed:
+
+ - If it is allocated with
new it should be released with delete by the client that created it
+ - If its lifetime is lexical (it is only used in one function), then it is enough to declare it as a local variable
+ of that function (not a pointer) and the C++ runtime will ensure it is released on exit.
+
+
+
+
+There are two possible messages:
+
+
+
+ - "Resource x is acquired by class C but not released in the destructor. It is released from f,
+ so this function may need to be called in the destructor".
+
+
+This indicates that the resource (x) is being released, just not in the destructor of the class. Typically,
+it is released in a function called close, free or something similar. This does not always
+indicate a resource leak, but it shows that the class is unnecessarily difficult to use because it does not conform to
+the RAII pattern.
+
+
+
+ - "Resource x is acquired by class C but not released anywhere in this class".
+
+
+This indicates that the class is allocating resources but not responsible for releasing them. This is very error-prone:
+even if a class requires an explicit close operator, it should manage any resources it allocates rather than forcing
+clients to manage them. In the worst case this can be a resource leak, if client code does not free the resource.
+
+
+
+
+
+If the resource is not being released at all, ensure that the class does release the resource, normally by adding
+the release to the destructor of the class. This change needs to be carefully validated: client code may be relying
+on the resource outliving the class that allocated it, and must be reviewed and updated if necessary.
+
+
+
+In the other case, for instance a class that has an explicit close function, the aim is to migrate the class
+to a straightforward RAII pattern. This can be achieved in several steps:
+
+ - First, ensure that the
close function (or its equivalent) is safe to call twice, by releasing resources
+ only if they have not been released before.
+ - Next, call the
close function from the destructor. This does not require changing the client code, since
+ it is safe to call it twice.
+ - Migrate client code to remove direct uses of the
close function, taking the opportunity to check that
+ the object itself is being deleted appropriately.
+ - Finally, when possible also migrate initialization code to the constructor of the class to make it follow the RAII
+ pattern precisely.
+
+
+
+
+
+
+
+
+
+ AV Rule 79, Joint Strike Fighter Air Vehicle C++ Coding Standards. Lockheed Martin Corporation, 2005.
+
+
+ S. Meyers. Effective C++ 3d ed. pp 61-66. Addison-Wesley Professional, 2005.
+
+
+ Resource Acquisition Is Initialization
+
+
+
+
+
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 79.ql b/cpp/ql/src/jsf/4.10 Classes/AV Rule 79.ql
new file mode 100644
index 000000000000..22ee7204b91c
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 79.ql
@@ -0,0 +1,249 @@
+/**
+ * @name Resource not released in destructor
+ * @description All resources acquired by a class should be released by its destructor. Avoid the use of the 'open / close' pattern, since C++ constructors and destructors provide a safer way to handle resource acquisition and release. Best practice in C++ is to use the 'RAII' technique: constructors allocate resources and destructors free them.
+ * @kind problem
+ * @problem.severity warning
+ * @precision high
+ * @id cpp/resource-not-released-in-destructor
+ * @tags efficiency
+ * readability
+ * external/cwe/cwe-404
+ */
+import cpp
+
+// List pairs of functions that do resource acquisition/release
+// Extend this to add custom function pairs. As written the query
+// will only apply if the resource is the *return value* of the
+// first call and a *parameter* to the second. Other cases should
+// be handled differently.
+predicate resourceManagementPair(string acquire, string release) {
+
+ (acquire = "fopen" and release = "fclose")
+ or
+ (acquire = "open" and release = "close")
+ or
+ (acquire = "socket" and release = "close")
+
+}
+
+// List functions that return malloc-allocated memory. Customize
+// to list your own functions there
+predicate mallocFunction(Function malloc) {
+ malloc.hasName("malloc") or malloc.hasName("calloc") or // Not realloc: doesn't acquire it, really
+ malloc.hasName("strdup")
+}
+
+private predicate isRelease(string release) {
+ resourceManagementPair(_, release) or
+ release = "free" or
+ release = "delete"
+}
+
+/**
+ * Gets the expression `e` or a `PointerDereferenceExpr` around
+ * it.
+ */
+Expr exprOrDereference(Expr e) {
+ result = e or
+ result.(PointerDereferenceExpr).getOperand() = e
+}
+
+/**
+ * Holds if the expression `e` releases expression `released`, whether directly
+ * or via one or more function call(s).
+ */
+private predicate exprReleases(Expr e, Expr released, string releaseType) {
+ (
+ // `e` is a call to a release function and `released` is any argument
+ e.(FunctionCall).getTarget().getName() = releaseType and
+ isRelease(releaseType) and
+ e.(FunctionCall).getAnArgument() = released
+ ) or (
+ // `e` is a call to `delete` and `released` is the target
+ e.(DeleteExpr).getExpr() = released and
+ releaseType = "delete"
+ ) or (
+ // `e` is a call to `delete[]` and `released` is the target
+ e.(DeleteArrayExpr).getExpr() = released and
+ releaseType = "delete"
+ ) or exists(Function f, int arg |
+ // `e` is a call to a function that releases one of it's parameters,
+ // and `released` is the corresponding argument
+ e.(FunctionCall).getTarget() = f and
+ e.(FunctionCall).getArgument(arg) = released and
+ exprReleases(_, exprOrDereference(f.getParameter(arg).getAnAccess()), releaseType)
+ ) or exists(Function f, Expr innerThis |
+ // `e` is a call to a method that releases `this`, and `released`
+ // is the object that is called
+ e.(FunctionCall).getTarget() = f and
+ e.(FunctionCall).getQualifier() = exprOrDereference(released) and
+ innerThis.getEnclosingFunction() = f and
+ exprReleases(_, innerThis, releaseType) and
+ innerThis instanceof ThisExpr and
+ releaseType = "delete"
+ )
+}
+
+class Resource extends MemberVariable {
+
+ Resource() { not isStatic() }
+
+ // Check that an expr is somewhere in this class - does not have to be a constructor
+ predicate inSameClass(Expr e) {
+ e.getEnclosingFunction().(MemberFunction).getDeclaringType() = this.getDeclaringType()
+ }
+
+ private predicate calledFromDestructor(Function f) {
+ (f instanceof Destructor and f.getDeclaringType() = this.getDeclaringType())
+ or
+ exists(Function mid, FunctionCall fc |
+ calledFromDestructor(mid) and
+ fc.getEnclosingFunction() = mid and
+ fc.getTarget() = f and
+ f.getDeclaringType() = this.getDeclaringType())
+ }
+
+ predicate inDestructor(Expr e) {
+ exists(Function f | f = e.getEnclosingFunction() |
+ calledFromDestructor(f)
+ )
+ }
+
+ predicate acquisitionWithRequiredRelease(Expr acquire, string releaseName) {
+ acquire.(Assignment).getLValue() = this.getAnAccess() and
+ // Should be in this class, but *any* member method will do
+ this.inSameClass(acquire) and
+ // Check that it is an acquisition function and return the corresponding free
+ (
+ exists(Function f | f = acquire.(Assignment).getRValue().(FunctionCall).getTarget() and
+ (resourceManagementPair(f.getName(), releaseName) or (mallocFunction(f) and (releaseName = "free" or releaseName = "delete")))
+ )
+ or
+ (acquire = this.getANew() and releaseName = "delete")
+ )
+ }
+
+ private Assignment getANew() {
+ result.getLValue() = this.getAnAccess() and
+ (result.getRValue() instanceof NewExpr or result.getRValue() instanceof NewArrayExpr) and
+ this.inSameClass(result)
+ }
+
+ Expr getAReleaseExpr(string releaseName) {
+ exprReleases(result, this.getAnAccess(), releaseName)
+ }
+}
+
+predicate unreleasedResource(Resource r, Expr acquire, File f, int acquireLine) {
+ // Note: there could be several release functions, because there could be
+ // several functions called 'fclose' for example. We want to check that
+ // *none* of these functions are called to release the resource
+ r.acquisitionWithRequiredRelease(acquire, _) and
+ not exists(Expr releaseExpr, string releaseName |
+ r.acquisitionWithRequiredRelease(acquire, releaseName) and
+ releaseExpr = r.getAReleaseExpr(releaseName) and
+ r.inDestructor(releaseExpr)
+ )
+ and f = acquire.getFile()
+ and acquireLine = acquire.getLocation().getStartLine()
+}
+
+predicate freedInSameMethod(Resource r, Expr acquire) {
+ unreleasedResource(r, acquire, _, _) and
+ exists(Expr releaseExpr, string releaseName |
+ r.acquisitionWithRequiredRelease(acquire, releaseName) and
+ releaseExpr = r.getAReleaseExpr(releaseName) and
+ releaseExpr.getEnclosingFunction() = acquire.getEnclosingFunction()
+ )
+}
+
+/**
+ * Resource `r`, acquired by `acquire`, is passed to some external
+ * object in the function where it's acquired. This other object
+ * may have taken responsibility for freeing the resource.
+ */
+predicate leakedInSameMethod(Resource r, Expr acquire) {
+ unreleasedResource(r, acquire, _, _) and
+ (
+ exists(FunctionCall fc |
+ // `r` (or something computed from it) is passed to another function
+ // near to where it's acquired, and might be stored elsewhere.
+ fc.getAnArgument().getAChild*() = r.getAnAccess() and
+ fc.getEnclosingFunction() = acquire.getEnclosingFunction()
+ ) or exists(Variable v, Expr e |
+ // `r` (or something computed from it) is stored in another variable
+ // near to where it's acquired, and might be released through that
+ // variable.
+ v.getAnAssignedValue() = e and
+ e.getAChild*() = r.getAnAccess() and
+ e.getEnclosingFunction() = acquire.getEnclosingFunction()
+ ) or exists(FunctionCall fc |
+ // `this` (i.e. the class where `r` is acquired) is passed into `r` via a
+ // method, or the constructor. `r` may use this to register itself with
+ // `this` in some way, ensuring it is later deleted.
+ fc.getEnclosingFunction() = acquire.getEnclosingFunction() and
+ fc.getAnArgument() instanceof ThisExpr and
+ (
+ fc.getQualifier() = r.getAnAccess() or // e.g. `r->setOwner(this)`
+ fc = acquire.getAChild*() // e.g. `r = new MyClass(this)`
+ )
+ )
+ )
+}
+
+pragma[noopt] predicate badRelease(Resource r, Expr acquire, Function functionCallingRelease, int line) {
+ unreleasedResource(r, acquire, _, _) and
+ exists(Expr releaseExpr, string releaseName,
+ Location releaseExprLocation, Function acquireFunction |
+ r.acquisitionWithRequiredRelease(acquire, releaseName) and
+ releaseExpr = r.getAReleaseExpr(releaseName) and
+ releaseExpr.getEnclosingFunction() = functionCallingRelease and
+ functionCallingRelease.getDeclaringType() = r.getDeclaringType() and
+ releaseExprLocation = releaseExpr.getLocation() and
+ line = releaseExprLocation.getStartLine() and
+ acquireFunction = acquire.getEnclosingFunction() and
+ functionCallingRelease != acquireFunction
+ )
+}
+
+Class qtObject() { result.getABaseClass*().getQualifiedName() = "QObject" }
+PointerType qtObjectReference() { result.getBaseType() = qtObject() }
+Constructor qtParentConstructor() {
+ exists(Parameter p |
+ p.getName() = "parent" and
+ p.getType() = qtObjectReference() and
+ result.getAParameter() = p and
+ result.getDeclaringType() = qtObject()
+ )
+}
+
+predicate automaticallyReleased(Assignment acquire)
+{
+ // sub-types of the Qt type QObject are released by their parent (if they have one)
+ exists(NewExpr alloc |
+ alloc.getType() = qtObject() and
+ acquire.getRValue() = alloc and
+ alloc.getInitializer() = qtParentConstructor().getACallToThisFunction()
+ )
+}
+
+from Resource r, Expr acquire, File f, string message
+where unreleasedResource(r, acquire, f, _) and
+ not freedInSameMethod(r, acquire) and
+ not leakedInSameMethod(r, acquire) and
+ (
+ exists(Function releaseFunction, int releaseLine | badRelease(r, acquire, releaseFunction, releaseLine) and
+ message =
+ "Resource " + r.getName() + " is acquired by class " + r.getDeclaringType().getName() +
+ " but not released in the destructor. It is released from " + releaseFunction.getName() + " on line " + releaseLine +
+ ", so this function may need to be called from the destructor."
+ )
+ or
+ (
+ not badRelease(r, _, _, _) and
+ message = "Resource " + r.getName() + " is acquired by class " + r.getDeclaringType().getName() + " but not released anywhere in this class."
+ )
+ ) and
+ not automaticallyReleased(acquire) and
+ not r.getDeclaringType() instanceof TemplateClass // template classes may contain insufficient information for this analysis; results from instantiations will usually suffice.
+select acquire, message
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 81.ql b/cpp/ql/src/jsf/4.10 Classes/AV Rule 81.ql
new file mode 100644
index 000000000000..a6bba73ebd4b
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 81.ql
@@ -0,0 +1,78 @@
+/**
+ * @name AV Rule 81
+ * @description The assignment operator shall handle self-assignment correctly.
+ * @kind problem
+ * @id cpp/jsf/av-rule-81
+ * @problem.severity error
+ */
+import cpp
+
+/*
+ * Note: it's almost impossible to implement this rule fully. We take a bug-finding
+ * approach: try to look for some patterns that are definitely bad, while allowing
+ * common patterns. Passing this query by no means implies that the implementation
+ * is correct; though it probably shows that some thought has been put into it.
+ * Hopefully correct implementations also pass, but 'cunning' implementations may not.
+ */
+
+/** A copy assignment operator taking its parameter by reference.
+ * For our purposes, copy assignment operators taking parameters by
+ * value are likely fine, since the copy already happened
+ */
+class ReferenceCopyAssignmentOperator extends MemberFunction {
+ ReferenceCopyAssignmentOperator() {
+ this.getName() = "operator=" and
+ this.getNumberOfParameters() = 1 and
+ exists (ReferenceType rt |
+ rt = this.getParameter(0).getType() and
+ (rt.getBaseType() = this.getDeclaringType() or
+ rt.getBaseType().(SpecifiedType).getBaseType() = this.getDeclaringType())
+ )
+ }
+
+ Parameter getRhs() { result = this.getParameter(0) }
+
+ /** A self-equality test: between 'this' and the RHS parameter */
+ IfStmt getASelfEqualityTest() {
+ result.getEnclosingFunction() = this and
+ exists(ComparisonOperation op |
+ op = result.getCondition() and
+ op.getAnOperand() instanceof ThisExpr and
+ op.getAnOperand().(AddressOfExpr).getOperand().(VariableAccess).getTarget() = this.getRhs()
+ )
+ }
+
+ /** A call to a function called swap. Note: could be a member,
+ * std::swap or a function overloading std::swap (not in std::)
+ * so keep it simple
+ */
+ FunctionCall getASwapCall() {
+ result.getEnclosingFunction() = this and
+ result.getTarget().getName() = "swap"
+ }
+
+ /** A call to delete on a member variable */
+ DeleteExpr getADeleteExpr() {
+ result.getEnclosingFunction() = this and
+ result.getExpr().(VariableAccess).getTarget().(MemberVariable).getDeclaringType() = this.getDeclaringType()
+ }
+
+}
+
+/** Test whether a class has a resource that needs management. Value class types are
+ * okay because they get their semantics from their assignment operator. Primitive
+ * types are fine (no management needed). Constant and reference values are okay too
+ * (they can't be changed anyway). All that remains are pointer types.
+ */
+predicate hasResource(Class c) {
+ exists (MemberVariable mv |
+ mv.getDeclaringType() = c and
+ mv.getType() instanceof PointerType)
+}
+
+from ReferenceCopyAssignmentOperator op
+where hasResource(op.getDeclaringType())
+ and not exists(op.getASelfEqualityTest())
+ and not exists(op.getASwapCall())
+ and exists(op.getADeleteExpr())
+select op
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 82.cpp b/cpp/ql/src/jsf/4.10 Classes/AV Rule 82.cpp
new file mode 100644
index 000000000000..b6dc6b383d5e
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 82.cpp
@@ -0,0 +1,12 @@
+class B {
+ B& operator=(const B& other) {
+ ... //incorrect, does not return a reference to this
+ }
+};
+
+class C {
+ C& operator=(const C& other) {
+ ...
+ return *this; //correct, returns reference to this
+ }
+};
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 82.qhelp b/cpp/ql/src/jsf/4.10 Classes/AV Rule 82.qhelp
new file mode 100644
index 000000000000..ace0d6e4f985
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 82.qhelp
@@ -0,0 +1,46 @@
+
+
+
+
+
+
+This rule finds assignment operator definitions that do not return a reference to this.
+The reference to this is required for an assignment expression to have a meaningful value
+(i.e. so that expressions like a = b = 3 would work correctly). Not returning a reference to
+this would give the assignment expression an unexpected value, most likely causing such chained assignments to fail.
+Both the standard library types and the built-in types behave in this manner, and the default behavior
+of the assignment operator is an almost universal assumption of all developers that it is unwise to change
+it considerably. If the desired behavior is significantly different from that of the default
+assignment operator, it may be better to define a separate function instead.
+
+
+
+
+
+Make sure that the assignment operator overload returns a reference to this. Define a separate
+function if the desired assignment operator differs significantly from the default behavior.
+
+
+
+
+
+
+
+
+
+
+
+ AV Rule 82, Joint Strike Fighter Air Vehicle C++ Coding Standards. Lockheed Martin Corporation, 2005.
+
+
+ S. Meyers. Effective C++ 3d ed. pp 52-53. Addison-Wesley Professional, 2005.
+
+
+ C++ Operator Overloading Guidelines
+
+
+
+
+
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 82.ql b/cpp/ql/src/jsf/4.10 Classes/AV Rule 82.ql
new file mode 100644
index 000000000000..e48827979400
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 82.ql
@@ -0,0 +1,86 @@
+/**
+ * @name Overloaded assignment does not return 'this'
+ * @description An assignment operator should return a reference to *this. Both the standard library types and the built-in types behave in this manner.
+ * @kind problem
+ * @problem.severity warning
+ * @precision high
+ * @id cpp/assignment-does-not-return-this
+ * @tags reliability
+ * readability
+ * language-features
+ */
+import cpp
+
+predicate callOnThis(FunctionCall fc) {
+ // `this->f(...)`
+ fc.getQualifier() instanceof ThisExpr or
+
+ // `(*this).f(...)`
+ fc.getQualifier().(PointerDereferenceExpr).getChild(0) instanceof ThisExpr
+}
+
+predicate pointerThis(Expr e) {
+ e instanceof ThisExpr or
+
+ // `f(...)`
+ // (includes `this = ...`, where `=` is overloaded so a `FunctionCall`)
+ exists(FunctionCall fc | fc = e and callOnThis(fc) |
+ exists(fc.getTarget().getBlock()) implies returnsPointerThis(fc.getTarget())
+ ) or
+
+ // `this = ...` (where `=` is not overloaded, so an `AssignExpr`)
+ pointerThis(e.(AssignExpr).getLValue())
+}
+
+predicate dereferenceThis(Expr e) {
+ pointerThis(e.(PointerDereferenceExpr).getChild(0)) or
+
+ // `f(...)`
+ // (includes `*this = ...`, where `=` is overloaded so a `FunctionCall`)
+ exists(FunctionCall fc | fc = e and callOnThis(fc) |
+ exists(fc.getTarget().getBlock()) implies returnsDereferenceThis(fc.getTarget())
+ ) or
+
+ // `*this = ...` (where `=` is not overloaded, so an `AssignExpr`)
+ dereferenceThis(e.(AssignExpr).getLValue())
+}
+
+predicate returnsPointerThis(Function f) {
+ forex(ReturnStmt s | s.getEnclosingFunction() = f |
+ // `return this`
+ pointerThis(s.getExpr())
+ )
+}
+
+predicate returnsDereferenceThis(Function f) {
+ forex(ReturnStmt s | s.getEnclosingFunction() = f |
+ // `return *this`
+ dereferenceThis(s.getExpr())
+ )
+}
+
+predicate assignOperatorWithWrongType(Operator op, string msg) {
+ op.hasName("operator=")
+ and exists(op.getBlock())
+ and exists(Class c |
+ c = op.getDeclaringType()
+ and op.getType() = c
+ and msg = "Assignment operator in class " + c.getName() + " should have return type " + c.getName() + "&. Otherwise a copy is created at each call."
+ )
+}
+
+predicate assignOperatorWithWrongResult(Operator op, string msg) {
+ op.hasName("operator=")
+ and not returnsDereferenceThis(op)
+ and exists(op.getBlock())
+ and not op.getType() instanceof VoidType
+ and not assignOperatorWithWrongType(op, _)
+ and msg = "Assignment operator in class " + op.getDeclaringType().getName() + " does not return a reference to *this."
+}
+
+// Applies to all assignment operators, not just a copy assignment operator
+
+from Operator op, string msg
+where assignOperatorWithWrongType(op, msg)
+ or assignOperatorWithWrongResult(op, msg)
+select op, msg
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 85.cpp b/cpp/ql/src/jsf/4.10 Classes/AV Rule 85.cpp
new file mode 100644
index 000000000000..bacb47f69e44
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 85.cpp
@@ -0,0 +1,21 @@
+class B {
+ int x;
+ int y; //new field
+ bool operator==(const C& other) {
+ return this->x % 3 == 0 && this->y % 4 ==0; //updated to include the new field y
+ }
+ bool operator!=(const C& other) {
+ return this->x % 3 != 0; //Wrong: forgot to update to include new field y
+ }
+};
+class C {
+ int x;
+ int y; //new field
+ bool operator==(const C& other) {
+ return this->x % 3 == 0 && this->y % 4 == 0; //updated to include the new field
+ }
+ bool operator!=(const C& other) {
+ return !(*this == other); //Correct, no need to update this operator
+ //definition when adding the new field
+ }
+};
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 85.qhelp b/cpp/ql/src/jsf/4.10 Classes/AV Rule 85.qhelp
new file mode 100644
index 000000000000..a92a3beac088
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 85.qhelp
@@ -0,0 +1,40 @@
+
+
+
+
+
+
+This rule ensures that all operators with opposites (e.g. == and !=) are both defined, and
+that one of them is defined in terms of the other. This just enforces the consistency of meaning
+of the operators.
+
+
+
+
+The indicated operator either does not have its opposite defined, or both of the definitions are not in terms of the other.
+Not defining an operator in terms of its opposite is prone to mistakes, as it requires modification of both operators when
+the behavior of one changes. Deliberately defining opposite operators with behaviors that are not actual logical opposites
+(e.g. defining x == y if x and y are divisible by 2 and x != y if x and y are divisible by 3)
+violates the almost universal assumptions developers have on the relationship of == and != and will
+lead to unnecessary confusion.
+
+
+
+
+
+Make sure that both opposite operators are defined when they are overloaded, and ensure that one of the overloads
+is defined in terms of the other.
+
+
+
+
+
+
+
+
+
+AV Rule 85, Joint Strike Fighter Air Vehicle C++ Coding Standards. Lockheed Martin Corporation, 2005.
+
+
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 85.ql b/cpp/ql/src/jsf/4.10 Classes/AV Rule 85.ql
new file mode 100644
index 000000000000..690dd9479d28
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 85.ql
@@ -0,0 +1,41 @@
+/**
+ * @name Opposite operator definition
+ * @description When two operators are opposites, both should be defined and one should be defined in terms of the other.
+ * @kind problem
+ * @id cpp/jsf/av-rule-85
+ * @problem.severity warning
+ * @tags reliability
+ */
+import cpp
+
+predicate oppositeOperators(string op1, string op2) {
+ op1="operator<" and op2="operator>="
+ or op1="operator<=" and op2="operator>"
+ or op1="operator==" and op2="operator!="
+ or oppositeOperators(op2, op1)
+}
+
+// whether op1 is implemented as the negation of op2
+/* this match is very syntactic: we simply check that op1 is defined as
+ !op2(_, _) */
+predicate implementedAsNegationOf(Operator op1, Operator op2) {
+ exists(Block b, ReturnStmt r, NotExpr n, FunctionCall c |
+ b = op1.getBlock() and
+ b.getNumStmt() = 1 and
+ r = b.getStmt(0) and
+ n = r.getExpr() and
+ c = n.getOperand() and
+ c.getTarget() = op2)
+}
+
+from Class c, string op, string opp, Operator rator
+where c.fromSource() and
+ oppositeOperators(op, opp) and
+ rator = c.getAMember() and
+ rator.hasName(op) and
+ not exists(Operator oprator | oprator = c.getAMember() and
+ oprator.hasName(opp) and
+ ( implementedAsNegationOf(rator, oprator)
+ or implementedAsNegationOf(oprator, rator)))
+select c, "When two operators are opposites, both should be defined and one should be defined in terms of the other. Operator " + op +
+ " is declared on line " + rator.getLocation().getStartLine().toString() + ", but it is not defined in terms of its opposite operator " + opp + "."
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 88.1.ql b/cpp/ql/src/jsf/4.10 Classes/AV Rule 88.1.ql
new file mode 100644
index 000000000000..a96697f1e5c9
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 88.1.ql
@@ -0,0 +1,24 @@
+/**
+ * @name AV Rule 88.1
+ * @description A stateful virtual base shall be explicitly declared in each derived class that accesses it. Explicitly declaring a stateful virtual base at each level in a hierarchy (where that base is used), documents that fact that no assumptions can be made with respect to the exclusive use of the data contained within the virtual base.
+ * @kind problem
+ * @id cpp/jsf/av-rule-88-1
+ * @problem.severity error
+ */
+import cpp
+
+predicate derivesVirtual(Class c, Class base)
+{
+ exists(ClassDerivation d | d.getDerivedClass() = c and d.getBaseClass() = base
+ and d.hasSpecifier("virtual"))
+}
+
+predicate derivesVirtualStar(Class c, Class base) {
+ derivesVirtual(c, base) or derivesVirtualStar(c.getABaseClass(), base)
+}
+
+from Class c, Class base
+where c.getABaseClass+() = base
+ and derivesVirtualStar(c, base)
+ and not derivesVirtual(c, base)
+select c, "AV Rule 88.1: The virtual base " + base.getName() + " shall be explicitly declared."
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 88.cpp b/cpp/ql/src/jsf/4.10 Classes/AV Rule 88.cpp
new file mode 100644
index 000000000000..b663d04bcacc
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 88.cpp
@@ -0,0 +1,18 @@
+//correct:
+// only one protected base,
+// multiple interfaces ("pure virtual" classes), and
+// multiple private implementations
+class C : protected Superclass,
+ public InterfaceA, public InterfaceB,
+ private ImplementationA, private ImplementationB
+{
+ //implementation
+};
+
+//wrong: multiple protected bases
+class D : protected Superclass1, protected Superclass2,
+ public Interface, private Implementation
+{
+ //implementation
+};
+
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 88.qhelp b/cpp/ql/src/jsf/4.10 Classes/AV Rule 88.qhelp
new file mode 100644
index 000000000000..3e59ea516407
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 88.qhelp
@@ -0,0 +1,54 @@
+
+
+
+
+
+
+This rule ensures that classes conform to a restricted form of multiple inheritance.
+The restricted form allows inheriting from any number of interfaces (i.e. classes which contain only pure
+virtual functions and only essential data), any number of private implementations, and only one protected implementation.
+Allowing only one protected base class ensures that the class is only allowed to override functions from that base class
+(and not accidentally override functions from other base classes). Allowing multiple private implementations allow
+reuse (but not overriding) of functions from multiple classes.
+
+
+
+This restricted form of inheritance is almost identical to Java, where a class may extend (public/protected derive) only a single class,
+but may implement (public derive) multiple interfaces (pure virtual classes), with the addition of mixin-like behavior provided by
+the reuse of members by privately deriving from implementation classes [Bracha and Cook]. This enforces a public class hierarchy that is predictable and easy to comprehend
+while giving flexibility and opportunities for code reuse for the non-public implementation.
+
+
+
+The indicated class violates the restricted form of multiple inheritance.
+
+
+
+
+
+Change the class to conform to the restricted form of multiple inheritance.
+
+
+
+
+
+
+
+
+
+
+
+ AV Rule 88, Joint Strike Fighter Air Vehicle C++ Coding Standards. Lockheed Martin Corporation, 2005.
+
+
+ G. Bracha and W. Cook. Mixin-based inheritance. OOPSLA/ECOOP '90: Proceedings of the European conference on object-oriented programming on Object-oriented programming systems, languages, and applications, pp 303-311. 1990.
+
+
+ S. Meyers. Effective C++ 3d ed. pp 192-198. Addison-Wesley Professional, 2005.
+
+
+
+
+
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 88.ql b/cpp/ql/src/jsf/4.10 Classes/AV Rule 88.ql
new file mode 100644
index 000000000000..1deeb5da9eb0
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 88.ql
@@ -0,0 +1,53 @@
+/**
+ * @name Undisciplined multiple inheritance
+ * @description Multiple inheritance should only be used in the following restricted form: n interfaces plus m private implementations, plus at most one protected implementation. Multiple inheritance can lead to complicated inheritance hierarchies that are difficult to comprehend and maintain.
+ * @kind problem
+ * @problem.severity recommendation
+ * @precision high
+ * @id cpp/undisciplined-multiple-inheritance
+ * @tags readability
+ */
+import cpp
+
+/*
+In the context of this rule, an interface is specified by a class which has the following properties:
+- it is intended to be an interface,
+- its public methods are pure virtual functions, and
+- it does not hold any data, unless those data items are small and function as part of the interface (e.g. a unique object identifier).
+
+An approximation of this definition is classes with pure virtual functions and less than 3 member variables.
+*/
+class InterfaceClass extends Class {
+ InterfaceClass() {
+ exists(MemberFunction m | m.getDeclaringType() = this and not compgenerated(m))
+ and
+ forall(MemberFunction m | m.getDeclaringType() = this and not compgenerated(m) | m instanceof PureVirtualFunction)
+ and
+ count(MemberVariable v | v.getDeclaringType() = this) < 3
+ }
+}
+
+class InterfaceImplementor extends Class {
+ InterfaceImplementor() {
+ exists(ClassDerivation d | d.getDerivedClass() = this and d.getBaseClass() instanceof InterfaceClass)
+ }
+ int getNumInterfaces() {
+ result = count(ClassDerivation d | d.getDerivedClass() = this and d.getBaseClass() instanceof InterfaceClass)
+ }
+ int getNumProtectedImplementations() {
+ result = count(ClassDerivation d | d.hasSpecifier("protected") and d.getDerivedClass() = this and not d.getBaseClass() instanceof InterfaceClass)
+ }
+ int getNumPrivateImplementations() {
+ result = count(ClassDerivation d | d.hasSpecifier("private") and d.getDerivedClass() = this and not d.getBaseClass() instanceof InterfaceClass)
+ }
+ int getNumPublicImplementations() {
+ result = count(ClassDerivation d | d.hasSpecifier("public") and d.getDerivedClass() = this and not d.getBaseClass() instanceof InterfaceClass)
+ }
+}
+
+from InterfaceImplementor d
+where d.getNumPublicImplementations() > 0
+ or d.getNumProtectedImplementations() > 1
+select d, "Multiple inheritance should not be used with " + d.getNumInterfaces().toString()
+ + " interfaces, " + d.getNumPrivateImplementations().toString() + " private implementations, " + d.getNumProtectedImplementations().toString() + " protected implementations, and "
+ + d.getNumPublicImplementations().toString() + " public implementations."
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 89.qhelp b/cpp/ql/src/jsf/4.10 Classes/AV Rule 89.qhelp
new file mode 100644
index 000000000000..819d9e995cb3
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 89.qhelp
@@ -0,0 +1,23 @@
+
+
+
+
+If a base class is both virtual and non-virtual within a single hierarchy then the hierarchy is
+more difficult to understand and maintain. This rule identifies any base classes that are derived
+as both virtual and non-virtual in one hierarchy as violations.
+
+
+
+
+
+ AV Rule 89, Joint Strike Fighter Air Vehicle C++ Coding Standards. Lockheed Martin Corporation, 2005.
+
+
+ Virtual Base Classes
+
+
+
+
+
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 89.ql b/cpp/ql/src/jsf/4.10 Classes/AV Rule 89.ql
new file mode 100644
index 000000000000..7e39363e8389
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 89.ql
@@ -0,0 +1,29 @@
+/**
+ * @name Inconsistent virtual inheritance
+ * @description A base class shall not be both virtual and non-virtual in the same hierarchy.
+ * @kind problem
+ * @problem.severity error
+ * @precision high
+ * @id cpp/inconsistent-virtual-inheritance
+ * @tags maintainability
+ * readability
+ */
+import cpp
+
+predicate derivesVirtual(Class c, Class base) {
+ exists(ClassDerivation d | d.getDerivedClass() = c and d.getBaseClass() = base
+ and d.hasSpecifier("virtual"))
+ or derivesVirtual(c.getABaseClass(), base)
+}
+
+predicate derivesNonVirtual(Class c, Class base) {
+ exists(ClassDerivation d | d.getDerivedClass() = c and d.getBaseClass() = base
+ and not d.hasSpecifier("virtual"))
+ or derivesNonVirtual(c.getABaseClass(), base)
+}
+
+from Class c, Class base
+where c.getABaseClass+() = base
+ and derivesVirtual(c, base)
+ and derivesNonVirtual(c, base)
+select c, "AV Rule 89: The base class " + base.getName() + " is derived both virtual and non-virtual."
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 94.ql b/cpp/ql/src/jsf/4.10 Classes/AV Rule 94.ql
new file mode 100644
index 000000000000..1bf0465486a2
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 94.ql
@@ -0,0 +1,17 @@
+/**
+ * @name AV Rule 94
+ * @description An inherited nonvirtual function shall not be redefined in a derived class. Such definitions would hide the function in the base class.
+ * @kind problem
+ * @id cpp/jsf/av-rule-94
+ * @problem.severity error
+ */
+import cpp
+
+from MemberFunction f1, MemberFunction f2
+where f1 != f2
+ and not (f1 instanceof VirtualFunction)
+ and not (f2 instanceof VirtualFunction)
+ and f1.getDeclaringType().getABaseClass+() = f2.getDeclaringType()
+ and f1.getName() = f2.getName()
+ and forall(Parameter p1, Parameter p2, int i | f1.getParameter(i) = p1 and f2.getParameter(i) = p2 | p1.getType() = p2.getType() )
+select f1, "AV Rule 94: An inherited nonvirtual function shall not be redefined in a derived class."
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 95.cpp b/cpp/ql/src/jsf/4.10 Classes/AV Rule 95.cpp
new file mode 100644
index 000000000000..2c9a76e676ed
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 95.cpp
@@ -0,0 +1,20 @@
+enum Shape_color { red, green, blue };
+class Shape
+{
+ public:
+ virtual void draw (Shape_color color = green) const;
+ ...
+}
+class Circle : public Shape
+{
+ public:
+ virtual void draw (Shape_color color = red) const;
+ ...
+}
+void fun()
+{
+ Shape* sp;
+
+ sp = new Circle;
+ sp->draw (); // Invokes Circle::draw(green) even though the default
+} // parameter for Circle is red.
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 95.qhelp b/cpp/ql/src/jsf/4.10 Classes/AV Rule 95.qhelp
new file mode 100644
index 000000000000..a38089c450fe
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 95.qhelp
@@ -0,0 +1,26 @@
+
+
+
+
+Inherited default parameters should not be redefined because this obscures the behavior of the code. Default values are statically bound and when they are redefined in dynamically bound function calls this reduces readability of the code, increasing the risk of introducing defects.
+
+For example, while C++ dynamically binds virtual methods, the default parameters of those methods are statically bound. Hence, the draw() method of the derived type (Circle), if referenced through a base type pointer (Shape *), will be invoked with the default parameters of the base type (Shape).
+
+
+
+
+
+
+
+
+ AV Rule 95, Joint Strike Fighter Air Vehicle C++ Coding Standards. Lockheed Martin Corporation, 2005.
+
+
+ Scott Meyers. Item 38, Effective C++: 50 Specific Ways to Improve Your Programs and Design, 2nd Edition. Addison-Wesley, 1998.
+
+
+
+
+
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 95.ql b/cpp/ql/src/jsf/4.10 Classes/AV Rule 95.ql
new file mode 100644
index 000000000000..a43c7b56a3bb
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 95.ql
@@ -0,0 +1,27 @@
+/**
+ * @name Redefined default parameter
+ * @description An inherited default parameter shall never be redefined. Default values are bound statically which is confusing when combined with dynamically bound function calls.
+ * @kind problem
+ * @problem.severity error
+ * @precision high
+ * @id cpp/redefined-default-parameter
+ * @tags maintainability
+ * readability
+ */
+import cpp
+
+from Parameter p, Parameter superP, MemberFunction subF, MemberFunction superF, int i, string subValue, string superValue
+where p.hasInitializer()
+ and subF.getParameter(i) = p
+ and superP.hasInitializer()
+ and subF.overrides(superF)
+ and superF.getParameter(i) = superP
+ and subValue = p.getInitializer().getExpr().getValue()
+ and superValue = superP.getInitializer().getExpr().getValue()
+ and subValue != superValue
+select p.getInitializer().getExpr(),
+ "Parameter " + p.getName() +
+ " redefines its default value to " + subValue +
+ " from the inherited default value " + superValue +
+ " (in " + superF.getDeclaringType().getName() +
+ ").\nThe default value will be resolved statically, not by dispatch, so this can cause confusion."
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 96.ql b/cpp/ql/src/jsf/4.10 Classes/AV Rule 96.ql
new file mode 100644
index 000000000000..d577b649df86
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 96.ql
@@ -0,0 +1,32 @@
+/**
+ * @name AV Rule 96
+ * @description Arrays shall not be treated polymorphically. Array indexing in C/C++ is implemented as pointer arithmetic. Hence, a[i] is equivalent to a+i*SIZEOF(array element). Since derived classes are often larger than base classes, polymorphism and pointer arithmetic are not compatible techniques.
+ * @kind problem
+ * @id cpp/jsf/av-rule-96
+ * @problem.severity error
+ */
+import cpp
+
+predicate compatible(Type t1, Type t2) {
+ t1 = t2
+ or compatible(t1.(DerivedType).getBaseType().getUnspecifiedType(), t2.(DerivedType).getBaseType().getUnspecifiedType())
+}
+predicate baseElement(ArrayType t, Type e) {
+ t.getBaseType() instanceof ArrayType and baseElement(t.getBaseType(), e)
+ or not t.getBaseType() instanceof ArrayType and e = t.getBaseType()
+}
+
+from Expr e, Class cl
+where e.getType() instanceof ArrayType
+ and exists(
+ FunctionCall c, int i, Function f |
+ c.getArgument(i) = e
+ and
+ c.getTarget() = f
+ and
+ exists(Parameter p | f.getParameter(i) = p) // varargs
+ and
+ baseElement(e.getType(), cl) // only interested in arrays with classes
+ and
+ not compatible(f.getParameter(i).getType().getUnspecifiedType(), e.getType().getUnspecifiedType()))
+ select e, "AV Rule 96: Arrays shall not be teated polymorphically"
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 97.1.ql b/cpp/ql/src/jsf/4.10 Classes/AV Rule 97.1.ql
new file mode 100644
index 000000000000..455add085d5f
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 97.1.ql
@@ -0,0 +1,13 @@
+/**
+ * @name AV Rule 97.1
+ * @description Neither operand of an equality operator (== or !=) shall be a pointer to a virtual member function.
+ * @kind problem
+ * @id cpp/jsf/av-rule-97-1
+ * @problem.severity error
+ */
+import cpp
+
+from EqualityOperation e, PointerToMemberType t, Class c
+where e.getAnOperand().getType() = t
+ and t.getClass() = c and exists(VirtualFunction f | c.getAMemberFunction() = f)
+select e, "AV Rule 97.1: Neither operand of an equality operator shall be a pointer to a virtual member function."
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 97.cpp b/cpp/ql/src/jsf/4.10 Classes/AV Rule 97.cpp
new file mode 100644
index 000000000000..ef3e59b02f4f
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 97.cpp
@@ -0,0 +1,4 @@
+void f(char buf[]) { //wrong: uses an array as a parameter type
+ int length = sizeof(buf); //will return sizeof(char*), not the size of the array passed
+ ...
+}
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 97.qhelp b/cpp/ql/src/jsf/4.10 Classes/AV Rule 97.qhelp
new file mode 100644
index 000000000000..102b92471d80
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 97.qhelp
@@ -0,0 +1,41 @@
+
+
+
+
+
+
+
+This rule finds class members (functions or data) that are or use arrays. This is particularly important for
+functions with array type parameters, as these parameters are treated as pointers to the array's first element
+inside the function (array decay). Assuming that it is still has the type of the array passed to the function can cause unexpected
+behavior (e.g. when using the sizeof operator).
+
+
+
+
+
+
+Use the Array class, or explicitly declare the variable/parameter as a pointer so there is no possibility for confusion.
+
+
+
+
+
+
+
+
+
+
+
+
+ AV Rule 97, Joint Strike Fighter Air Vehicle C++ Coding Standards. Lockheed Martin Corporation, 2005.
+
+
+ comp.lang.c FAQ list · Question 6.3
+
+
+
+
+
diff --git a/cpp/ql/src/jsf/4.10 Classes/AV Rule 97.ql b/cpp/ql/src/jsf/4.10 Classes/AV Rule 97.ql
new file mode 100644
index 000000000000..256b1174ccb4
--- /dev/null
+++ b/cpp/ql/src/jsf/4.10 Classes/AV Rule 97.ql
@@ -0,0 +1,32 @@
+/**
+ * @name No raw arrays in interfaces
+ * @description Arrays should not be used in interfaces. Arrays degenerate to pointers when passed as parameters. This array decay problem has long been known to be a source of errors. Consider using std::vector or encapsulating the array in an Array class.
+ * @kind problem
+ * @problem.severity recommendation
+ * @precision high
+ * @id cpp/array-in-interface
+ * @tags reliability
+ * readability
+ * language-features
+ */
+import cpp
+
+predicate containsArray(Type t) {
+ t instanceof ArrayType
+ or containsArray(t.(PointerType).getBaseType())
+ or containsArray(t.(SpecifiedType).getBaseType())
+ or (containsArray(t.getUnderlyingType()) and not exists(TypedefType allowed | allowed = t |
+ allowed.hasGlobalName("jmp_buf") or
+ allowed.hasGlobalName("va_list")
+ ))
+}
+
+predicate functionAPIViolation(MemberFunction f) {
+ f.isPublic() and
+ containsArray(f.getAParameter().getType())
+}
+
+from MemberFunction m
+where functionAPIViolation(m)
+ and not m.getDeclaringType() instanceof Struct
+select m, "Raw arrays should not be used in interfaces. A container class should be used instead."
diff --git a/cpp/ql/src/jsf/4.11 Namespaces/AV Rule 99.ql b/cpp/ql/src/jsf/4.11 Namespaces/AV Rule 99.ql
new file mode 100644
index 000000000000..920853145fcd
--- /dev/null
+++ b/cpp/ql/src/jsf/4.11 Namespaces/AV Rule 99.ql
@@ -0,0 +1,19 @@
+/**
+ * @name AV Rule 99
+ * @description Namespaces will not be nested more than two levels deep
+ * @kind problem
+ * @id cpp/jsf/av-rule-99
+ * @problem.severity warning
+ */
+import cpp
+
+// Pick a representative file for a namespace - more than a bit dodgy, but otherwise
+// the results don't show up anywhere which is less than helpful
+predicate namespaceRepresentative(Namespace ns, File rep) {
+ rep.getAbsolutePath() = min(File f | exists(Declaration d | d = ns.getADeclaration() | d.getFile() = f) | f.getAbsolutePath())
+}
+
+from Namespace ns, File rep
+where exists(ns.getParentNamespace().getParentNamespace().getParentNamespace())
+ and namespaceRepresentative(ns, rep)
+select rep, "AV Rule 99: namespace " + ns.toString() + " is nested more than two levels deep"
diff --git a/cpp/ql/src/jsf/4.12 Templates/AV Rule 104.ql b/cpp/ql/src/jsf/4.12 Templates/AV Rule 104.ql
new file mode 100644
index 000000000000..2c4037770ba8
--- /dev/null
+++ b/cpp/ql/src/jsf/4.12 Templates/AV Rule 104.ql
@@ -0,0 +1,27 @@
+/**
+ * @name AV Rule 104
+ * @description A template specialization shall be declared before its use.
+ * @kind problem
+ * @id cpp/jsf/av-rule-104
+ * @problem.severity error
+ */
+import cpp
+
+/** A compiler warning that a template specialization occurs after
+ * what would have been its use. In C++ a template specialization
+ * only applies after it is defined; if it would have applied had
+ * it been defined earlier this warning is triggered.
+ *
+ * The warning is also triggered if the specialization would have
+ * made a use ambiguous had it occurred earlier. */
+class WarningLateTemplateSpecialization extends CompilerWarning {
+
+ WarningLateTemplateSpecialization() {
+ this.getTag() = "partial_spec_after_instantiation" or
+ this.getTag() = "partial_spec_after_instantiation_ambiguous"
+ }
+
+}
+
+from WarningLateTemplateSpecialization warning
+select warning, "AV Rule 104: A template specialization shall be declared before its use; " + warning.getMessage() + "."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.13 Functions/AV Rule 107.cpp b/cpp/ql/src/jsf/4.13 Functions/AV Rule 107.cpp
new file mode 100644
index 000000000000..252c9967076e
--- /dev/null
+++ b/cpp/ql/src/jsf/4.13 Functions/AV Rule 107.cpp
@@ -0,0 +1,10 @@
+int f() {
+ extern int other(); //scope of externs is the entire file, not just the
+ //block where it is declared
+ ...
+ other()
+}
+
+int g() {
+ other(); //this will use the other() function declared inside f()
+}
diff --git a/cpp/ql/src/jsf/4.13 Functions/AV Rule 107.qhelp b/cpp/ql/src/jsf/4.13 Functions/AV Rule 107.qhelp
new file mode 100644
index 000000000000..46463d413ef3
--- /dev/null
+++ b/cpp/ql/src/jsf/4.13 Functions/AV Rule 107.qhelp
@@ -0,0 +1,39 @@
+
+
+
+
+
+
+This rule finds functions that are declared in a block.
+It is confusing to declare a function at block scope, and the visibility of the function is not what would be expected.
+extern function declarations inside a block, which are allowed in C, are particularly confusing, as the scope
+of the declaration is the entire file, not just the block where it was declared.
+
+
+
+
+
+
+Declare the function in file scope to prevent any confusion as to its visibility.
+
+
+
+
+
+
+
+
+
+
+
+ AV Rule 107, Joint Strike Fighter Air Vehicle C++ Coding Standards. Lockheed Martin Corporation, 2005.
+
+
+ MISRA C++ Rule 3-1-2, Guidelines for the use of the C++ language in critical systems. The Motor Industry Software Reliability Associate, 2008.
+
+
+
+
+
diff --git a/cpp/ql/src/jsf/4.13 Functions/AV Rule 107.ql b/cpp/ql/src/jsf/4.13 Functions/AV Rule 107.ql
new file mode 100644
index 000000000000..223413301507
--- /dev/null
+++ b/cpp/ql/src/jsf/4.13 Functions/AV Rule 107.ql
@@ -0,0 +1,17 @@
+/**
+ * @name Function declared in block
+ * @description Functions should always be declared at file scope. It is confusing to declare a function at block scope, and the visibility of the function is not what would be expected.
+ * @kind problem
+ * @problem.severity warning
+ * @precision high
+ * @id cpp/function-in-block
+ * @tags maintainability
+ * readability
+ */
+import cpp
+
+from DeclStmt ds
+where ds.getADeclaration() instanceof Function
+ and not ds.isInMacroExpansion()
+ and not exists(MacroInvocation mi | mi.getLocation() = ds.getADeclarationEntry().getLocation())
+select ds, "Functions should be declared at file scope, not inside blocks."
diff --git a/cpp/ql/src/jsf/4.13 Functions/AV Rule 108.ql b/cpp/ql/src/jsf/4.13 Functions/AV Rule 108.ql
new file mode 100644
index 000000000000..1ece9be6fe80
--- /dev/null
+++ b/cpp/ql/src/jsf/4.13 Functions/AV Rule 108.ql
@@ -0,0 +1,12 @@
+/**
+ * @name AV Rule 108
+ * @description Functions with variable number of arguments shall not be used.
+ * @kind problem
+ * @id cpp/jsf/av-rule-108
+ * @problem.severity error
+ */
+import cpp
+
+from Function f
+where f.fromSource() and f.hasSpecifier("varargs")
+select f, "AV Rule 108: Functions with variable number of arguments shall not be used."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.13 Functions/AV Rule 110.ql b/cpp/ql/src/jsf/4.13 Functions/AV Rule 110.ql
new file mode 100644
index 000000000000..16e24b9697b3
--- /dev/null
+++ b/cpp/ql/src/jsf/4.13 Functions/AV Rule 110.ql
@@ -0,0 +1,13 @@
+/**
+ * @name AV Rule 110
+ * @description Functions with more than 7 arguments will not be used.
+ * @kind problem
+ * @id cpp/jsf/av-rule-110
+ * @problem.severity warning
+ */
+import cpp
+
+from Function f
+where f.getNumberOfParameters() > 7
+ and f.fromSource()
+select f, "AV Rule 110: Functions with more than 7 arguments will not be used."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.13 Functions/AV Rule 111.cpp b/cpp/ql/src/jsf/4.13 Functions/AV Rule 111.cpp
new file mode 100644
index 000000000000..9b229f857060
--- /dev/null
+++ b/cpp/ql/src/jsf/4.13 Functions/AV Rule 111.cpp
@@ -0,0 +1,7 @@
+Record* fixRecord(Record* r) {
+ Record myRecord = *r;
+ delete r;
+
+ myRecord.fix();
+ return &myRecord; //returns pointer to myRecord, which is a stack-allocated object
+}
diff --git a/cpp/ql/src/jsf/4.13 Functions/AV Rule 111.qhelp b/cpp/ql/src/jsf/4.13 Functions/AV Rule 111.qhelp
new file mode 100644
index 000000000000..577784582cc7
--- /dev/null
+++ b/cpp/ql/src/jsf/4.13 Functions/AV Rule 111.qhelp
@@ -0,0 +1,35 @@
+
+
+
+
+
+
+This rule finds return statements that return pointers to an object allocated on the stack. The lifetime
+of a stack allocated memory location only lasts until the function returns, , and
+the contents of that memory become undefined after that. Clearly, using a pointer to stack
+memory after the function has already returned will have undefined results.
+
+
+
+
+
+
+
+
+
+Do not return pointers to stack memory locations. Instead, create an output parameter, or create a heap-allocated
+buffer, copy the contents of the stack allocated memory to that buffer and return that instead.
+
+
+
+
+
+
+
+
+
+AV Rule 111, Joint Strike Fighter Air Vehicle C++ Coding Standards. Lockheed Martin Corporation, 2005.
+
+
diff --git a/cpp/ql/src/jsf/4.13 Functions/AV Rule 111.ql b/cpp/ql/src/jsf/4.13 Functions/AV Rule 111.ql
new file mode 100644
index 000000000000..edc3f8c646dd
--- /dev/null
+++ b/cpp/ql/src/jsf/4.13 Functions/AV Rule 111.ql
@@ -0,0 +1,25 @@
+/**
+ * @name Return stack-allocated object
+ * @description A function must not return a pointer or reference to a non-static local object.
+ * @kind problem
+ * @id cpp/jsf/av-rule-111
+ * @problem.severity error
+ * @tags reliability
+ */
+import semmle.code.cpp.pointsto.PointsTo
+
+class ReturnPointsToExpr extends PointsToExpr
+{
+ override predicate interesting() {
+ exists(ReturnStmt ret | ret.getExpr() = this)
+ and pointerValue(this)
+ }
+
+ ReturnStmt getReturnStmt() { result.getExpr() = this }
+}
+
+from ReturnPointsToExpr ret, LocalVariable dest
+where ret.pointsTo() = dest
+ and ret.getReturnStmt().getParentStmt().getEnclosingFunction() = dest.getFunction()
+ and not(dest.isStatic())
+select ret.getReturnStmt(), "AV Rule 111: A function shall not return a pointer or reference to a non-static local object."
diff --git a/cpp/ql/src/jsf/4.13 Functions/AV Rule 113.ql b/cpp/ql/src/jsf/4.13 Functions/AV Rule 113.ql
new file mode 100644
index 000000000000..938e8b3a81e6
--- /dev/null
+++ b/cpp/ql/src/jsf/4.13 Functions/AV Rule 113.ql
@@ -0,0 +1,14 @@
+/**
+ * @name AV Rule 113
+ * @description Functions will have a single exit point.
+ * @kind problem
+ * @id cpp/jsf/av-rule-113
+ * @problem.severity warning
+ */
+import cpp
+
+from Function f, Stmt s1, Stmt s2
+where s1 = f.getAPredecessor().getEnclosingStmt() and
+ s2 = f.getAPredecessor().getEnclosingStmt() and
+ s1 != s2
+select f, "AV Rule 113: Functions will have a single exit point."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.13 Functions/AV Rule 114.cpp b/cpp/ql/src/jsf/4.13 Functions/AV Rule 114.cpp
new file mode 100644
index 000000000000..101736499c5c
--- /dev/null
+++ b/cpp/ql/src/jsf/4.13 Functions/AV Rule 114.cpp
@@ -0,0 +1,8 @@
+int f() {
+ ...
+ if (error) {
+ return -1;
+ }
+ ...
+ //wrong: no explicit return here, value returned is undefined
+}
diff --git a/cpp/ql/src/jsf/4.13 Functions/AV Rule 114.qhelp b/cpp/ql/src/jsf/4.13 Functions/AV Rule 114.qhelp
new file mode 100644
index 000000000000..e47368f5d664
--- /dev/null
+++ b/cpp/ql/src/jsf/4.13 Functions/AV Rule 114.qhelp
@@ -0,0 +1,45 @@
+
+
+
+
+
+
+This rule finds non-void functions with an execution path that does not return through an explicit
+return statement. The return value in such a case is undefined. For example, in the cdecl
+calling convention for x86, it would be whatever value was in the AX/EAX register when the function returned,
+assuming the function had a non-float return type that can fit in a machine word.
+
+
+
+
+
+
+
+
+Make sure that all execution paths in the function exit through an explicit return statement.
+
+
+
+
+
+
+
+
+
+
+
+
+ AV Rule 114, Joint Strike Fighter Air Vehicle C++ Coding Standards. Lockheed Martin Corporation, 2005.
+
+
+ MISRA C++ Rule 8-4-3, Guidelines for the use of the C++ language in critical systems. The Motor Industry Software Reliability Associate, 2008.
+
+
+ The return Statement
+
+
+
+
+
diff --git a/cpp/ql/src/jsf/4.13 Functions/AV Rule 114.ql b/cpp/ql/src/jsf/4.13 Functions/AV Rule 114.ql
new file mode 100644
index 000000000000..71bab6e01be7
--- /dev/null
+++ b/cpp/ql/src/jsf/4.13 Functions/AV Rule 114.ql
@@ -0,0 +1,44 @@
+/**
+ * @name Missing return statement
+ * @description All functions that are not void should return a value on every exit path.
+ * @kind problem
+ * @problem.severity error
+ * @precision medium
+ * @id cpp/missing-return
+ * @tags reliability
+ * readability
+ * language-features
+ */
+import cpp
+
+/* This is slightly subtle: The extractor adds a dummy 'return;' statement for control paths
+ that fall off the end of a function. So we can simply look for non-void functions containing
+ a non-value carrying return. If the predecessor is a return statement it means that
+ the return did not return a value. (If that return was not added by the extractor but by the
+ programmer, we can flag it anyway, since this is arguably a bug.) */
+
+predicate functionsMissingReturnStmt(Function f, ControlFlowNode blame) {
+ f.fromSource() and
+ not f.getType().getUnderlyingType().getUnspecifiedType() instanceof VoidType and
+ exists(ReturnStmt s | f.getAPredecessor() = s | blame = s.getAPredecessor())}
+
+/* If a function has a value-carrying return statement, but the extractor hit a snag
+ whilst parsing the value, then the control flow graph will not include the value.
+ As such, to avoid embarrassing false positives, we exclude any function which
+ wasn't perfectly extracted. */
+predicate functionImperfectlyExtracted(Function f) {
+ exists(CompilerError e | f.getBlock().getLocation().subsumes(e.getLocation()))
+ or
+ exists(ErrorExpr ee | ee.getEnclosingFunction() = f)
+}
+
+from Stmt stmt, string msg
+where
+ exists(Function f, ControlFlowNode blame |
+ functionsMissingReturnStmt(f, blame) and
+ reachable(blame) and
+ not functionImperfectlyExtracted(f) and
+ (blame = stmt or blame.(Expr).getEnclosingStmt() = stmt) and
+ msg = "Function " + f.getName() + " should return a value of type " + f.getType().getName() + " but does not return a value here"
+ )
+select stmt, msg
diff --git a/cpp/ql/src/jsf/4.13 Functions/AV Rule 115.ql b/cpp/ql/src/jsf/4.13 Functions/AV Rule 115.ql
new file mode 100644
index 000000000000..af81266e1d86
--- /dev/null
+++ b/cpp/ql/src/jsf/4.13 Functions/AV Rule 115.ql
@@ -0,0 +1,39 @@
+/**
+ * @name AV Rule 115
+ * @description If a function returns error information, then that
+ * information will be tested.
+ * @kind problem
+ * @id cpp/jsf/av-rule-115
+ * @problem.severity warning
+ */
+import cpp
+
+// a return statement that looks like it returns an error code
+// we use an extremely simple approximation: any return statement that returns
+// a literal or a symbolic constant is considered to return an error code; we
+// make an exception for integral constant zero, which often indicates success
+// (unlike, of course, the null pointer)
+class ErrorReturn extends ReturnStmt {
+ ErrorReturn() {
+ exists(Expr e |
+ e = super.getExpr() and
+ (e instanceof Literal
+ or e.(VariableAccess).getTarget().isConst()) and
+ not (e.getValue() = "0" and e.getActualType() instanceof IntegralType))
+ }
+}
+
+// a function that has both a return statement returning an error code, and one that doesn't
+class FunctionReturningErrorCode extends Function {
+ FunctionReturningErrorCode() {
+ exists(ErrorReturn er, ReturnStmt nr |
+ er.getEnclosingFunction() = this and
+ nr.getEnclosingFunction() = this and
+ not nr instanceof ErrorReturn)
+ }
+}
+
+from FunctionReturningErrorCode frec, Call c
+where c = frec.getACallToThisFunction() and
+ c instanceof ExprInVoidContext
+select c, "AV Rule 115: If a function returns error information, it will be tested."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.13 Functions/AV Rule 119.ql b/cpp/ql/src/jsf/4.13 Functions/AV Rule 119.ql
new file mode 100644
index 000000000000..e45afd248802
--- /dev/null
+++ b/cpp/ql/src/jsf/4.13 Functions/AV Rule 119.ql
@@ -0,0 +1,13 @@
+/**
+ * @name AV Rule 119
+ * @description Functions shall not call themselves, either directly or indirectly (i.e. recursion shall not be allowed).
+ * @kind problem
+ * @id cpp/jsf/av-rule-119
+ * @problem.severity error
+ */
+import cpp
+
+from Function f
+where f.fromSource() and
+ f.calls+(f)
+select f, "Functions shall not call theselves, either directly or indirectly"
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.14 Comments/AV Rule 126.ql b/cpp/ql/src/jsf/4.14 Comments/AV Rule 126.ql
new file mode 100644
index 000000000000..975489f30f28
--- /dev/null
+++ b/cpp/ql/src/jsf/4.14 Comments/AV Rule 126.ql
@@ -0,0 +1,13 @@
+/**
+ * @name AV Rule 126
+ * @description Only valid C++ style comments shall be used.
+ * @kind problem
+ * @id cpp/jsf/av-rule-126
+ * @problem.severity error
+ */
+import cpp
+
+from Comment c
+where c.fromSource() and
+ not c.getContents().regexpMatch("\\s*//.*")
+select c, "AV Rule 126: Only valid C++ style comments shall be used."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.14 Comments/AV Rule 127.ql b/cpp/ql/src/jsf/4.14 Comments/AV Rule 127.ql
new file mode 100644
index 000000000000..e8dfa01e54db
--- /dev/null
+++ b/cpp/ql/src/jsf/4.14 Comments/AV Rule 127.ql
@@ -0,0 +1,14 @@
+/**
+ * @name AV Rule 127
+ * @description Code that is not used (commented out) shall be deleted.
+ * @kind problem
+ * @id cpp/jsf/av-rule-127
+ * @problem.severity error
+ */
+
+import cpp
+import external.ExternalArtifact
+
+from DefectExternalData d
+where d.getQueryPath() = "jsf/4.14 Comments/AV Rule 127.ql"
+select d, d.getMessage()
diff --git a/cpp/ql/src/jsf/4.14 Comments/AV Rule 133.ql b/cpp/ql/src/jsf/4.14 Comments/AV Rule 133.ql
new file mode 100644
index 000000000000..6de8e990e3e2
--- /dev/null
+++ b/cpp/ql/src/jsf/4.14 Comments/AV Rule 133.ql
@@ -0,0 +1,58 @@
+/**
+ * @name AV Rule 133
+ * @description Every source file will be documented with an introductory comment that provides information on the file name, its contents, and any program-required information (eg. legal statements, copyright information, etc)
+ * @kind problem
+ * @id cpp/jsf/av-rule-133
+ * @problem.severity warning
+ */
+import cpp
+
+class FirstComment extends Comment {
+
+ FirstComment() {
+ not exists(Locatable l | l != this and shouldNotBeBefore(l) and l.getFile() = this.getFile() and l.getLocation().getEndLine() <= this.getLocation().getStartLine())
+ }
+
+ /*
+ * Test whether the comment is a reasonable start-of-file comment.
+ * CUSTOMIZATION POINT: INSERT STYLE RULES FOR THE START-OF-FILE COMMENT HERE
+ * Simple checks only - if there is a comment at the beginning of the file, that
+ * is pretty much enough
+ */
+ predicate isValid() {
+ // At least 3 lines long: make sure it's a proper comment
+ this.getLocation().getEndLine() >= this.getLocation().getStartLine() + 2
+ and
+ exists (string contents | contents = this.getContents() |
+ // Make sure the name of the file is included
+ contents.matches("%" + this.getFile().getShortName() + "%")
+ // Other checks could go here; for instance containing a standard copyright notice
+ )
+ }
+
+}
+
+/** Elements that should not appear before the 'first' comment */
+predicate shouldNotBeBefore(Locatable l) {
+ l instanceof Comment or
+ l instanceof Declaration or
+ l instanceof PreprocessorDirective
+}
+
+from File f, Element blame, string message
+where f.fromSource() and
+ (
+ (
+ not exists(FirstComment comment | comment.getFile() = f)
+ and blame = f
+ and message = ""
+ )
+
+ or
+
+ (
+ exists(FirstComment comment | comment.getFile() = f and not comment.isValid() and blame = comment )
+ and message = "The introductory comment does not match the required style rules."
+ )
+ )
+select blame, "AV Rule 133: every source file will be documented with an introductory comment. " + message
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.15 Declarations and Definitions/AV Rule 135.cpp b/cpp/ql/src/jsf/4.15 Declarations and Definitions/AV Rule 135.cpp
new file mode 100644
index 000000000000..7cfe4617035d
--- /dev/null
+++ b/cpp/ql/src/jsf/4.15 Declarations and Definitions/AV Rule 135.cpp
@@ -0,0 +1,12 @@
+void f() {
+ int i = 10;
+
+ for (int i = 0; i < 10; i++) { //the loop counter hides the variable
+ ...
+ }
+
+ {
+ int i = 12; //this variable hides the variable in the outer block
+ ...
+ }
+}
diff --git a/cpp/ql/src/jsf/4.15 Declarations and Definitions/AV Rule 135.qhelp b/cpp/ql/src/jsf/4.15 Declarations and Definitions/AV Rule 135.qhelp
new file mode 100644
index 000000000000..33de5f3b5812
--- /dev/null
+++ b/cpp/ql/src/jsf/4.15 Declarations and Definitions/AV Rule 135.qhelp
@@ -0,0 +1,29 @@
+
+
+
+
+
+
+This rule finds identifiers in an inner scope that hide (have the same name as) an identifier in an outer scope.
+This should be avoided as it can cause confusion about the actual variable being used in an expression.
+
+
+
+
+
+
+Change the name of the identifier so it does not hide another on an outer scope.
+
+
+
+
+
+
+
+
+
+
+AV Rule 135, Joint Strike Fighter Air Vehicle C++ Coding Standards. Lockheed Martin Corporation, 2005.
+
diff --git a/cpp/ql/src/jsf/4.15 Declarations and Definitions/AV Rule 135.ql b/cpp/ql/src/jsf/4.15 Declarations and Definitions/AV Rule 135.ql
new file mode 100644
index 000000000000..d5fb20d4883a
--- /dev/null
+++ b/cpp/ql/src/jsf/4.15 Declarations and Definitions/AV Rule 135.ql
@@ -0,0 +1,39 @@
+/**
+ * @name Hiding identifiers
+ * @description Identifiers in an inner scope should not use the same name as an identifier in an outer scope, and therefore hide that identifier.
+ * @kind problem
+ * @id cpp/jsf/av-rule-135
+ * @problem.severity recommendation
+ * @tags maintainability
+ */
+import cpp
+import Best_Practices.Hiding.Shadowing
+
+// Shadowing globals by locals or parameters. Only in the same file;
+// otherwise the rule is violated too often
+
+class LocalVariableOrParameter extends Variable {
+ LocalVariableOrParameter() {
+ this instanceof LocalVariable or this instanceof Parameter
+ }
+
+ predicate shadowsGlobal(GlobalVariable gv) {
+ this.getName() = gv.getName() and this.getFile() = gv.getFile()
+ }
+}
+
+// Shadowing parameters by locals
+
+predicate localShadowsParameter(LocalVariable lv, Parameter p) {
+ p.getName() = lv.getName() and
+ p.getFunction() = lv.getFunction()
+}
+
+from Variable v, Variable shadowed
+where not v.getParentScope().(Block).isInMacroExpansion() and
+ (
+ v.(LocalVariableOrParameter).shadowsGlobal((GlobalVariable)shadowed)
+ or localShadowsParameter(v, shadowed)
+ or shadowing(v, shadowed)
+ )
+select v, "Identifiers in an inner scope should not hide identifiers in an outer scope"
diff --git a/cpp/ql/src/jsf/4.15 Declarations and Definitions/AV Rule 138.ql b/cpp/ql/src/jsf/4.15 Declarations and Definitions/AV Rule 138.ql
new file mode 100644
index 000000000000..0a6744aed2ce
--- /dev/null
+++ b/cpp/ql/src/jsf/4.15 Declarations and Definitions/AV Rule 138.ql
@@ -0,0 +1,42 @@
+/**
+ * @name AV Rule 138
+ * @description Identifiers shall not simultaneously have both internal and external linkage in the same translation unit.
+ * @kind problem
+ * @id cpp/jsf/av-rule-138
+ * @problem.severity error
+ */
+import cpp
+
+/*
+ * Interpretation: the standards doc is a bit unclear on this rule, making it sound like it is
+ * about name shadowing when rule 135 prevents shadowing anyway. This is supported by the example,
+ * which incorrectly points to a variable with static storage but no linkage as having internal
+ * linkage.
+ *
+ * We interpret it as: do not have two declarations of the same identifier *anywhere* in the same
+ * translation unit if one has internal linkage and the other external linkage.
+ *
+ * RESTRICTION: variable names only.
+ * NOTE: only applies to C++; rules for C are different.
+ */
+
+// FOR FUTURE REFERENCE ONLY - CURRENTLY USELESS BECAUSE OF POPULATOR LIMITATIONS
+// We need to have all the declarations of a variable to make this work; the extractor
+// does not currently provide that.
+
+predicate externalLinkage(Variable v) {
+ v.getADeclarationEntry().hasSpecifier("extern")
+ or v instanceof GlobalVariable and
+ not v.isConst() and
+ not v.isStatic()
+}
+
+predicate internalLinkage(GlobalVariable v) {
+ v.isStatic()
+ or v.isConst() and
+ not v.hasSpecifier("extern")
+}
+
+from Variable v
+where externalLinkage(v) and internalLinkage(v)
+select v, "AV Rule 138: Identifiers shall not simultaneously have both internal and external linkage in the same translation unit."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.15 Declarations and Definitions/AV Rule 139.ql b/cpp/ql/src/jsf/4.15 Declarations and Definitions/AV Rule 139.ql
new file mode 100644
index 000000000000..1d8a8849ac1b
--- /dev/null
+++ b/cpp/ql/src/jsf/4.15 Declarations and Definitions/AV Rule 139.ql
@@ -0,0 +1,40 @@
+/**
+ * @name AV Rule 139
+ * @description External objects will not be declared in more than one file
+ * @kind problem
+ * @id cpp/jsf/av-rule-139
+ * @problem.severity warning
+ */
+import cpp
+
+predicate twoDeclarations(Declaration element, Location l1, Location l2) {
+ l1 = element.getADeclarationLocation() and
+ l2 = element.getADeclarationLocation() and
+ l1.getFile() != l2.getFile() and
+ l1 != element.getDefinitionLocation() and
+ l2 != element.getDefinitionLocation()
+}
+
+predicate twoDeclarationFilesWithDifferentNames(Declaration d, string f1, string f2) {
+ f1 = min(string s, File f, Location l | twoDeclarations(d, l, _) and l.getFile() = f and s = f.getBaseName() | s) and
+ f2 = min(string s, File f, Location l | twoDeclarations(d, l, _) and l.getFile() = f and s = f.getBaseName() and s != f1 | s)
+}
+
+predicate twoDeclarationFilesWithSameNames(Declaration d, string f1, string f2) {
+ f1 = min(string s, File f, Location l | twoDeclarations(d, l, _) and l.getFile() = f and s = f.toString() | s) and
+ f2 = min(string s, File f, Location l | twoDeclarations(d, l, _) and l.getFile() = f and s = f.toString() and s != f1 | s)
+}
+
+
+predicate twoDeclarationFilesMessage(Declaration d, string msg) {
+ // If we can get two files with different names, all the better for the error message
+ if twoDeclarationFilesWithDifferentNames(d,_,_) then
+ exists(string f1, string f2 | twoDeclarationFilesWithDifferentNames(d, f1, f2) and msg = "Declared in " + f1 + " and " + f2)
+ else
+ exists(string f1, string f2 | twoDeclarationFilesWithSameNames(d, f1, f2) and msg = "Declared in " + f1 + " and " + f2)
+}
+
+from Declaration d, string msg
+where twoDeclarations(d, _, _) and
+ twoDeclarationFilesMessage(d, msg)
+select d, "AV Rule 139: external objects will not be declared in more than one file. " + msg
diff --git a/cpp/ql/src/jsf/4.15 Declarations and Definitions/AV Rule 140.cpp b/cpp/ql/src/jsf/4.15 Declarations and Definitions/AV Rule 140.cpp
new file mode 100644
index 000000000000..ecb89ff7ff15
--- /dev/null
+++ b/cpp/ql/src/jsf/4.15 Declarations and Definitions/AV Rule 140.cpp
@@ -0,0 +1,16 @@
+int f() {
+ //wrong: register storage specifier used
+ register int i; //these register definitions can crowd out the
+ //variables x1 to x5 that are used in the complex
+ //operation in the inner loop, leading to slower
+ //performance
+ register int j;
+
+ for (i = 0; i < HUGE_NUM; i++) {
+ for (j = 0; j < HUGE_NUM; j++) {
+ int x1, x2, x3, x4, x5;
+ //complex CPU-intensive operation that accesses
+ //x1 to x5 a large number of times
+ }
+ }
+}
diff --git a/cpp/ql/src/jsf/4.15 Declarations and Definitions/AV Rule 140.qhelp b/cpp/ql/src/jsf/4.15 Declarations and Definitions/AV Rule 140.qhelp
new file mode 100644
index 000000000000..50354e8788cd
--- /dev/null
+++ b/cpp/ql/src/jsf/4.15 Declarations and Definitions/AV Rule 140.qhelp
@@ -0,0 +1,31 @@
+
+
+
+
+
+
+This rule finds variables with the register storage class specifier. Modern compilers are now capable of
+optimal register placement, and overriding it could lead to worse performance.
+
+
+
+
+
+
+Remove the register storage class specifier.
+
+
+
+
+
+
+
+
+
+
+AV Rule 140, Joint Strike Fighter Air Vehicle C++ Coding Standards. Lockheed Martin Corporation, 2005.
+M. Banahan, D. Brady, M. Doram. The C Book. Section 8.2.1.1. http://publications.gbdirect.co.uk/c_book/
+
+
diff --git a/cpp/ql/src/jsf/4.15 Declarations and Definitions/AV Rule 140.ql b/cpp/ql/src/jsf/4.15 Declarations and Definitions/AV Rule 140.ql
new file mode 100644
index 000000000000..7a0e6f58661a
--- /dev/null
+++ b/cpp/ql/src/jsf/4.15 Declarations and Definitions/AV Rule 140.ql
@@ -0,0 +1,13 @@
+/**
+ * @name Register variables
+ * @description The register storage class specifier shall not be used. It is better and more portable to rely on the compiler to allocate registers automatically.
+ * @kind problem
+ * @id cpp/jsf/av-rule-140
+ * @problem.severity warning
+ * @tags portability
+ */
+import cpp
+
+from Declaration d
+where d.hasSpecifier("register")
+select d, "The register storage class specifier should not be used; compilers can be trusted to decide whether to store a variable in a register."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.16 Initialization/AV Rule 142.ql b/cpp/ql/src/jsf/4.16 Initialization/AV Rule 142.ql
new file mode 100644
index 000000000000..570a3566d4a1
--- /dev/null
+++ b/cpp/ql/src/jsf/4.16 Initialization/AV Rule 142.ql
@@ -0,0 +1,54 @@
+/**
+ * @name AV Rule 142
+ * @description All variables shall be initialized before use.
+ * @kind problem
+ * @id cpp/jsf/av-rule-142
+ * @problem.severity error
+ */
+import cpp
+
+// whether s defines variable v (conservative)
+predicate defines(ControlFlowNode s, Variable lv) {
+ exists(VariableAccess va | va = s and va.getTarget() = lv and va.isLValue())
+}
+
+// whether s uses variable v (conservative)
+predicate uses(ControlFlowNode s, Variable lv) {
+ exists(VariableAccess va | va = s and va.getTarget() = lv and va.isRValue()
+ and not va.getParent+() instanceof SizeofOperator)
+}
+
+// whether there is a path from the declaration of lv to n such that lv is definitely not defined before n
+predicate noDefPath(LocalVariable lv, ControlFlowNode n) {
+ n.(DeclStmt).getADeclaration() = lv and not exists(lv.getInitializer())
+ or exists(ControlFlowNode p | noDefPath(lv, p) and n = p.getASuccessor() and not defines(p, lv))
+}
+
+predicate isAggregateType(Type t) {
+ t instanceof Class or t instanceof ArrayType
+}
+
+// whether va is a use of a local variable that has not been previously defined
+predicate undefinedLocalUse(VariableAccess va) {
+ exists(LocalVariable lv |
+ // it is hard to tell when a struct or array has been initialised, so we ignore them
+ not isAggregateType(lv.getUnderlyingType()) and
+ not lv.getType().hasName("va_list") and
+ va = lv.getAnAccess() and
+ noDefPath(lv, va) and
+ uses(va, lv))
+}
+
+// whether gv is a potentially uninitialised global variable
+predicate uninitialisedGlobal(GlobalVariable gv) {
+ exists(VariableAccess va |
+ not isAggregateType(gv.getUnderlyingType()) and
+ va = gv.getAnAccess() and
+ va.isRValue() and
+ not gv.hasInitializer() and
+ not gv.hasSpecifier("extern"))
+}
+
+from Element elt
+where undefinedLocalUse(elt) or uninitialisedGlobal(elt)
+select elt, "AV Rule 142: All variables shall be initialized before use."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.16 Initialization/AV Rule 143.ql b/cpp/ql/src/jsf/4.16 Initialization/AV Rule 143.ql
new file mode 100644
index 000000000000..595b414ee9be
--- /dev/null
+++ b/cpp/ql/src/jsf/4.16 Initialization/AV Rule 143.ql
@@ -0,0 +1,45 @@
+/**
+ * @name AV Rule 143
+ * @description Variables will not be introduced until they can be initialized
+ * with meaningful values.
+ * @kind problem
+ * @id cpp/jsf/av-rule-143
+ * @problem.severity warning
+ */
+import cpp
+
+// whether s defines variable v (conservative)
+predicate defines(VariableAccess va, Variable lv) {
+ va.getTarget() = lv and va.isLValue()
+}
+
+// whether s uses variable v (conservative)
+predicate uses(ControlFlowNode s, Variable lv) {
+ exists(VariableAccess va | va = s and va.getTarget() = lv and va.isRValue()
+ and not va.getParent+() instanceof SizeofOperator)
+}
+
+// whether there is a path from the declaration of lv to n such that lv is definitely not used or defined
+// before n
+predicate noDefUsePath(LocalVariable lv, ControlFlowNode n) {
+ n.(DeclStmt).getADeclaration() = lv
+ or exists(ControlFlowNode p | noDefUsePath(lv, p) and
+ n = p.getASuccessor() and
+ not defines(p, lv) and
+ not uses(p, lv))
+}
+
+predicate neighbouringStmts(Stmt s1, Stmt s2) {
+ exists(Block b, int i |
+ i in [0..b.getNumStmt()-2] and
+ s1 = b.getStmt(i) and
+ s2 = b.getStmt(i+1))
+}
+
+from LocalVariable lv, VariableAccess def, DeclStmt d
+where lv.fromSource() and
+ d.getADeclaration() = lv and
+ noDefUsePath(lv, def) and defines(def, lv) and
+ not neighbouringStmts(d, def.getEnclosingStmt()) and
+ not exists(ControlFlowNode use | noDefUsePath(lv, use) and uses(use, lv))
+select def, "AV Rule 143: Variables will not be introduced until they can be initialized with meaningful values."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.16 Initialization/AV Rule 145.cpp b/cpp/ql/src/jsf/4.16 Initialization/AV Rule 145.cpp
new file mode 100644
index 000000000000..dda71c28946b
--- /dev/null
+++ b/cpp/ql/src/jsf/4.16 Initialization/AV Rule 145.cpp
@@ -0,0 +1,23 @@
+//wrong: inconsistent initialization, only the first should be initialized,
+//or all should be initialized
+enum {
+ VALUE_SHOULD_BE_10 = 10,
+ VALUE_SHOULD_BE_11,
+ VALUE_SHOULD_BE_12,
+ VALUE_SHOULD_BE_20, //newly added member, but initialization was forgotten
+ //(would have a value of 13 instead of 20).
+ VALUE_SHOULD_BE_30 = 30,
+ VALUE_SHOULD_BE_40 = 40
+} bad_values;
+
+//correct: all enum values initialized
+enum {
+ VALUE_SHOULD_BE_10 = 10,
+ VALUE_SHOULD_BE_11 = 11,
+ VALUE_SHOULD_BE_12 = 12,
+ VALUE_SHOULD_BE_20 = 20, //newly added member, it is less likely to forget
+ //putting in initialization since everything else
+ //is initialized
+ VALUE_SHOULD_BE_30 = 30,
+ VALUE_SHOULD_BE_40 = 40
+} good_values;
diff --git a/cpp/ql/src/jsf/4.16 Initialization/AV Rule 145.qhelp b/cpp/ql/src/jsf/4.16 Initialization/AV Rule 145.qhelp
new file mode 100644
index 000000000000..e207680edc43
--- /dev/null
+++ b/cpp/ql/src/jsf/4.16 Initialization/AV Rule 145.qhelp
@@ -0,0 +1,45 @@
+
+
+
+
+
+
+This rule finds enumerations that initialize their members inconsistently. Only the first enumeration member should be
+initialized using '=', or all of them should be initialized. Inconsistent initialization of members in enumerations
+can easily cause defects, especially when adding or removing members, or if the code relies on the actual integer
+values of the enumeration members.
+
+
+
+
+
+
+Change the enumeration so that only the first member is initialized, or initialize all the members of the enumeration.
+In general, initialize all enumeration members if you actually care about their integer values. If not, it is
+better to let the compiler assign values at compile time.
+
+
+
+
+
+
+
+
+
+
+
+
+ AV Rule 145, Joint Strike Fighter Air Vehicle C++ Coding Standards. Lockheed Martin Corporation, 2005.
+
+
+ MISRA C++ Rule 8-5-3, Guidelines for the use of the C++ language in critical systems. The Motor Industry Software Reliability Associate, 2008.
+
+
+ C++ Enumeration Declarations
+
+
+
+
+
diff --git a/cpp/ql/src/jsf/4.16 Initialization/AV Rule 145.ql b/cpp/ql/src/jsf/4.16 Initialization/AV Rule 145.ql
new file mode 100644
index 000000000000..858fbf9e1234
--- /dev/null
+++ b/cpp/ql/src/jsf/4.16 Initialization/AV Rule 145.ql
@@ -0,0 +1,63 @@
+/**
+ * @name Irregular enum initialization
+ * @description In an enumerator list, the = construct should not be used to explicitly initialize members other than the first, unless all items are explicitly initialized. An exception is the pattern to use the last element of an enumerator list to get the number of possible values.
+ * @kind problem
+ * @problem.severity recommendation
+ * @precision high
+ * @id cpp/irregular-enum-init
+ * @tags reliability
+ * readability
+ * language-features
+ */
+import cpp
+
+predicate hasInitializer(EnumConstant c) {
+ c.getInitializer().fromSource()
+}
+
+/** Does this have an initializer that is not just a ref to another constant in the same enum? */
+predicate hasNonReferenceInitializer(EnumConstant c) {
+ exists (Initializer init |
+ init = c.getInitializer() and
+ init.fromSource() and
+ not init.getExpr().(EnumConstantAccess).getTarget().getDeclaringEnum() = c.getDeclaringEnum()
+ )
+}
+
+predicate hasReferenceInitializer(EnumConstant c) {
+ exists (Initializer init |
+ init = c.getInitializer() and
+ init.fromSource() and
+ init.getExpr().(EnumConstantAccess).getTarget().getDeclaringEnum() = c.getDeclaringEnum()
+ )
+}
+
+
+// There exists another constant whose value is implicit, but it's
+// not the last one: the last value is okay to use to get the highest
+// enum value automatically. It can be followed by aliases though.
+predicate enumThatHasConstantWithImplicitValue(Enum e) {
+ exists(EnumConstant ec, int pos |
+ ec = e.getEnumConstant(pos) and
+ not hasInitializer(ec) and
+ exists(EnumConstant ec2, int pos2 |
+ ec2 = e.getEnumConstant(pos2) and
+ pos2 > pos and
+ not hasReferenceInitializer(ec2)
+ )
+ )
+}
+
+from Enum e, int i
+where // e is at position i, and has an explicit value in the source - but
+ // not just a reference to another enum constant
+ hasNonReferenceInitializer(e.getEnumConstant(i)) and
+ // but e is not the first or the last constant of the enum
+ i != 0 and
+ exists(e.getEnumConstant(i+1)) and
+ // and there exists another constant whose value is implicit, but it's
+ // not the last one: the last value is okay to use to get the highest
+ // enum value automatically. It can be followed by aliases though.
+ enumThatHasConstantWithImplicitValue(e)
+
+select e, "In an enumerator list, the = construct should not be used to explicitly initialize members other than the first, unless all items are explicitly initialized."
diff --git a/cpp/ql/src/jsf/4.17 Types/AV Rule 147.cpp b/cpp/ql/src/jsf/4.17 Types/AV Rule 147.cpp
new file mode 100644
index 000000000000..af6e84b67715
--- /dev/null
+++ b/cpp/ql/src/jsf/4.17 Types/AV Rule 147.cpp
@@ -0,0 +1,12 @@
+// Wrong: floating point bit implementation exposed by union with bit field.
+// Endianness and different floating-point implementations across architectures
+// as well as different packing methods across compilers could make this behave
+// incorrectly.
+typedef union {
+ float float_num;
+ struct {
+ unsigned sign : 1;
+ unsigned exp : 8;
+ unsigned fraction : 23;
+ } bits;
+} floatbits;
diff --git a/cpp/ql/src/jsf/4.17 Types/AV Rule 147.qhelp b/cpp/ql/src/jsf/4.17 Types/AV Rule 147.qhelp
new file mode 100644
index 000000000000..489ab0fe575e
--- /dev/null
+++ b/cpp/ql/src/jsf/4.17 Types/AV Rule 147.qhelp
@@ -0,0 +1,40 @@
+
+
+
+
+
+
+This rule finds portions of code that can expose the floating point implementation of the underlying
+machine. Manually manipulating the bits in the float is prone to mistakes and is unportable. Floating point
+implementations can vary across architectures, and bit-field packing can differ across compilers,
+making manual bit-manipulation of floats inadvisable.
+
+
+
+The bits of a floating point could be exposed by:
+
+
+ - casting a float pointer to a pointer of another type
+ - casting a float array to a non-float pointer type
+ - using a float in a union with another type
+
+
+
+
+
+
+Do not expose the bit contents of a float.
+
+
+
+
+
+
+
+
+
+
+AV Rule 147, Joint Strike Fighter Air Vehicle C++ Coding Standards. Lockheed Martin Corporation, 2005.
+
diff --git a/cpp/ql/src/jsf/4.17 Types/AV Rule 147.ql b/cpp/ql/src/jsf/4.17 Types/AV Rule 147.ql
new file mode 100644
index 000000000000..072076080b17
--- /dev/null
+++ b/cpp/ql/src/jsf/4.17 Types/AV Rule 147.ql
@@ -0,0 +1,50 @@
+/**
+ * @name Do not expose float representation
+ * @description The underlying bit representation of floating point numbers should not be used in any way by the programmer. This leads to non-portable and hard to maintain code.
+ * @kind problem
+ * @id cpp/jsf/av-rule-147
+ * @problem.severity error
+ * @tags reliability
+ */
+import cpp
+
+/*
+ * The bit representation of a float can be exposed by:
+ * - casting a float pointer to another pointer type
+ * - casting a float array to a non-float pointer type
+ * - using a float in a union with at least one non-float member
+ */
+
+class GeneralPointerType extends DerivedType {
+ GeneralPointerType() { this instanceof PointerType or this instanceof ArrayType }
+}
+
+class InvalidFloatCastExpr extends Expr {
+
+ InvalidFloatCastExpr() {
+ exists(Type src, Type dst |
+ src = this.getUnderlyingType().getUnspecifiedType() and
+ dst = this.getActualType().getUnderlyingType().getUnspecifiedType() and
+ src.(GeneralPointerType).getBaseType() instanceof FloatingPointType and
+ src.(GeneralPointerType).getBaseType() != dst.(GeneralPointerType).getBaseType()
+ )
+ }
+}
+
+class FloatUnion extends Union {
+
+ FloatUnion() {
+ exists (MemberVariable mv | this.getAMemberVariable() = mv and mv.getType().getUnderlyingType() instanceof FloatingPointType)
+ and exists (MemberVariable mv | this.getAMemberVariable() = mv and not mv.getType().getUnderlyingType() instanceof FloatingPointType)
+ }
+
+ MemberVariable getAFloatMember() { result = this.getAMemberVariable() and result.getType().getUnderlyingType() instanceof FloatingPointType }
+
+}
+
+from Element e, string message
+where
+ (e instanceof InvalidFloatCastExpr and message = "Casting a float pointer to another pointer type exposes the bit representation of the float, leading to unportable code.")
+ or
+ (exists (FloatUnion fu | e = fu.getAFloatMember()) and message = "Defining a union with a float member exposes the bit representation of the float, leading to unportable code.")
+select e, message
diff --git a/cpp/ql/src/jsf/4.17 Types/AV Rule 148.cpp b/cpp/ql/src/jsf/4.17 Types/AV Rule 148.cpp
new file mode 100644
index 000000000000..dfef08e607a5
--- /dev/null
+++ b/cpp/ql/src/jsf/4.17 Types/AV Rule 148.cpp
@@ -0,0 +1,28 @@
+typedef enum {
+ CASE_VAL1,
+ CASE_VAL2
+} caseVals;
+
+void f() {
+ int caseVal;
+ //Wrong: switch statement uses an integer
+ switch(caseVal) {
+ case 1:
+ //...
+ case 0xFF:
+ //...
+ default:
+ //...
+ }
+
+ //Correct: switch statement uses enum. It is easier to see if a case
+ //has been left out, and that all cases are valid values
+ caseVals caseVal2;
+ switch (caseVal2) {
+ case CASE_VAL1:
+ //...
+ case CASE_VAL2:
+ //...
+ default:
+ }
+}
diff --git a/cpp/ql/src/jsf/4.17 Types/AV Rule 148.qhelp b/cpp/ql/src/jsf/4.17 Types/AV Rule 148.qhelp
new file mode 100644
index 000000000000..3546970390be
--- /dev/null
+++ b/cpp/ql/src/jsf/4.17 Types/AV Rule 148.qhelp
@@ -0,0 +1,38 @@
+
+
+
+
+
+
+This rule finds switch statements that use an integer instead of an enumeration.
+Enumerations are preferred when dealing with a limited number of choices as they makes it easier
+to see if a case has been left out.
+
+
+
+
+
+
+Use an enumeration instead of an integer to represent a limited set of choices.
+
+
+
+
+
+
+
+
+
+
+
+ AV Rule 148, Joint Strike Fighter Air Vehicle C++ Coding Standards. Lockheed Martin Corporation, 2005.
+
+
+ C++ Switch statement
+
+
+
+
+
diff --git a/cpp/ql/src/jsf/4.17 Types/AV Rule 148.ql b/cpp/ql/src/jsf/4.17 Types/AV Rule 148.ql
new file mode 100644
index 000000000000..e76a52ce3cdb
--- /dev/null
+++ b/cpp/ql/src/jsf/4.17 Types/AV Rule 148.ql
@@ -0,0 +1,20 @@
+/**
+ * @name Use of integer where enum is preferred
+ * @description Enumeration types should be used instead of integer types (and constants) to select from a limited series of choices.
+ * @kind problem
+ * @problem.severity warning
+ * @precision medium
+ * @id cpp/integer-used-for-enum
+ * @tags maintainability
+ * readability
+ * language-features
+ */
+import cpp
+
+// flag switch statements where every non-default case dispatches on an integer constant
+from SwitchStmt s
+where forex(SwitchCase sc | sc = s.getASwitchCase() and not sc instanceof DefaultCase |
+ sc.getExpr().(VariableAccess).getTarget().isConst())
+ // Allow switch on character types
+ and not (s.getExpr().getUnderlyingType().getUnspecifiedType() instanceof CharType)
+select s, "Enumeration types should be used instead of integers to select from a limited series of choices."
diff --git a/cpp/ql/src/jsf/4.18 Constants/AV Rule 149.ql b/cpp/ql/src/jsf/4.18 Constants/AV Rule 149.ql
new file mode 100644
index 000000000000..d09fd2de3dc2
--- /dev/null
+++ b/cpp/ql/src/jsf/4.18 Constants/AV Rule 149.ql
@@ -0,0 +1,13 @@
+/**
+ * @name AV Rule 149
+ * @description Octal constants (other than zero) shall not be used.
+ * @kind problem
+ * @id cpp/jsf/av-rule-149
+ * @problem.severity error
+ */
+import cpp
+
+from OctalLiteral l
+where l.fromSource() and
+ l.getValue() != "0"
+select l, "AV Rule 149: Octal constants (other than zero) shall not be used."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.18 Constants/AV Rule 150.ql b/cpp/ql/src/jsf/4.18 Constants/AV Rule 150.ql
new file mode 100644
index 000000000000..542d241721a6
--- /dev/null
+++ b/cpp/ql/src/jsf/4.18 Constants/AV Rule 150.ql
@@ -0,0 +1,13 @@
+/**
+ * @name AV Rule 150
+ * @description Hexadecimal constants will be represented using all uppercase letters.
+ * @kind problem
+ * @id cpp/jsf/av-rule-150
+ * @problem.severity warning
+ */
+import cpp
+
+from HexLiteral l
+where l.fromSource() and
+ l.getValueText().regexpMatch(".*[a-z].*")
+select l, "AV Rule 150: Hexadecimal constants will be represented using all uppercase letters."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.18 Constants/AV Rule 151.1.cpp b/cpp/ql/src/jsf/4.18 Constants/AV Rule 151.1.cpp
new file mode 100644
index 000000000000..609bfa23d6a9
--- /dev/null
+++ b/cpp/ql/src/jsf/4.18 Constants/AV Rule 151.1.cpp
@@ -0,0 +1,9 @@
+void f() {
+ char *s = "String"; //wrong: literal assigned to non-const
+ //this will cause a write error or corrupt other data in the data section
+ strcpy(s, "Another string");
+
+ const char* cs ="String"; //correct: literal assigned to a const
+ //this will cause a compile error (trying to write to a const)
+ strcpy(cs, "Another string");
+}
diff --git a/cpp/ql/src/jsf/4.18 Constants/AV Rule 151.1.qhelp b/cpp/ql/src/jsf/4.18 Constants/AV Rule 151.1.qhelp
new file mode 100644
index 000000000000..8e3770c0b451
--- /dev/null
+++ b/cpp/ql/src/jsf/4.18 Constants/AV Rule 151.1.qhelp
@@ -0,0 +1,31 @@
+
+
+
+
+
+
+This rule finds string literals that are assigned to a non-const variable. String literals
+should not be changed, since they are usually stored in the data section, and depending on the architecture,
+writing to the data section will cause undefined behavior, such as memory corruption or memory write error.
+
+
+
+
+
+Only assign string literals to const variables. In general, using const to indicate values
+that do not change is good practice, as it provides a compile-time check and when used on function parameters gives an
+indication of the function's expected behavior.
+
+
+
+
+
+
+
+
+
+
+AV Rule 151.1, Joint Strike Fighter Air Vehicle C++ Coding Standards. Lockheed Martin Corporation, 2005.
+
diff --git a/cpp/ql/src/jsf/4.18 Constants/AV Rule 151.1.ql b/cpp/ql/src/jsf/4.18 Constants/AV Rule 151.1.ql
new file mode 100644
index 000000000000..8411c8ebf3fd
--- /dev/null
+++ b/cpp/ql/src/jsf/4.18 Constants/AV Rule 151.1.ql
@@ -0,0 +1,27 @@
+/**
+ * @name Constant string literals
+ * @description A string literal must not be modified, as the result is undefined. To ensure this, only variables of type const char * or const char [] can hold string literals.
+ * @kind problem
+ * @id cpp/jsf/av-rule-151-1
+ * @problem.severity error
+ * @tags correctness
+ */
+import cpp
+
+// Interpretation (from the example in AV151.1):
+// rather than doing points-to to find writes into string literals, the
+// check forbids assigning to non-const string variables, which prevents it.
+// Casting the const-ness of the variable away is still possible; ideally it
+// should be prevented but it doesn't seem worth the effort since it will likely
+// flag another rule.
+
+class NonConstStringType extends DerivedType {
+ NonConstStringType() {
+ this.(ArrayType).getBaseType() instanceof CharType or
+ this.(PointerType).getBaseType() instanceof CharType
+ }
+}
+
+from StringLiteral l
+where l.getFullyConverted().getType().getUnderlyingType() instanceof NonConstStringType
+select l, "A string literal must not be used as a non-const value: modifying string literals leads to undefined behavior."
diff --git a/cpp/ql/src/jsf/4.18 Constants/AV Rule 151.ql b/cpp/ql/src/jsf/4.18 Constants/AV Rule 151.ql
new file mode 100644
index 000000000000..e4dad7e2e001
--- /dev/null
+++ b/cpp/ql/src/jsf/4.18 Constants/AV Rule 151.ql
@@ -0,0 +1,21 @@
+/**
+ * @name AV Rule 151
+ * @description Numeric values in code will not be used; symbolic values will be used instead.
+ * @kind problem
+ * @id cpp/jsf/av-rule-151
+ * @problem.severity warning
+ */
+import cpp
+
+from Literal l
+where l.fromSource() and
+ l.getType() instanceof ArithmeticType and
+ not l.isInMacroExpansion() and
+ not l.getParent() instanceof ArrayExpr and
+ not exists(Variable v | v.getInitializer().getExpr() = l) and
+ not exists(Assignment a | a.getLValue() instanceof ArrayExpr and
+ a.getRValue() = l and
+ a.getControlFlowScope() instanceof Constructor) and
+ not l.getValue() = "0" and
+ not l.getValue() = "1"
+select l, "AV Rule 151: Numeric values in code will not be used; symbolic values will be used instead."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.19 Variables/AV Rule 152.ql b/cpp/ql/src/jsf/4.19 Variables/AV Rule 152.ql
new file mode 100644
index 000000000000..d57a9eb79b02
--- /dev/null
+++ b/cpp/ql/src/jsf/4.19 Variables/AV Rule 152.ql
@@ -0,0 +1,31 @@
+/**
+ * @name AV Rule 152
+ * @description Multiple variable declarations shall not be allowed on the same line.
+ * @kind problem
+ * @id cpp/jsf/av-rule-152
+ * @problem.severity error
+ */
+import cpp
+
+predicate isNonSolitary(Declaration d) {
+ exists(DeclStmt ds, Variable v |
+ ds.fromSource() and
+ d = ds.getADeclaration() and
+ d instanceof Variable and
+ v = ds.getADeclaration() and
+ v != d)
+ or
+ exists(GlobalVariable g | g.fromSource() and
+ g.getLocation().getStartLine() = d.(GlobalVariable).getLocation().getStartLine() and
+ g.getLocation().getFile() = d.getLocation().getFile() and
+ g != d)
+ or
+ exists(Field f | f.fromSource() and
+ f.getLocation().getStartLine() = d.(Field).getLocation().getStartLine() and
+ f.getLocation().getFile() = d.getLocation().getFile() and
+ f != d)
+}
+
+from Declaration d
+where isNonSolitary(d)
+select d, "AV Rule 152: Multiple variable declarations shall not be allowed on the same line."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.20 Unions and Bit Fields/AV Rule 153.ql b/cpp/ql/src/jsf/4.20 Unions and Bit Fields/AV Rule 153.ql
new file mode 100644
index 000000000000..7f0298c3558e
--- /dev/null
+++ b/cpp/ql/src/jsf/4.20 Unions and Bit Fields/AV Rule 153.ql
@@ -0,0 +1,14 @@
+/**
+ * @name AV Rule 153
+ * @description Unions shall not be used.
+ * @kind problem
+ * @id cpp/jsf/av-rule-153
+ * @problem.severity error
+ */
+import cpp
+
+// see MISRA Rule 9-5-1
+
+from Union u
+where u.fromSource()
+select u, "AV Rule 153: Unions shall not be used."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.20 Unions and Bit Fields/AV Rule 154.cpp b/cpp/ql/src/jsf/4.20 Unions and Bit Fields/AV Rule 154.cpp
new file mode 100644
index 000000000000..a95e99d10d66
--- /dev/null
+++ b/cpp/ql/src/jsf/4.20 Unions and Bit Fields/AV Rule 154.cpp
@@ -0,0 +1,4 @@
+struct {
+ short s : 4; //wrong: behavior of signed bit-field members vary across compilers
+ unsigned int : 24; //correct: unsigned
+} bits;
diff --git a/cpp/ql/src/jsf/4.20 Unions and Bit Fields/AV Rule 154.qhelp b/cpp/ql/src/jsf/4.20 Unions and Bit Fields/AV Rule 154.qhelp
new file mode 100644
index 000000000000..604a44b5e70d
--- /dev/null
+++ b/cpp/ql/src/jsf/4.20 Unions and Bit Fields/AV Rule 154.qhelp
@@ -0,0 +1,39 @@
+
+
+
+
+
+
+This rule finds bit fields with members that are not explicitly declared to be unsigned.
+The sign of plain char, short, int, or long bit field is implementation-specific, and declaring
+them all to be unsigned removes the ambiguity and ensures portability.
+
+
+
+
+
+
+Declare all members of the bit field to be unsigned.
+
+
+
+
+
+
+
+
+
+
+
+
+ AV Rule 154, Joint Strike Fighter Air Vehicle C++ Coding Standards. Lockheed Martin Corporation, 2005.
+
+
+ C++ Bit Fields
+
+
+
+
+
diff --git a/cpp/ql/src/jsf/4.20 Unions and Bit Fields/AV Rule 154.ql b/cpp/ql/src/jsf/4.20 Unions and Bit Fields/AV Rule 154.ql
new file mode 100644
index 000000000000..c5cf42641961
--- /dev/null
+++ b/cpp/ql/src/jsf/4.20 Unions and Bit Fields/AV Rule 154.ql
@@ -0,0 +1,26 @@
+/**
+ * @name Possible signed bit-field member
+ * @description Bit fields should have explicitly unsigned integral or
+ * enumeration types only. For example, use `unsigned int` rather
+ * than `int`. It is implementation specific whether an
+ * `int`-typed bit field is signed, so there could be unexpected
+ * sign extension or overflow.
+ * @kind problem
+ * @problem.severity warning
+ * @precision low
+ * @id cpp/signed-bit-field
+ * @tags reliability
+ * readability
+ * language-features
+ * external/cwe/cwe-190
+ */
+import cpp
+
+from BitField bf
+where not bf.getType().getUnspecifiedType().(IntegralType).isUnsigned()
+ and not bf.getUnderlyingType() instanceof Enum
+ and not bf.getUnderlyingType().getUnspecifiedType() instanceof BoolType
+ and not bf.getType().hasName("BOOL") // At least for C programs on Windows, BOOL is a common typedef for a type representing BoolType.
+ and not bf.getDeclaredNumBits() = bf.getType().getSize() * 8 // If this is true, then there cannot be unsigned sign extension or overflow.
+ and not bf.isAnonymous()
+select bf, "Bit field " + bf.getName() + " of type " + bf.getUnderlyingType().getName() + " should have explicitly unsigned integral or enumeration type."
diff --git a/cpp/ql/src/jsf/4.20 Unions and Bit Fields/AV Rule 155.ql b/cpp/ql/src/jsf/4.20 Unions and Bit Fields/AV Rule 155.ql
new file mode 100644
index 000000000000..ba48fe3539ab
--- /dev/null
+++ b/cpp/ql/src/jsf/4.20 Unions and Bit Fields/AV Rule 155.ql
@@ -0,0 +1,14 @@
+/**
+ * @name AV Rule 155
+ * @description Bit fields will not be used to pack data into a word for the
+ * sole purpose of saving space.
+ * @kind problem
+ * @id cpp/jsf/av-rule-155
+ * @problem.severity warning
+ */
+import cpp
+
+from BitField bf
+where not bf.getUnderlyingType() instanceof Enum and
+ not bf.getDeclaredNumBits() = 0
+select bf, "AV Rule 155: Bit fields will not be used purely to save space."
diff --git a/cpp/ql/src/jsf/4.20 Unions and Bit Fields/AV Rule 156.ql b/cpp/ql/src/jsf/4.20 Unions and Bit Fields/AV Rule 156.ql
new file mode 100644
index 000000000000..2dcabc930989
--- /dev/null
+++ b/cpp/ql/src/jsf/4.20 Unions and Bit Fields/AV Rule 156.ql
@@ -0,0 +1,18 @@
+/**
+ * @name AV Rule 156
+ * @description All the members of a structure (or class) shall be named
+ * and shall only be accessed via their names.
+ * @kind problem
+ * @id cpp/jsf/av-rule-156
+ * @problem.severity error
+ */
+import cpp
+
+// TODO: what about the "shall only be accessed" part?
+// TODO: implement better check for namelessness (at the moment we rely on the fact
+// that the frontend creates dummy names of the form "(unnamed X)" for nameless members)
+
+from Declaration m
+where m.isMember() and m.getName().matches("(%") and
+ not m.(BitField).getDeclaredNumBits() = 0
+select m, "AV Rule 156: All the members of a structure (or class) shall be named and shall only be accessed via their names."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.21 Operators/AV Rule 157.ql b/cpp/ql/src/jsf/4.21 Operators/AV Rule 157.ql
new file mode 100644
index 000000000000..18cbc5118a14
--- /dev/null
+++ b/cpp/ql/src/jsf/4.21 Operators/AV Rule 157.ql
@@ -0,0 +1,16 @@
+/**
+ * @name AV Rule 157
+ * @description The right hand operand of a && or || operator shall not
+ * contain side effects.
+ * @kind problem
+ * @id cpp/jsf/av-rule-157
+ * @problem.severity error
+ */
+import cpp
+
+// see MISRA Rule 5-14-1
+
+from BinaryLogicalOperation blo
+where blo.fromSource() and
+ not blo.getRightOperand().isPure()
+select blo, "AV Rule 157: The right hand operand of a && or || operator shall not contain side effects."
diff --git a/cpp/ql/src/jsf/4.21 Operators/AV Rule 158.ql b/cpp/ql/src/jsf/4.21 Operators/AV Rule 158.ql
new file mode 100644
index 000000000000..6063f45073d3
--- /dev/null
+++ b/cpp/ql/src/jsf/4.21 Operators/AV Rule 158.ql
@@ -0,0 +1,17 @@
+/**
+ * @name AV Rule 158
+ * @description The operands of a logical && or || operator shall be parenthesized
+ * if the operands contain binary operators.
+ * @kind problem
+ * @id cpp/jsf/av-rule-158
+ * @problem.severity error
+ */
+import cpp
+
+// NB: we only check if the immediate operands are (unparenthesised) binary operations
+
+from BinaryLogicalOperation blo, BinaryOperation bo
+where blo.fromSource() and
+ bo = blo.getAnOperand() and
+ not bo.isParenthesised()
+select blo, "AV Rule 158: The operands of a logical && or || operator shall be parenthesized if the operands contain binary operators."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.21 Operators/AV Rule 159.ql b/cpp/ql/src/jsf/4.21 Operators/AV Rule 159.ql
new file mode 100644
index 000000000000..ae3350aeecec
--- /dev/null
+++ b/cpp/ql/src/jsf/4.21 Operators/AV Rule 159.ql
@@ -0,0 +1,18 @@
+/**
+ * @name AV Rule 159
+ * @description Operators ||, &&, and unary & shall not be overloaded
+ * @kind problem
+ * @id cpp/jsf/av-rule-159
+ * @problem.severity error
+ */
+// See More Effective C++ item 7
+// Note: Meyers allows unary & to be overloaded but not comma
+
+import cpp
+
+from Function o, string message
+where (o.getName() = "operator&&" and message = "AV Rule 159: the && operator shall not be overloaded as short-circuit semantics cannot be obtained.")or
+ (o.getName() = "operator||" and message = "AV Rule 159: the || operator shall not be overloaded as short-circuit semantics cannot be obtained.")or
+ (o.getName() = "operator&" and o.getNumberOfParameters() = 1 and
+ message = "AV Rule 159: the unary & operator shall not be overloaded because of undefined behavior.")
+select o, message
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.21 Operators/AV Rule 160.ql b/cpp/ql/src/jsf/4.21 Operators/AV Rule 160.ql
new file mode 100644
index 000000000000..e34673b90706
--- /dev/null
+++ b/cpp/ql/src/jsf/4.21 Operators/AV Rule 160.ql
@@ -0,0 +1,39 @@
+/**
+ * @name AV Rule 160
+ * @description An assignment expression shall be used only as the expression in an expression statement.
+ * @kind problem
+ * @id cpp/jsf/av-rule-160
+ * @problem.severity error
+ */
+import cpp
+
+predicate multipleAssignExpr(Expr e) {
+ e instanceof AssignExpr
+ or exists(CommaExpr ce | ce = e |
+ multipleAssignExpr(ce.getLeftOperand()) and
+ multipleAssignExpr(ce.getRightOperand())
+ )
+
+}
+
+class MultipleAssignExpr extends Expr {
+ MultipleAssignExpr() { multipleAssignExpr(this) }
+
+ Assignment getAnAssignment() { result = this.getAChild*() }
+
+}
+
+class ForStmtSideEffectExpr extends Expr {
+ ForStmtSideEffectExpr() {
+ exists (ForStmt stmt |
+ this = stmt.getUpdate() or
+ this = stmt.getInitialization().getAChild().(MultipleAssignExpr).getAnAssignment()
+ )
+ }
+}
+
+from AssignExpr ae
+where ae.fromSource() and
+ not ae.getParent() instanceof ExprStmt and
+ not ae instanceof ForStmtSideEffectExpr
+select ae, "AV Rule 160: An assignment expression shall be used only as the exprression in an expression statement."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.21 Operators/AV Rule 162.ql b/cpp/ql/src/jsf/4.21 Operators/AV Rule 162.ql
new file mode 100644
index 000000000000..e9f1fa4f08f9
--- /dev/null
+++ b/cpp/ql/src/jsf/4.21 Operators/AV Rule 162.ql
@@ -0,0 +1,28 @@
+/**
+ * @name AV Rule 162
+ * @description Signed and unsigned values shall not be mixed in arithmetic or comparison operations. Mixing signed and unsigned values is error prone as it subjects operations to numerous arithmetic conversion and integral promotion rules.
+ * @kind problem
+ * @id cpp/jsf/av-rule-162
+ * @problem.severity error
+ */
+import cpp
+
+predicate excluded(Expr e) {
+ // Don't bother with literals - signed/unsigned is less meaningful there
+ e instanceof Literal
+}
+
+predicate isSignedOperand(Expr e) {
+ e.getExplicitlyConverted().getUnderlyingType().(IntegralType).isSigned()
+ and not excluded(e)
+}
+predicate isUnsignedOperand(Expr e) {
+ e.getExplicitlyConverted().getUnderlyingType().(IntegralType).isUnsigned()
+ and not excluded(e)
+}
+
+from BinaryOperation op
+where (op instanceof BinaryArithmeticOperation or op instanceof ComparisonOperation)
+ and isSignedOperand(op.getAnOperand())
+ and isUnsignedOperand(op.getAnOperand())
+select op, "AV Rule 162: signed and unsigned values shall not be mixed in arithmetic or comparison operations"
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.21 Operators/AV Rule 163.ql b/cpp/ql/src/jsf/4.21 Operators/AV Rule 163.ql
new file mode 100644
index 000000000000..d8a5a8930a9f
--- /dev/null
+++ b/cpp/ql/src/jsf/4.21 Operators/AV Rule 163.ql
@@ -0,0 +1,24 @@
+/**
+ * @name AV Rule 163
+ * @description Unsigned arithmetic shall not be used.
+ * @kind problem
+ * @id cpp/jsf/av-rule-163
+ * @problem.severity error
+ */
+import cpp
+
+predicate excluded(Expr e) {
+ // Don't bother with literals - signed/unsigned is less meaningful there
+ e instanceof Literal
+}
+
+predicate isUnsignedOperand(Expr e) {
+ e.getUnderlyingType().(IntegralType).isUnsigned()
+ and not excluded(e)
+}
+
+from BinaryOperation op
+where op instanceof BinaryArithmeticOperation
+ and isUnsignedOperand(op.getChild(0))
+ and isUnsignedOperand(op.getChild(1))
+select op, "AV Rule 163: unsigned arithmetic shall not be used"
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.21 Operators/AV Rule 164.ql b/cpp/ql/src/jsf/4.21 Operators/AV Rule 164.ql
new file mode 100644
index 000000000000..5531028f4663
--- /dev/null
+++ b/cpp/ql/src/jsf/4.21 Operators/AV Rule 164.ql
@@ -0,0 +1,45 @@
+/**
+ * @name AV Rule 164
+ * @description The right-hand operand of a shift operator shall lie between zero and one less than the width in bits of the left-hand operand.
+ * @kind problem
+ * @id cpp/jsf/av-rule-164
+ * @problem.severity error
+ */
+import cpp
+
+/*
+ * We'll check the cases where the value of the RHS can be easily determined only.
+ * Include:
+ * - constants and exprs that evaluate to constants, and
+ * - variables that are only assigned constants
+ */
+
+predicate possibleValue(Variable v, Expr value) {
+ v.getInitializer().getExpr() = value or
+ value = v.getAnAssignedValue()
+}
+
+predicate constantValue(Expr e, int value) {
+ e.getType().getUnderlyingType().getUnspecifiedType() instanceof IntegralType and
+ (
+ // Either the expr has a constant value
+ value = e.getValue().toInt() or
+ // The expr is a variable access and all values of the variable are constant
+ exists(VariableAccess va | va = e and
+ forall(Expr init | possibleValue(va.getTarget(), init) | constantValue(init,_)) and
+ exists(Expr init | possibleValue(va.getTarget(), init) | constantValue(init,value))
+ )
+ )
+}
+
+predicate violation(BinaryBitwiseOperation op, int lhsBytes, int value) {
+ (op instanceof LShiftExpr or op instanceof RShiftExpr) and
+ constantValue(op.getRightOperand(), value) and
+ lhsBytes = op.getLeftOperand().getType().getSize() and
+ (value < 0 or value >= lhsBytes * 8)
+}
+
+
+from BinaryBitwiseOperation op, int lhsBytes, int canonicalValue
+where canonicalValue = min(int v | violation(op, lhsBytes, v))
+select op, "AV Rule 164: The right-hand operand (here a value is " + canonicalValue.toString() + ") of this shift shall lie between 0 and " + (lhsBytes * 8 - 1).toString() + "."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.21 Operators/AV Rule 165.cpp b/cpp/ql/src/jsf/4.21 Operators/AV Rule 165.cpp
new file mode 100644
index 000000000000..7ac57c159de5
--- /dev/null
+++ b/cpp/ql/src/jsf/4.21 Operators/AV Rule 165.cpp
@@ -0,0 +1,8 @@
+//for this example, sizeof(short) == 2 bytes
+short f(unsigned short c) {
+ return -c; //unsigned value being negated
+}
+
+cout << f(100); //as expected, returns -100
+cout << f(40000U); //returns 25536
+// (negation finds the two's complement of the bit representation of 40000)
diff --git a/cpp/ql/src/jsf/4.21 Operators/AV Rule 165.qhelp b/cpp/ql/src/jsf/4.21 Operators/AV Rule 165.qhelp
new file mode 100644
index 000000000000..48d385848021
--- /dev/null
+++ b/cpp/ql/src/jsf/4.21 Operators/AV Rule 165.qhelp
@@ -0,0 +1,31 @@
+
+
+
+
+
+
+This rule finds unsigned values that are being negated. Behavior is undefined in such cases.
+Negating integer values produces the two's complement of that number, which cannot represent negative
+values of large unsigned values (values where the sign bit is used) and are most likely to be interpreted
+as a smaller positive integer instead.
+
+
+
+
+
+
+Do not negate unsigned values.
+
+
+
+
+
+
+
+
+
+
+AV Rule 165, Joint Strike Fighter Air Vehicle C++ Coding Standards. Lockheed Martin Corporation, 2005.
+
diff --git a/cpp/ql/src/jsf/4.21 Operators/AV Rule 165.ql b/cpp/ql/src/jsf/4.21 Operators/AV Rule 165.ql
new file mode 100644
index 000000000000..ba2e452eade8
--- /dev/null
+++ b/cpp/ql/src/jsf/4.21 Operators/AV Rule 165.ql
@@ -0,0 +1,16 @@
+/**
+ * @name Negation of unsigned value
+ * @description The unary minus operator should not be applied to unsigned expressions - cast the expression to a signed type to avoid unexpected behavior.
+ * @kind problem
+ * @id cpp/jsf/av-rule-165
+ * @problem.severity warning
+ * @tags reliability
+ */
+import cpp
+
+// see MISRA Rule 5-3-2
+
+from UnaryMinusExpr ume
+where ume.getOperand().getUnderlyingType().(IntegralType).isUnsigned()
+ and not ume.getOperand() instanceof Literal
+select ume, "The unary minus operator should not be applied to an unsigned expression."
diff --git a/cpp/ql/src/jsf/4.21 Operators/AV Rule 166.cpp b/cpp/ql/src/jsf/4.21 Operators/AV Rule 166.cpp
new file mode 100644
index 000000000000..706f27224e97
--- /dev/null
+++ b/cpp/ql/src/jsf/4.21 Operators/AV Rule 166.cpp
@@ -0,0 +1,6 @@
+int f(void){
+ int i = 0;
+ char arr[20];
+ int size = sizeof(arr[i++]); //wrong: sizeof expression has side effect
+ cout << i; //would output 0 instead of 1
+}
diff --git a/cpp/ql/src/jsf/4.21 Operators/AV Rule 166.qhelp b/cpp/ql/src/jsf/4.21 Operators/AV Rule 166.qhelp
new file mode 100644
index 000000000000..3524312aacbd
--- /dev/null
+++ b/cpp/ql/src/jsf/4.21 Operators/AV Rule 166.qhelp
@@ -0,0 +1,35 @@
+
+
+
+
+
+
+This rule finds sizeof expressions that have a parameter with side-effects. sizeof only
+uses the type of the parameter, so the parameter will not be evaluated. In the C99 standard, using sizeof on
+expressions with dynamic arrays may or may not evaluate the side-effect, so it is better to avoid it completely.
+
+
+
+
+
+Simplify the sizeof parameter to use only the subexpression that is of the type you need.
+
+
+
+
+
+
+
+
+
+ AV Rule 166, Joint Strike Fighter Air Vehicle C++ Coding Standards. Lockheed Martin Corporation, 2005.
+
+
+ Tutorialspoint - The C++ Programming Language: C++ sizeof Operator
+
+
+
+
+
diff --git a/cpp/ql/src/jsf/4.21 Operators/AV Rule 166.ql b/cpp/ql/src/jsf/4.21 Operators/AV Rule 166.ql
new file mode 100644
index 000000000000..019e52e0e9f8
--- /dev/null
+++ b/cpp/ql/src/jsf/4.21 Operators/AV Rule 166.ql
@@ -0,0 +1,15 @@
+/**
+ * @name Sizeof with side effects
+ * @description The sizeof operator should not be used on expressions that contain side effects. It is subtle whether the side effects will occur or not.
+ * @kind problem
+ * @problem.severity recommendation
+ * @precision high
+ * @id cpp/sizeof-side-effect
+ * @tags reliability
+ * correctness
+ */
+import cpp
+import jsf.lib.section_4_21_Operators.AV_Rule_166
+
+from SizeofImpureExprOperator sz
+select sz, "A sizeof operator should not be used on expressions that contain side effects as the effect is confusing."
diff --git a/cpp/ql/src/jsf/4.21 Operators/AV Rule 168.ql b/cpp/ql/src/jsf/4.21 Operators/AV Rule 168.ql
new file mode 100644
index 000000000000..6a47217fd1ad
--- /dev/null
+++ b/cpp/ql/src/jsf/4.21 Operators/AV Rule 168.ql
@@ -0,0 +1,15 @@
+/**
+ * @name AV Rule 168
+ * @description The comma operator shall not be used.
+ * @kind problem
+ * @id cpp/jsf/av-rule-168
+ * @problem.severity error
+ */
+import cpp
+
+// see MISRA Rule 5-18-1
+
+from CommaExpr ce
+where ce.fromSource()
+ and not exists (MacroInvocation me | ce = me.getAnAffectedElement())
+select ce, "AV Rule 168: The comma operator shall not be used."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.22 Pointers and References/AV Rule 170.ql b/cpp/ql/src/jsf/4.22 Pointers and References/AV Rule 170.ql
new file mode 100644
index 000000000000..1cd0a5a5a68c
--- /dev/null
+++ b/cpp/ql/src/jsf/4.22 Pointers and References/AV Rule 170.ql
@@ -0,0 +1,13 @@
+/**
+ * @name AV Rule 170
+ * @description More than two levels of pointer indirection shall not be used.
+ * @kind problem
+ * @id cpp/jsf/av-rule-170
+ * @problem.severity error
+ */
+import cpp
+
+from PointerType t, Element e
+where t.getPointerIndirectionLevel() > 2 and
+ t.getATypeNameUse() = e
+select e, "AV Rule 170: More than two levels of pointer indirection shall not be used."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.22 Pointers and References/AV Rule 171.ql b/cpp/ql/src/jsf/4.22 Pointers and References/AV Rule 171.ql
new file mode 100644
index 000000000000..a5a282bd280b
--- /dev/null
+++ b/cpp/ql/src/jsf/4.22 Pointers and References/AV Rule 171.ql
@@ -0,0 +1,34 @@
+/**
+ * @name AV Rule 171
+ * @description Relational operations shall not be applied to pointer types except where
+ * both operands are of the same type and point to or into the same object.
+ * @kind problem
+ * @id cpp/jsf/av-rule-171
+ * @problem.severity error
+ */
+import cpp
+import semmle.code.cpp.pointsto.PointsTo
+
+class PointerInComparison extends PointsToExpr {
+ override predicate interesting() {
+ exists(ComparisonOperation comp | comp.getAChild() = this) and
+ pointerValue(this)
+ }
+
+ ComparisonOperation getComparison() {
+ result.getAChild() = this
+ }
+}
+
+predicate mayBeCompared(PointerInComparison p, PointerInComparison q) {
+ p.getUnderlyingType() = q.getUnderlyingType() and
+ p.pointsTo() = q.pointsTo()
+ // TODO: should handle null pointers (p and q can only be compared if either both or none can be null)
+ // for now, just allow comparisons with null
+ or p.getValue() = "0" or q.getValue() = "0"
+}
+
+from PointerInComparison p, PointerInComparison q
+where p.getComparison() = q.getComparison() and
+ not mayBeCompared(p, q)
+select p.getComparison(), "AV Rule 171: Relational operators shall not be applied to pointer types except in very specific circumstances."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.22 Pointers and References/AV Rule 173.ql b/cpp/ql/src/jsf/4.22 Pointers and References/AV Rule 173.ql
new file mode 100644
index 000000000000..9bbc4f563886
--- /dev/null
+++ b/cpp/ql/src/jsf/4.22 Pointers and References/AV Rule 173.ql
@@ -0,0 +1,29 @@
+/**
+ * @name AV Rule 173
+ * @description The address of an object with automatic storage shall not be
+ * assigned to an object which persists after the object has ceased
+ * to exist.
+ * @kind problem
+ * @id cpp/jsf/av-rule-173
+ * @problem.severity error
+ */
+import cpp
+
+// see MISRA Rule 7-5-2
+// TODO: this catches only the most obvious cases
+
+// Current caught cases: assignment x = &y (literally) where
+// - y is a local
+// - EITHER x is a nonlocal
+// - OR x is a local defined in an enclosing scope
+// - OR x has static storage duration
+
+from Assignment a, Variable global, Variable local
+where a.fromSource() and
+ global.getAnAccess() = a.getLValue().(VariableAccess) and
+ local.getAnAccess() = a.getRValue().(AddressOfExpr).getOperand() and
+ local.hasSpecifier("auto") and
+ (not global instanceof LocalVariable
+ or global.getParentScope() = local.getParentScope().getParentScope+()
+ or global.hasSpecifier("static"))
+select a, "AV Rule 173: The address of an object with automatic storage shall not be assigned to another object that may persist after the first object has ceased to exist"
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.22 Pointers and References/AV Rule 175.ql b/cpp/ql/src/jsf/4.22 Pointers and References/AV Rule 175.ql
new file mode 100644
index 000000000000..b9b19ca12369
--- /dev/null
+++ b/cpp/ql/src/jsf/4.22 Pointers and References/AV Rule 175.ql
@@ -0,0 +1,13 @@
+/**
+ * @name AV Rule 175
+ * @description A pointer shall not be compared to NULL or be assigned NULL; use plain 0 instead.
+ * @kind problem
+ * @id cpp/jsf/av-rule-175
+ * @problem.severity error
+ */
+import cpp
+
+from NULL null
+where exists (Assignment a | null = a.getRValue())
+ or exists (ComparisonOperation op | null = op.getAnOperand())
+select null, "A pointer shall not be compared to NULL or be assigned NULL; use plain 0 instead."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.22 Pointers and References/AV Rule 176.ql b/cpp/ql/src/jsf/4.22 Pointers and References/AV Rule 176.ql
new file mode 100644
index 000000000000..3b3369dff21d
--- /dev/null
+++ b/cpp/ql/src/jsf/4.22 Pointers and References/AV Rule 176.ql
@@ -0,0 +1,18 @@
+/**
+ * @name AV Rule 176
+ * @description A typedef will be used to simplify program syntax when declaring function pointers.
+ * @kind problem
+ * @id cpp/jsf/av-rule-176
+ * @problem.severity warning
+ */
+import cpp
+
+predicate allowed(TypeDeclarationEntry tde, FunctionPointerType t)
+{
+ tde.getDeclaration().(TypedefType).getBaseType() = t
+}
+
+from FunctionPointerType t, Locatable l
+where t.getATypeNameUse() = l and
+ not allowed(l, t)
+select l, "AV Rule 176: A typedef will be used when declaring function pointers."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.23 Type Conversions/AV Rule 178.ql b/cpp/ql/src/jsf/4.23 Type Conversions/AV Rule 178.ql
new file mode 100644
index 000000000000..62bb5ac7207c
--- /dev/null
+++ b/cpp/ql/src/jsf/4.23 Type Conversions/AV Rule 178.ql
@@ -0,0 +1,22 @@
+/**
+ * @name AV Rule 178
+ * @description Down casting (casting from base to derived class) shall only be
+ * allowed through virtual functions.
+ * @kind problem
+ * @id cpp/jsf/av-rule-178
+ * @problem.severity error
+ */
+import cpp
+
+predicate subtype(Type sub, Type sup) {
+ sub.getUnderlyingType().(Class).getABaseClass+() = sup.getUnderlyingType()
+}
+
+from Expr e, Type declared, Type converted
+where e.fromSource() and
+ declared = e.getUnderlyingType() and
+ converted = e.getActualType() and
+ (subtype(converted.(ReferenceType).getBaseType(), declared.(ReferenceType).getBaseType())
+ or
+ subtype(converted.(PointerType).getBaseType(), declared.(PointerType).getBaseType()))
+select e, "AV Rule 178: Down casting shall only be allowed through virtual functions."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.23 Type Conversions/AV Rule 179.ql b/cpp/ql/src/jsf/4.23 Type Conversions/AV Rule 179.ql
new file mode 100644
index 000000000000..007f6c9c80a9
--- /dev/null
+++ b/cpp/ql/src/jsf/4.23 Type Conversions/AV Rule 179.ql
@@ -0,0 +1,18 @@
+/**
+ * @name AV Rule 179
+ * @description A pointer to a virtual base class shall not be converted
+ * to a pointer to a derived class.
+ * @kind problem
+ * @id cpp/jsf/av-rule-179
+ * @problem.severity error
+ */
+import cpp
+
+from Expr e, Class declared, Class converted, Class sub, Class sup
+where e.fromSource() and
+ declared = e.getUnderlyingType().(PointerType).getBaseType().getUnderlyingType() and
+ converted = e.getActualType().(PointerType).getBaseType().getUnderlyingType() and
+ converted.getABaseClass*() = sub and
+ sub.hasVirtualBaseClass(sup) and
+ sup.getABaseClass*() = declared
+select e, "AV Rule 179: A pointer to a virtual base class shall not be converted to a pointer to a derived class."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.23 Type Conversions/AV Rule 180.ql b/cpp/ql/src/jsf/4.23 Type Conversions/AV Rule 180.ql
new file mode 100644
index 000000000000..7f3ecd38c998
--- /dev/null
+++ b/cpp/ql/src/jsf/4.23 Type Conversions/AV Rule 180.ql
@@ -0,0 +1,103 @@
+/**
+ * @name AV Rule 180
+ * @description Implicit conversions that may result in a loss of information
+ * shall not be used.
+ * @kind problem
+ * @id cpp/jsf/av-rule-180
+ * @problem.severity error
+ */
+import cpp
+
+class IntConstantExpr extends Expr {
+
+ IntConstantExpr() {
+ this.getType() instanceof IntegralType
+ and exists (this.getValue())
+ }
+
+ int getIntValue() {
+ result = this.getValue().toInt()
+ }
+
+ predicate isNegative() {
+ this.getIntValue() < 0
+ }
+
+ /** Find out how many (8, 16, 32, 64) bits are required.
+ FIXME Currently only works up to 32 bits */
+ int getRequiredSizeBits() {
+ exists (int value |
+ value = this.getIntValue() and
+ (
+ (value < -32768 and result = 32) or
+ (value >= -32768 and value < -128 and result = 16) or
+ (value >= -128 and value < 0 and result = 8) or
+ (value >= 0 and value < 128 and result = 7) or
+ (value >= 128 and value < 256 and result = 8) or
+ (value >= 256 and value < 32768 and result = 15) or
+ (value >= 32768 and value < 65536 and result = 16) or
+ (value >= 65536 and value <= 2147483647 and result = 31) or
+ (value > 2147483647 and result = 32)
+ )
+ )
+ }
+
+}
+
+class ImplicitConversion extends Expr {
+ ImplicitConversion() {
+ super.hasImplicitConversion()
+ }
+
+ Type getUnderlyingSourceType() {
+ result = this.getUnderlyingType()
+ }
+
+ Type getUnderlyingTargetType() {
+ result = this.getConversion().getUnderlyingType()
+ }
+
+ int getSourceSize() {
+ if this instanceof IntConstantExpr then
+ result = this.(IntConstantExpr).getRequiredSizeBits()
+ else
+ result = this.getUnderlyingSourceType().getSize() * 8
+ }
+
+ int getTargetSize() {
+ result = this.getUnderlyingTargetType().getSize() * 8
+ }
+
+ predicate isSourceSignedInt() {
+ if this instanceof IntConstantExpr then
+ this.(IntConstantExpr).isNegative()
+ else
+ this.getUnderlyingSourceType().(IntegralType).isSigned()
+ }
+ predicate isTargetSignedInt() {
+ this.getUnderlyingTargetType().(IntegralType).isSigned()
+ }
+}
+
+class LossyImplicitConversion extends ImplicitConversion {
+ LossyImplicitConversion() {
+ // conversion to smaller type
+ super.getTargetSize() < super.getSourceSize()
+ // signed to unsigned conversion
+ or super.isSourceSignedInt() and not super.isTargetSignedInt()
+ // unsigned to signed conversion without increasing size
+ or (not super.isSourceSignedInt() and super.isTargetSignedInt()
+ and super.getTargetSize() = super.getSourceSize())
+ // floating-integral conversion
+ or super.getUnderlyingSourceType() instanceof FloatingPointType and
+ super.getUnderlyingTargetType() instanceof IntegralType
+ // integral-floating conversion
+ or super.getUnderlyingSourceType() instanceof IntegralType and
+ super.getUnderlyingTargetType() instanceof FloatingPointType
+ }
+}
+
+from LossyImplicitConversion lic
+where // Conversions to bool are always fine
+ not lic.getUnderlyingTargetType() instanceof BoolType
+select lic, "AV Rule 180: implicit conversion from " + lic.getUnderlyingSourceType().toString() + " to " + lic.getUnderlyingTargetType().toString() + " may lose information"
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.23 Type Conversions/AV Rule 181.ql b/cpp/ql/src/jsf/4.23 Type Conversions/AV Rule 181.ql
new file mode 100644
index 000000000000..cd32f6f4208d
--- /dev/null
+++ b/cpp/ql/src/jsf/4.23 Type Conversions/AV Rule 181.ql
@@ -0,0 +1,16 @@
+/**
+ * @name AV Rule 181
+ * @description Redundant explicit casts will not be used.
+ * @kind problem
+ * @id cpp/jsf/av-rule-181
+ * @problem.severity warning
+ */
+import cpp
+
+from Expr e, Conversion c
+where e.fromSource() and
+ c = e.getConversion() and
+ not c instanceof ParenthesisExpr and
+ not c.isCompilerGenerated() and
+ c.getUnderlyingType() = e.getUnderlyingType()
+select c.findRootCause(), "AV Rule 181: Redundant explicit casts will not be used."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.23 Type Conversions/AV Rule 182.ql b/cpp/ql/src/jsf/4.23 Type Conversions/AV Rule 182.ql
new file mode 100644
index 000000000000..0e5a345c1981
--- /dev/null
+++ b/cpp/ql/src/jsf/4.23 Type Conversions/AV Rule 182.ql
@@ -0,0 +1,30 @@
+/**
+ * @name AV Rule 182
+ * @description Type casting from any type to or from pointers shall not be used.
+ * @kind problem
+ * @id cpp/jsf/av-rule-182
+ * @problem.severity error
+ */
+import cpp
+
+class NullPointer extends Expr {
+ NullPointer() {
+ this.getValue() = "0" and this.getType() instanceof IntegralType
+ or
+ this instanceof NULL
+ }
+}
+
+from Expr e, Type t1, Type t2
+where t1 = e.getUnderlyingType().getUnspecifiedType() and
+ t2 = e.getActualType().getUnderlyingType().getUnspecifiedType() and
+ t1 != t2 and
+ (t1 instanceof PointerType or t2 instanceof PointerType) and
+ not (t2 instanceof VoidPointerType and t1 instanceof PointerType) and
+ // Conversion to bool type is always fine
+ not (t2 instanceof BoolType) and
+ // Ignore assigning NULL to a pointer
+ not e instanceof NullPointer and
+ // Allow array -> pointer conversion
+ not t1.(ArrayType).getBaseType() = t2.(PointerType).getBaseType()
+select e, "AV Rule 182: illegal cast from type " + t1.toString() + " to type " + t2.toString() + ". Casting to or from pointers shall not be used"
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.23 Type Conversions/AV Rule 184.ql b/cpp/ql/src/jsf/4.23 Type Conversions/AV Rule 184.ql
new file mode 100644
index 000000000000..b72c3803f062
--- /dev/null
+++ b/cpp/ql/src/jsf/4.23 Type Conversions/AV Rule 184.ql
@@ -0,0 +1,31 @@
+/**
+ * @name AV Rule 184
+ * @description Floating point numbers shall not be converted to integers,
+ * unless such a conversion is a specified algorithmic
+ * requirement or is necessary for a hardware interface.
+ * @kind problem
+ * @id cpp/jsf/av-rule-184
+ * @problem.severity error
+ */
+import cpp
+
+// extend to allow certain conversions
+predicate necessaryFloatToIntConversion(Expr e) {
+ none()
+}
+
+predicate badConversion(Expr e) {
+ e.fromSource() and
+ e.getUnderlyingType() instanceof FloatingPointType and
+ e.getActualType() instanceof IntegralType and
+ not necessaryFloatToIntConversion(e)
+}
+
+from Expr e
+where badConversion(e) and
+ // Only include outermost matches; no need to be transitive
+ // (should report an expr if a distant parent is a violation
+ // but the exprs in between are fine). Exclude brackets
+ not badConversion(e.getParent()) and
+ not e instanceof ParenthesisExpr
+select e, "AV Rule 184: Floating point numbers shall not be converted to integers."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.23 Type Conversions/AV Rule 185.ql b/cpp/ql/src/jsf/4.23 Type Conversions/AV Rule 185.ql
new file mode 100644
index 000000000000..5a276d498c7e
--- /dev/null
+++ b/cpp/ql/src/jsf/4.23 Type Conversions/AV Rule 185.ql
@@ -0,0 +1,17 @@
+/**
+ * @name AV Rule 185
+ * @description C++ style casts (const_cast, reinterpret_cast, and static_cast) shall be used
+ * instead of the traditional C-style cast.
+ * @kind problem
+ * @id cpp/jsf/av-rule-185
+ * @problem.severity error
+ */
+import cpp
+
+from Cast c
+where c.fromSource() and
+ c.getFile() instanceof CppFile and // Ignore C-style casts in C files
+ not c instanceof ConstCast and
+ not c instanceof ReinterpretCast and
+ not c instanceof StaticCast
+select c.findRootCause(), "AV Rule 184: C++ style casts shall be used instead of the traditional C-style casts."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 186.ql b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 186.ql
new file mode 100644
index 000000000000..2ee5c35140ae
--- /dev/null
+++ b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 186.ql
@@ -0,0 +1,29 @@
+/**
+ * @name AV Rule 186
+ * @description There shall be no unreachable code.
+ * @kind problem
+ * @id cpp/jsf/av-rule-186
+ * @problem.severity error
+ */
+import cpp
+
+// whether f is to be considered an API entry point, and hence reachable by default
+predicate isAPI(Function f) {
+ f.hasName("main")
+ or f.(MemberFunction).hasSpecifier("public")
+}
+
+predicate unusedFunction(Function f) {
+ not isAPI(f) and
+ not exists(FunctionCall c | c.getTarget() = f) and
+ not exists(Access acc | acc.getTarget() = f) and
+ f.hasDefinition()
+}
+
+predicate unreachableStmt(Stmt s) {
+ not s.getControlFlowScope().getBlock().getASuccessor*() = s
+}
+
+from ControlFlowNode n
+where unreachableStmt(n) or unusedFunction(n)
+select n, "AV Rule 186: There shall be no unreachable code."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 187.ql b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 187.ql
new file mode 100644
index 000000000000..6033c421a4f4
--- /dev/null
+++ b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 187.ql
@@ -0,0 +1,23 @@
+/**
+ * @name AV Rule 187
+ * @description All non-null statements shall potentially have a side-effect.
+ * @kind problem
+ * @id cpp/jsf/av-rule-187
+ * @problem.severity error
+ */
+import cpp
+
+from Stmt s
+where s.fromSource() and
+ // Exclude empty statements
+ not s instanceof EmptyStmt and
+ // Exclude control statements
+ not s instanceof LabelStmt and
+ not s instanceof JumpStmt and
+ not s instanceof ReturnStmt and
+ not s instanceof ControlStructure and
+ // Exclude blocks; if a child of the block violates the rule that will still
+ // be picked up so there is no point in blaming the block as well
+ not s instanceof Block and
+ s.isPure()
+select s, "AV Rule 187: All non-null statements shall potentially have a side-effect."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 188.ql b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 188.ql
new file mode 100644
index 000000000000..f01c15a9a0e0
--- /dev/null
+++ b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 188.ql
@@ -0,0 +1,12 @@
+/**
+ * @name AV Rule 188
+ * @description Labels will not be used, except in switch statements.
+ * @kind problem
+ * @id cpp/jsf/av-rule-188
+ * @problem.severity warning
+ */
+import cpp
+
+from LabelStmt l
+where not exists(GotoStmt g | g.breaksFromNestedLoops() and g.getTarget() = l)
+select l, "AV Rule 188: Labels will not be used, except in switch statements."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 189.qhelp b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 189.qhelp
new file mode 100644
index 000000000000..211a694ae16d
--- /dev/null
+++ b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 189.qhelp
@@ -0,0 +1,40 @@
+
+
+
+
+Use of goto statements makes code more difficult to understand and maintain. Consequently, the use
+of goto statements is deprecated except as a mechanism for breaking out of multiple nested loops.
+This rule identifies any goto statements that are called directly or from a single nested loop as violations.
+
+
+
+
+In most cases you should replace the goto statement in the highlighted code with an alternative jump statement
+(break, continue or return). In deeply nested loops you may need to use a goto statement because
+the break statement only exits from one level of the loop.
+
+
+
+
+
+ AV Rule 189, Joint Strike Fighter Air Vehicle C++ Coding Standards. Lockheed Martin Corporation, 2005.
+
+
+ A Case against the GO TO Statement (EWD-215).
+
+
+ MSDN Library: The goto Statement
+
+
+ Mats Henricson and Erik Nyquist, Industrial Strength C++, published by Prentice Hall PTR (1997).
+ Chapter 4: Control Flow, Rule 4.6 (PDF).
+
+
+ www.cplusplus.com Control Structures
+
+
+
+
+
diff --git a/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 189.ql b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 189.ql
new file mode 100644
index 000000000000..fbf0a1b0b117
--- /dev/null
+++ b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 189.ql
@@ -0,0 +1,14 @@
+/**
+ * @name AV Rule 189
+ * @description The goto statement shall not be used.
+ * @kind problem
+ * @id cpp/jsf/av-rule-189
+ * @problem.severity error
+ * @tags maintainability
+ */
+import cpp
+
+from GotoStmt s
+where s.fromSource() and
+ not s.breaksFromNestedLoops()
+select s, "AV Rule 189: The goto statement shall not be used."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 190.ql b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 190.ql
new file mode 100644
index 000000000000..8e794081c2ea
--- /dev/null
+++ b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 190.ql
@@ -0,0 +1,12 @@
+/**
+ * @name AV Rule 190
+ * @description The continue statement shall not be used.
+ * @kind problem
+ * @id cpp/jsf/av-rule-190
+ * @problem.severity error
+ */
+import cpp
+
+from ContinueStmt s
+where s.fromSource()
+select s, "AV Rule 190: The continue statement shall not be used."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 191.ql b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 191.ql
new file mode 100644
index 000000000000..866dbcd2a229
--- /dev/null
+++ b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 191.ql
@@ -0,0 +1,23 @@
+/**
+ * @name AV Rule 191
+ * @description The break statement shall not be used.
+ * @kind problem
+ * @id cpp/jsf/av-rule-191
+ * @problem.severity error
+ */
+import cpp
+
+/* TODO: "The break statement may be used to break out of a single loop provided
+ the alternative would obscure or otherwise significantly complicate the
+ control logic." */
+
+// whether t is the last statement of s, possibly peeling off blocks
+predicate isTerminatingStmt(Stmt s, Stmt t) {
+ s=t or isTerminatingStmt(s.(Block).getLastStmt(), t)
+}
+
+from BreakStmt s
+where s.fromSource() and
+ // exclude break statements that terminate switch cases
+ not exists(SwitchCase sc | isTerminatingStmt(sc.getLastStmt(), s))
+select s, "AV Rule 191: The break statement shall not be used."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 192.ql b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 192.ql
new file mode 100644
index 000000000000..8553d0a005af
--- /dev/null
+++ b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 192.ql
@@ -0,0 +1,26 @@
+/**
+ * @name AV Rule 192
+ * @description All if, else if constructs will contain either a final else clause
+ * or a comment indicating why a final else clause is not necessary.
+ * @kind problem
+ * @id cpp/jsf/av-rule-192
+ * @problem.severity warning
+ */
+import cpp
+
+// the extractor associates comments with the statement immediately following them
+// additionally, we also want to count comments that come right after the if statement,
+// as this seems a likely place to put a comment explaining the absence of an else
+predicate isCommented(IfStmt i) {
+ exists(Comment c |
+ c.getCommentedElement() = i
+ or i.getLocation().getEndLine() = c.getLocation().getStartLine())
+}
+
+from IfStmt i
+where i.fromSource() and
+ // only applies if there are one or more else-ifs
+ exists(IfStmt i2 | i2.getElse() = i) and
+ not i.hasElse() and
+ not isCommented(i)
+select i, "AV Rule 192: All if-else if chains will have an else clause or a comment explaining its absence."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 193.ql b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 193.ql
new file mode 100644
index 000000000000..6e589bb0fab1
--- /dev/null
+++ b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 193.ql
@@ -0,0 +1,28 @@
+/**
+ * @name AV Rule 193
+ * @description Every non-empty case clause in a switch statement
+ * shall be terminated with a break statement.
+ * @kind problem
+ * @id cpp/jsf/av-rule-193
+ * @problem.severity error
+ */
+import cpp
+
+/* Interpretation:
+ * - return statements should be okay too; if not desired another rule should catch it
+ * - the default case should be excluded, as long as it is at the end
+ * We don't allow the last case to omit the break/return, because that seems to violate the
+ * spirit of the rule (what if another case was added?)
+ */
+
+predicate lastDefaultCase(SwitchCase sc) {
+ sc.isDefault() and not exists(SwitchCase sc2 | sc2.getSwitchStmt() = sc.getSwitchStmt() and sc2.getChildNum() > sc.getChildNum())
+}
+
+from SwitchCase sc
+where sc.fromSource() and
+ exists(sc.getAStmt()) and
+ not lastDefaultCase(sc) and
+ not sc.terminatesInBreakStmt() and
+ not sc.terminatesInReturnStmt()
+select sc, "AV Rule 193: Every non-empty case clause in a switch statement shall be terminated with a break statement."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 194.ql b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 194.ql
new file mode 100644
index 000000000000..4aa98eb85e60
--- /dev/null
+++ b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 194.ql
@@ -0,0 +1,18 @@
+/**
+ * @name AV Rule 194
+ * @description All switch statements that do not intend to test for every enumeration value shall contain a final default clause.
+ * @kind problem
+ * @id cpp/jsf/av-rule-194
+ * @problem.severity error
+ */
+import cpp
+
+from EnumSwitch es, EnumConstant ec
+where // A switch without a default case ...
+ not es.hasDefaultCase() and
+ // ... that misses at least one value ...
+ ec = es.getAMissingCase() and
+ // ... and make sure we pick a single missed value; choose the first one
+ not exists (EnumConstant ec2, int i, int j |
+ ec2 = es.getAMissingCase() and ec2 = ec2.getDeclaringEnum().getEnumConstant(i) and ec = ec.getDeclaringEnum().getEnumConstant(j) and i < j)
+select es, "AV Rule 195: all switch statements that do not intend to test for every enumeration value shall contain a final default clause. This statement is missing a case for " + ec.getName()
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 195.ql b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 195.ql
new file mode 100644
index 000000000000..8a8fa4b58e54
--- /dev/null
+++ b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 195.ql
@@ -0,0 +1,13 @@
+/**
+ * @name AV Rule 195
+ * @description A switch expression will not represent a Boolean value.
+ * @kind problem
+ * @id cpp/jsf/av-rule-195
+ * @problem.severity warning
+ */
+import cpp
+
+from SwitchStmt s
+where s.fromSource() and
+ s.getExpr().getUnderlyingType() instanceof BoolType
+select s, "AV Rule 195: A switch expression will not represent a Boolean value."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 196.cpp b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 196.cpp
new file mode 100644
index 000000000000..115f3d212dac
--- /dev/null
+++ b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 196.cpp
@@ -0,0 +1,18 @@
+int f() {
+ int val = 0;
+ switch(val) { //wrong, use an if instead
+ case 0:
+ //...
+ default:
+ //...
+ }
+
+ switch(val) { //correct, has 2 cases and a default
+ case 0:
+ //...
+ case 1:
+ //...
+ default:
+ //...
+ }
+}
diff --git a/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 196.qhelp b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 196.qhelp
new file mode 100644
index 000000000000..ccf1548d28d0
--- /dev/null
+++ b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 196.qhelp
@@ -0,0 +1,42 @@
+
+
+
+
+The following forms of switch statement are considered trivial:
+
+
+ - No cases at all.
+ - Just a default case.
+ - Just one non-default case.
+ - A default case and one non-default case.
+
+
+
+
+
+Either the switch statement should be replaced with a simpler control flow structure, or it should be extended
+to handle more cases. Each trivial form has a different replacement:
+
+
+ - If there are no cases, the
switch statement can be removed.
+ - If there is just one default case, the
switch keyword, the default keyword, and the subsequent colon can all be removed.
+ - If there is just one non-default case, the
switch statement can be turned into an if statement.
+ - If there is one default case and one non-default case, the
switch statement can be turned into an if/else statement.
+
+
+
+
+
+
+
+
+
+
+AV Rule 196, Joint Strike Fighter Air Vehicle C++ Coding Standards. Lockheed Martin Corporation, 2005.
+
+
+
+
+
diff --git a/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 196.ql b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 196.ql
new file mode 100644
index 000000000000..b0f2627e6556
--- /dev/null
+++ b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 196.ql
@@ -0,0 +1,17 @@
+/**
+ * @name No trivial switch statements
+ * @description Using a switch statement when there are fewer than two non-default cases leads to unclear code.
+ * @kind problem
+ * @problem.severity recommendation
+ * @precision high
+ * @id cpp/trivial-switch
+ * @tags maintainability
+ * readability
+ */
+import cpp
+
+from SwitchStmt s
+where s.fromSource() and
+ count(SwitchCase sc | sc.getSwitchStmt() = s and not sc instanceof DefaultCase) < 2 and
+ not exists(s.getGeneratingMacro())
+select s, "This switch statement should either handle more cases, or be rewritten as an if statement."
diff --git a/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 197.cpp b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 197.cpp
new file mode 100644
index 000000000000..b0f5d9f68e71
--- /dev/null
+++ b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 197.cpp
@@ -0,0 +1,12 @@
+void f() {
+ float i = 0.0f;
+ //wrong: float used as loop counter
+ for (i = 0; i < 1000000.0f; i++) { //may execute 1000000 +x/-x times
+ //...
+ }
+ for (i = 0; i < 100000000.0f; i++) { //may never terminate, as rounding errors
+ //cancel out the addition of 1.0 once
+ //i becomes large enough
+ //...
+ }
+}
diff --git a/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 197.qhelp b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 197.qhelp
new file mode 100644
index 000000000000..b9e8387ec320
--- /dev/null
+++ b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 197.qhelp
@@ -0,0 +1,40 @@
+
+
+
+
+
+
+This rule finds float variables being used as loop counter. float values
+are prone to rounding and truncation. In particular, very large and very small
+float values are prone to rounding errors and could lead to unexpected loop behavior.
+
+
+
+
+
+Use an integral variable instead of a float variable for the loop counter.
+
+
+
+
+
+
+
+
+
+
+
+ AV Rule 197, Joint Strike Fighter Air Vehicle C++ Coding Standards. Lockheed Martin Corporation, 2005.
+
+
+ MISRA C++ Rule 6-5-1, Guidelines for the use of the C++ language in critical systems. The Motor Industry Software Reliability Associate, 2008.
+
+
+ FLP30-C. Do not use floating-point variables as loop counters
+
+
+
+
+
diff --git a/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 197.ql b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 197.ql
new file mode 100644
index 000000000000..37fc05b58338
--- /dev/null
+++ b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 197.ql
@@ -0,0 +1,15 @@
+/**
+ * @name Avoid floats in for loops
+ * @description Floating point variables should not be used as loop counters. For loops are best suited to simple increments and termination conditions; while loops are preferable for more complex uses.
+ * @kind problem
+ * @problem.severity recommendation
+ * @precision high
+ * @id cpp/loop-variable-float
+ * @tags reliability
+ * readability
+ */
+import cpp
+
+from LoopCounter lc
+where lc.getUnderlyingType() instanceof FloatingPointType
+select lc, "Floating point variables should not be used as loop counters."
diff --git a/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 198.ql b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 198.ql
new file mode 100644
index 000000000000..9b973d40264f
--- /dev/null
+++ b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 198.ql
@@ -0,0 +1,19 @@
+/**
+ * @name AV Rule 198
+ * @description The initialization statement in a for loop will only
+ * initialize a single loop parameter.
+ * @kind problem
+ * @id cpp/jsf/av-rule-198
+ * @problem.severity warning
+ */
+import cpp
+
+predicate isValidLoopInitialization(Stmt s) {
+ s instanceof DeclStmt
+ or s.(ExprStmt).getExpr() instanceof AssignExpr
+}
+
+from ForStmt for
+where for.fromSource() and
+ not isValidLoopInitialization(for.getInitialization())
+select for, "AV Rule 198: The initialization statement in a for loop will only initialize a single loop parameter."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 199.ql b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 199.ql
new file mode 100644
index 000000000000..258a6c1e2bfa
--- /dev/null
+++ b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 199.ql
@@ -0,0 +1,20 @@
+/**
+ * @name AV Rule 199
+ * @description The increment expression in a for loop will only update
+ * a single loop parameter.
+ * @kind problem
+ * @id cpp/jsf/av-rule-199
+ * @problem.severity warning
+ */
+import cpp
+
+predicate isValidLoopUpdate(Expr e) {
+ e instanceof CrementOperation
+ or e instanceof AssignExpr
+ or e instanceof FunctionCall // this is to account for overloaded operators
+}
+
+from ForStmt for
+where for.fromSource() and
+ not isValidLoopUpdate(for.getUpdate())
+select for, "AV Rule 199: The increment expression in a for loop will only update a single for loop parameter."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 200.ql b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 200.ql
new file mode 100644
index 000000000000..cbabf4852659
--- /dev/null
+++ b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 200.ql
@@ -0,0 +1,14 @@
+/**
+ * @name AV Rule 200
+ * @description Null initialize or increment expressions in for loops will not be used;
+ * a while loop will be used instead.
+ * @kind problem
+ * @id cpp/jsf/av-rule-200
+ * @problem.severity warning
+ */
+import cpp
+
+from ForStmt f
+where f.fromSource() and
+ (not exists(f.getInitialization()) or not exists(f.getUpdate()))
+select f, "AV Rule 200: Every for loop will have non-null initialize and increment expressions."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 201.cpp b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 201.cpp
new file mode 100644
index 000000000000..329e65cd8ae8
--- /dev/null
+++ b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 201.cpp
@@ -0,0 +1,12 @@
+void f() {
+ int i = 0;
+ for (i = 0; i < 10; i++) {
+ //...
+ if (special_case) {
+ i += 5; //Wrong: loop variable changed in body, which is contrary
+ //to the usual expectation of for loop behavior.
+ //Use a while loop instead.
+ continue;
+ }
+ }
+}
diff --git a/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 201.qhelp b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 201.qhelp
new file mode 100644
index 000000000000..c165fe59ba8c
--- /dev/null
+++ b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 201.qhelp
@@ -0,0 +1,47 @@
+
+
+
+
+
+
+This rule finds for loop variables that are being modified in the loop body. for loops should
+be reserved for simple iteration, use while loops for more complicated cases. Most developers assume that
+the for loop iteration statement is the only thing that changes the value of the loop counter, so changing it
+inside the loop body can lead to confusion.
+
+
+
+
+
+
+Use only the increment expression in the for loop to modify loop variables, or change it to a while
+loop if the loop requires more complicated variable iteration.
+
+
+
+
+
+
+
+
+
+
+
+ AV Rule 201, Joint Strike Fighter Air Vehicle C++ Coding Standards. Lockheed Martin Corporation, 2005.
+
+
+ MISRA C++ Rule 6-5-3, Guidelines for the use of the C++ language in critical systems. The Motor Industry Software Reliability Associate, 2008.
+
+
+ For statements
+
+
+ Mats Henricson and Erik Nyquist, Industrial Strength C++, published by Prentice Hall PTR (1997).
+ Chapter 4: Control Flow, Rule 4.1 (PDF).
+
+
+
+
+
diff --git a/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 201.ql b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 201.ql
new file mode 100644
index 000000000000..060734ab0eca
--- /dev/null
+++ b/cpp/ql/src/jsf/4.24 Control Flow Structures/AV Rule 201.ql
@@ -0,0 +1,51 @@
+/**
+ * @name For loop variable changed in body
+ * @description Numeric variables being used within a for loop for iteration counting should not be modified in the body of the loop. Reserve for loops for straightforward iterations, and use a while loop instead for more complex cases.
+ * @kind problem
+ * @problem.severity recommendation
+ * @precision high
+ * @id cpp/loop-variable-changed
+ * @tags reliability
+ * readability
+ */
+import cpp
+import Likely_Bugs.NestedLoopSameVar
+
+pragma[noopt]
+predicate loopModification(ForStmt for, Variable loopVariable, VariableAccess acc) {
+ loopVariable = for.getAnIterationVariable() and
+ acc = loopVariable.getAnAccess() and
+ acc.isModified() and
+ exists(Stmt stmt | acc.getEnclosingStmt() = stmt and stmtInForBody(stmt, for))
+}
+
+pragma[noopt]
+predicate stmtInForBody(Stmt stmt, ForStmt forStmt) {
+ (forStmt.getStmt() = stmt or exists(StmtParent parent | parent = stmt.getParent() | stmtInForBody(parent, forStmt)))
+ and forStmt instanceof ForStmt
+}
+
+from ForStmt for, Variable loopVariable, VariableAccess acc
+where
+ loopModification(for, loopVariable, acc) and
+
+ // field accesses must have the same object
+ (
+ loopVariable instanceof Field implies
+ exists(Variable obj |
+ simpleFieldAccess(obj, loopVariable, acc) and
+ simpleFieldAccess(obj, loopVariable, for.getCondition().getAChild*())
+ )
+ ) and
+
+ // don't duplicate results from NestedLoopSameVar.ql
+ not exists(ForStmt inner |
+ nestedForViolation(inner, loopVariable, for) and
+ (
+ acc.getParent*() = inner or
+ acc.getParent*() = inner.getInitialization()
+ )
+ )
+select
+ acc, "Loop counters should not be modified in the body of the $@.",
+ for.getStmt(), "loop"
diff --git a/cpp/ql/src/jsf/4.25 Expressions/AV Rule 202.ql b/cpp/ql/src/jsf/4.25 Expressions/AV Rule 202.ql
new file mode 100644
index 000000000000..352993f2c17a
--- /dev/null
+++ b/cpp/ql/src/jsf/4.25 Expressions/AV Rule 202.ql
@@ -0,0 +1,15 @@
+/**
+ * @name AV Rule 202
+ * @description Floating point variables shall not be tested for exact equality or inequality.
+ * @kind problem
+ * @id cpp/jsf/av-rule-202
+ * @problem.severity error
+ */
+import cpp
+
+// see MISRA 6-2-2
+
+from EqualityOperation e
+where e.fromSource() and
+ e.getAnOperand().getType() instanceof FloatingPointType
+select e, "AV Rule 202: Floating point variables shall not be tested for exact equality or inequality."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.25 Expressions/AV Rule 204.1.ql b/cpp/ql/src/jsf/4.25 Expressions/AV Rule 204.1.ql
new file mode 100644
index 000000000000..d1c53d781eda
--- /dev/null
+++ b/cpp/ql/src/jsf/4.25 Expressions/AV Rule 204.1.ql
@@ -0,0 +1,31 @@
+/**
+ * @name AV Rule 204.1
+ * @description The value of an expression shall be the same under any order of evaluation that the standard permits. Except where noted, the order in which operators and subexpression are evaluated, as well as the order in which side effects take place, is unspecified.
+ * @kind problem
+ * @id cpp/jsf/av-rule-204-1
+ * @problem.severity error
+ */
+import cpp
+
+class SideEffectVariableExpr extends VariableAccess {
+ SideEffectVariableExpr() {
+ exists(CrementOperation o | o.getOperand() = this)
+ or exists(AssignExpr e | e.getLValue() = this)
+ }
+}
+
+predicate characteristicSequencePointExpr(Expr e, Expr c) {
+ if exists(Expr p | p = e.getParent() and not p instanceof BinaryLogicalOperation
+ and not p instanceof CommaExpr and not p instanceof ConditionalExpr) then
+ characteristicSequencePointExpr(e.getParent(), c)
+ else
+ e = c
+}
+
+from SideEffectVariableExpr e, Expr c, Variable v, VariableAccess va
+where e.getTarget() = v and va.getTarget() = v and
+ characteristicSequencePointExpr(e, c)
+ and characteristicSequencePointExpr(va, c)
+ and va != e
+ and not e.getParent().(AssignExpr).getLValue() = e
+select c, "AV Rule 204.1: The value of an expression shall be the same under any order of evaluation that the standard permits"
diff --git a/cpp/ql/src/jsf/4.25 Expressions/AV Rule 204.ql b/cpp/ql/src/jsf/4.25 Expressions/AV Rule 204.ql
new file mode 100644
index 000000000000..04a8806c8309
--- /dev/null
+++ b/cpp/ql/src/jsf/4.25 Expressions/AV Rule 204.ql
@@ -0,0 +1,87 @@
+/**
+ * @name AV Rule 204
+ * @description A single operation with side-effects shall only be used by itself,
+ * to the right of an assignment, in a condition, as the only argument
+ * with side-effects in a function call, as a loop condition, as a switch
+ * condition, or as a part of a chained operation.
+ * @kind problem
+ * @id cpp/jsf/av-rule-204
+ * @problem.severity error
+ */
+import cpp
+
+// whether the main operation of e is pure (not considering its operands)
+predicate isPureOperation(Expr e) {
+ e instanceof Operation and
+ not e instanceof Assignment and
+ not e instanceof CrementOperation
+}
+
+// f is the smallest expression containing e composed entirely of
+// pure operators such that e is the only non-constant subexpression
+// e.g., in x = g(y) + 1, if e is g(y), then f is g(y) + 1
+predicate stripOffConstants(Expr e, Expr f) {
+ (not isPureOperation(e.getParent()) and f=e)
+
+ or exists(Operation p |
+ p = e.getParent() and
+ isPureOperation(p) and
+ (if forall(Expr g | g = p.getAChild() and e != g | g.isConstant()) then
+ stripOffConstants(p, f)
+ else f=e))
+}
+
+// whether e occurs by itself as a statement
+predicate occursByItself(Expr e) {
+ exists(ExprStmt s | e = s.getExpr())
+ or exists(ForStmt s | s.getUpdate() = e)
+}
+
+// whether e is the source of an assignment or an initializer
+predicate isOnRightOfAssignment(Expr e) {
+ exists(Assignment a | a.getRValue() = e)
+ or exists(Initializer i | i.getExpr() = e)
+}
+
+// whether e is a loop condition, an if condition, or a switch expression
+predicate isControllingExpr(Expr e) {
+ exists(ControlStructure c | c.getControllingExpr() = e)
+}
+
+// whether e is the only impure argument expression of a function call
+predicate isSoleNonConstFunArg(Expr e) {
+ exists(FunctionCall fc | fc.getAnArgument() = e and forall(Expr g | g = fc.getAnArgument() and g!=e | g.isPure()))
+}
+
+// whether e occurs as part of a chain of qualifiers
+predicate isPartOfChain(Expr e) {
+ qualifies(e, _) or qualifies(_, e)
+}
+
+// whether q qualifies e
+predicate qualifies(Expr q, Expr e) {
+ q = e.(Call).getQualifier() or q = e.(VariableAccess).getQualifier()
+}
+
+predicate impureExprInDisallowedContext(Expr e) {
+ exists(Expr f |
+ e.fromSource() and
+ not e.isPure() and
+ stripOffConstants(e, f) and
+ not occursByItself(f) and
+ not isOnRightOfAssignment(f) and
+ not isControllingExpr(f) and
+ not isSoleNonConstFunArg(f) and
+ not isPartOfChain(f))
+}
+
+from Expr e
+where impureExprInDisallowedContext(e) and
+ not e.isCompilerGenerated() and
+ // A few cases that are always ok
+ not e instanceof Conversion and
+ not exists(@ctorinit ci | e = ci) and
+ not exists(@dtordestruct dd | e = dd) and
+ // Avoid flagging nested expressions
+ not impureExprInDisallowedContext(e.getParent+())
+select e.findRootCause(), "AV Rule 204: A single operation with side-effects shall only be used in certain contexts."
diff --git a/cpp/ql/src/jsf/4.25 Expressions/AV Rule 205.ql b/cpp/ql/src/jsf/4.25 Expressions/AV Rule 205.ql
new file mode 100644
index 000000000000..a269959daa26
--- /dev/null
+++ b/cpp/ql/src/jsf/4.25 Expressions/AV Rule 205.ql
@@ -0,0 +1,19 @@
+/**
+ * @name AV Rule 205
+ * @description The volatile keyword shall not be used unless directly interfacing with hardware.
+ * @kind problem
+ * @id cpp/jsf/av-rule-205
+ * @problem.severity error
+ */
+import cpp
+
+// whether it is acceptable for s to be declared volatile
+// by default, we accept volatile specifiers on external global variables
+predicate acceptableVolatile(Variable v) {
+ v instanceof GlobalVariable and v.hasSpecifier("extern")
+}
+
+from Variable v
+where v.getType().hasSpecifier("volatile") and
+ not acceptableVolatile(v)
+select v, "AV Rule 205: The volatile keyword shall not be used unless directly interfacing with hardware."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.26 Memory Allocation/AV Rule 206.ql b/cpp/ql/src/jsf/4.26 Memory Allocation/AV Rule 206.ql
new file mode 100644
index 000000000000..30254488556e
--- /dev/null
+++ b/cpp/ql/src/jsf/4.26 Memory Allocation/AV Rule 206.ql
@@ -0,0 +1,18 @@
+/**
+ * @name AV Rule 206
+ * @description Allocation/deallocation from/to the free store (heap) shall not
+ * occur after initialization.
+ * @kind problem
+ * @id cpp/jsf/av-rule-206
+ * @problem.severity error
+ */
+import cpp
+
+predicate occursAfterInitialization(Expr e) {
+ not e.getEnclosingFunction() instanceof Constructor and
+ not e.getEnclosingFunction() instanceof Destructor
+}
+
+from Expr e
+where isMemoryManagementExpr(e) and occursAfterInitialization(e)
+select e, "AV Rule 206: Memory management shall not occur after initialization."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.26 Memory Allocation/AV Rule 207.ql b/cpp/ql/src/jsf/4.26 Memory Allocation/AV Rule 207.ql
new file mode 100644
index 000000000000..6628234ff0c0
--- /dev/null
+++ b/cpp/ql/src/jsf/4.26 Memory Allocation/AV Rule 207.ql
@@ -0,0 +1,28 @@
+/**
+ * @name AV Rule 207
+ * @description Unencapsulated global data will be avoided. Global non-constant variables should be objects of encapsulated types - not basic types, structs or struct-like classes.
+ * @kind problem
+ * @id cpp/jsf/av-rule-207
+ * @problem.severity warning
+ */
+import cpp
+
+predicate unencapsulated(Type t) {
+ exists(Type base | base = t.getUnderlyingType() and
+ (
+ base instanceof ArithmeticType or
+ base instanceof Enum or
+ base instanceof StructLikeClass or
+ unencapsulated(base.(PointerType).getBaseType()) or
+ unencapsulated(base.(SpecifiedType).getBaseType()) or
+ unencapsulated(base.(ReferenceType).getBaseType())
+ )
+ )
+}
+
+
+from GlobalVariable gv
+where unencapsulated(gv.getType())
+ // Allow immutable global constants
+ and not gv.getType().isDeeplyConst()
+select gv, "AV Rule 207: Unencapsulated global data will be avoided."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.27 Fault Handling/AV Rule 208.ql b/cpp/ql/src/jsf/4.27 Fault Handling/AV Rule 208.ql
new file mode 100644
index 000000000000..172f8db58a86
--- /dev/null
+++ b/cpp/ql/src/jsf/4.27 Fault Handling/AV Rule 208.ql
@@ -0,0 +1,12 @@
+/**
+ * @name AV Rule 208
+ * @description C++ exceptions shall not be used.
+ * @kind problem
+ * @id cpp/jsf/av-rule-208
+ * @problem.severity error
+ */
+import cpp
+
+from Element e
+where e instanceof TryStmt or e instanceof ThrowExpr
+select e, "AV Rule 208: C++ exceptions shall not be used."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.28 Portable Code/AV Rule 209.ql b/cpp/ql/src/jsf/4.28 Portable Code/AV Rule 209.ql
new file mode 100644
index 000000000000..991026f4fa60
--- /dev/null
+++ b/cpp/ql/src/jsf/4.28 Portable Code/AV Rule 209.ql
@@ -0,0 +1,17 @@
+/**
+ * @name AV Rule 209
+ * @description The basic types of int, short, long, float and double shall not be used,
+ * but specific-length equivalents should be typedef'd accordingly for
+ * each compiler, and these type names used in the code.
+ * @kind problem
+ * @id cpp/jsf/av-rule-209
+ * @problem.severity error
+ */
+import cpp
+
+from Element u, ArithmeticType at
+where (at.hasName("int") or at.hasName("short") or at.hasName("long")
+ or at.hasName("float") or at.hasName("double")) and
+ u = at.getATypeNameUse() and
+ not at instanceof WideCharType
+select u, "AV Rule 209: The basic types of int, short, long, float and double shall not be used."
diff --git a/cpp/ql/src/jsf/4.28 Portable Code/AV Rule 210.ql b/cpp/ql/src/jsf/4.28 Portable Code/AV Rule 210.ql
new file mode 100644
index 000000000000..c8fb016284dc
--- /dev/null
+++ b/cpp/ql/src/jsf/4.28 Portable Code/AV Rule 210.ql
@@ -0,0 +1,60 @@
+/**
+ * @name AV Rule 210
+ * @description Algorithms shall not make assumptions concerning how
+ * data is represented in memory.
+ * @kind problem
+ * @id cpp/jsf/av-rule-210
+ * @problem.severity error
+ * @precision low
+ */
+import cpp
+
+/* The standard lists three things that are disallowed in particular:
+ * - relying on big vs. little endian representation
+ * - relying on base class subobject ordering in derived classes
+ * - relying on nonstatic data member ordering across access specifiers
+ *
+ * We currently only check for violations of the first one, in a similar way
+ * to AV Rule 147: No casts from pointers to/arrays of integrals to pointers to
+ * integrals of a different size, no unions that both contain an integral and
+ * an array of smaller integrals. */
+
+class PointerOrArrayType extends DerivedType {
+ PointerOrArrayType() { this instanceof PointerType or this instanceof ArrayType }
+}
+
+// cast from pointer to integral type to pointer to a different integral type
+class ExposingIntegralCastExpr extends Expr {
+ ExposingIntegralCastExpr() {
+ exists(PointerOrArrayType src, PointerOrArrayType dst, IntegralType srcbase, IntegralType dstbase |
+ src = this.getUnderlyingType() and
+ srcbase = src.getBaseType().getUnderlyingType() and
+ dst = this.getActualType() and
+ dstbase = dst.getBaseType().getUnderlyingType() and
+ srcbase != dstbase)
+ }
+}
+
+class ExposingIntegralUnion extends Union {
+ ExposingIntegralUnion() {
+ exists (MemberVariable mv1, MemberVariable mv2, IntegralType mv1tp, IntegralType mv2tp |
+ mv1 = this.getAMemberVariable() and
+ mv2 = this.getAMemberVariable() and
+ mv1tp = mv1.getUnderlyingType().(IntegralType) and
+ (mv2tp = mv2.getUnderlyingType().(IntegralType)
+ or
+ mv2tp = mv2.getUnderlyingType().(ArrayType).getBaseType().getUnderlyingType().(IntegralType)) and
+ mv1tp.getSize() > mv2tp.getSize())
+ }
+}
+
+from Element e, string message
+where
+ (
+ e instanceof ExposingIntegralCastExpr and
+ message = "AV Rule 210: This cast makes assumptions concerning data representation in memory."
+ ) or (
+ e instanceof ExposingIntegralUnion and
+ message = "AV Rule 210: This union may make assumptions concerning data representation in memory."
+ )
+select e, message
diff --git a/cpp/ql/src/jsf/4.28 Portable Code/AV Rule 212.ql b/cpp/ql/src/jsf/4.28 Portable Code/AV Rule 212.ql
new file mode 100644
index 000000000000..5a05826fa191
--- /dev/null
+++ b/cpp/ql/src/jsf/4.28 Portable Code/AV Rule 212.ql
@@ -0,0 +1,37 @@
+/**
+ * @name AV Rule 212
+ * @description Underflow or overflow functioning shall not be depended on
+ * in any special way.
+ * @kind problem
+ * @id cpp/jsf/av-rule-212
+ * @problem.severity error
+ */
+import cpp
+
+/* We check for the use of the "a + b < a" idiom. */
+
+predicate isNonNegative(Expr e) {
+ e.getUnderlyingType().(IntegralType).isUnsigned()
+ or e.getValue().toInt() >= 0
+}
+
+predicate sameExpr(Expr e, Expr f) {
+ e.(VariableAccess).getTarget() = f.(VariableAccess).getTarget()
+ // adding the following disjunct OOMs on non-trivial databases
+ //or e.getValue() = f.getValue()
+}
+
+class UnreliableOverflowTest extends LTExpr {
+ UnreliableOverflowTest() {
+ exists(AddExpr l, Expr a, Expr b, Expr r |
+ l = super.getLeftOperand() and
+ a = l.getLeftOperand() and
+ b = l.getRightOperand() and
+ r = super.getRightOperand() and
+ ( sameExpr(a, r) and isNonNegative(b)
+ or sameExpr(b, r) and isNonNegative(a)))
+ }
+}
+
+from UnreliableOverflowTest t
+select t, "AV Rule 212: Underflow or overflow functioning shall not be depended on."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.28 Portable Code/AV Rule 213.ql b/cpp/ql/src/jsf/4.28 Portable Code/AV Rule 213.ql
new file mode 100644
index 000000000000..7cdcc1e9e24a
--- /dev/null
+++ b/cpp/ql/src/jsf/4.28 Portable Code/AV Rule 213.ql
@@ -0,0 +1,32 @@
+/**
+ * @name AV Rule 213
+ * @description No dependence shall be placed on C++'s operator precedence rules,
+ * below arithmetic operators, in expressions.
+ * @kind problem
+ * @id cpp/jsf/av-rule-213
+ * @problem.severity error
+ */
+import cpp
+
+// Interpretation and deviations:
+// - if the higher operator has precedence > arithmetic then it is fine
+// RATIONALE: exprs like f(), *x, &x are easily understood to bind tightly
+// - if the higher operator is the RHS of an assign then it is fine
+// RATIONALE: cf. MISRA, too many cases excluded otherwise
+// - comparison operators can be mixed with arithmetic
+// RATIONALE: x==y+z is common and unambiguous
+
+predicate arithmeticPrecedence(int p) { p = 12 or p = 13 }
+predicate comparisonPrecedence(int p) { p = 9 or p = 10 }
+
+from Expr e1, Expr e2, int p1, int p2
+where e1.getAChild() = e2 and
+ p1 = e1.getPrecedence() and
+ p2 = e2.getPrecedence() and
+ p1 < p2 and
+ not e2.isParenthesised() and
+ p1 <= 11 and
+ p2 <= 13 and // allow > arithmetic operators
+ not (arithmeticPrecedence(p2) and comparisonPrecedence(p1)) and // arith-compare deviation
+ not e2 = e1.(Assignment).getRValue() // assignment deviation
+select e1, "AV Rule 213: Limited dependence shall be placed on operator precedence rules."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.28 Portable Code/AV Rule 214.ql b/cpp/ql/src/jsf/4.28 Portable Code/AV Rule 214.ql
new file mode 100644
index 000000000000..9b873f8e716c
--- /dev/null
+++ b/cpp/ql/src/jsf/4.28 Portable Code/AV Rule 214.ql
@@ -0,0 +1,39 @@
+/**
+ * @name AV Rule 214
+ * @description Assuming that non-local static objects, in separate translation units,
+ * are initialized in a special order shall not be done.
+ * @kind problem
+ * @id cpp/jsf/av-rule-214
+ * @problem.severity error
+ */
+import cpp
+
+// whether e is part of an initializer of a global variable in file f
+predicate inGlobalInitializer(Expr e, File f) {
+ exists(GlobalVariable gv | gv.getInitializer().getExpr() = e.getParent*() and
+ f = gv.getFile())
+}
+
+// whether c is called from within a global initializer in f
+// TODO: this should be transitive, but maybe it's not worth the extra hassle
+predicate calledFromGlobalInitializer(Function fn, File f) {
+ exists(FunctionCall c | inGlobalInitializer(c, f) and fn = c.getTarget())
+}
+
+predicate evaluatedBeforeMain(Expr e, File f) {
+ inGlobalInitializer(e, f)
+ or exists(Function fn | calledFromGlobalInitializer(fn, f) and fn = e.getControlFlowScope())
+}
+
+// whether f1 and f2 belong to the same translation unit
+predicate sameTranslationUnit(File f1, File f2) {
+ exists(File f | f.getAnIncludedFile*() = f1 and f.getAnIncludedFile*() = f2)
+}
+
+from VariableAccess v, File f1, File f2
+where v.fromSource() and
+ v.isRValue() and
+ evaluatedBeforeMain(v, f1) and
+ v.getTarget().getFile() = f2 and
+ not sameTranslationUnit(f1, f2)
+select v, "AV Rule 214: It shall not be assumed that objects in separated translation units are initialized in a special order."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/4.28 Portable Code/AV Rule 215.ql b/cpp/ql/src/jsf/4.28 Portable Code/AV Rule 215.ql
new file mode 100644
index 000000000000..201ea073fd99
--- /dev/null
+++ b/cpp/ql/src/jsf/4.28 Portable Code/AV Rule 215.ql
@@ -0,0 +1,12 @@
+/**
+ * @name AV Rule 215
+ * @description Pointer arithmetic will not be used.
+ * @kind problem
+ * @id cpp/jsf/av-rule-215
+ * @problem.severity warning
+ */
+import cpp
+
+from PointerArithmeticOperation pao
+where pao.fromSource()
+select pao, "AV Rule 215: Pointer arithmetic will not be used."
\ No newline at end of file
diff --git a/cpp/ql/src/jsf/lib/section_4_21_Operators/AV_Rule_166.qll b/cpp/ql/src/jsf/lib/section_4_21_Operators/AV_Rule_166.qll
new file mode 100644
index 000000000000..6e7176fb86db
--- /dev/null
+++ b/cpp/ql/src/jsf/lib/section_4_21_Operators/AV_Rule_166.qll
@@ -0,0 +1,19 @@
+import cpp
+
+class IgnoreAllVolatileSpecifiersEverywhere extends Specifier {
+ override string getName() { result = super.getName() and result != "volatile" }
+}
+
+class SizeofImpureExprOperator extends SizeofExprOperator {
+ SizeofImpureExprOperator () {
+ exists (Expr e |
+ e = this.getExprOperand()
+ and not e.isPure()
+ and not e.isAffectedByMacro()
+ and not e.(OverloadedPointerDereferenceExpr).getExpr().isPure()
+ and not exists(OverloadedArrayExpr op | op = e |
+ op.getArrayBase().isPure()
+ and op.getArrayOffset().isPure()))
+ }
+}
+
diff --git a/cpp/ql/src/objc.qll b/cpp/ql/src/objc.qll
new file mode 100644
index 000000000000..4996ace84523
--- /dev/null
+++ b/cpp/ql/src/objc.qll
@@ -0,0 +1 @@
+import cpp
diff --git a/cpp/ql/src/plugin.xml b/cpp/ql/src/plugin.xml
new file mode 100644
index 000000000000..e08a29947a6c
--- /dev/null
+++ b/cpp/ql/src/plugin.xml
@@ -0,0 +1,16 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/queries.xml b/cpp/ql/src/queries.xml
new file mode 100644
index 000000000000..99f4a7278c21
--- /dev/null
+++ b/cpp/ql/src/queries.xml
@@ -0,0 +1 @@
+
diff --git a/cpp/ql/src/semmle/code/cpp/ASTSanity.ql b/cpp/ql/src/semmle/code/cpp/ASTSanity.ql
new file mode 100644
index 000000000000..758a2a26169c
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ASTSanity.ql
@@ -0,0 +1,9 @@
+/**
+ * @name AST Sanity Check
+ * @description Performs sanity checks on the Abstract Syntax Tree. This query should have no results.
+ * @kind problem
+ * @id cpp/ast-sanity-check
+ */
+
+import cpp
+import CastSanity
diff --git a/cpp/ql/src/semmle/code/cpp/AutogeneratedFile.qll b/cpp/ql/src/semmle/code/cpp/AutogeneratedFile.qll
new file mode 100644
index 000000000000..6cc5f28c8f22
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/AutogeneratedFile.qll
@@ -0,0 +1,44 @@
+import semmle.code.cpp.Comments
+import semmle.code.cpp.File
+import semmle.code.cpp.Preprocessor
+
+/**
+ * Holds if `c` is a comment which is usually seen in autogenerated files.
+ * For example, comments containing 'autogenerated' or 'generated by'.
+ */
+predicate isAutogeneratedComment(Comment c) {
+ c.getContents().regexpMatch("(?si).*(?:auto[ -]?generated|generated (?:by|file)|changes made in this file will be lost).*")
+}
+
+/**
+ * Holds if the file contains `#line` pragmas that refer to a different file.
+ * For example, in `parser.c` a pragma `#line 1 "parser.rl"`.
+ * Such pragmas usually indicate that the file was automatically generated.
+ */
+predicate hasPragmaDifferentFile(File f) {
+ exists (PreprocessorLine pl, string s |
+ pl.getFile() = f and
+ pl.getHead().splitAt(" ", 1) = s and /* Zero index is line number, one index is file reference */
+ not ("\"" + f.getAbsolutePath() + "\"" = s))
+}
+
+/**
+ * Holds if the file is probably an autogenerated file.
+ *
+ * A file is probably autogenerated if either of the following heuristics
+ * hold:
+ * 1. There is a comment in the start of the file that matches
+ * 'autogenerated', 'generated by', or a similar phrase.
+ * 2. There is a `#line` directive referring to a different file.
+ */
+class AutogeneratedFile extends File {
+ cached AutogeneratedFile() {
+ exists(int limit, int head |
+ head <= 5 and
+ limit = max(int line | locations_default(_, this, head, _, line, _)) + 5
+ |
+ exists (Comment c | c.getFile() = this and c.getLocation().getStartLine() <= limit and isAutogeneratedComment(c))
+ )
+ or hasPragmaDifferentFile(this)
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/Class.qll b/cpp/ql/src/semmle/code/cpp/Class.qll
new file mode 100644
index 000000000000..8c001a6574e5
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/Class.qll
@@ -0,0 +1,1019 @@
+import semmle.code.cpp.Type
+import semmle.code.cpp.UserType
+import semmle.code.cpp.metrics.MetricClass
+import semmle.code.cpp.Linkage
+private import semmle.code.cpp.internal.Type
+
+/**
+ * A class type [N4140 9].
+ *
+ * While this does include types declared with the `class` keyword, it also
+ * includes types declared with the `struct` and `union` keywords.
+ */
+class Class extends UserType {
+ Class() {
+ isClass(this) and this = resolve(_)
+ }
+
+ /** Gets a child declaration of this class. */
+ override Declaration getADeclaration() { result = this.getAMember() }
+
+ /** Gets a type declared in this class. */
+ UserType getANestedType() { result = this.getAMember() }
+
+ /**
+ * Gets a function declared in this class.
+ * For template member functions, results include both the template
+ * and the instantiations of that template. If you only want the
+ * template, then use `getACanonicalMemberFunction()` instead.
+ */
+ MemberFunction getAMemberFunction() { result = this.getAMember() }
+
+ /**
+ * Gets a function declared in this class.
+ * For template member functions, results include only the template.
+ * If you also want instantiations of the template, then use
+ * `getAMemberFunction()` instead.
+ */
+ MemberFunction getACanonicalMemberFunction() {
+ result = this.getACanonicalMember()
+ }
+
+ /**
+ * Gets a member variable declared in this class.
+ * For template member variables, results include both the template
+ * and the instantiations of that template. If you only want the
+ * template, then use `getACanonicalMemberVariable()` instead.
+ */
+ MemberVariable getAMemberVariable() { result = this.getAMember() }
+
+ /**
+ * Gets a member variable declared in this class.
+ * For template member variables, results include only the template.
+ * If you also want instantiations of the template, then use
+ * `getAMemberVariable()` instead.
+ */
+ MemberVariable getACanonicalMemberVariable() { result = this.getAMember() }
+
+ /**
+ * Gets a member declared in this class. For template members, this
+ * may be either the template or an instantiation of that template.
+ * If you only want the template, see
+ * `getACanonicalMember()`.
+ */
+ Declaration getAMember() { result = this.getAMember(_) }
+
+ /**
+ * Gets a member declared in this class.
+ * If you also want template instantiations of results, see
+ * `getAMember()`.
+ */
+ Declaration getACanonicalMember() { result = this.getCanonicalMember(_) }
+
+ /**
+ * Gets the (zero-based) `index`th member declared in this class.
+ * If you also want template instantiations of results, see
+ * `getAMember(int)`.
+ */
+ Declaration getCanonicalMember(int index) { member(this,index,result) }
+
+ /**
+ * Gets the (zero-based) `index`th canonical member declared in this
+ * class and, if that member is a template, all instantiations of that
+ * template. If you only want the canonical member, see
+ * `getCanonicalMember(int)`.
+ */
+ Declaration getAMember(int index) {
+ result = this.getCanonicalMember(index) or
+ result = this.getCanonicalMember(index).(TemplateClass).getAnInstantiation() or
+ result = this.getCanonicalMember(index).(TemplateFunction).getAnInstantiation() or
+ result = this.getCanonicalMember(index).(TemplateVariable).getAnInstantiation()
+ }
+
+ /**
+ * DEPRECATED: Use `getCanonicalMember(int)` or `getAMember(int)` instead.
+ * Gets the `index`th member of this class.
+ */
+ deprecated Declaration getMember(int index) { member(this,index,result) }
+
+ /**
+ * DEPRECATED: As this includes a somewhat arbitrary number of
+ * template instantiations, it is unlikely to do what
+ * you need.
+ * Gets the number of members that this class has. This includes both
+ * templates that are in this class, and instantiations of those
+ * templates.
+ */
+ deprecated int getNumMember() { result = count(this.getAMember()) }
+
+ /**
+ * Gets a private member declared in this class.
+ * For template members, this may be either the template or an
+ * instantiation of that template. For just the template, use
+ * `getAPrivateCanonicalMember()`.
+ */
+ Declaration getAPrivateMember() {
+ result = this.getAMember() and result.hasSpecifier("private")
+ }
+
+ /**
+ * Gets a private canonical member declared in this class.
+ * If you also want template instantiations of results, see
+ * `getAPrivateMember()`.
+ */
+ Declaration getAPrivateCanonicalMember() {
+ result = this.getACanonicalMember() and result.hasSpecifier("private")
+ }
+
+ /**
+ * Gets a protected member declared in this class.
+ * For template members, this may be either the template or an
+ * instantiation of that template. For just the template, use
+ * `getAProtectedCanonicalMember()`.
+ */
+ Declaration getAProtectedMember() {
+ result = this.getAMember() and result.hasSpecifier("protected")
+ }
+
+ /**
+ * Gets a protected canonical member declared in this class.
+ * If you also want template instantiations of results, see
+ * `getAProtectedMember()`.
+ */
+ Declaration getAProtectedCanonicalMember() {
+ result = this.getACanonicalMember() and result.hasSpecifier("protected")
+ }
+
+ /**
+ * Gets a public member declared in this class.
+ * For template members, this may be either the template or an
+ * instantiation of that template. For just the template, use
+ * `getAPublicCanonicalMember()`.
+ */
+ Declaration getAPublicMember() {
+ result = this.getAMember() and result.hasSpecifier("public")
+ }
+
+ /**
+ * Gets a public canonical member declared in this class.
+ * If you also want template instantiations of results, see
+ * `getAPublicMember()`.
+ */
+ Declaration getAPublicCanonicalMember() {
+ result = this.getACanonicalMember() and result.hasSpecifier("public")
+ }
+
+ /** Gets a static member declared in this class. */
+ Declaration getAStaticMember() {
+ result = this.getAMember() and result.isStatic()
+ }
+
+ /** Gets a field of this class. */
+ Field getAField() { result = this.getAMemberVariable() }
+
+ /** Gets a constructor of this class. */
+ Constructor getAConstructor() { result = this.getAMemberFunction() }
+
+ /** Holds if this class has a constructor. */
+ predicate hasConstructor() { exists(this.getAConstructor()) }
+
+ /**
+ * Holds if this class has a copy constructor that is either explicitly
+ * declared (though possibly `= delete`) or is auto-generated, non-trivial
+ * and called from somewhere.
+ *
+ * DEPRECATED: There is more than one reasonable definition of what it means
+ * to have a copy constructor, and we do not want to promote one particular
+ * definition by naming it with this predicate. Having a copy constructor
+ * could mean that such a member is declared or defined in the source or that
+ * it is callable by a particular caller. For C++11, there's also a question
+ * of whether to include members that are defaulted or deleted.
+ */
+ deprecated predicate hasCopyConstructor() {
+ exists(CopyConstructor cc | cc = this.getAMemberFunction())
+ }
+
+ /**
+ * Holds if this class has a copy assignment operator that is either
+ * explicitly declared (though possibly `= delete`) or is auto-generated,
+ * non-trivial and called from somewhere.
+ *
+ * DEPRECATED: There is more than one reasonable definition of what it means
+ * to have a copy assignment operator, and we do not want to promote one
+ * particular definition by naming it with this predicate. Having a copy
+ * assignment operator could mean that such a member is declared or defined
+ * in the source or that it is callable by a particular caller. For C++11,
+ * there's also a question of whether to include members that are defaulted
+ * or deleted.
+ */
+ deprecated predicate hasCopyAssignmentOperator() {
+ exists(CopyAssignmentOperator coa | coa = this.getAMemberFunction())
+ }
+
+ /**
+ * Like accessOfBaseMember but returns multiple results if there are multiple
+ * paths to `base` through the inheritance graph.
+ */
+ private AccessSpecifier accessOfBaseMemberMulti(Class base,
+ AccessSpecifier fieldInBase)
+ {
+ (this = base and result = fieldInBase)
+ or
+ exists(ClassDerivation cd | cd.getBaseClass() = base |
+ result = this.accessOfBaseMemberMulti(
+ cd.getDerivedClass(),
+ fieldInBase.accessInDirectDerived(cd.getASpecifier().(AccessSpecifier))
+ )
+ )
+ }
+
+ /**
+ * Gets the access specifier, if any, that a hypothetical member of `base`
+ * would have when viewed as a member of `this`, given that this member had
+ * access specifier `fieldInBase`. Encodes the rules of C++14 11.2/1 and
+ * 11.6/1, except that this predicate includes the case of `base` = `this`.
+ */
+ AccessSpecifier accessOfBaseMember(Class base, AccessSpecifier fieldInBase) {
+ // If there are multiple paths through the inheritance graph, we take the
+ // most permissive one (C++14 11.6/1). This implementation relies on the
+ // alphabetical order of "private", "protected", "public".
+ result.hasName(
+ max(this.accessOfBaseMemberMulti(base, fieldInBase).getName())
+ )
+ }
+
+ /**
+ * Gets the access specifier, if any, that `member` has when viewed as a
+ * member of `this`, where `member` may come from a base class of `this`.
+ * Encodes the rules of C++14 11.2/1 and 11.6/1, except that this predicate
+ * includes the case of `base` = `this`.
+ */
+ AccessSpecifier accessOfBaseMember(Declaration member) {
+ result = this.accessOfBaseMember(
+ member.getDeclaringType(),
+ member.getASpecifier().(AccessSpecifier)
+ )
+ }
+
+ /**
+ * DEPRECATED: name changed to `hasImplicitCopyConstructor` to reflect that
+ * `= default` members are no longer included.
+ */
+ deprecated predicate hasGeneratedCopyConstructor() {
+ hasImplicitCopyConstructor()
+ }
+
+ /**
+ * DEPRECATED: name changed to `hasImplicitCopyAssignmentOperator` to
+ * reflect that `= default` members are no longer included.
+ */
+ deprecated predicate hasGeneratedCopyAssignmentOperator() {
+ hasImplicitCopyConstructor()
+ }
+
+ /**
+ * Holds if this class has an implicitly-declared copy constructor that is
+ * not _deleted_. This predicate is more accurate than checking
+ * if this class has a `CopyConstructor cc` where `cc.isCompilerGenerated()`
+ * since such a `CopyConstructor` may not exist in the database if (1) it is
+ * never called or (2) it is _trivial_, meaning that it is equivalent to
+ * `memcpy`.
+ */
+ predicate hasImplicitCopyConstructor() {
+ not this.implicitCopyConstructorDeleted() and
+ forall(CopyConstructor cc | cc = this.getAMemberFunction() |
+ cc.isCompilerGenerated() and not cc.isDeleted()
+ )
+ }
+
+ /**
+ * Holds if this class has an implicitly-declared copy assignment operator
+ * that is not _deleted_. This predicate is more accurate than checking
+ * if this class has a `CopyAssignmentOperator ca` where
+ * `ca.isCompilerGenerated()` since such a `CopyAssignmentOperator` may not
+ * exist in the database if (1) it is never called or (2) it is _trivial_,
+ * meaning that it is equivalent to `memcpy`.
+ */
+ predicate hasImplicitCopyAssignmentOperator() {
+ not this.implicitCopyAssignmentOperatorDeleted() and
+ forall(CopyAssignmentOperator ca | ca = this.getAMemberFunction() |
+ ca.isCompilerGenerated() and not ca.isDeleted()
+ )
+ }
+
+ /**
+ * Holds if the compiler would be unable to generate a copy constructor for
+ * this class. This predicate implements the rules listed here:
+ * http://en.cppreference.com/w/cpp/language/copy_constructor#Deleted_implicitly-declared_copy_constructor
+ */
+ predicate implicitCopyConstructorDeleted() {
+ // - T has non-static data members that cannot be copied (have deleted,
+ // inaccessible, or ambiguous copy constructors);
+ exists(Type t | t = this.getAFieldSubobjectType().getUnspecifiedType() |
+ // Note: Overload resolution is not implemented -- all copy
+ // constructors are considered equal.
+ this.cannotAccessCopyConstructorOnAny(t.(Class))
+ )
+ or
+ // - T has direct or virtual base class that cannot be copied (has deleted,
+ // inaccessible, or ambiguous copy constructors);
+ exists(Class c | c = this.getADirectOrVirtualBase() |
+ // Note: Overload resolution is not implemented -- all copy
+ // constructors are considered equal.
+ this.cannotAccessCopyConstructorOnThis(c)
+ )
+ or
+ // - T has direct or virtual base class with a deleted or inaccessible
+ // destructor;
+ exists(Class base | base = this.getADirectOrVirtualBase() |
+ this.cannotAccessDestructor(base, this)
+ )
+ or
+ // - T has a user-defined move constructor or move assignment operator;
+ exists(MoveConstructor mc | mc = this.getAMemberFunction() |
+ not mc.isCompilerGenerated())
+ or
+ exists(MoveAssignmentOperator ma | ma = this.getAMemberFunction() |
+ not ma.isCompilerGenerated())
+ or
+ // - T is a union and has a variant member with non-trivial copy
+ // constructor (since C++11)
+ none() // Not implemented
+ or
+ // - T has a data member of rvalue reference type.
+ exists (Type t | t = this.getAFieldSubobjectType() |
+ t instanceof RValueReferenceType
+ )
+ }
+
+ /**
+ * Holds if the compiler would be unable to generate a copy assignment
+ * operator for this class. This predicate implements the rules listed here:
+ * http://en.cppreference.com/w/cpp/language/copy_assignment#Deleted_implicitly-declared_copy_assignment_operator
+ */
+ predicate implicitCopyAssignmentOperatorDeleted() {
+ // - T has a user-declared move constructor;
+ exists(MoveConstructor mc | mc = this.getAMemberFunction() |
+ not mc.isCompilerGenerated())
+ or
+ // - T has a user-declared move assignment operator.
+ exists(MoveAssignmentOperator ma | ma = this.getAMemberFunction() |
+ not ma.isCompilerGenerated())
+ or
+
+ // - T has a non-static data member of non-class type (or array thereof)
+ // that is const;
+ exists(Type t | t = this.getAFieldSubobjectType() |
+ // The rule for this case refers only to non-class types only, but our
+ // implementation extends it to cover class types too. Class types are
+ // supposed to be covered by the rule below on data members that
+ // cannot be copy-assigned. Copy-assigning a const class-typed member
+ // would call an overload of type
+ // `const C& operator=(const C&) const;`. Such an overload is unlikely
+ // to exist because it contradicts the intention of "const": it allows
+ // assigning to a const object. But since we have not implemented the
+ // ability to distinguish between overloads, we cannot distinguish that
+ // overload from the ordinary `C& operator=(const C&);`. Instead, we
+ // require class types to be non-const in this clause.
+ /* not t instanceof Class and */ t.isConst()
+ )
+ or
+ // - T has a non-static data member of a reference type;
+ exists (Type t | t = this.getAFieldSubobjectType() |
+ t instanceof ReferenceType
+ )
+ or
+ // - T has a non-static data member or a direct or virtual base class that
+ // cannot be copy-assigned (overload resolution for the copy assignment
+ // fails, or selects a deleted or inaccessible function);
+ exists(Type t | t = this.getAFieldSubobjectType().getUnspecifiedType() |
+ // Note: Overload resolution is not implemented -- all copy assignment
+ // operators are considered equal.
+ this.cannotAccessCopyAssignmentOperatorOnAny(t.(Class))
+ )
+ or
+ exists(Class c | c = this.getADirectOrVirtualBase() |
+ // Note: Overload resolution is not implemented -- all copy assignment
+ // operators are considered equal.
+ this.cannotAccessCopyAssignmentOperatorOnThis(c)
+ )
+ // - T is a union-like class, and has a variant member whose corresponding
+ // assignment operator is non-trivial.
+ // Not implemented
+ }
+
+ /** Gets the destructor of this class, if any. */
+ Destructor getDestructor() { result = this.getAMemberFunction() }
+
+ /** Holds if this class has a destructor. */
+ predicate hasDestructor() { exists(this.getDestructor()) }
+
+ /**
+ * Holds if this class is a POD (Plain Old Data) class [N4140 9(10)].
+ *
+ * The definition of POD changed between C++03 and C++11, so whether
+ * a class is POD can depend on which version of the language it was
+ * compiled for. For this reason, the `is_pod_class` predicate is
+ * generated by the extractor.
+ */
+ predicate isPOD() { is_pod_class(this) }
+
+ /**
+ * Holds if this class is abstract, in other words whether it declares one
+ * or more pure virtual member functions.
+ */
+ predicate isAbstract() { this.getAMemberFunction() instanceof PureVirtualFunction }
+
+ /** Gets a direct base class of this class [N4140 10]. */
+ Class getABaseClass() { this.getADerivation().getBaseClass() = result }
+
+ /** Gets a class that is directly derived from this class [N4140 10]. */
+ Class getADerivedClass() { result.getABaseClass() = this }
+
+ /** Holds if this class derives directly from that. */
+ predicate derivesFrom(Class that) {
+ this.getABaseClass() = that
+ }
+
+ override predicate refersToDirectly(Type t) {
+ t = this.getATemplateArgument() or
+ this.isConstructedFrom(t)
+ }
+
+ /**
+ * Gets a class derivation of this class, for example the "public B"
+ * in "class D : public B { ... };".
+ */
+ ClassDerivation getADerivation() {
+ exists(ClassDerivation d | d.getDerivedClass() = this and d = result)
+ }
+ ClassDerivation getDerivation(int index) {
+ exists(ClassDerivation d
+ | d.getDerivedClass() = this and d.getIndex() = index and d = result)
+ }
+
+ /**
+ * Gets the byte offset within `this` of each base class subobject of type
+ * `baseClass`, or zero if `baseClass` and `this` are the same type. Both
+ * direct and indirect base classes are included.
+ * Does not hold for base class subobjects for virtual base classes, nor does
+ * it hold for further base class subobjects of virtual base classes.
+ */
+ private int getANonVirtualBaseClassByteOffset(Class baseClass) {
+ baseClass = this and result = 0 or // `baseClass` is the most-derived type
+ exists(ClassDerivation cd |
+ // Add the offset of the direct base class and the offset of `baseClass`
+ // within that direct base class.
+ cd = getADerivation() and
+ result = cd.getBaseClass().getANonVirtualBaseClassByteOffset(baseClass) +
+ cd.getByteOffset()
+ )
+ }
+
+ /**
+ * Gets the byte offset within `this` of each base class subobject of type
+ * `baseClass`, or zero if `baseClass` and `this` are the same type. Both
+ * direct and indirect base classes are included.
+ * Note that for virtual base classes, and non-virtual base classes thereof,
+ * this predicate assumes that `this` is the type of the complete most-derived
+ * object.
+ */
+ int getABaseClassByteOffset(Class baseClass) {
+ // Handle the non-virtual case.
+ result = getANonVirtualBaseClassByteOffset(baseClass) or
+ exists(Class virtualBaseClass, int virtualBaseOffset,
+ int offsetFromVirtualBase |
+ // Look for the base class as a non-virtual base of a direct or indirect
+ // virtual base, adding the two offsets.
+ getVirtualBaseClassByteOffset(virtualBaseClass) = virtualBaseOffset and
+ offsetFromVirtualBase =
+ virtualBaseClass.getANonVirtualBaseClassByteOffset(baseClass) and
+ result = virtualBaseOffset + offsetFromVirtualBase
+ )
+ }
+
+ /**
+ * Holds if this class has a virtual class derivation, for example the
+ * "virtual public B" in "class D : virtual public B { ... };".
+ */
+ predicate hasVirtualBaseClass(Class base) {
+ exists(ClassDerivation cd |
+ this.getADerivation() = cd and
+ cd.getBaseClass() = base and
+ cd.hasSpecifier("virtual")
+ )
+ }
+
+ /**
+ * Gets the byte offset of virtual base class subobject `base` within a
+ * most-derived object of class `this`. The virtual base can be a direct or
+ * indirect virtual base of `this`. Does not hold if `this` is an
+ * uninstantiated template.
+ * See `ClassDerivation.getByteOffset` for offsets of non-virtual base
+ * classes.
+ */
+ int getVirtualBaseClassByteOffset(Class base) {
+ virtual_base_offsets(this, base, result)
+ }
+
+ /**
+ * Holds if this class has a private class derivation, for example the
+ * "private B" in "class D : private B { ... };".
+ */
+ predicate hasPrivateBaseClass(Class base) {
+ exists(ClassDerivation cd |
+ this.getADerivation() = cd and
+ cd.getBaseClass() = base and
+ cd.hasSpecifier("private")
+ )
+ }
+
+ /**
+ * Holds if this class has a public class derivation, for example the
+ * "public B" in "class D : public B { ... };".
+ */
+ predicate hasPublicBaseClass(Class base) {
+ exists(ClassDerivation cd |
+ this.getADerivation() = cd and
+ cd.getBaseClass() = base and
+ cd.hasSpecifier("public")
+ )
+ }
+
+ /**
+ * Holds if this class has a protected class derivation, for example the
+ * "protected B" in "class D : protected B { ... };".
+ */
+ predicate hasProtectedBaseClass(Class base) {
+ exists(ClassDerivation cd |
+ this.getADerivation() = cd and
+ cd.getBaseClass() = base and
+ cd.hasSpecifier("protected")
+ )
+ }
+
+ /** Gets the metric class. */
+ MetricClass getMetrics() { result = this }
+
+ /** Gets a friend declaration in this class. */
+ FriendDecl getAFriendDecl() { result.getDeclaringClass() = this }
+
+ override string explain() { result = "class " + this.getName() }
+
+ override predicate isDeeplyConstBelow() { any() } // No subparts
+
+ /**
+ * The alignment of this type in bytes (on the machine where facts were
+ * extracted).
+ */
+ int getAlignment() { usertypesize(this,_,result) }
+
+ /**
+ * Holds if this class is constructed from another class as a result of
+ * template instantiation. It originates either from a class template or
+ * from a class nested in a class template.
+ */
+ predicate isConstructedFrom(Class c) {
+ class_instantiation(this, c)
+ }
+
+ /**
+ * Gets a template argument used to instantiate this class from a class
+ * template. When called on a class template, this will return a template
+ * parameter.
+ */
+ Type getATemplateArgument() {
+ exists(int i | this.getTemplateArgument(i) = result )
+ }
+
+ /** Gets the number of template arguments for this class. */
+ int getNumberOfTemplateArguments() {
+ result = count(int i | exists(getTemplateArgument(i)))
+ }
+
+ /**
+ * Gets the `i`th template argument used to instantiate this class from a
+ * class template. When called on a class template, this will return the
+ * `i`th template parameter.
+ */
+ Type getTemplateArgument(int i) {
+ class_template_argument(this,i,unresolve(result))
+ }
+
+ /**
+ * Holds if or not this class is polymorphic (has a virtual function, or
+ * inherits one).
+ */
+ predicate isPolymorphic() {
+ exists(MemberFunction f | f.getDeclaringType() = getABaseClass*() and f.isVirtual())
+ }
+
+ override predicate involvesTemplateParameter() {
+ getATemplateArgument().involvesTemplateParameter()
+ }
+
+ /** Holds if this class was declared 'final'. */
+ predicate isFinal() {
+ usertype_final(this)
+ }
+
+ /** Gets a link target which references this class. */
+ LinkTarget getALinkTarget() {
+ this = result.getAClass()
+ }
+
+ /**
+ * Gets the UUID that associated with this class via the `__declspec(uuid)`
+ * attribute.
+ *
+ * Regardless of the format of the UUID string in source code, the returned
+ * value is normalized to the standard "registry format", without braces, and
+ * using lowercase letters (e.g. "01234567-89ab-cdef-0123-456789abcdef").
+ */
+ string getUuid() {
+ usertype_uuid(this, result)
+ }
+
+ private Type getAFieldSubobjectType() {
+ result = stripArrayTypes(this.getAField().getUnderlyingType())
+ }
+
+ private Class getADirectOrVirtualBase() {
+ // `result` is a direct base of `this`
+ result.getADerivedClass() = this
+ or
+ // `result` is an indirect virtual base of `this`. The case where `result`
+ // is a direct virtual base of `this` is included in the above clause, and
+ // therefore we can use "+"-closure instead of "*"-closure here.
+ result.(VirtualBaseClass)
+ .getAVirtuallyDerivedClass()
+ .getADerivedClass+() = this
+ }
+
+ /**
+ * Holds if `this` can NOT access the destructor of class `c` on an object of
+ * type `objectClass`. Note: this implementation is incomplete but will be
+ * correct in most cases; it errs on the side of claiming that the destructor
+ * is accessible.
+ */
+ pragma[inline]
+ private predicate cannotAccessDestructor(Class c, Class objectClass) {
+ // The destructor in our db, if any, is accessible. If there is no
+ // destructor in our db, it usually means that there is a default
+ // public one.
+ exists(Destructor d | d = c.getAMemberFunction() |
+ not this.canAccessMember(d, objectClass))
+
+ // The extractor doesn't seem to support the case of a deleted destructor,
+ // so we ignore that. It is very much a corner case.
+
+ // To implement this properly, there should be a predicate about whether
+ // the implicit destructor is deleted, similar to
+ // `implicitCopyConstructorDeleted`. See
+ // http://en.cppreference.com/w/cpp/language/destructor#Deleted_implicitly-declared_destructor
+ }
+
+ private predicate cannotAccessCopyConstructorOnThis(Class c) {
+ this.cannotAccessCopyConstructor(c, this)
+ }
+
+ private predicate cannotAccessCopyConstructorOnAny(Class c) {
+ this.cannotAccessCopyConstructor(c, c)
+ }
+
+ /**
+ * Holds if `this` can NOT access the copy constructor of class `c` in order
+ * to construct an object of class `objectClass`. In practice, set
+ * `objectClass` to `this` when access-checking a base subobject
+ * initialization (like `class D : C { D(D& that) : C(that) { ... } }`). Set
+ * `objectClass` to `c` for any other purpose (like `C y = x;`).
+ */
+ pragma[inline]
+ private predicate cannotAccessCopyConstructor(Class c, Class objectClass) {
+ // Pseudocode:
+ // if c has CopyConstructor cc
+ // then this.cannotAccess(cc)
+ // else this.implicitCopyConstructorDeleted()
+ exists(CopyConstructor cc | cc = c.getAMemberFunction() |
+ not this.canAccessMember(cc, objectClass))
+ or
+ (
+ not exists(CopyConstructor cc | cc = c.getAMemberFunction() and not cc.isDeleted()) and
+ c.implicitCopyConstructorDeleted() // mutual recursion here
+ // no access check in this case since the implicit member is always
+ // public.
+ )
+ }
+
+ private predicate cannotAccessCopyAssignmentOperatorOnThis(Class c) {
+ this.cannotAccessCopyAssignmentOperator(c, this)
+ }
+
+ private predicate cannotAccessCopyAssignmentOperatorOnAny(Class c) {
+ this.cannotAccessCopyAssignmentOperator(c, c)
+ }
+
+ /**
+ * Holds if `this` can NOT access the copy assignment operator of class `c` on
+ * an object of type `objectClass`, where `objectClass` is derived from or
+ * equal to `c`. That is, whether the call `x.C::operator=(...)` is forbidden
+ * when the type of `x` is `objectClass`, and `c` has the name `C`.
+ */
+ pragma[inline]
+ private predicate cannotAccessCopyAssignmentOperator(Class c, Class objectClass) {
+ // Pseudocode:
+ // if c has CopyAssignmentOperator ca
+ // then this.cannotAccess(ca)
+ // else this.implicitCopyAssignmentOperatorDeleted()
+ exists(CopyAssignmentOperator ca | ca = c.getAMemberFunction() |
+ not this.canAccessMember(ca, objectClass))
+ or
+ (
+ not exists(CopyAssignmentOperator ca | ca = c.getAMemberFunction() and not ca.isDeleted()) and
+ c.implicitCopyAssignmentOperatorDeleted() // mutual recursion here
+ // no access check in this case since the implicit member is always
+ // public.
+ )
+ }
+}
+
+/**
+ * A class derivation, for example the "public B" in
+ * "class D : public B { ... };".
+ */
+class ClassDerivation extends Locatable, @derivation {
+ /**
+ * Gets the class/struct from which we are actually deriving, resolving a
+ * typedef if necessary. For example, the base class in the following
+ * would be B:
+ *
+ * struct B {};
+ * typedef B T;
+ * struct D : T {};
+ */
+ Class getBaseClass() {
+ result = getBaseType().getUnderlyingType()
+ }
+
+ /**
+ * Gets the type from which we are deriving, without resolving any
+ * typedef. For example, the base type in the following would be T:
+ *
+ * struct B {};
+ * typedef B T;
+ * struct D : T {};
+ */
+ Type getBaseType() {
+ derivations(this,_,_,unresolve(result),_)
+ }
+
+ /**
+ * Gets the class that is doing the deriving. For example, the derived
+ * class in the following would be D:
+ *
+ * struct B {};
+ * struct D : B {};
+ */
+ Class getDerivedClass() {
+ derivations(this,unresolve(result),_,_,_)
+ }
+
+ /**
+ * Gets the index of the derivation in the derivation list for the
+ * derived class (indexed from 0). For example, the index of the
+ * derivation of B2 in "struct D : B1, B2 { ... };" would be 1.
+ */
+ int getIndex() {
+ derivations(this,_,result,_,_)
+ }
+
+ /** Gets a specifier (for example "public") applied to the derivation. */
+ Specifier getASpecifier() {
+ derspecifiers(this,result)
+ }
+
+ /** Holds if the derivation has specifier `s`. */
+ predicate hasSpecifier(string s) {
+ this.getASpecifier().hasName(s)
+ }
+
+ /** Holds if the derivation is for a virtual base class. */
+ predicate isVirtual() {
+ hasSpecifier("virtual")
+ }
+
+ /** Gets the location of the derivation. */
+ override Location getLocation() {
+ derivations(this,_,_,_,result)
+ }
+
+ /**
+ * Gets the byte offset of the base class subobject relative to the start of
+ * the derived class object. Only holds for non-virtual bases, since the
+ * offset of a virtual base class is not a constant. Does not hold if the
+ * derived class is an uninstantiated template.
+ * See `Class.getVirtualBaseClassByteOffset` for offsets of virtual base
+ * classes.
+ */
+ int getByteOffset() {
+ direct_base_offsets(this, result)
+ }
+
+ override string toString() {
+ result = "derivation"
+ }
+}
+
+/** A class that is directly enclosed by a function. */
+class LocalClass extends Class {
+ LocalClass() {
+ isLocal()
+ }
+
+ override Function getEnclosingAccessHolder() {
+ result = this.getEnclosingFunction()
+ }
+}
+
+/**
+ * A nested class [4140 9.7].
+ */
+class NestedClass extends Class {
+ NestedClass() {
+ this.isMember()
+ }
+
+ /** Holds if this member is private. */
+ predicate isPrivate() { this.hasSpecifier("private") }
+
+ /** Holds if this member is public. */
+ predicate isProtected() { this.hasSpecifier("protected") }
+
+ /** Holds if this member is public. */
+ predicate isPublic() { this.hasSpecifier("public") }
+
+}
+
+/**
+ * An "abstract class", in other words a class that contains at least one
+ * pure virtual function.
+ */
+class AbstractClass extends Class {
+ AbstractClass() {
+ exists(PureVirtualFunction f| this.getAMemberFunction() = f)
+ }
+}
+
+/**
+ * A class template. (This class also finds partial specializations
+ * of class templates).
+ */
+class TemplateClass extends Class {
+ TemplateClass() { usertypes(this,_,6) }
+ Class getAnInstantiation() {
+ result.isConstructedFrom(this) and
+ exists(result.getATemplateArgument())
+ }
+}
+
+/**
+ * A class that is an instantiation of a template.
+ */
+class ClassTemplateInstantiation extends Class {
+ ClassTemplateInstantiation() {
+ exists(TemplateClass tc | tc.getAnInstantiation() = this)
+ }
+}
+
+/**
+ * A specialization of a class template.
+ */
+abstract class ClassTemplateSpecialization extends Class {
+ /**
+ * Gets the primary template for the specialization, for example
+ * S<T,int> -> S<T,U>.
+ */
+ TemplateClass getPrimaryTemplate() {
+ // Ignoring template arguments, the primary template has the same name
+ // as each of its specializations.
+ result.getSimpleName() = getSimpleName()
+
+ // It is in the same namespace as its specializations.
+ and result.getNamespace() = getNamespace()
+
+ // It is distinguished by the fact that each of its template arguments
+ // is a distinct template parameter.
+ and count(TemplateParameter tp | tp = result.getATemplateArgument()) =
+ count(int i | exists(result.getTemplateArgument(i)))
+ }
+}
+
+/**
+ * A full specialization of a class template.
+ */
+class FullClassTemplateSpecialization extends ClassTemplateSpecialization {
+ FullClassTemplateSpecialization() {
+ // This class has template arguments, but none of them involves a template parameter.
+ exists(getATemplateArgument())
+ and not exists(Type ta | ta = getATemplateArgument() and ta.involvesTemplateParameter())
+
+ // This class does not have any instantiations.
+ and not exists(this.(TemplateClass).getAnInstantiation())
+
+ // This class is not an instantiation of a class template.
+ and not this instanceof ClassTemplateInstantiation
+ }
+}
+
+/**
+ * A partial specialization of a class template.
+ */
+class PartialClassTemplateSpecialization extends ClassTemplateSpecialization {
+ PartialClassTemplateSpecialization() {
+ /*
+ * (a) At least one of this class's template arguments involves a
+ * template parameter in some respect, for example T, T*, etc.
+ *
+ * (b) It is not the case that the n template arguments of this class
+ * are a set of n distinct template parameters.
+ *
+ * template class X {}; // class template
+ * template class X {}; // partial class template specialization
+ * template class X {}; // partial class template specialization
+ * template class Y {}; // class template
+ * template class Y {}; // partial class template specialization
+ */
+ exists(Type ta | ta = getATemplateArgument() and ta.involvesTemplateParameter())
+ and count(TemplateParameter tp | tp = getATemplateArgument()) !=
+ count(int i | exists(getTemplateArgument(i)))
+ }
+}
+
+/**
+ * An "interface", in other words a class that only contains pure virtual
+ * functions.
+ */
+class Interface extends Class {
+ Interface() {
+ forex(Declaration m | m.getDeclaringType() = this.getABaseClass*() and not compgenerated(m) | m instanceof PureVirtualFunction)
+ }
+}
+
+/**
+ * A class derivation that is virtual, for example
+ * "class X : --> virtual public Y <--."
+ */
+class VirtualClassDerivation extends ClassDerivation {
+ VirtualClassDerivation() {
+ hasSpecifier("virtual")
+ }
+}
+
+/**
+ * A class that is the base of some virtual class derivation.
+ */
+class VirtualBaseClass extends Class {
+ VirtualBaseClass() {
+ exists(VirtualClassDerivation cd | cd.getBaseClass() = this)
+ }
+
+ /** A virtual class derivation of which this class is the base. */
+ VirtualClassDerivation getAVirtualDerivation() {
+ result.getBaseClass() = this
+ }
+
+ /** A class that is derived from this one using virtual inheritance. */
+ Class getAVirtuallyDerivedClass() {
+ result = getAVirtualDerivation().getDerivedClass()
+ }
+}
+
+/**
+ * The proxy class (where needed) associated with a template parameter, as
+ * in the following code:
+ *
+ * template <typename T>
+ * struct S : T // the type of this T is a proxy class
+ * {};
+ */
+class ProxyClass extends UserType {
+ ProxyClass() {
+ usertypes(this,_,9)
+ }
+
+ /** Gets the location of the proxy class. */
+ override Location getLocation() {
+ result = getTemplateParameter().getDefinitionLocation()
+ }
+
+ /** Gets the template parameter for which this is the proxy class. */
+ TemplateParameter getTemplateParameter() {
+ is_proxy_class_for(this,result)
+ }
+}
+
+// Unpacks "array of ... of array of t" into t.
+private Type stripArrayTypes(Type t) {
+ not t instanceof ArrayType and result = t or
+ result = stripArrayTypes(t.(ArrayType).getBaseType())
+}
diff --git a/cpp/ql/src/semmle/code/cpp/Comments.qll b/cpp/ql/src/semmle/code/cpp/Comments.qll
new file mode 100644
index 000000000000..1176ccfaf785
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/Comments.qll
@@ -0,0 +1,30 @@
+import semmle.code.cpp.Location
+import semmle.code.cpp.Element
+
+/**
+ * A C/C++ comment.
+ */
+class Comment extends Locatable, @comment {
+ override string toString() { result = this.getContents() }
+ override Location getLocation() { comments(this,_,result) }
+ string getContents() { comments(this,result,_) }
+ Element getCommentedElement() { commentbinding(this,result) }
+}
+
+/**
+ * A C style comment (one which starts with `/*`).
+ */
+class CStyleComment extends Comment {
+ CStyleComment() {
+ this.getContents().matches("/*%")
+ }
+}
+
+/**
+ * A CPP style comment (one which starts with `//`).
+ */
+class CppStyleComment extends Comment {
+ CppStyleComment() {
+ this.getContents().prefix(2) = "//"
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/Compilation.qll b/cpp/ql/src/semmle/code/cpp/Compilation.qll
new file mode 100644
index 000000000000..339cea244c6c
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/Compilation.qll
@@ -0,0 +1,124 @@
+import semmle.code.cpp.File
+
+/**
+ * These two helper predicates are used to associate a unique integer with
+ * each `@compilation`, for use in the `toString` method of `Compilation`.
+ * These integers are not stable across trap imports, but stable across
+ * runs with the same database.
+ */
+private predicate id(@compilation x, @compilation y) { x = y }
+private predicate idOf(@compilation x, int y) = equivalenceRelation(id/2)(x, y)
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ * gcc -c f1.c f2.c f3.c
+ *
+ * Three things happen to each file during a compilation:
+ *
+ * 1. The file is compiled by a real compiler, such as gcc or VC.
+ * 2. The file is parsed by Semmle's C++ front-end.
+ * 3. The parsed representation is converted to database tables by
+ * Semmle's extractor.
+ *
+ * This class provides CPU and elapsed time information for steps 2 and 3,
+ * but not for step 1.
+ */
+class Compilation extends @compilation {
+ /** Gets a textual representation of this element. */
+ string toString() {
+ exists(int i
+ | idOf(this, i) and
+ result = "")
+ }
+
+ /** Gets a file compiled during this invocation. */
+ File getAFileCompiled() { result = getFileCompiled(_) }
+ File getFileCompiled(int i) {
+ compilation_compiling_files(this, i, result)
+ }
+
+ /**
+ * Gets the amount of CPU time spent processing file number `i` in the C++
+ * front-end.
+ */
+ float getFrontendCpuSeconds(int i) {
+ compilation_time(this, i, 1, result)
+ }
+
+ /**
+ * Gets the amount of elapsed time while processing file number `i` in the
+ * C++ front-end.
+ */
+ float getFrontendElapsedSeconds(int i) {
+ compilation_time(this, i, 2, result)
+ }
+
+ /**
+ * Gets the amount of CPU time spent processing file number `i` in the
+ * extractor.
+ */
+ float getExtractorCpuSeconds(int i) {
+ compilation_time(this, i, 3, result)
+ }
+
+ /**
+ * Gets the amount of elapsed time while processing file number `i` in the
+ * extractor.
+ */
+ float getExtractorElapsedSeconds(int i) {
+ compilation_time(this, i, 4, result)
+ }
+
+ /**
+ * Gets an argument passed to the extractor on this invocation.
+ */
+ string getAnArgument() { result = getArgument(_) }
+
+ /**
+ * Gets the `i`th argument passed to the extractor on this invocation.
+ *
+ * If the compiler was invoked as `gcc -c f1.c f2.c f3.c` then this
+ * will typically hold for
+ *
+ * i | result
+ * - | ---
+ * 0 | *path to extractor*
+ * 1 | `--mimic`
+ * 2 | `/usr/bin/gcc`
+ * 3 | `-c`
+ * 4 | f1.c
+ * 5 | f2.c
+ * 6 | f3.c
+ */
+ string getArgument(int i) {
+ compilation_args(this, i, result)
+ }
+
+ /**
+ * Gets the total amount of CPU time spent processing all the files in the
+ * front-end and extractor.
+ */
+ float getTotalCpuSeconds() {
+ compilation_finished(this, result, _)
+ }
+
+ /**
+ * Gets the total amount of elapsed time while processing all the files in
+ * the front-end and extractor.
+ */
+ float getTotalElapsedSeconds() {
+ compilation_finished(this, _, result)
+ }
+
+ /**
+ * Holds if the extractor terminated normally. Terminating with an exit
+ * code indicating that an error occurred is considered normal
+ * termination, but crashing due to something like a segfault is not.
+ */
+ predicate normalTermination() {
+ compilation_finished(this, _, _)
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/Declaration.qll b/cpp/ql/src/semmle/code/cpp/Declaration.qll
new file mode 100644
index 000000000000..45fc1ec2d6ab
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/Declaration.qll
@@ -0,0 +1,573 @@
+import semmle.code.cpp.Element
+import semmle.code.cpp.Specifier
+import semmle.code.cpp.Namespace
+
+/**
+ * A C/C++ declaration: for example, a variable declaration, a type
+ * declaration, or a function declaration.
+ *
+ * This file defines two closely related classes: `Declaration` and
+ * `DeclarationEntry`. Some declarations do not correspond to a unique
+ * location in the source code. For example, a global variable might
+ * be declared in multiple source files:
+ *
+ * extern int myglobal;
+ *
+ * Each of these declarations is given its own distinct `DeclarationEntry`,
+ * but they all share the same `Declaration`.
+ *
+ * Some derived class of `Declaration` do not have a corresponding
+ * `DeclarationEntry`, because they always have a unique source location.
+ * `EnumConstant` and `FriendDecl` are both examples of this.
+ */
+abstract class Declaration extends Locatable, @declaration {
+ /**
+ * Gets the innermost namespace which contains this declaration.
+ *
+ * The result will either be GlobalNamespace, or the tightest lexically
+ * enclosing namespace block. In particular, note that for declarations
+ * within structures, the namespace of the declaration is the same as the
+ * namespace of the structure.
+ */
+ Namespace getNamespace() {
+ // Top level declaration in a namespace ...
+ result.getADeclaration() = this
+
+ // ... or nested in another structure.
+ or
+ exists (Declaration m
+ | m = this and result = m.getDeclaringType().getNamespace())
+ or
+ exists (EnumConstant c
+ | c = this and result = c.getDeclaringEnum().getNamespace())
+ or
+ exists (Parameter p
+ | p = this and result = p.getFunction().getNamespace())
+ or
+ exists (LocalVariable v
+ | v = this and result = v.getFunction().getNamespace())
+ }
+
+ /**
+ * Gets the name of the declaration, fully qualified with its
+ * namespace. For example: "A::B::C::myfcn".
+ */
+ string getQualifiedName() {
+ // MemberFunction, MemberVariable, MemberType
+ exists (Declaration m
+ | m = this and
+ result = m.getDeclaringType().getQualifiedName() + "::" + m.getName())
+ or
+ exists (EnumConstant c
+ | c = this and
+ result = c.getDeclaringEnum().getQualifiedName() + "::" + c.getName())
+ or
+ exists (GlobalVariable v, string s1, string s2
+ | v = this and
+ s2 = v.getNamespace().getQualifiedName() and
+ s1 = v.getName()
+ | (s2 != "" and result = s2 + "::" + s1) or (s2 = "" and result = s1))
+ or
+ exists (Function f, string s1, string s2
+ | f = this and f.isTopLevel() and
+ s2 = f.getNamespace().getQualifiedName() and
+ s1 = f.getName()
+ | (s2 != "" and result = s2 + "::" + s1) or (s2 = "" and result = s1))
+ or
+ exists (UserType t, string s1, string s2
+ | t = this and t.isTopLevel() and
+ s2 = t.getNamespace().getQualifiedName() and
+ s1 = t.getName()
+ | (s2 != "" and result = s2 + "::" + s1) or (s2 = "" and result = s1))
+ }
+
+ predicate hasQualifiedName(string name) {
+ this.getQualifiedName() = name
+ }
+
+ override string toString() { result = this.getName() }
+
+ /** Gets the name of this declaration. */
+ abstract string getName();
+ predicate hasName(string name) { name = this.getName() }
+
+ /** Holds if this element has the given name in the global namespace. */
+ predicate hasGlobalName(string name) {
+ hasName(name)
+ and getNamespace() instanceof GlobalNamespace
+ }
+
+ /** Gets a specifier of this declaration. */
+ abstract Specifier getASpecifier();
+
+ /** Holds if this declaration has a specifier with the given name. */
+ predicate hasSpecifier(string name) {
+ this.getASpecifier().hasName(name)
+ }
+
+ /**
+ * Gets a declaration entry corresponding to this declaration. See the
+ * comment above this class for an explanation of the relationship
+ * between `Declaration` and `DeclarationEntry`.
+ */
+ DeclarationEntry getADeclarationEntry() {
+ none()
+ }
+
+ /**
+ * Gets the location of a declaration entry corresponding to this
+ * declaration.
+ */
+ abstract Location getADeclarationLocation();
+
+ /**
+ * Gets the declaration entry corresponding to this declaration that is a
+ * definition, if any.
+ */
+ DeclarationEntry getDefinition() {
+ none()
+ }
+
+ /** Gets the location of the definition, if any. */
+ abstract Location getDefinitionLocation();
+
+ /** Holds if the declaration has a definition. */
+ predicate hasDefinition() { exists(this.getDefinition()) }
+ predicate isDefined() { hasDefinition() }
+
+ /** Gets the preferred location of this declaration, if any. */
+ override Location getLocation() {
+ none()
+ }
+
+ /** Gets a file where this element occurs. */
+ File getAFile() { result = this.getADeclarationLocation().getFile() }
+
+ /** Holds if this declaration is a top-level declaration. */
+ predicate isTopLevel() {
+ not (this.isMember() or
+ this instanceof EnumConstant or
+ this instanceof Parameter or
+ this instanceof ProxyClass or
+ this instanceof LocalVariable or
+ this instanceof TemplateParameter or
+ this.(UserType).isLocal())
+ }
+
+ /** Holds if this declaration is static. */
+ predicate isStatic() { this.hasSpecifier("static") }
+
+ /** Holds if this declaration is a member of a class/struct/union. */
+ predicate isMember() { hasDeclaringType() }
+
+ /** Holds if this declaration is a member of a class/struct/union. */
+ predicate hasDeclaringType() {
+ exists(this.getDeclaringType())
+ }
+
+ /**
+ * Gets the class where this member is declared, if it is a member.
+ * For templates, both the template itself and all instantiations of
+ * the template are considered to have the same declaring class.
+ */
+ Class getDeclaringType() {
+ this = result.getAMember()
+ }
+}
+
+/**
+ * A C/C++ declaration entry. See the comment above `Declaration` for an
+ * explanation of the relationship between `Declaration` and
+ * `DeclarationEntry`.
+ */
+abstract class DeclarationEntry extends Locatable {
+ /** a specifier associated with this declaration entry */
+ abstract string getASpecifier();
+
+ /**
+ * Gets the name associated with the corresponding definition (where
+ * available), or the name declared by this entry otherwise.
+ */
+ string getCanonicalName() {
+ if getDeclaration().isDefined() then
+ result = getDeclaration().getDefinition().getName()
+ else
+ result = getName()
+ }
+
+ /**
+ * Gets the declaration for which this is a declaration entry.
+ *
+ * Note that this is *not* always the inverse of
+ * Declaration.getADeclarationEntry(), for example if C is a
+ * TemplateClass, I is an instantiation of C, and D is a Declaration of
+ * C, then:
+ * C.getADeclarationEntry() returns D
+ * I.getADeclarationEntry() returns D
+ * but D.getDeclaration() only returns C
+ */
+ abstract Declaration getDeclaration();
+
+ /** Gets the name associated with this declaration entry, if any. */
+ abstract string getName();
+
+ /**
+ * Gets the type associated with this declaration entry.
+ *
+ * For variable declarations, get the type of the variable.
+ * For function declarations, get the return type of the function.
+ * For type declarations, get the type being declared.
+ */
+ abstract Type getType();
+
+ /**
+ * Holds if this declaration entry has a specifier with the given name.
+ */
+ predicate hasSpecifier(string specifier) {
+ getASpecifier() = specifier
+ }
+
+ /** Holds if this declaration entry is a definition. */
+ abstract predicate isDefinition();
+
+ override string toString() {
+ if isDefinition() then
+ result = "definition of " + getName()
+ else if getName() = getCanonicalName() then
+ result = "declaration of " + getName()
+ else
+ result = "declaration of " + getCanonicalName() + " as " + getName()
+ }
+}
+
+
+/**
+ * A declaration that can potentially have more C++ access rights than its
+ * enclosing element. This comprises `Class` (they have access to their own
+ * private members) along with other `UserType`s and `Function` (they can be
+ * the target of `friend` declarations).
+ *
+ * In the C++ standard (N4140 11.2), rules for access control revolve around
+ * the informal phrase "_R_ occurs in a member or friend of class C", where
+ * `AccessHolder` corresponds to this _R_.
+ */
+abstract class AccessHolder extends Declaration {
+ /**
+ * Holds if `this` can access private members of class `c`.
+ *
+ * This predicate encodes the phrase "occurs in a member or friend" that is
+ * repeated many times in the C++14 standard, section 11.2.
+ */
+ predicate inMemberOrFriendOf(Class c) {
+ (
+ this.getEnclosingAccessHolder*() = c
+ ) or (
+ exists(FriendDecl fd | fd.getDeclaringClass() = c |
+ this.getEnclosingAccessHolder*() = fd.getFriend()
+ )
+ )
+ }
+
+ /**
+ * Gets the nearest enclosing AccessHolder.
+ */
+ abstract AccessHolder getEnclosingAccessHolder();
+
+ /**
+ * Holds if a base class `base` of `derived` _is accessible at_ `this` (N4140
+ * 11.2/4). When this holds, and `derived` has only one base subobject of
+ * type `base`, code in `this` can implicitly convert a pointer to `derived`
+ * into a pointer to `base`. Conversely, if such a conversion is possible
+ * then this predicate holds.
+ *
+ * For the sake of generality, this predicate also holds whenever `base` =
+ * `derived`.
+ *
+ * This predicate is `pragma[inline]` because it is infeasible to fully
+ * compute it on large code bases: all classes `derived` can be converted to
+ * their public bases `base` from everywhere (`this`), so this predicate
+ * could yield a number of tuples that is quadratic in the size of the
+ * program. To avoid this combinatorial explosion, only use this predicate in
+ * a context where `this` together with `base` or `derived` are sufficiently
+ * restricted.
+ */
+ pragma[inline]
+ predicate canAccessClass(Class base, Class derived) {
+ // This predicate is marked `inline` and implemented in a very particular
+ // way. If we allowed this predicate to be fully computed, it would relate
+ // all `AccessHolder`s to all classes, which would be too much.
+
+ // There are four rules in N4140 11.2/4. Only the one named (4.4) is
+ // recursive, and it describes a transitive closure: intuitively, if A can
+ // be converted to B, and B can be converted to C, then A can be converted
+ // to C. To limit the number of tuples in the non-inline helper predicates,
+ // we first separate the derivation of 11.2/4 into two cases:
+
+ // Derivations using only (4.1) and (4.4). Note that these derivations are
+ // independent of `this`, which is why users of this predicate must take
+ // care to avoid a combinatorial explosion.
+ isDirectPublicBaseOf*(base, derived)
+ or
+ exists(DirectAccessHolder n |
+ this.getEnclosingAccessHolder*() = n and
+ // Derivations using (4.2) or (4.3) at least once.
+ n.thisCanAccessClassTrans(base, derived)
+ )
+ }
+
+ /**
+ * Holds if a non-static member `member` _is accessible at_ `this` when named
+ * in a class `derived` that is derived from or equal to the declaring class
+ * of `member` (N4140 11.2/5 and 11.4).
+ *
+ * This predicate determines whether an expression `x.member` would be
+ * allowed in `this` when `x` has type `derived`. The more general syntax
+ * `x.N::member`, where `N` may be a base class of `derived`, is not
+ * supported. This should only affect very rare edge cases of 11.4. This
+ * predicate concerns only _access_ and thus does not determine whether
+ * `member` can be unambiguously named at `this`: multiple overloads may
+ * apply, or `member` may be declared in an ambiguous base class.
+ *
+ * This predicate is `pragma[inline]` because it is infeasible to fully
+ * compute it on large code bases: all public members `member` are accessible
+ * from everywhere (`this`), so this predicate could yield a number of tuples
+ * that is quadratic in the size of the program. To avoid this combinatorial
+ * explosion, only use this predicate in a context where `this` and `member`
+ * are sufficiently restricted when `member` is public.
+ */
+ pragma[inline]
+ predicate canAccessMember(Declaration member, Class derived) {
+ this.couldAccessMember(
+ member.getDeclaringType(),
+ member.getASpecifier().(AccessSpecifier),
+ derived
+ )
+ }
+
+ /**
+ * Holds if a hypothetical non-static member of `memberClass` with access
+ * specifier `memberAccess` _is accessible at_ `this` when named in a class
+ * `derived` that is derived from or equal to `memberClass` (N4140 11.2/5 and
+ * 11.4).
+ *
+ * This predicate determines whether an expression `x.m` would be
+ * allowed in `this` when `x` has type `derived` and `m` has `memberAccess`
+ * in `memberClass`. The more general syntax `x.N::n`, where `N` may be a
+ * base class of `derived`, is not supported. This should only affect very
+ * rare edge cases of 11.4.
+ *
+ * This predicate is `pragma[inline]` because it is infeasible to fully
+ * compute it on large code bases: all classes `memberClass` have their
+ * public members accessible from everywhere (`this`), so this predicate
+ * could yield a number of tuples that is quadratic in the size of the
+ * program. To avoid this combinatorial explosion, only use this predicate in
+ * a context where `this` and `memberClass` are sufficiently restricted when
+ * `memberAccess` is public.
+ */
+ pragma[inline]
+ predicate couldAccessMember(Class memberClass, AccessSpecifier memberAccess,
+ Class derived)
+ {
+ // There are four rules in N4140 11.2/5. To limit the number of tuples in
+ // the non-inline helper predicates, we first separate the derivation of
+ // 11.2/5 into two cases:
+
+ // Rule (5.1) directly: the member is public, and `derived` uses public
+ // inheritance all the way up to `memberClass`. Note that these derivations
+ // are independent of `this`, which is why users of this predicate must
+ // take care to avoid a combinatorial explosion.
+ everyoneCouldAccessMember(memberClass, memberAccess, derived)
+ or
+ exists(DirectAccessHolder n |
+ this.getEnclosingAccessHolder*() = n and
+ // Any other derivation.
+ n.thisCouldAccessMember(memberClass, memberAccess, derived)
+ )
+ }
+}
+
+/**
+ * A declaration that very likely has more C++ access rights than its
+ * enclosing element. This comprises `Class` (they have access to their own
+ * private members) along with any target of a `friend` declaration.
+ *
+ * Most access rights are computed for `DirectAccessHolder` instead of
+ * `AccessHolder` -- that's more efficient because there are fewer
+ * `DirectAccessHolder`s. If a `DirectAccessHolder` contains an `AccessHolder`,
+ * then the contained `AccessHolder` inherits its access rights.
+ */
+private class DirectAccessHolder extends @declaration {
+ DirectAccessHolder() {
+ this instanceof Class
+ or
+ exists(FriendDecl fd | fd.getFriend() = this)
+ }
+
+ /**
+ * Holds if a base class `base` of `derived` _is accessible at_ `this` when
+ * the derivation of that fact uses rule (4.2) and (4.3) of N4140 11.2/4 at
+ * least once. In other words, the `this` parameter is not ignored. This
+ * restriction makes it feasible to fully enumerate this predicate even on
+ * large code bases.
+ */
+ predicate thisCanAccessClassTrans(Class base, Class derived) {
+ // This implementation relies on the following property of our predicates:
+ // if `this.thisCanAccessClassStep(b, d)` and
+ // `isDirectPublicBaseOf(b2, b)`, then
+ // `this.thisCanAccessClassStep(b2, d)`. In other words, if a derivation
+ // uses (4.2) or (4.3) somewhere and uses (4.1) directly above that in the
+ // transitive chain, then the use of (4.1) is redundant. This means we only
+ // need to consider derivations that use (4.2) or (4.3) as the "first"
+ // step, that is, towards `base`, so this implementation is essentially a
+ // transitive closure with a restricted base case.
+ this.thisCanAccessClassStep(base, derived)
+ or
+ exists(Class between | thisCanAccessClassTrans(base, between) |
+ isDirectPublicBaseOf(between, derived) or
+ this.thisCanAccessClassStep(between, derived)
+ )
+
+ // It is possible that this predicate could be computed faster for deep
+ // hierarchies if we can prove and utilize that all derivations of 11.2/4
+ // can be broken down into steps where `base` is a _direct_ base of
+ // `derived` in each step.
+ }
+
+ /**
+ * Holds if a base class `base` of `derived` _is accessible at_ `this` using
+ * only a single application of rule (4.2) and (4.3) of N4140 11.2/4.
+ */
+ private predicate thisCanAccessClassStep(Class base, Class derived) {
+ exists(AccessSpecifier public | public.hasName("public") |
+ // Rules (4.2) and (4.3) are implemented together as one here with
+ // reflexive-transitive inheritance, where (4.3) is the transitive case,
+ // and (4.2) is the reflexive case.
+ exists(Class p | p = derived.getADerivedClass*() |
+ this.isFriendOfOrEqualTo(p) and
+ // Note: it's crucial that this is `!=` rather than `not =` since
+ // accessOfBaseMember does not have a result when the member would be
+ // inaccessible.
+ p.accessOfBaseMember(base, public) != public
+ )
+ ) and
+ // This is the only case that doesn't in itself guarantee that
+ // `derived` < `base`, so we add the check here. The standard suggests
+ // computing `canAccessClass` only for derived classes, but that seems
+ // incompatible with the execution model of QL, so we instead construct
+ // every case to guarantee `derived` < `base`.
+ derived = base.getADerivedClass+()
+ }
+
+ /**
+ * Like `couldAccessMember` but only contains derivations in which either
+ * (5.2), (5.3) or (5.4) must be invoked. In other words, the `this`
+ * parameter is not ignored. This restriction makes it feasible to fully
+ * enumerate this predicate even on large code bases. We check for 11.4 as
+ * part of (5.3), since this further limits the number of tuples produced by
+ * this predicate.
+ */
+ predicate thisCouldAccessMember(Class memberClass,
+ AccessSpecifier memberAccess,
+ Class derived)
+ {
+ // Only (5.4) is recursive, and chains of invocations of (5.4) can always
+ // be collapsed to one invocation by the transitivity of 11.2/4.
+ // Derivations not using (5.4) can always be rewritten to have a (5.4) rule
+ // in front because our encoding of 11.2/4 in `canAccessClass` is
+ // reflexive. Thus, we only need to consider three cases: rule (5.4)
+ // followed by either (5.1), (5.2) or (5.3).
+
+ // Rule (5.4), using a non-trivial derivation of 11.2/4, followed by (5.1).
+ // If the derivation of 11.2/4 is trivial (only uses (4.1) and (4.4)), this
+ // case can be replaced with purely (5.1) and thus does not need to be in
+ // this predicate.
+ exists(Class between | this.thisCanAccessClassTrans(between, derived) |
+ everyoneCouldAccessMember(memberClass, memberAccess, between)
+ )
+ or
+ // Rule (5.4) followed by Rule (5.2)
+ exists(Class between | this.(AccessHolder).canAccessClass(between, derived) |
+ between.accessOfBaseMember(memberClass, memberAccess)
+ .hasName("private") and
+ this.isFriendOfOrEqualTo(between)
+ )
+ or
+ // Rule (5.4) followed by Rule (5.3), integrating 11.4. We integrate 11.4
+ // here because we would otherwise generate too many tuples. This code is
+ // very performance-sensitive, and any changes should be benchmarked on
+ // LibreOffice.
+
+ // Rule (5.4) requires that `this.canAccessClass(between, derived)`
+ // (implying that `derived <= between` in the class hierarchy) and that
+ // `p <= between`. Rule 11.4 additionally requires `derived <= p`, but
+ // all these rules together result in too much freedom and overlap between
+ // cases. Therefore, for performance, we split into three cases for how
+ // `between` as a base of `derived` is accessible at `this`, where `this`
+ // is the implementation of `p`:
+ // 1. `between` is an accessible base of `derived` by going through `p` as
+ // an intermediate step.
+ // 2. `this` is part of the implementation of `derived` because it's a
+ // member or a friend. In this case, we do not need `p` to perform this
+ // derivation, so we can set `p = derived` and proceed as in case 1.
+ // 3. `derived` has an alternative inheritance path up to `between` that
+ // bypasses `p`. Then that path must be public, or we are in case 2.
+ exists(AccessSpecifier public | public.hasName("public") |
+ exists(Class between, Class p |
+ between.accessOfBaseMember(memberClass, memberAccess)
+ .hasName("protected") and
+ this.isFriendOfOrEqualTo(p) and
+ (
+ // This is case 1 from above. If `p` derives privately from `between`
+ // then the member we're trying to access is private or inaccessible
+ // in `derived`, so either rule (5.2) applies instead, or the member
+ // is inaccessible. Therefore, in this case, `p` must derive at least
+ // protected from `between`. Further, since the access of `derived`
+ // to its base `between` must pass through `p` in this case, we know
+ // that `derived` must derived publicly from `p` unless we are in
+ // case 2; there are no other cases of 11.2/4 where the
+ // implementation of a base class can access itself as a base.
+ p.accessOfBaseMember(between, public).getName() >= "protected" and
+ derived.accessOfBaseMember(p, public) = public
+ or
+ // This is case 3 above.
+ derived.accessOfBaseMember(between, public) = public and
+ derived = p.getADerivedClass*() and
+ exists(p.accessOfBaseMember(between, memberAccess))
+ )
+ )
+ )
+ }
+
+ private predicate isFriendOfOrEqualTo(Class c) {
+ exists(FriendDecl fd | fd.getDeclaringClass() = c | this = fd.getFriend())
+ or
+ this = c
+ }
+
+ string toString() { result = this.(Declaration).toString() }
+}
+
+/**
+ * Holds if `base` is a direct public base of `derived`, possibly virtual and
+ * possibly through typedefs. The transitive closure of this predicate encodes
+ * derivations of N4140 11.2/4 that use only (4.1) and (4.4).
+ */
+private predicate isDirectPublicBaseOf(Class base, Class derived) {
+ exists(ClassDerivation cd |
+ cd.getBaseClass() = base and
+ cd.getDerivedClass() = derived and
+ cd.getASpecifier().hasName("public")
+ )
+}
+
+/**
+ * Holds if a hypothetical member of `memberClass` with access specifier
+ * `memberAccess` would be public when named as a member of `derived`.
+ * This encodes N4140 11.2/5 case (5.1).
+ */
+private predicate everyoneCouldAccessMember(Class memberClass,
+ AccessSpecifier memberAccess,
+ Class derived)
+{
+ derived.accessOfBaseMember(memberClass, memberAccess).hasName("public")
+}
diff --git a/cpp/ql/src/semmle/code/cpp/Diagnostics.qll b/cpp/ql/src/semmle/code/cpp/Diagnostics.qll
new file mode 100644
index 000000000000..692da6d39f8b
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/Diagnostics.qll
@@ -0,0 +1,66 @@
+import semmle.code.cpp.Location
+
+/** A compiler-generated error, warning or remark. */
+class Diagnostic extends Locatable, @diagnostic {
+
+ /**
+ * Gets the severity of the message, on a range from 1 to 5: 1=remark,
+ * 2=warning, 3=discretionary error, 4=error, 5=catastrophic error.
+ */
+ int getSeverity() { diagnostics(this, result, _, _, _, _) }
+
+ /** Gets the error code for this compiler message. */
+ string getTag() { diagnostics(this, _, result, _, _, _) }
+ predicate hasTag(string s) { this.getTag() = s }
+
+ /**
+ * Gets the error message text associated with this compiler
+ * diagnostic.
+ */
+ string getMessage() { diagnostics(this, _, _, result, _, _) }
+
+ /**
+ * Gets the full error message text associated with this compiler
+ * diagnostic.
+ */
+ string getFullMessage() { diagnostics(this, _, _, _, result, _) }
+
+ /** Gets the source location corresponding to the compiler message. */
+ override Location getLocation() { diagnostics(this, _, _, _, _, result) }
+
+ override string toString() { result = this.getMessage() }
+
+}
+
+/** A compiler-generated remark (milder than a warning). */
+class CompilerRemark extends Diagnostic {
+
+ CompilerRemark() { this.getSeverity() = 1 }
+}
+
+/** A compiler-generated warning. */
+class CompilerWarning extends Diagnostic {
+
+ CompilerWarning() { this.getSeverity() = 2 }
+}
+
+/**
+ * A compiler-generated discretionary error (a compile-time error that may
+ * be suppressed).
+ */
+class CompilerDiscretionaryError extends Diagnostic {
+
+ CompilerDiscretionaryError() { this.getSeverity() = 3 }
+}
+
+/** A compiler error message. */
+class CompilerError extends Diagnostic {
+
+ CompilerError() { this.getSeverity() = 4 }
+}
+
+/** A compiler error that prevents compilation from continuing. */
+class CompilerCatastrophe extends Diagnostic {
+
+ CompilerCatastrophe() { this.getSeverity() = 5 }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/Element.qll b/cpp/ql/src/semmle/code/cpp/Element.qll
new file mode 100644
index 000000000000..a4e6eb44fda7
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/Element.qll
@@ -0,0 +1,254 @@
+import semmle.code.cpp.Location
+private import semmle.code.cpp.Enclosing
+private import semmle.code.cpp.internal.Type
+
+/**
+ * A C/C++ element. This class is the base class for all C/C++
+ * elements, such as functions, classes, expressions, and so on.
+ */
+class Element extends @element {
+ Element() {
+ isElement(this)
+ }
+
+ /** Gets a textual representation of this element. */
+ string toString() { none() }
+
+ /** Gets the primary file where this element occurs. */
+ File getFile() { result = this.getLocation().getFile() }
+
+ /**
+ * Holds if this element may be from source.
+ *
+ * Note: this predicate is provided for consistency with the libraries
+ * for other languages, such as Java and Python. In C++, all files are
+ * classified as source files, so this predicate is always true.
+ */
+ predicate fromSource() { this.getFile().fromSource() }
+
+ /**
+ * Holds if this element may be from a library.
+ *
+ * DEPRECATED: always true.
+ */
+ deprecated
+ predicate fromLibrary() { this.getFile().fromLibrary() }
+
+ /** Gets the primary location of this element. */
+ Location getLocation() {
+ none()
+ }
+
+ /**
+ * Gets the source of this element: either itself or a macro that expanded
+ * to this element.
+ *
+ * If the element is not in a macro expansion, then the "root" is just
+ * the element itself. Otherwise, it is the definition of the innermost
+ * macro whose expansion the element is in.
+ *
+ * This method is useful for filtering macro results in checks: simply
+ * blame `e.findRootCause` rather than `e`. This will report only bugs
+ * that are not in macros, and in addition report macros that (somewhere)
+ * expand to a bug.
+ */
+ Element findRootCause() {
+ if (exists(MacroInvocation mi | this = mi.getAGeneratedElement())) then
+ exists(MacroInvocation mi |
+ this = mi.getAGeneratedElement() and
+ not exists(MacroInvocation closer |
+ this = closer.getAGeneratedElement() and
+ mi = closer.getParentInvocation+()
+ ) and
+ result = mi.getMacro()
+ )
+ else
+ result = this
+ }
+
+ /**
+ * Gets the parent scope of this `Element`, if any.
+ * A scope is a `Type` (`Class` / `Enum`), a `Namespace`, a `Block`, a `Function`,
+ * or certain kinds of `Statement`.
+ */
+ Element getParentScope() {
+ // result instanceof class
+ exists (Declaration m
+ | m = this and
+ result = m.getDeclaringType() and
+ not this instanceof EnumConstant)
+ or
+ exists (TemplateClass tc
+ | this = tc.getATemplateArgument() and result = tc)
+
+ // result instanceof namespace
+ or
+ exists (Namespace n
+ | result = n and n.getADeclaration() = this)
+ or
+ exists (FriendDecl d, Namespace n
+ | this = d and n.getADeclaration() = d and result = n)
+ or
+ exists (Namespace n
+ | this = n and result = n.getParentNamespace())
+
+ // result instanceof stmt
+ or
+ exists (LocalVariable v
+ | this = v and
+ exists (DeclStmt ds
+ | ds.getADeclaration() = v and result = ds.getParent()))
+ or
+ exists (Parameter p
+ | this = p and result = p.getFunction())
+ or
+ exists (GlobalVariable g, Namespace n
+ | this = g and n.getADeclaration() = g and result = n)
+ or
+ exists (EnumConstant e
+ | this = e and result = e.getDeclaringEnum())
+
+ // result instanceof block|function
+ or
+ exists (Block b
+ | this = b and blockscope(b, result))
+ or
+ exists (TemplateFunction tf
+ | this = tf.getATemplateArgument() and result = tf)
+
+ // result instanceof stmt
+ or
+ exists (ControlStructure s
+ | this = s and result = s.getParent())
+
+ or
+ using_container(result, this)
+ }
+
+ /**
+ * Holds if this element comes from a macro expansion. Only elements that
+ * are entirely generated by a macro are included - for elements that
+ * partially come from a macro, see `isAffectedByMacro`.
+ */
+ predicate isInMacroExpansion() {
+ inMacroExpansion(this)
+ }
+
+ /**
+ * Holds if this element is affected in any way by a macro. All elements
+ * that are totally or partially generated by a macro are included, so
+ * this is a super-set of `isInMacroExpansion`.
+ */
+ predicate isAffectedByMacro() {
+ affectedByMacro(this)
+ }
+
+ private Element getEnclosingElementPref() {
+ enclosingfunction(this, result) or
+ result.(Function) = stmtEnclosingElement(this) or
+ this.(LocalScopeVariable).getFunction() = result or
+ enumconstants(this, result, _, _, _, _) or
+ derivations(this, result, _, _, _) or
+ stmtparents(this, _, result) or
+ exprparents(this, _, result) or
+ namequalifiers(this, result, _, _) or
+ initialisers(this, result, _, _) or
+ exprconv(result, this) or
+ this = result.(MacroAccess).getParentInvocation() or
+ result = this.(MacroInvocation).getExpr() or // macroinvocation -> outer Expr
+ param_decl_bind(this,_,result)
+ }
+
+ /** Gets the closest `Element` enclosing this one. */
+ cached Element getEnclosingElement() {
+ result = getEnclosingElementPref() or
+ (
+ not exists(getEnclosingElementPref()) and
+ (
+ // macroinvocation -> all enclosed elements
+ inmacroexpansion(result, this)
+ or
+ macrolocationbind(
+ this.(MacroInvocation),
+ result.(VariableDeclarationEntry).getLocation())
+ or
+ macrolocationbind(
+ this.(MacroInvocation),
+ result.(FunctionDeclarationEntry).getLocation())
+ or
+ this = result.(Class).getAMember()
+ or
+ result = exprEnclosingElement(this)
+ or
+ var_decls(this, result, _, _, _)
+ )
+ )
+ }
+
+ /**
+ * Holds if this `Element` is a part of a template instantiation (but not
+ * the template itself).
+ */
+ predicate isFromTemplateInstantiation(Element instantiation) {
+ exists(Element e |
+ isFromTemplateInstantiationRec(e, instantiation) |
+ this = e or
+ this.(DeclarationEntry).getDeclaration() = e
+ )
+ }
+
+ /**
+ * Holds if this `Element` is part of a template `template` (not if it is
+ * part of an instantiation of `template`). This means it is represented in
+ * the database purely as syntax and without guarantees on the presence or
+ * correctness of type-based operations such as implicit conversions.
+ *
+ * If an element is nested within several templates, this predicate holds with
+ * a value of `template` for each containing template.
+ */
+ predicate isFromUninstantiatedTemplate(Element template) {
+ exists(Element e |
+ isFromUninstantiatedTemplateRec(e, template) |
+ this = e or
+ this.(DeclarationEntry).getDeclaration() = e
+ )
+ }
+}
+
+private predicate isFromTemplateInstantiationRec(Element e, Element instantiation) {
+ instantiation.(Function).isConstructedFrom(_) and
+ e = instantiation
+ or
+ instantiation.(Class).isConstructedFrom(_) and
+ e = instantiation
+ or
+ instantiation.(Variable).isConstructedFrom(_) and
+ e = instantiation
+ or
+ isFromTemplateInstantiationRec(e.getEnclosingElement(), instantiation) and
+ not e instanceof MacroAccess
+}
+
+private predicate isFromUninstantiatedTemplateRec(Element e, Element template) {
+ is_class_template(template) and
+ e = template
+ or
+ is_function_template(template) and
+ e = template
+ or
+ is_variable_template(template) and
+ e = template
+ or
+ isFromUninstantiatedTemplateRec(e.getEnclosingElement(), template) and
+ not e instanceof MacroAccess
+}
+
+/**
+ * A C++11 `static_assert` or C11 `_Static_assert` construct.
+ */
+class StaticAssert extends Locatable, @static_assert {
+ override string toString() { result = "static_assert(..., \"" + getMessage() + "\")" }
+ Expr getCondition() { static_asserts(this, result, _, _) }
+ string getMessage() { static_asserts(this, _, result, _) }
+ override Location getLocation() { static_asserts(this, _, _, result) }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/Enclosing.qll b/cpp/ql/src/semmle/code/cpp/Enclosing.qll
new file mode 100644
index 000000000000..525b04a79f74
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/Enclosing.qll
@@ -0,0 +1,36 @@
+import cpp
+
+/**
+ * Gets the enclosing element of statement `s`.
+ */
+cached Element stmtEnclosingElement(Stmt s) {
+ result.(Function).getEntryPoint() = s or
+ result = stmtEnclosingElement(s.getParent()) or
+ result = exprEnclosingElement(s.getParent())
+}
+
+/**
+ * Gets the enclosing element of expression `e`.
+ */
+cached Element exprEnclosingElement(Expr e) {
+ result = exprEnclosingElement(e.getParent()) or
+ result = stmtEnclosingElement(e.getParent()) or
+ result.(Function) = e.getParent() or
+ result = exprEnclosingElement(e.(Conversion).getExpr()) or
+ exists(Initializer i | i.getExpr() = e and
+ if exists(i.getEnclosingStmt())
+ then result = stmtEnclosingElement(i.getEnclosingStmt())
+ else if i.getDeclaration() instanceof Parameter
+ then result = i.getDeclaration().(Parameter).getFunction()
+ else result = i.getDeclaration()) or
+ exists(Expr anc | expr_ancestor(e, anc) and result = exprEnclosingElement(anc)) or
+ exists(Stmt anc | expr_ancestor(e, anc) and result = stmtEnclosingElement(anc)) or
+ exists(DeclarationEntry de |
+ expr_ancestor(e, de) and
+ if exists(DeclStmt ds | de = ds.getADeclarationEntry())
+ then exists(DeclStmt ds |
+ de = ds.getADeclarationEntry() and
+ result = stmtEnclosingElement(ds))
+ else result = de.getDeclaration())
+}
+
diff --git a/cpp/ql/src/semmle/code/cpp/Enum.qll b/cpp/ql/src/semmle/code/cpp/Enum.qll
new file mode 100644
index 000000000000..c699803fbeaa
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/Enum.qll
@@ -0,0 +1,138 @@
+import semmle.code.cpp.Type
+private import semmle.code.cpp.internal.Type
+
+/**
+ * A C/C++ enum [N4140 7.2].
+ */
+class Enum extends UserType, IntegralOrEnumType {
+ /** Gets an enumerator of this enumeration. */
+ EnumConstant getAnEnumConstant() { result.getDeclaringEnum() = this }
+ EnumConstant getEnumConstant(int index) { enumconstants(result,this,index,_,_,_) }
+
+ /**
+ * Gets a descriptive string for the enum. This method is only intended to
+ * be used for debugging purposes. For more information, see the comment
+ * for `Type.explain`.
+ */
+ override string explain() { result = "enum " + this.getName() }
+
+ /** See `Type.isDeeplyConst` and `Type.isDeeplyConstBelow`. Internal. */
+ override predicate isDeeplyConstBelow() { any() } // No subparts
+
+ /**
+ * Holds if this enum has an enum-base [N4140 7.2].
+ * For example: `enum E : int`.
+ */
+ predicate hasExplicitUnderlyingType() {
+ derivations(_, this, _, _, _)
+ }
+
+ /**
+ * The type of the enum-base [N4140 7.2], if it is specified.
+ * For example: `int` in `enum E : int`.
+ */
+ Type getExplicitUnderlyingType() {
+ derivations(_, this, _, result, _)
+ }
+}
+
+/**
+ * A C++ enum that is directly enclosed by a function.
+ */
+class LocalEnum extends Enum {
+ LocalEnum() {
+ isLocal()
+ }
+}
+
+/**
+ * A C++ enum that is declared within a class.
+ */
+class NestedEnum extends Enum {
+
+ NestedEnum() {
+ this.isMember()
+ }
+
+ /** Holds if this member is private. */
+ predicate isPrivate() { this.hasSpecifier("private") }
+
+ /** Holds if this member is protected. */
+ predicate isProtected() { this.hasSpecifier("protected") }
+
+ /** Holds if this member is public. */
+ predicate isPublic() { this.hasSpecifier("public") }
+
+}
+
+/**
+ * A C++ scoped enum.
+ *
+ * For example, `enum class Color { red, blue }`.
+ */
+class ScopedEnum extends Enum {
+ ScopedEnum() {
+ usertypes(this,_,13)
+ }
+}
+
+/**
+ * A C/C++ enumerator [N4140 7.2].
+ *
+ * For example: `green` in `enum { red, green, blue }`.
+ *
+ * Enumerators are also knowns as enumeration constants.
+ */
+class EnumConstant extends @enumconstant, Declaration {
+ /**
+ * Gets the enumeration of which this enumerator is a member.
+ */
+ Enum getDeclaringEnum() { enumconstants(this,result,_,_,_,_) }
+
+ override Class getDeclaringType() {
+ result = this.getDeclaringEnum().getDeclaringType()
+ }
+
+ /**
+ * Gets the name of this enumerator.
+ */
+ override string getName() { enumconstants(this,_,_,_,result,_) }
+
+ /**
+ * Gets the value that this enumerator is initialized to, as a
+ * string. This can be a value explicitly given to the enumerator, or an
+ * automatically assigned value.
+ */
+ string getValue() { result = this.getInitializer().getExpr().getValue() }
+
+ /** Gets the type of this enumerator. */
+ Type getType() { enumconstants(this,_,_,unresolve(result),_,_) }
+
+ /** Gets the location of a declaration of this enumerator. */
+ override Location getADeclarationLocation() { result = this.getDefinitionLocation() }
+
+ /** Gets the location of the definition of this enumerator. */
+ override Location getDefinitionLocation() { enumconstants(this,_,_,_,_,result) }
+
+ /** Gets the location of the definition of this enumerator. */
+ override Location getLocation() { result = this.getDefinitionLocation() }
+
+ /** Gets the initializer of this enumerator, if any. */
+ Initializer getInitializer() { result.getDeclaration() = this }
+
+ /** Gets an access of this enumerator. */
+ EnumConstantAccess getAnAccess() { result.getTarget() = this }
+
+ /** Gets a specifier of this enumerator. */
+ override Specifier getASpecifier() { varspecifiers(this,result) }
+
+ /**
+ * An attribute of this enumerator.
+ *
+ * Note that allowing attributes on enumerators is a language extension
+ * which is only supported by Clang.
+ */
+ Attribute getAnAttribute() {
+ varattributes(this, result)
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/Field.qll b/cpp/ql/src/semmle/code/cpp/Field.qll
new file mode 100644
index 000000000000..87b07e9b2909
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/Field.qll
@@ -0,0 +1,107 @@
+import semmle.code.cpp.Variable
+import semmle.code.cpp.Enum
+import semmle.code.cpp.exprs.Access
+
+/**
+ * A C structure member or C++ non-static member variable.
+ */
+class Field extends MemberVariable {
+
+ Field() {
+ fieldoffsets(this,_,_)
+ }
+
+ /**
+ * Gets the offset of this field in bytes from the start of its declaring
+ * type (on the machine where facts were extracted).
+ */
+ int getByteOffset() { fieldoffsets(this,result,_) }
+
+ /**
+ * Gets the byte offset within `mostDerivedClass` of each occurence of this
+ * field within `mostDerivedClass` itself or a base class subobject of
+ * `mostDerivedClass`.
+ * Note that for fields of virtual base classes, and non-virtual base classes
+ * thereof, this predicate assumes that `mostDerivedClass` is the type of the
+ * complete most-derived object.
+ */
+ int getAByteOffsetIn(Class mostDerivedClass) {
+ result = mostDerivedClass.getABaseClassByteOffset(getDeclaringType()) +
+ getByteOffset()
+ }
+
+ /**
+ * Holds if the field can be initialized as part of an initializer list. For
+ * example, in:
+ *
+ * struct S {
+ * unsigned int a : 5;
+ * unsigned int : 5;
+ * unsigned int b : 5;
+ * };
+ *
+ * Fields `a` and `b` are initializable, but the unnamed bitfield is not.
+ */
+ predicate isInitializable() {
+ // All non-bitfield fields are initializable. This predicate is overridden
+ // in `BitField` to handle the anonymous bitfield case.
+ any()
+ }
+
+ /**
+ * Gets the zero-based index of the specified field within its enclosing
+ * class, counting only fields that can be initialized. This is the order in
+ * which the field will be initialized, whether by an initializer list or in a
+ * constructor.
+ */
+ final int getInitializationOrder() {
+ exists(Class cls, int memberIndex |
+ this = cls.getCanonicalMember(memberIndex) and
+ memberIndex = rank[result + 1](int index |
+ cls.getCanonicalMember(index).(Field).isInitializable()
+ )
+ )
+ }
+}
+
+/**
+ * A C structure member or C++ member variable declared with an explicit size in bits.
+ *
+ * Syntactically, this looks like `int x : 3` in `struct S { int x : 3; };`.
+ */
+class BitField extends Field {
+ BitField() { bitfield(this,_,_) }
+
+ /**
+ * Gets the size of this bitfield in bits (on the machine where facts
+ * were extracted).
+ */
+ int getNumBits() { bitfield(this,result,_) }
+
+ /**
+ * Gets the value which appeared after the colon in the bitfield
+ * declaration.
+ *
+ * In most cases, this will give the same value as `getNumBits`. It will
+ * only differ when the value after the colon is larger than the size of
+ * the variable's type. For example, given `int32_t x : 1234`,
+ * `getNumBits` will give 32, whereas `getDeclaredNumBits` will give
+ * 1234.
+ */
+ int getDeclaredNumBits() { bitfield(this,_,result) }
+
+ /**
+ * Gets the offset of this bitfield in bits from the byte identified by
+ * getByteOffset (on the machine where facts were extracted).
+ */
+ int getBitOffset() { fieldoffsets(this,_,result) }
+
+ predicate isAnonymous() {
+ hasName("(unnamed bitfield)")
+ }
+
+ override predicate isInitializable() {
+ // Anonymous bitfields are not initializable.
+ not isAnonymous()
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/File.qll b/cpp/ql/src/semmle/code/cpp/File.qll
new file mode 100644
index 000000000000..3526739d5b46
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/File.qll
@@ -0,0 +1,507 @@
+import semmle.code.cpp.Element
+import semmle.code.cpp.Declaration
+import semmle.code.cpp.metrics.MetricFile
+
+/** A file or folder. */
+abstract class Container extends Locatable, @container {
+ /**
+ * Gets the absolute, canonical path of this container, using forward slashes
+ * as path separator.
+ *
+ * The path starts with a _root prefix_ followed by zero or more _path
+ * segments_ separated by forward slashes.
+ *
+ * The root prefix is of one of the following forms:
+ *
+ * 1. A single forward slash `/` (Unix-style)
+ * 2. An upper-case drive letter followed by a colon and a forward slash,
+ * such as `C:/` (Windows-style)
+ * 3. Two forward slashes, a computer name, and then another forward slash,
+ * such as `//FileServer/` (UNC-style)
+ *
+ * Path segments are never empty (that is, absolute paths never contain two
+ * contiguous slashes, except as part of a UNC-style root prefix). Also, path
+ * segments never contain forward slashes, and no path segment is of the
+ * form `.` (one dot) or `..` (two dots).
+ *
+ * Note that an absolute path never ends with a forward slash, except if it is
+ * a bare root prefix, that is, the path has no path segments. A container
+ * whose absolute path has no segments is always a `Folder`, not a `File`.
+ */
+ abstract string getAbsolutePath();
+
+ /**
+ * DEPRECATED: Use `getLocation` instead.
+ * Gets a URL representing the location of this container.
+ *
+ * For more information see https://lgtm.com/help/ql/locations#providing-urls.
+ */
+ deprecated abstract string getURL();
+
+ /**
+ * Gets the relative path of this file or folder from the root folder of the
+ * analyzed source location. The relative path of the root folder itself is
+ * the empty string.
+ *
+ * This has no result if the container is outside the source root, that is,
+ * if the root folder is not a reflexive, transitive parent of this container.
+ */
+ string getRelativePath() {
+ exists (string absPath, string pref |
+ absPath = getAbsolutePath() and sourceLocationPrefix(pref) |
+ absPath = pref and result = ""
+ or
+ absPath = pref.regexpReplaceAll("/$", "") + "/" + result and
+ not result.matches("/%")
+ )
+ }
+
+ /**
+ * Gets the base name of this container including extension, that is, the last
+ * segment of its absolute path, or the empty string if it has no segments.
+ *
+ * Here are some examples of absolute paths and the corresponding base names
+ * (surrounded with quotes to avoid ambiguity):
+ *
+ *
+ * | Absolute path | Base name |
|---|
+ * | "/tmp/tst.js" | "tst.js" |
+ * | "C:/Program Files (x86)" | "Program Files (x86)" |
+ * | "/" | "" |
+ * | "C:/" | "" |
+ * | "D:/" | "" |
+ * | "//FileServer/" | "" |
+ *
+ */
+ string getBaseName() {
+ result = getAbsolutePath().regexpCapture(".*/(([^/]*?)(?:\\.([^.]*))?)", 1)
+ }
+
+ /**
+ * Gets the extension of this container, that is, the suffix of its base name
+ * after the last dot character, if any.
+ *
+ * In particular,
+ *
+ * - if the name does not include a dot, there is no extension, so this
+ * predicate has no result;
+ * - if the name ends in a dot, the extension is the empty string;
+ * - if the name contains multiple dots, the extension follows the last dot.
+ *
+ * Here are some examples of absolute paths and the corresponding extensions
+ * (surrounded with quotes to avoid ambiguity):
+ *
+ *
+ * | Absolute path | Extension |
|---|
+ * | "/tmp/tst.js" | "js" |
+ * | "/tmp/.classpath" | "classpath" |
+ * | "/bin/bash" | not defined |
+ * | "/tmp/tst2." | "" |
+ * | "/tmp/x.tar.gz" | "gz" |
+ *
+ */
+ string getExtension() {
+ result = getAbsolutePath().regexpCapture(".*/([^/]*?)(\\.([^.]*))?", 3)
+ }
+
+ /**
+ * Gets the stem of this container, that is, the prefix of its base name up to
+ * (but not including) the last dot character if there is one, or the entire
+ * base name if there is not.
+ *
+ * Here are some examples of absolute paths and the corresponding stems
+ * (surrounded with quotes to avoid ambiguity):
+ *
+ *
+ * | Absolute path | Stem |
|---|
+ * | "/tmp/tst.js" | "tst" |
+ * | "/tmp/.classpath" | "" |
+ * | "/bin/bash" | "bash" |
+ * | "/tmp/tst2." | "tst2" |
+ * | "/tmp/x.tar.gz" | "x.tar" |
+ *
+ */
+ string getStem() {
+ result = getAbsolutePath().regexpCapture(".*/([^/]*?)(?:\\.([^.]*))?", 1)
+ }
+
+ /** Gets the parent container of this file or folder, if any. */
+ Container getParentContainer() {
+ containerparent(result, this)
+ }
+
+ /** Gets a file or sub-folder in this container. */
+ Container getAChildContainer() {
+ this = result.getParentContainer()
+ }
+
+ /** Gets a file in this container. */
+ File getAFile() {
+ result = getAChildContainer()
+ }
+
+ /** Gets the file in this container that has the given `baseName`, if any. */
+ File getFile(string baseName) {
+ result = getAFile() and
+ result.getBaseName() = baseName
+ }
+
+ /** Gets a sub-folder in this container. */
+ Folder getAFolder() {
+ result = getAChildContainer()
+ }
+
+ /** Gets the sub-folder in this container that has the given `baseName`, if any. */
+ Folder getFolder(string baseName) {
+ result = getAFolder() and
+ result.getBaseName() = baseName
+ }
+
+ /**
+ * Gets a textual representation of the path of this container.
+ *
+ * This is the absolute path of the container.
+ */
+ string toString() {
+ result = getAbsolutePath()
+ }
+}
+
+/**
+ * A folder that was observed on disk during the build process.
+ *
+ * For the example folder name of "/usr/home/me", the path decomposes to:
+ *
+ * 1. "/usr/home" - see `getParentContainer`.
+ * 2. "me" - see `getBaseName`.
+ *
+ * To get the full path, use `getAbsolutePath`.
+ */
+class Folder extends Container, @folder {
+ override string getAbsolutePath() {
+ folders(this, result, _)
+ }
+
+ override Location getLocation() {
+ result.getContainer() = this and
+ result.hasLocationInfo(_, 0, 0, 0, 0)
+ }
+
+ /**
+ * DEPRECATED: Use `getLocation` instead.
+ * Gets the URL of this folder.
+ */
+ deprecated override string getURL() {
+ result = "folder://" + getAbsolutePath()
+ }
+
+ /**
+ * DEPRECATED: use `getAbsolutePath` instead.
+ * Gets the name of this folder.
+ */
+ deprecated
+ string getName() { folders(this,result,_) }
+
+ /**
+ * DEPRECATED: use `getAbsolutePath` instead.
+ * Holds if this element is named `name`.
+ */
+ deprecated
+ predicate hasName(string name) { name = this.getName() }
+
+ /**
+ * DEPRECATED: use `getAbsolutePath` instead.
+ * Gets the full name of this folder.
+ */
+ deprecated
+ string getFullName() { result = this.getName() }
+
+ /**
+ * DEPRECATED: use `getBaseName` instead.
+ * Gets the last part of the folder name.
+ */
+ deprecated
+ string getShortName() {
+ exists (string longnameRaw, string longname
+ | folders(this,_,longnameRaw) and
+ longname = longnameRaw.replaceAll("\\", "/")
+ | exists (int index
+ | result = longname.splitAt("/", index) and
+ not exists (longname.splitAt("/", index+1))))
+ }
+
+ /**
+ * DEPRECATED: use `getParentContainer` instead.
+ * Gets the parent folder.
+ */
+ deprecated
+ Folder getParent() { containerparent(result,this) }
+}
+
+/**
+ * A file that was observed on disk during the build process.
+ *
+ * For the example filename of "/usr/home/me/myprogram.c", the filename
+ * decomposes to:
+ *
+ * 1. "/usr/home/me" - see `getParentContainer`.
+ * 2. "myprogram.c" - see `getBaseName`.
+ *
+ * The base name further decomposes into the _stem_ and _extension_ -- see
+ * `getStem` and `getExtension`. To get the full path, use `getAbsolutePath`.
+ */
+class File extends Container, @file {
+ override string getAbsolutePath() {
+ files(this, result, _, _, _)
+ }
+
+ override string toString() {
+ result = Container.super.toString()
+ }
+
+ override Location getLocation() {
+ result.getContainer() = this and
+ result.hasLocationInfo(_, 0, 0, 0, 0)
+ }
+
+ /**
+ * DEPRECATED: Use `getLocation` instead.
+ * Gets the URL of this file.
+ */
+ deprecated override string getURL() {
+ result = "file://" + this.getAbsolutePath() + ":0:0:0:0"
+ }
+
+ /** Holds if this file was compiled as C (at any point). */
+ predicate compiledAsC() {
+ fileannotations(this,1,"compiled as c","1")
+ }
+
+ /** Holds if this file was compiled as C++ (at any point). */
+ predicate compiledAsCpp() {
+ fileannotations(this,1,"compiled as c++","1")
+ }
+
+ /**
+ * DEPRECATED: Objective-C is no longer supported.
+ * Holds if this file was compiled as Objective C (at any point).
+ */
+ deprecated predicate compiledAsObjC() {
+ none()
+ }
+
+ /**
+ * DEPRECATED: Objective-C is no longer supported.
+ * Holds if this file was compiled as Objective C++ (at any point).
+ */
+ deprecated predicate compiledAsObjCpp() {
+ none()
+ }
+
+ /** Holds if this file was compiled by a Microsoft compiler (at any point). */
+ predicate compiledAsMicrosoft() {
+ exists(Compilation c |
+ c.getAFileCompiled() = this and
+ c.getAnArgument() = "--microsoft"
+ )
+ }
+
+ /** Gets a top-level element declared in this file. */
+ Declaration getATopLevelDeclaration() {
+ result.getAFile() = this and result.isTopLevel()
+ }
+
+ /** Gets a declaration in this file. */
+ Declaration getADeclaration() { result.getAFile() = this }
+
+ /** Holds if this file uses the given macro. */
+ predicate usesMacro(Macro m) {
+ exists(MacroInvocation mi | mi.getFile() = this and
+ mi.getMacro() = m)
+ }
+
+ /**
+ * Gets a file that is directly included from this file (using a
+ * pre-processor directive like `#include`).
+ */
+ File getAnIncludedFile() {
+ exists(Include i | i.getFile() = this and i.getIncludedFile() = result)
+ }
+
+ /**
+ * DEPRECATED: use `getParentContainer` instead.
+ * Gets the folder which contains this file.
+ */
+ deprecated
+ Folder getParent() { containerparent(result,this) }
+
+ /**
+ * Holds if this file may be from source. This predicate holds for all files
+ * except the dummy file, whose name is the empty string, which contains
+ * declarations that are built into the compiler.
+ */
+ override predicate fromSource() { numlines(this,_,_,_) }
+
+ /**
+ * Holds if this file may be from a library.
+ *
+ * DEPRECATED: For historical reasons this is true for any file.
+ */
+ deprecated override
+ predicate fromLibrary() { any() }
+
+ /** Gets the metric file. */
+ MetricFile getMetrics() { result = this }
+
+ /**
+ * DEPRECATED: Use `getAbsolutePath` instead.
+ * Gets the full name of this file, for example:
+ * "/usr/home/me/myprogram.c".
+ */
+ deprecated
+ string getName() { files(this,result,_,_,_) }
+
+ /**
+ * DEPRECATED: Use `getAbsolutePath` instead.
+ * Holds if this file has the specified full name.
+ *
+ * Example usage: `f.hasName("/usr/home/me/myprogram.c")`.
+ */
+ deprecated
+ predicate hasName(string name) { name = this.getName() }
+
+ /**
+ * DEPRECATED: Use `getAbsolutePath` instead.
+ * Gets the full name of this file, for example
+ * "/usr/home/me/myprogram.c".
+ */
+ deprecated
+ string getFullName() { result = this.getName() }
+
+ /**
+ * Gets the remainder of the base name after the first dot character. Note
+ * that the name of this predicate is in plural form, unlike `getExtension`,
+ * which gets the remainder of the base name after the _last_ dot character.
+ *
+ * Predicates `getStem` and `getExtension` should be preferred over
+ * `getShortName` and `getExtensions` since the former pair is compatible
+ * with the file libraries of other languages.
+ * Note the slight difference between this predicate and `getStem`:
+ * for example, for "file.tar.gz", this predicate will have the result
+ * "tar.gz", while `getExtension` will have the result "gz".
+ */
+ string getExtensions() {
+ files(this,_,_,result,_)
+ }
+
+ /**
+ * DEPRECATED: Use `getBaseName` instead.
+ * Gets the name and extension(s), but not path, of a file. For example,
+ * if the full name is "/path/to/filename.a.bcd" then the filename is
+ * "filename.a.bcd".
+ */
+ deprecated
+ string getFileName() {
+ // [a/b.c/d/]fileName
+ // ^ beginAfter
+ exists(string fullName, int beginAfter |
+ fullName = this.getName() and
+ beginAfter = max(int i | i = -1 or fullName.charAt(i) = "/" | i) and
+ result = fullName.suffix(beginAfter + 1)
+ )
+ }
+
+ /**
+ * Gets the short name of this file, that is, the prefix of its base name up
+ * to (but not including) the first dot character if there is one, or the
+ * entire base name if there is not. For example, if the full name is
+ * "/path/to/filename.a.bcd" then the short name is "filename".
+ *
+ * Predicates `getStem` and `getExtension` should be preferred over
+ * `getShortName` and `getExtensions` since the former pair is compatible
+ * with the file libraries of other languages.
+ * Note the slight difference between this predicate and `getStem`:
+ * for example, for "file.tar.gz", this predicate will have the result
+ * "file", while `getStem` will have the result "file.tar".
+ */
+ string getShortName() { files(this,_,result,_,_) }
+}
+
+
+/**
+ * A C/C++ header file, as determined (mainly) by file extension.
+ *
+ * For the related notion of whether a file is included anywhere (using a
+ * pre-processor directive like `#include`), use `Include.getIncludedFile`.
+ */
+class HeaderFile extends File {
+
+ HeaderFile() {
+ exists(string ext | ext = this.getExtension().toLowerCase() |
+ ext = "h" or ext = "r"
+ /* --- */ or ext = "hpp" or ext = "hxx" or ext = "h++" or ext = "hh" or ext = "hp"
+ or ext = "tcc" or ext = "tpp" or ext = "txx" or ext = "t++" /* --- --- */
+ )
+ or
+ not exists(this.getExtension()) and
+ exists(Include i | i.getIncludedFile() = this)
+ }
+
+}
+
+/**
+ * A C source file, as determined by file extension.
+ *
+ * For the related notion of whether a file is compiled as C code, use
+ * `File.compiledAsC`.
+ */
+class CFile extends File {
+
+ CFile() {
+ exists(string ext | ext = this.getExtension().toLowerCase() |
+ ext = "c" or ext = "i"
+ )
+ }
+
+}
+
+/**
+ * A C++ source file, as determined by file extension.
+ *
+ * For the related notion of whether a file is compiled as C++ code, use
+ * `File.compiledAsCpp`.
+ */
+class CppFile extends File {
+
+ CppFile() {
+ exists(string ext | ext = this.getExtension().toLowerCase() |
+ /* --- */ ext = "cpp" or ext = "cxx" or ext = "c++" or ext = "cc" or ext = "cp"
+ or ext = "icc" or ext = "ipp" or ext = "ixx" or ext = "i++" or ext = "ii" /* --- */
+ // Note: .C files are indistinguishable from .c files on some
+ // file systems, so we just treat them as CFile's.
+ )
+ }
+
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C source file, as determined by file extension.
+ *
+ * For the related notion of whether a file is compiled as Objective C
+ * code, use `File.compiledAsObjC`.
+ */
+deprecated class ObjCFile extends File {
+ ObjCFile() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C++ source file, as determined by file extension.
+ *
+ * For the related notion of whether a file is compiled as Objective C++
+ * code, use `File.compiledAsObjCpp`.
+ */
+deprecated class ObjCppFile extends File {
+ ObjCppFile() { none() }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/FriendDecl.qll b/cpp/ql/src/semmle/code/cpp/FriendDecl.qll
new file mode 100644
index 000000000000..0919a6c0f4cb
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/FriendDecl.qll
@@ -0,0 +1,64 @@
+import semmle.code.cpp.Declaration
+private import semmle.code.cpp.internal.Type
+
+/**
+ * A C++ friend declaration [N4140 11.3].
+ * For example:
+ *
+ * class A {
+ * friend void f(int);
+ * friend class X;
+ * };
+ *
+ * void f(int x) { ... }
+ * class X { ... };
+ */
+class FriendDecl extends Declaration, @frienddecl {
+ /**
+ * Gets the location of this friend declaration. The result is the
+ * location of the friend declaration itself, not the class or function
+ * that it refers to. Note: to get the target of the friend declaration,
+ * use `getFriend`.
+ */
+ override Location getADeclarationLocation() { result = this.getLocation() }
+
+ /**
+ * Implements the abstract method `Declaration.getDefinitionLocation`. A
+ * friend declaration cannot be a definition because it is only a link to
+ * another class or function. But we have to provide an implementation of
+ * this method, so we use the location of the declaration as the location
+ * of the definition. Note: to get the target of the friend declaration,
+ * use `getFriend`.
+ */
+ override Location getDefinitionLocation() { result = this.getLocation() }
+
+ /** Gets the location of this friend declaration. */
+ override Location getLocation() { frienddecls(this,_,_,result) }
+
+ /** Gets a descriptive string for this friend declaration. */
+ override string getName() {
+ result = this.getDeclaringClass().getName() + "'s friend"
+ }
+
+ /**
+ * Friend declarations do not have specifiers. It makes no difference
+ * whether they are declared in a public, protected or private section of
+ * the class.
+ */
+ override Specifier getASpecifier() { none() }
+
+ /**
+ * Gets the target of this friend declaration.
+ * For example: `X` in `class A { friend class X }`.
+ */
+ AccessHolder getFriend() { frienddecls(this,_,result,_) }
+
+ /**
+ * Gets the declaring class (also known as the befriending class).
+ * For example: `A` in `class A { friend class X }`.
+ */
+ Class getDeclaringClass() { frienddecls(this,unresolve(result),_,_) }
+
+ /* Holds if this declaration is a top-level declaration. */
+ override predicate isTopLevel() { none() }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/Function.qll b/cpp/ql/src/semmle/code/cpp/Function.qll
new file mode 100644
index 000000000000..52a9111c737e
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/Function.qll
@@ -0,0 +1,1159 @@
+import semmle.code.cpp.Location
+import semmle.code.cpp.Member
+import semmle.code.cpp.Class
+import semmle.code.cpp.Parameter
+import semmle.code.cpp.exprs.Call
+import semmle.code.cpp.metrics.MetricFunction
+import semmle.code.cpp.Linkage
+private import semmle.code.cpp.internal.Type
+
+/**
+ * A C/C++ function [N4140 8.3.5]. Both member functions and non-member
+ * functions are included.
+ *
+ * Function has a one-to-many relationship with FunctionDeclarationEntry,
+ * because the same function can be declared in multiple locations. This
+ * relationship between `Declaration` and `DeclarationEntry` is explained
+ * in more detail in `Declaration.qll`.
+ */
+class Function extends Declaration, ControlFlowNode, AccessHolder, @function {
+
+ /**
+ * Gets the name of this function.
+ *
+ * This name doesn't include a namespace or any argument types, so both
+ * `::open()` and `::std::ifstream::open(...)` have the same name.
+ *
+ * To get the name including the namespace, use `getQualifiedName` or
+ * `hasQualifiedName`.
+ *
+ * To test whether a function has a particular name in the global
+ * namespace, use `hasGlobalName`.
+ */
+ override string getName() { functions(this,result,_) }
+
+ /**
+ * Gets the full signature of this function, including return type, parameter
+ * types, and template arguments.
+ *
+ * For example, in the following code:
+ * ```
+ * template T min(T x, T y);
+ * int z = min(5, 7);
+ * ```
+ * The full signature of the function called on the last line would be
+ * "min(int, int) -> int", and the full signature of the uninstantiated
+ * template on the first line would be "min(T, T) -> T".
+ */
+ string getFullSignature() {
+ exists(string name, string templateArgs, string args |
+ result = name + templateArgs + args + " -> " + getType().toString() and
+ name = getQualifiedName() and
+ (
+ if exists(getATemplateArgument()) then (
+ templateArgs = "<" +
+ concat(int i |
+ exists(getTemplateArgument(i)) |
+ getTemplateArgument(i).toString(), ", " order by i
+ ) + ">"
+ )
+ else
+ templateArgs = ""
+ ) and
+ args = "(" +
+ concat(int i |
+ exists(getParameter(i)) |
+ getParameter(i).getType().toString(), ", " order by i
+ ) + ")"
+ )
+ }
+
+ /** Gets a specifier of this function. */
+ override Specifier getASpecifier() {
+ funspecifiers(this,result)
+ or result.hasName(getADeclarationEntry().getASpecifier())
+ }
+
+ /** Gets an attribute of this function. */
+ Attribute getAnAttribute() { funcattributes(this, result) }
+
+ /** Holds if this function is generated by the compiler. */
+ predicate isCompilerGenerated() {
+ compgenerated(this)
+ }
+
+ /** Holds if this function is inline. */
+ predicate isInline() {
+ this.hasSpecifier("inline")
+ }
+
+ /** Holds if this function is virtual. */
+ predicate isVirtual() {
+ this.hasSpecifier("virtual")
+ }
+
+ /**
+ * Holds if this function is deleted.
+ * This may be because it was explicitly deleted with an `= delete`
+ * definition, or because the compiler was unable to auto-generate a
+ * definition for it.
+ *
+ * Most implicitly deleted functions are omitted from the database.
+ * `Class.implicitCopyConstructorDeleted` and
+ * `Class.implicitCopyAssignmentOperatorDeleted` can be used to find
+ * whether a class would have had those members implicitly deleted.
+ */
+ predicate isDeleted() {
+ function_deleted(this)
+ }
+
+ /**
+ * Holds if this function is explicitly defaulted with the `= default`
+ * specifier.
+ */
+ predicate isDefaulted() {
+ function_defaulted(this)
+ }
+
+ /**
+ * Holds if this function is declared with `__attribute__((naked))` or
+ * `__declspec(naked)`.
+ */
+ predicate isNaked() {
+ getAnAttribute().hasName("naked")
+ }
+
+ /** Gets the return type of this function. */
+ Type getType() { function_return_type(this,unresolve(result)) }
+
+ /** Gets the nth parameter of this function. */
+ Parameter getParameter(int n) { params(result,this,n,_) }
+
+ /** Gets a parameter of this function. */
+ Parameter getAParameter() { params(result,this,_,_) }
+
+ /**
+ * Gets the number of parameters of this function, _not_ including any
+ * implicit `this` parameter or any `...` varargs pseudo-parameter.
+ */
+ int getNumberOfParameters() {
+ result = count(this.getAParameter())
+ }
+
+ /**
+ * Gets the number of parameters of this function, _including_ any implicit
+ * `this` parameter but _not_ including any `...` varargs pseudo-parameter.
+ */
+ int getEffectiveNumberOfParameters() {
+ // This method is overridden in `MemberFunction`, where the result is
+ // adjusted to account for the implicit `this` parameter.
+ result = getNumberOfParameters()
+ }
+
+ /**
+ * Gets a string representing the parameters of this function.
+ *
+ * For example: for a function `int Foo(int p1, int p2)` this would
+ * return `int p1, int p2`.
+ */
+ string getParameterString() {
+ result = getParameterStringFrom(0)
+ }
+
+ private string getParameterStringFrom(int index) {
+ (
+ index = getNumberOfParameters() and
+ result = ""
+ ) or (
+ index = getNumberOfParameters() - 1 and
+ result = getParameter(index).getTypedName()
+ ) or (
+ index < getNumberOfParameters() - 1 and
+ result = getParameter(index).getTypedName() + ", " + getParameterStringFrom(index + 1)
+ )
+ }
+
+ FunctionCall getACallToThisFunction() {
+ result.getTarget() = this
+ }
+
+ /**
+ * Gets a declaration entry corresponding to this declaration. The
+ * relationship between `Declaration` and `DeclarationEntry` is explained
+ * in `Declaration.qll`.
+ */
+ override FunctionDeclarationEntry getADeclarationEntry() {
+ if fun_decls(_,this,_,_,_) then
+ declEntry(result)
+ else
+ exists(Function f | this.isConstructedFrom(f) and fun_decls(result,f,_,_,_))
+ }
+
+ private predicate declEntry(FunctionDeclarationEntry fde) {
+ fun_decls(fde,this,_,_,_) and
+ // If one .cpp file specializes a function, and another calls the
+ // specialized function, then when extracting the second we only see an
+ // instantiation, not the specialization. We Therefore need to ignore
+ // any non-specialized declarations if there are any specialized ones.
+ (this.isSpecialization() implies fde.isSpecialization())
+ }
+
+ /**
+ * Gets the location of a `FunctionDeclarationEntry` corresponding to this
+ * declaration.
+ */
+ override Location getADeclarationLocation() {
+ result = getADeclarationEntry().getLocation()
+ }
+
+ /** Holds if this Function is a Template specialization. */
+ predicate isSpecialization() {
+ exists(FunctionDeclarationEntry fde | fun_decls(fde,this,_,_,_)
+ and fde.isSpecialization())
+ }
+
+ /**
+ * Gets the declaration entry corresponding to this declaration that is a
+ * definition, if any.
+ */
+ override FunctionDeclarationEntry getDefinition() {
+ result = getADeclarationEntry() and
+ result.isDefinition()
+ }
+
+ /** Gets the location of the definition, if any. */
+ override Location getDefinitionLocation() {
+ if exists(getDefinition()) then
+ result = getDefinition().getLocation()
+ else
+ exists(Function f | this.isConstructedFrom(f) and result = f.getDefinition().getLocation())
+ }
+
+ /**
+ * Gets the preferred location of this declaration. (The location of the
+ * definition, if possible.)
+ */
+ override Location getLocation() {
+ if exists(getDefinition()) then
+ result = this.getDefinitionLocation()
+ else
+ result = this.getADeclarationLocation()
+ }
+
+ /** Gets a child declaration of this function. */
+ Declaration getADeclaration() { result = this.getAParameter() }
+
+ /**
+ * Gets the block that is the function body.
+ *
+ * For C++ functions whose body is a function try statement rather than a
+ * block, this gives the block guarded by the try statement. See
+ * `FunctionTryStmt` for further information.
+ */
+ Block getBlock() { result.getParentScope() = this }
+
+ /** Holds if this function has an entry point. */
+ predicate hasEntryPoint() { exists(getEntryPoint()) }
+
+ /**
+ * Gets the first node in this function's control flow graph.
+ *
+ * For most functions, this first node will be the `Block` returned by
+ * `getBlock`. However in C++, the first node can also be a
+ * `FunctionTryStmt`.
+ */
+ Stmt getEntryPoint() {
+ function_entry_point(this, result)
+ }
+
+ /**
+ * Gets the metric class. `MetricFunction` has methods for computing
+ * various metrics, such as "number of lines of code" and "number of
+ * function calls".
+ */
+ MetricFunction getMetrics() { result = this }
+
+ /** Holds if this function calls the function `f`. */
+ predicate calls(Function f) {
+ exists(Locatable l | this.calls(f, l))
+ }
+
+ /**
+ * Holds if this function calls the function `f` in the `FunctionCall`
+ * expression `l`.
+ */
+ predicate calls(Function f, Locatable l) {
+ exists(FunctionCall call | call.getEnclosingFunction() = this and call.getTarget() = f and call = l)
+ or exists(DestructorCall call | call.getEnclosingFunction() = this and call.getTarget() = f and call = l)
+ }
+
+ /** Holds if this function accesses a function or variable or enumerator `a`. */
+ predicate accesses(Declaration a) {
+ exists(Locatable l | this.accesses(a, l))
+ }
+
+ /**
+ * Holds if this function accesses a function or variable or enumerator `a`
+ * in the `Access` expression `l`.
+ */
+ predicate accesses(Declaration a, Locatable l) {
+ exists(Access access | access.getEnclosingFunction() = this and
+ a = access.getTarget() and access = l)
+ }
+
+ /** Gets a variable that is written-to in this function. */
+ Variable getAWrittenVariable() {
+ exists(ConstructorFieldInit cfi | cfi.getEnclosingFunction() = this and result = cfi.getTarget()) or
+ exists(VariableAccess va | va = result.getAnAccess() and
+ va.isUsedAsLValue() and
+ va.getEnclosingFunction() = this)
+ }
+
+ /**
+ * Implements `ControlFlowNode.getControlFlowScope`. The `Function` is
+ * used to represent the exit node of the control flow graph, so it is
+ * its own scope.
+ */
+ override Function getControlFlowScope() {
+ result = this
+ }
+
+ /**
+ * Implements `ControlFlowNode.getEnclosingStmt`. The `Function` is
+ * used to represent the exit node of the control flow graph, so it
+ * has no enclosing statement.
+ */
+ override Stmt getEnclosingStmt() {
+ none()
+ }
+
+ /**
+ * Holds if this function has C linkage, as specified by one of its
+ * declaration entries. For example: `extern "C" void foo();`.
+ */
+ predicate hasCLinkage() {
+ getADeclarationEntry().hasCLinkage()
+ }
+
+ /**
+ * Holds if this function is constructed from `f` as a result
+ * of template instantiation. If so, it originates either from a template
+ * function or from a function nested in a template class.
+ */
+ predicate isConstructedFrom(Function f) {
+ function_instantiation(this, f)
+ }
+
+ /**
+ * Gets an argument used to instantiate this class from a template
+ * class.
+ */
+ Type getATemplateArgument() {
+ exists(int i | this.getTemplateArgument(i) = result )
+ }
+
+ /**
+ * Gets a particular argument used to instantiate this class from a
+ * template class.
+ */
+ Type getTemplateArgument(int index) {
+ function_template_argument(this,index,unresolve(result))
+ }
+
+ /**
+ * Holds if this function is defined in several files. This is illegal in
+ * C (though possible in some C++ compilers), and likely indicates that
+ * several functions that are not linked together have been compiled. An
+ * example would be a project with many 'main' functions.
+ */
+ predicate isMultiplyDefined() {
+ strictcount(getFile()) > 1
+ }
+
+ /** Holds if this function is a varargs function. */
+ predicate isVarargs() {
+ hasSpecifier("varargs")
+ }
+
+ /** Gets a type that is specified to be thrown by the function. */
+ Type getAThrownType() {
+ result = getADeclarationEntry().getAThrownType()
+ }
+
+ /**
+ * Gets the `i`th type specified to be thrown by the function.
+ */
+ Type getThrownType(int i) {
+ result = getADeclarationEntry().getThrownType(i)
+ }
+
+ /** Holds if the function has an exception specification. */
+ predicate hasExceptionSpecification() {
+ getADeclarationEntry().hasExceptionSpecification()
+ }
+
+ /** Holds if this function has a `throw()` exception specification. */
+ predicate isNoThrow() {
+ getADeclarationEntry().isNoThrow()
+ }
+
+ /** Holds if this function has a `noexcept` exception specification. */
+ predicate isNoExcept() {
+ getADeclarationEntry().isNoExcept()
+ }
+
+ /** Gets a function that overloads this one. */
+ Function getAnOverload() {
+ result.getName() = getName()
+ and result.getNamespace() = getNamespace()
+ and result != this
+
+ // If this function is declared in a class, only consider other
+ // functions from the same class. Conversely, if this function is not
+ // declared in a class, only consider other functions not declared in a
+ // class.
+ and
+ (
+ if exists(getDeclaringType()) then
+ result.getDeclaringType() = getDeclaringType()
+ else
+ not exists(result.getDeclaringType())
+ )
+
+ // Instantiations and specializations don't participate in overload
+ // resolution.
+ and not (this instanceof FunctionTemplateInstantiation or
+ result instanceof FunctionTemplateInstantiation)
+ and not (this instanceof FunctionTemplateSpecialization or
+ result instanceof FunctionTemplateSpecialization)
+ }
+
+ /** Gets a link target which compiled or referenced this function. */
+ LinkTarget getALinkTarget() {
+ this = result.getAFunction()
+ }
+
+ /**
+ * Holds if this function is side-effect free (conservative
+ * approximation).
+ */
+ predicate isSideEffectFree() {
+ not this.mayHaveSideEffects()
+ }
+
+ /**
+ * Holds if this function may have side-effects; if in doubt, we assume it
+ * may.
+ */
+ predicate mayHaveSideEffects() {
+ // If we cannot see the definition then we assume that it may have
+ // side-effects.
+ if exists(this.getEntryPoint()) then (
+ // If it might be globally impure (we don't care about it modifying
+ // temporaries) then it may have side-effects.
+ this.getEntryPoint().mayBeGloballyImpure() or
+ // Constructor initializers are separate from the entry point ...
+ this.(Constructor).getAnInitializer().mayBeGloballyImpure() or
+ // ... and likewise for destructors.
+ this.(Destructor).getADestruction().mayBeGloballyImpure()
+ ) else not exists(string name | this.hasGlobalName(name) |
+ // Unless it's a function that we know is side-effect-free, it may
+ // have side-effects.
+ name = "strcmp" or name = "wcscmp" or name = "_mbscmp" or
+ name = "strlen" or name = "wcslen" or
+ name = "_mbslen" or name = "_mbslen_l" or
+ name = "_mbstrlen" or name = "_mbstrlen_l" or
+ name = "strnlen" or name = "strnlen_s" or
+ name = "wcsnlen" or name = "wcsnlen_s" or
+ name = "_mbsnlen" or name = "_mbsnlen_l" or
+ name = "_mbstrnlen" or name = "_mbstrnlen_l" or
+ name = "strncmp" or name = "wcsncmp" or
+ name = "_mbsncmp" or name = "_mbsncmp_l" or
+ name = "strchr" or name = "memchr" or name = "wmemchr" or
+ name = "memcmp" or name = "wmemcmp" or
+ name = "_memicmp" or name = "_memicmp_l" or
+ name = "feof" or
+ name = "isdigit" or name = "isxdigit" or
+ name = "abs" or name = "fabs" or name = "labs" or
+ name = "floor" or name = "ceil" or
+ name = "atoi" or name = "atol" or name = "atoll" or name = "atof"
+ )
+ }
+
+ /**
+ * Gets the nearest enclosing AccessHolder.
+ */
+ override AccessHolder getEnclosingAccessHolder() {
+ result = this.getDeclaringType()
+ }
+}
+
+/**
+ * A particular declaration or definition of a C/C++ function.
+ */
+class FunctionDeclarationEntry extends DeclarationEntry, @fun_decl {
+ /** Gets the function which is being declared or defined. */
+ override Function getDeclaration() { result = getFunction() }
+
+ /** Gets the function which is being declared or defined. */
+ Function getFunction() { fun_decls(this,result,_,_,_) }
+
+ /** Gets the name of the function. */
+ override string getName() { fun_decls(this,_,_,result,_) }
+
+ /**
+ * Gets the return type of the function which is being declared or
+ * defined.
+ */
+ override Type getType() { fun_decls(this,_,unresolve(result),_,_) }
+
+ /** Gets the location of this declaration entry. */
+ override Location getLocation() { fun_decls(this,_,_,_,result) }
+
+ /** Gets a specifier associated with this declaration entry. */
+ override string getASpecifier() { fun_decl_specifiers(this,result) }
+
+ /**
+ * Implements `Element.getEnclosingElement`. A function declaration does
+ * not have an enclosing element.
+ */
+ override Element getEnclosingElement() { none() }
+
+ /**
+ * Gets the typedef type (if any) used for this function declaration. As
+ * an example, the typedef type in the declaration of function foo in the
+ * following is Foo:
+ *
+ * typedef int Foo();
+ * static Foo foo;
+ */
+ TypedefType getTypedefType() {
+ fun_decl_typedef_type(this,result)
+ }
+
+ /**
+ * Gets the cyclomatic complexity of this function:
+ *
+ * The number of branching statements (if, while, do, for, switch,
+ * case, catch) plus the number of branching expressions (`?`, `&&`,
+ * `||`) plus one.
+ */
+ int getCyclomaticComplexity() {
+ result = 1 + cyclomaticComplexityBranches(getBlock())
+ }
+
+ /**
+ * If this is a function definition, get the block containing the
+ * function body.
+ */
+ Block getBlock() {
+ this.isDefinition() and
+ result = getFunction().getBlock() and result.getFile() = this.getFile()
+ }
+
+ /**
+ * If this is a function definition, get the number of lines of code
+ * associated with it.
+ */
+ pragma[noopt] int getNumberOfLines() {
+ exists(Block b, Location l, int start, int end, int diff| b = getBlock() |
+ l = b.getLocation() and
+ start = l.getStartLine() and
+ end = l.getEndLine() and
+ diff = end - start and
+ result = diff + 1
+ )
+ }
+
+ /**
+ * Gets the declaration entry for a parameter of this function
+ * declaration.
+ */
+ ParameterDeclarationEntry getAParameterDeclarationEntry() {
+ result = getParameterDeclarationEntry(_)
+ }
+
+ /**
+ * Gets the declaration entry for the nth parameter of this function
+ * declaration.
+ */
+ ParameterDeclarationEntry getParameterDeclarationEntry(int n) {
+ param_decl_bind(result,n,this)
+ }
+
+ /** Gets the number of parameters of this function declaration. */
+ int getNumberOfParameters() {
+ result = count(this.getAParameterDeclarationEntry())
+ }
+
+ /**
+ * Gets a string representing the parameters of this function declaration.
+ *
+ * For example: for a function 'int Foo(int p1, int p2)' this would
+ * return 'int p1, int p2'.
+ */
+ string getParameterString() {
+ result = getParameterStringFrom(0)
+ }
+
+ private string getParameterStringFrom(int index) {
+ (
+ index = getNumberOfParameters() and
+ result = ""
+ ) or (
+ index = getNumberOfParameters() - 1 and
+ result = getParameterDeclarationEntry(index).getTypedName()
+ ) or (
+ index < getNumberOfParameters() - 1 and
+ result = getParameterDeclarationEntry(index).getTypedName() + ", " + getParameterStringFrom(index + 1)
+ )
+ }
+
+ /** Holds if this declaration entry specifies C linkage:
+ *
+ * `extern "C" void foo();`
+ */
+ predicate hasCLinkage() {
+ getASpecifier() = "c_linkage"
+ }
+
+ /** Holds if this declaration entry has a void parameter list. */
+ predicate hasVoidParamList() {
+ getASpecifier() = "void_param_list"
+ }
+
+ /** Holds if this declaration is also a definition of its function. */
+ override predicate isDefinition() {
+ fun_def(this)
+ }
+
+ /** Holds if this declaration is a Template specialization. */
+ predicate isSpecialization() {
+ fun_specialized(this)
+ }
+
+ /**
+ * Holds if this declaration is an implicit function declaration, that is,
+ * where a function is used before it is declared (under older C standards).
+ */
+ predicate isImplicit() {
+ fun_implicit(this)
+ }
+
+ /** Gets a type that is specified to be thrown by the declared function. */
+ Type getAThrownType() {
+ result = getThrownType(_)
+ }
+
+ /**
+ * Gets the `i`th type specified to be thrown by the declared function
+ * (where `i` is indexed from 0). For example, if a function is declared
+ * to `throw(int,float)`, then the thrown type with index 0 would be
+ * `int`, and that with index 1 would be `float`.
+ */
+ Type getThrownType(int i) {
+ fun_decl_throws(this,i,unresolve(result))
+ }
+
+ /**
+ * If this declaration has a noexcept-specification [N4140 15.4], then
+ * this predicate returns the argument to `noexcept` if one was given.
+ */
+ Expr getNoExceptExpr() {
+ fun_decl_noexcept(this,result)
+ }
+
+ /**
+ * Holds if the declared function has an exception specification [N4140
+ * 15.4].
+ */
+ predicate hasExceptionSpecification() {
+ fun_decl_throws(this,_,_) or
+ fun_decl_noexcept(this,_) or
+ isNoThrow() or
+ isNoExcept()
+ }
+
+ /**
+ * Holds if the declared function has a `throw()` exception specification.
+ */
+ predicate isNoThrow() {
+ fun_decl_empty_throws(this)
+ }
+
+ /**
+ * Holds if the declared function has an empty `noexcept` exception
+ * specification.
+ */
+ predicate isNoExcept() {
+ fun_decl_empty_noexcept(this)
+ }
+}
+
+
+/**
+ * A C/C++ non-member function (a function that is not a member of any
+ * class).
+ */
+class TopLevelFunction extends Function {
+ TopLevelFunction() {
+ not this.isMember()
+ }
+}
+
+/**
+ * A C++ function declared as a member of a class [N4140 9.3]. This includes
+ * static member functions.
+ */
+class MemberFunction extends Function {
+ MemberFunction() {
+ this.isMember()
+ }
+
+ /**
+ * Gets the number of parameters of this function, including any implicit
+ * `this` parameter.
+ */
+ override int getEffectiveNumberOfParameters() {
+ if isStatic() then
+ result = getNumberOfParameters()
+ else
+ result = getNumberOfParameters() + 1
+ }
+
+ /** Holds if this member is private. */
+ predicate isPrivate() { this.hasSpecifier("private") }
+
+ /** Holds if this member is protected. */
+ predicate isProtected() { this.hasSpecifier("protected") }
+
+ /** Holds if this member is public. */
+ predicate isPublic() { this.hasSpecifier("public") }
+
+ /** Holds if this function overrides that function. */
+ predicate overrides(MemberFunction that) { overrides(this,that) }
+
+ /** Gets a directly overridden function. */
+ MemberFunction getAnOverriddenFunction() { this.overrides(result) }
+
+ /** Gets a directly overriding function. */
+ MemberFunction getAnOverridingFunction() { result.overrides(this) }
+
+ /**
+ * Gets the declaration entry for this member function that is within the
+ * class body.
+ */
+ FunctionDeclarationEntry getClassBodyDeclarationEntry() {
+ if strictcount(getADeclarationEntry()) = 1 then
+ result = getDefinition()
+ else
+ (result = getADeclarationEntry() and result != getDefinition())
+ }
+
+}
+
+/**
+ * A C++ virtual function.
+ */
+class VirtualFunction extends MemberFunction {
+
+ VirtualFunction() {
+ this.hasSpecifier("virtual") or purefunctions(this)
+ }
+
+ /** Holds if this virtual function is pure. */
+ predicate isPure() { this instanceof PureVirtualFunction }
+
+ /**
+ * Holds if this function was declared with the `override` specifier
+ * [N4140 10.3].
+ */
+ predicate isOverrideExplicit() { this.hasSpecifier("override") }
+}
+
+/**
+ * A C++ pure virtual function [N4140 10.4].
+ */
+class PureVirtualFunction extends VirtualFunction {
+
+ PureVirtualFunction() { purefunctions(this) }
+
+}
+
+/**
+ * A const C++ member function [N4140 9.3.1/4]. A const function does not
+ * modify the state of its class.
+ * For example: `int day() const { return d; }`
+ */
+class ConstMemberFunction extends MemberFunction {
+
+ ConstMemberFunction() { this.hasSpecifier("const") }
+
+}
+
+/**
+ * A C++ constructor [N4140 12.1].
+ */
+class Constructor extends MemberFunction {
+
+ Constructor() { functions(this,_,2) }
+
+ /**
+ * Holds if this constructor serves as a default constructor.
+ *
+ * This holds for constructors with zero formal parameters. It also holds
+ * for constructors which have a non-zero number of formal parameters,
+ * provided that every parameter has a default value.
+ */
+ predicate isDefault() {
+ forall(Parameter p | p = this.getAParameter() | p.hasInitializer())
+ }
+
+ /**
+ * Gets an entry in the constructor's initializer list, or a
+ * compiler-generated action which initializes a base class or member
+ * variable.
+ */
+ ConstructorInit getAnInitializer() {
+ result = getInitializer(_)
+ }
+
+ /**
+ * Gets an entry in the constructor's initializer list, or a
+ * compiler-generated action which initializes a base class or member
+ * variable. The index specifies the order in which the initializer is
+ * to be evaluated.
+ */
+ ConstructorInit getInitializer(int i) {
+ exprparents(result, i, this)
+ }
+}
+
+/** A function that defines an implicit conversion. */
+abstract class ImplicitConversionFunction extends MemberFunction {
+ abstract Type getSourceType();
+ abstract Type getDestType();
+}
+
+/** A C++ constructor that also defines an implicit conversion. */
+class ConversionConstructor extends Constructor, ImplicitConversionFunction {
+ ConversionConstructor() {
+ strictcount(Parameter p | p = getAParameter() and not p.hasInitializer()) = 1
+ and not hasSpecifier("explicit")
+ and not(this instanceof CopyConstructor)
+ }
+
+ /** Gets the type this `ConversionConstructor` takes as input. */
+ override Type getSourceType() { result = this.getParameter(0).getType() }
+
+ /** Gets the type this `ConversionConstructor` is a constructor of. */
+ override Type getDestType() { result = this.getDeclaringType() }
+}
+
+private predicate hasCopySignature(MemberFunction f) {
+ f.getParameter(0).getType()
+ .getUnderlyingType() // resolve typedefs
+ .(LValueReferenceType).getBaseType() // step through lvalue reference type
+ .getUnspecifiedType() = // resolve typedefs, strip const/volatile
+ f.getDeclaringType()
+}
+
+private predicate hasMoveSignature(MemberFunction f) {
+ f.getParameter(0).getType()
+ .getUnderlyingType() // resolve typedefs
+ .(RValueReferenceType).getBaseType() // step through rvalue reference type
+ .getUnspecifiedType() = // resolve typedefs, strip const/volatile
+ f.getDeclaringType()
+}
+
+/**
+ * A C++ copy constructor, such as `T::T(const T&)` [N4140 12.8].
+ *
+ * As per the standard, a copy constructor of class T is a non-template
+ * constructor whose first parameter has type `T&`, `const T&`, `volatile
+ * T&`, or `const volatile T&`, and either there are no other parameters,
+ * or the rest of the parameters all have default values.
+ *
+ * For template classes, it can generally not be determined until instantiation
+ * whether a constructor is a copy constructor. For such classes, `CopyConstructor`
+ * over-approximates the set of copy constructors; if an under-approximation is
+ * desired instead, see the member predicate
+ * `mayNotBeCopyConstructorInInstantiation`.
+ */
+class CopyConstructor extends Constructor {
+ CopyConstructor() {
+ hasCopySignature(this) and
+ (
+ // The rest of the parameters all have default values
+ forall(int i | i > 0 and exists(getParameter(i)) |
+ getParameter(i).hasInitializer()
+ )
+ or
+ // or this is a template class, in which case the default values have
+ // not been extracted even if they exist. In that case, we assume that
+ // there are default values present since that is the most common case
+ // in real-world code.
+ getDeclaringType() instanceof TemplateClass
+ ) and
+ not exists(getATemplateArgument())
+ }
+
+ /**
+ * Holds if we cannot determine that this constructor will become a copy
+ * constructor in all instantiations. Depending on template parameters of the
+ * enclosing class, this may become an ordinary constructor or a copy
+ * constructor.
+ */
+ predicate mayNotBeCopyConstructorInInstantiation() {
+ // In general, default arguments of template classes can only be
+ // type-checked for each template instantiation; if an argument in an
+ // instantiation fails to type-check then the corresponding parameter has
+ // no default argument in the instantiation.
+ getDeclaringType() instanceof TemplateClass and
+ getNumberOfParameters() > 1
+ }
+}
+
+/**
+ * A C++ move constructor, such as `T::T(T&&)` [N4140 12.8].
+ *
+ * As per the standard, a move constructor of class T is a non-template
+ * constructor whose first parameter is `T&&`, `const T&&`, `volatile T&&`,
+ * or `const volatile T&&`, and either there are no other parameters, or
+ * the rest of the parameters all have default values.
+ *
+ * For template classes, it can generally not be determined until instantiation
+ * whether a constructor is a move constructor. For such classes, `MoveConstructor`
+ * over-approximates the set of move constructors; if an under-approximation is
+ * desired instead, see the member predicate
+ * `mayNotBeMoveConstructorInInstantiation`.
+ */
+class MoveConstructor extends Constructor {
+ MoveConstructor() {
+ hasMoveSignature(this) and
+ (
+ // The rest of the parameters all have default values
+ forall(int i | i > 0 and exists(getParameter(i)) |
+ getParameter(i).hasInitializer()
+ )
+ or
+ // or this is a template class, in which case the default values have
+ // not been extracted even if they exist. In that case, we assume that
+ // there are default values present since that is the most common case
+ // in real-world code.
+ getDeclaringType() instanceof TemplateClass
+ ) and
+ not exists(getATemplateArgument())
+ }
+
+ /**
+ * Holds if we cannot determine that this constructor will become a move
+ * constructor in all instantiations. Depending on template parameters of the
+ * enclosing class, this may become an ordinary constructor or a move
+ * constructor.
+ */
+ predicate mayNotBeMoveConstructorInInstantiation() {
+ // In general, default arguments of template classes can only be
+ // type-checked for each template instantiation; if an argument in an
+ // instantiation fails to type-check then the corresponding parameter has
+ // no default argument in the instantiation.
+ getDeclaringType() instanceof TemplateClass and
+ getNumberOfParameters() > 1
+ }
+}
+
+/**
+ * A C++ constructor that takes no arguments ('default' constructor). This
+ * is the constructor that is invoked when no initializer is given.
+ */
+class NoArgConstructor extends Constructor {
+ NoArgConstructor() {
+ this.getNumberOfParameters() = 0
+ }
+}
+
+/**
+ * A C++ destructor [N4140 12.4].
+ */
+class Destructor extends MemberFunction {
+ Destructor() { functions(this,_,3) }
+
+ /**
+ * Gets a compiler-generated action which destructs a base class or member
+ * variable.
+ */
+ DestructorDestruction getADestruction() {
+ result = getDestruction(_)
+ }
+
+ /**
+ * Gets a compiler-generated action which destructs a base class or member
+ * variable. The index specifies the order in which the destruction should
+ * be evaluated.
+ */
+ DestructorDestruction getDestruction(int i) {
+ exprparents(result, i, this)
+ }
+}
+
+/**
+ * A C++ conversion operator [N4140 12.3.2].
+ */
+class ConversionOperator extends MemberFunction, ImplicitConversionFunction {
+
+ ConversionOperator() { functions(this,_,4) }
+
+ override Type getSourceType() { result = this.getDeclaringType() }
+ override Type getDestType() { result = this.getType() }
+
+}
+
+/**
+ * A C++ user-defined operator [N4140 13.5].
+ */
+class Operator extends Function {
+
+ Operator() { functions(this,_,5) }
+
+}
+
+/**
+ * A C++ copy assignment operator, such as `T& T::operator=(const T&)`
+ * [N4140 12.8].
+ *
+ * As per the standard, a copy assignment operator of class `T` is a
+ * non-template non-static member function with the name `operator=` that
+ * takes exactly one parameter of type `T`, `T&`, `const T&`, `volatile
+ * T&`, or `const volatile T&`.
+ */
+class CopyAssignmentOperator extends Operator {
+ CopyAssignmentOperator() {
+ hasName("operator=") and
+ (hasCopySignature(this) or
+ // Unlike CopyConstructor, this member allows a non-reference
+ // parameter.
+ getParameter(0).getType().getUnspecifiedType() = getDeclaringType()
+ ) and
+ not exists(this.getParameter(1)) and
+ not exists(getATemplateArgument())
+ }
+}
+
+
+/**
+ * A C++ move assignment operator, such as `T& T::operator=(T&&)` [N4140
+ * 12.8].
+ *
+ * As per the standard, a move assignment operator of class `T` is a
+ * non-template non-static member function with the name `operator=` that
+ * takes exactly one parameter of type `T&&`, `const T&&`, `volatile T&&`,
+ * or `const volatile T&&`.
+ */
+class MoveAssignmentOperator extends Operator {
+ MoveAssignmentOperator() {
+ hasName("operator=") and
+ hasMoveSignature(this) and
+ not exists(this.getParameter(1)) and
+ not exists(getATemplateArgument())
+ }
+}
+
+
+/**
+ * A C++ function which has a non-empty template argument list.
+ *
+ * This includes function declarations which are immediately preceded by
+ * `template <...>`, where the "..." part is not empty, and therefore it
+ * does not include:
+ *
+ * 1. Full specializations of template functions, as they have an empty
+ * template argument list.
+ * 2. Instantiations of template functions, as they don't have an
+ * explicit template argument list.
+ * 3. Member functions of template classes - unless they have their own
+ * (non-empty) template argument list.
+ */
+class TemplateFunction extends Function {
+ TemplateFunction() { is_function_template(this) and exists(getATemplateArgument()) }
+
+ /**
+ * Gets a compiler-generated instantiation of this function template.
+ */
+ Function getAnInstantiation() {
+ result.isConstructedFrom(this)
+ and not result.isSpecialization()
+ }
+
+ /**
+ * Gets a full specialization of this function template.
+ *
+ * Note that unlike classes, functions overload rather than specialize
+ * partially. Therefore this does not include things which "look like"
+ * partial specializations, nor does it include full specializations of
+ * such things -- see FunctionTemplateSpecialization for further details.
+ */
+ FunctionTemplateSpecialization getASpecialization() {
+ result.getPrimaryTemplate() = this
+ }
+}
+
+/**
+ * A function that is an instantiation of a template.
+ */
+class FunctionTemplateInstantiation extends Function {
+ FunctionTemplateInstantiation() {
+ exists(TemplateFunction tf | tf.getAnInstantiation() = this)
+ }
+}
+
+/**
+ * An explicit specialization of a C++ function template.
+ * For example: `template <> void f(int *)`.
+ *
+ * Note that unlike classes, functions overload rather than specialize
+ * partially. Therefore this only includes the last two of the following
+ * four definitions, and in particular does not include the second one:
+ *
+ * ```
+ * template void f(T) {...}
+ * template void f(T*) {...}
+ * template <> void f(int *) {...}
+ * template <> void f(int *) {...}
+ * ```
+ *
+ * Furthermore, this does not include compiler-generated instantiations of
+ * function templates.
+ *
+ * For further reference on function template specializations, see:
+ * http://www.gotw.ca/publications/mill17.htm
+ */
+class FunctionTemplateSpecialization extends Function {
+ FunctionTemplateSpecialization() {
+ this.isSpecialization()
+ }
+
+ /**
+ * Gets the primary template for the specialization (the function template
+ * this specializes).
+ */
+ TemplateFunction getPrimaryTemplate() {
+ this.isConstructedFrom(result)
+ }
+}
+
+/**
+ * A GCC built-in function. For example: `__builtin___memcpy_chk`.
+ */
+class BuiltInFunction extends Function {
+ BuiltInFunction() {
+ functions(this,_,6)
+ }
+
+ /** Gets a dummy location for the built-in function. */
+ override Location getLocation() {
+ suppressUnusedThis(this) and
+ result instanceof UnknownDefaultLocation
+ }
+}
+
+private predicate suppressUnusedThis(Function f) { any() }
diff --git a/cpp/ql/src/semmle/code/cpp/Include.qll b/cpp/ql/src/semmle/code/cpp/Include.qll
new file mode 100644
index 000000000000..b29278a35ac1
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/Include.qll
@@ -0,0 +1,56 @@
+import semmle.code.cpp.Preprocessor
+
+/**
+ * A C/C++ `#include`, `#include_next`, or `#import` preprocessor
+ * directive.
+ */
+class Include extends PreprocessorDirective, @ppd_include {
+ override string toString() { result = "#include " + this.getIncludeText() }
+
+ /**
+ * Gets the token which occurs after `#include`, for example `"filename"`
+ * or `<filename>`.
+ */
+ string getIncludeText() { result = getHead() }
+
+ /** Gets the file directly included by this `#include`. */
+ File getIncludedFile() { includes(this, result) }
+
+ /**
+ * Gets a file which might be transitively included by this `#include`.
+ *
+ * Note that as this isn't computed within the context of a particular
+ * translation unit, it is often a slight over-approximation.
+ */
+ predicate provides(File l) {
+ exists(Include i | this.getAnInclude*() = i and i.getIncludedFile() = l)
+ }
+
+ /**
+ * A `#include` which appears in the file directly included by this
+ * `#include`.
+ */
+ Include getAnInclude() {
+ this.getIncludedFile() = result.getFile()
+ }
+}
+
+/**
+ * A `#include_next` preprocessor directive (a non-standard extension to
+ * C/C++).
+ */
+class IncludeNext extends Include, @ppd_include_next {
+ override string toString() {
+ result = "#include_next " + getIncludeText()
+ }
+}
+
+/**
+ * A `#import` preprocessor directive (used heavily in Objective C, and
+ * supported by GCC as an extension in C).
+ */
+class Import extends Include, @ppd_objc_import {
+ override string toString() {
+ result = "#import " + getIncludeText()
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/Initializer.qll b/cpp/ql/src/semmle/code/cpp/Initializer.qll
new file mode 100644
index 000000000000..d31d54b8987a
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/Initializer.qll
@@ -0,0 +1,36 @@
+import semmle.code.cpp.controlflow.ControlFlowGraph
+
+/**
+ * A C/C++ declaration initializer.
+ */
+class Initializer extends @initialiser, ControlFlowNode {
+ override Location getLocation() { initialisers(this,_,_,result) }
+
+ /** Holds if this initializer is explicit in the source. */
+ override predicate fromSource() {
+ not (this.getLocation() instanceof UnknownLocation)
+ }
+
+ override string toString() {
+ if exists(getDeclaration()) then (
+ result = "initializer for " + max(getDeclaration().getName())
+ ) else (
+ result = "initializer"
+ )
+ }
+
+ /** Gets the variable or enum constant being initialized. */
+ Declaration getDeclaration() { initialisers(this,result,_,_) }
+
+ /** Gets the initializing expression. */
+ Expr getExpr() { initialisers(this,_,result,_) }
+
+ /** Gets the function containing this control-flow node. */
+ override Function getControlFlowScope() {
+ result = this.getExpr().getEnclosingFunction()
+ }
+
+ override Stmt getEnclosingStmt() {
+ result = this.getExpr().getEnclosingStmt()
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/Iteration.qll b/cpp/ql/src/semmle/code/cpp/Iteration.qll
new file mode 100644
index 000000000000..5a63b5ff1bd0
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/Iteration.qll
@@ -0,0 +1,56 @@
+import semmle.code.cpp.Variable
+
+/**
+ * A C/C++ variable which is used within the condition of a 'for' loop, and
+ * mutated within the update expression of the same 'for' loop.
+ */
+class LoopCounter extends Variable {
+ LoopCounter() {
+ exists(ForStmt f | f.getAnIterationVariable() = this)
+ }
+
+ // Gets an access of this variable within loop `f`.
+ VariableAccess getVariableAccessInLoop(ForStmt f) {
+ this.getALoop() = f and
+ result.getEnclosingStmt().getParent*() = f and
+ this = result.getTarget()
+ }
+
+ // Gets a loop which uses this variable as its counter.
+ ForStmt getALoop() {
+ result.getAnIterationVariable() = this
+ }
+}
+
+/**
+ * A C/C++ variable which is used within the initialization, condition, or
+ * update expression of a 'for' loop.
+ */
+class LoopControlVariable extends Variable {
+ LoopControlVariable() {
+ this = loopControlVariable(_)
+ }
+
+ // Gets an access of this variable within loop `f`.
+ VariableAccess getVariableAccessInLoop(ForStmt f) {
+ this.getALoop() = f and
+ result.getEnclosingStmt().getParent*() = f and
+ this = result.getTarget()
+ }
+
+ // Gets a loop which uses this variable as its control variable.
+ ForStmt getALoop() {
+ this = loopControlVariable(result)
+ }
+}
+
+/**
+ * Gets a control variable of loop `f`.
+ */
+private Variable loopControlVariable(ForStmt f) {
+ exists(Expr e
+ | result.getAnAccess().getParent*() = e
+ | e = f.getControllingExpr() or
+ e = f.getInitialization().(ExprStmt).getExpr() or
+ e = f.getUpdate())
+}
diff --git a/cpp/ql/src/semmle/code/cpp/Linkage.qll b/cpp/ql/src/semmle/code/cpp/Linkage.qll
new file mode 100644
index 000000000000..c1d7ea7b54fa
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/Linkage.qll
@@ -0,0 +1,58 @@
+import semmle.code.cpp.Class
+import semmle.code.cpp.File
+import semmle.code.cpp.Function
+
+/**
+ * A linker call during the build process, typically resulting in an
+ * executable or a shared library.
+ *
+ * Note that if linkage information isn't captured as part of the snapshot,
+ * then everything is grouped together into a single dummy link target.
+ */
+class LinkTarget extends @link_target {
+ /**
+ * Gets the file which was built.
+ */
+ File getBinary() {
+ link_targets(this, result)
+ }
+
+ /**
+ * Holds if this is the dummy link target: if linkage information isn't
+ * captured as part of the snapshot, then everything is grouped together
+ * into a single dummy link target.
+ */
+ predicate isDummy() {
+ getBinary().getAbsolutePath() = ""
+ }
+
+ /** Gets a textual representation of this element. */
+ string toString() {
+ result = getBinary().getAbsolutePath()
+ }
+
+ /**
+ * Gets a function which was compiled into this link target, or had its
+ * declaration included by one of the translation units which contributed
+ * to this link target.
+ */
+ Function getAFunction() {
+ link_parent(result, this)
+ }
+
+ /**
+ * Gets a class which had its declaration included by one of the
+ * translation units which contributed to this link target.
+ */
+ Class getAClass() {
+ link_parent(result, this)
+ }
+}
+
+/**
+ * Holds if this database was created with the linker awareness feature
+ * switched on.
+ */
+cached predicate isLinkerAwareExtracted() {
+ exists(LinkTarget lt | not lt.isDummy())
+}
diff --git a/cpp/ql/src/semmle/code/cpp/Location.qll b/cpp/ql/src/semmle/code/cpp/Location.qll
new file mode 100644
index 000000000000..284299bc8493
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/Location.qll
@@ -0,0 +1,197 @@
+import semmle.code.cpp.Element
+import semmle.code.cpp.File
+
+/**
+ * A location of a C/C++ artifact.
+ */
+class Location extends @location {
+
+ /** Gets the container corresponding to this location. */
+ Container getContainer() {
+ locations_default(this,result,_,_,_,_) or
+ locations_stmt(this,result,_,_,_,_) or
+ locations_expr(this,result,_,_,_,_)
+ }
+
+ /** Gets the file corresponding to this location, if any. */
+ File getFile() {
+ result = this.getContainer()
+ }
+
+ /** Gets the start line of this location. */
+ int getStartLine() {
+ locations_default(this,_,result,_,_,_) or
+ locations_stmt(this,_,result,_,_,_) or
+ locations_expr(this,_,result,_,_,_)
+ }
+
+ /** Gets the end line of this location. */
+ int getEndLine() {
+ locations_default(this,_,_,_,result,_) or
+ locations_stmt(this,_,_,_,result,_) or
+ locations_expr(this,_,_,_,result,_)
+ }
+
+ /** Gets the start column of this location. */
+ int getStartColumn() {
+ locations_default(this,_,_,result,_,_) or
+ locations_stmt(this,_,_,result,_,_) or
+ locations_expr(this,_,_,result,_,_)
+ }
+
+ /** Gets the end column of this location. */
+ int getEndColumn() {
+ locations_default(this,_,_,_,_,result) or
+ locations_stmt(this,_,_,_,_,result) or
+ locations_expr(this,_,_,_,_,result)
+ }
+
+ /**
+ * Gets a textual representation of this element.
+ *
+ * The format is "file://filePath:startLine:startColumn:endLine:endColumn".
+ */
+ string toString() {
+ exists(string filepath, int startline, int startcolumn, int endline, int endcolumn
+ | this.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+ | toUrl(filepath, startline, startcolumn, endline, endcolumn, result)
+ )
+ }
+
+
+ /**
+ * Holds if this element is at the specified location.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `filepath`.
+ * For more information, see
+ * [LGTM locations](https://lgtm.com/help/ql/locations).
+ */
+ predicate hasLocationInfo(
+ string filepath, int startline, int startcolumn, int endline, int endcolumn) {
+ none()
+ }
+
+ /** Holds if `this` comes on a line strictly before `l`. */
+ predicate isBefore(Location l) {
+ this.getFile() = l.getFile() and this.getEndLine() < l.getStartLine()
+ }
+
+ /** Holds if location `l` is completely contained within this one. */
+ predicate subsumes(Location l) {
+ exists(File f | f = getFile() |
+ exists(int thisStart, int thisEnd | charLoc(f, thisStart, thisEnd) |
+ exists(int lStart, int lEnd | l.charLoc(f, lStart, lEnd) |
+ thisStart <= lStart and lEnd <= thisEnd
+ )
+ )
+ )
+ }
+
+ /**
+ * Holds if this location corresponds to file `f` and character "offsets"
+ * `start..end`. Note that these are not real character offsets, because
+ * we use `maxCols` to find the length of the longest line and then pretend
+ * that all the lines are the same length. However, these offsets are
+ * convenient for comparing or sorting locations in a file. For an example,
+ * see `subsumes`.
+ */
+ predicate charLoc(File f, int start, int end) {
+ f = getFile() and
+ exists(int maxCols | maxCols = maxCols(f) |
+ start = getStartLine() * maxCols + getStartColumn() and
+ end = getEndLine() * maxCols + getEndColumn()
+ )
+ }
+}
+
+/**
+ * A location of an element. Not used for expressions or statements, which
+ * instead use LocationExpr and LocationStmt respectively.
+ */
+library class LocationDefault extends Location, @location_default {
+ override predicate hasLocationInfo(
+ string filepath, int startline, int startcolumn, int endline, int endcolumn) {
+ exists(Container f
+ | locations_default(this,f,startline,startcolumn,endline,endcolumn)
+ | filepath = f.getAbsolutePath())
+ }
+}
+
+/** A location of a statement. */
+library class LocationStmt extends Location, @location_stmt {
+ override predicate hasLocationInfo(
+ string filepath, int startline, int startcolumn, int endline, int endcolumn) {
+ exists(Container f
+ | locations_stmt(this,f,startline,startcolumn,endline,endcolumn)
+ | filepath = f.getAbsolutePath())
+ }
+}
+
+/** A location of an expression. */
+library class LocationExpr extends Location, @location_expr {
+ override predicate hasLocationInfo(
+ string filepath, int startline, int startcolumn, int endline, int endcolumn) {
+ exists(Container f
+ | locations_expr(this,f,startline,startcolumn,endline,endcolumn)
+ | filepath = f.getAbsolutePath())
+ }
+}
+
+/**
+ * Gets the length of the longest line in file `f`.
+ */
+pragma[nomagic]
+private int maxCols(File f) {
+ result = max(Location l | l.getFile() = f | l.getEndColumn())
+}
+
+/**
+ * A C/C++ element that has a location in a file
+ */
+class Locatable extends Element {
+
+}
+
+/**
+ * A dummy location which is used when something doesn't have a location in
+ * the source code but needs to have a `Location` associated with it. There
+ * may be several distinct kinds of unknown locations. For example: one for
+ * expressions, one for statements and one for other program elements.
+ */
+class UnknownLocation extends Location {
+ UnknownLocation() {
+ getFile().getAbsolutePath() = ""
+ }
+}
+
+/**
+ * A dummy location which is used when something doesn't have a location in
+ * the source code but needs to have a `Location` associated with it.
+ */
+class UnknownDefaultLocation extends UnknownLocation {
+ UnknownDefaultLocation() {
+ locations_default(this, _, 0, 0, 0, 0)
+ }
+}
+
+/**
+ * A dummy location which is used when an expression doesn't have a
+ * location in the source code but needs to have a `Location` associated
+ * with it.
+ */
+class UnknownExprLocation extends UnknownLocation {
+ UnknownExprLocation() {
+ locations_expr(this, _, 0, 0, 0, 0)
+ }
+}
+
+/**
+ * A dummy location which is used when a statement doesn't have a location
+ * in the source code but needs to have a `Location` associated with it.
+ */
+class UnknownStmtLocation extends UnknownLocation {
+ UnknownStmtLocation() {
+ locations_stmt(this, _, 0, 0, 0, 0)
+ }
+}
+
diff --git a/cpp/ql/src/semmle/code/cpp/Macro.qll b/cpp/ql/src/semmle/code/cpp/Macro.qll
new file mode 100644
index 000000000000..febc4d4c47cb
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/Macro.qll
@@ -0,0 +1,336 @@
+import cpp
+
+/**
+ * A macro.
+ */
+class Macro extends PreprocessorDirective, @ppd_define {
+
+ /**
+ * Gets the head of this macro. For example, `MAX(x,y)` in
+ * `#define MAX(x,y) (((x)>(y))?(x):(y))`.
+ */
+ override string getHead() { preproctext(this,result,_) }
+
+ /**
+ * Gets the body of this macro. For example, `(((x)>(y))?(x):(y))` in
+ * `#define MAX(x,y) (((x)>(y))?(x):(y))`.
+ */
+ string getBody() { preproctext(this,_,result) }
+
+ /** Gets an invocation of this macro. */
+ MacroInvocation getAnInvocation() { result.getMacro() = this }
+
+ override string toString() {
+ if (this.getBody() = "") then (
+ result = "#define " + this.getHead()
+ ) else (
+ result = "#define " + this.getHead() + " " + this.getBody()
+ )
+ }
+
+ /**
+ * Holds if the body of the macro starts with an unmatched closing
+ * parenthesis. For example:
+ *
+ * #define RPAREN() )
+ *
+ * DEPRECATED: This predicate has a misleading name.
+ */
+ deprecated predicate isFunctionLike() {
+ this.getBody().regexpMatch("[^(]*\\).*")
+ }
+
+ /**
+ * Gets the name of the macro. For example, `MAX` in
+ * `#define MAX(x,y) (((x)>(y))?(x):(y))`.
+ */
+ string getName() {
+ result = getHead().splitAt("(", 0)
+ }
+
+ /** Holds if the macro has name `name`. */
+ predicate hasName(string name) {
+ getName() = name
+ }
+}
+
+/**
+ * A macro access (macro expansion or other macro access).
+ */
+class MacroAccess extends Locatable, @macroinvocation {
+ /** Gets the macro being invoked. */
+ Macro getMacro() { macroinvocations(this,result,_,_) }
+
+ /**
+ * Gets the location of the outermost macro access that triggered this macro
+ * access. This is equivalent to calling
+ * `this.getOutermostMacroAccess().getActualLocation()`. For example, the
+ * location of the invocation of `C` in `P(C)` will be the whole source range
+ * starting with `P` and ending with `)`.
+ */
+ override Location getLocation() {
+ result = this.getOutermostMacroAccess().getActualLocation()
+ }
+
+ /**
+ * Gets the location of this macro invocation. For a nested invocation, where
+ * `exists(this.getParentInvocation())`, this yields a location either inside
+ * a `#define` directive or inside an argument to another macro.
+ */
+ Location getActualLocation() {
+ macroinvocations(this,_,result,_)
+ }
+
+ /**
+ * Gets the parent macro invocation, if any. For example:
+ *
+ * ```
+ * 1: #define C 0
+ * 2: #define P C
+ * 3: static int x = P;
+ * ```
+ *
+ * The invocation of `P` on line 3 also invokes `C`. The invocation of
+ * `P` is the parent of the invocation of `C`.
+ *
+ * A macro invocation occurring in a macro argument often also establishes a
+ * parent relationship. This is due to the "call-by-name" evaluation order of
+ * C macros, where macro arguments are first substituted textually into the
+ * macro body before macro expansion is again performed on the body, invoking
+ * the macros present in the original macro argument. For example:
+ *
+ * ```
+ * 1: #define C 0
+ * 2: #define P(c) c + c
+ * 3: static int x = P(C);
+ * ```
+ *
+ * In this case, `P(C)` first expands to `C + C`, which triggers an
+ * invocation of `C` whose parent is the invocation of `P`. Had `c` not
+ * occurred in the body of `P`, there would have been no invocation of `C`.
+ * There is only a single invocation even though `c` occurs twice; this is an
+ * optimization for efficiency.
+ */
+ MacroInvocation getParentInvocation() { macroparent(this,result) }
+
+ /**
+ * Gets the outermost `MacroAccess` along the chain of `getParentInvocation`.
+ * If `this` has no parent, the result will be `this` itself.
+ */
+ MacroAccess getOutermostMacroAccess() {
+ if (not exists(this.getParentInvocation())) then
+ result = this
+ else
+ result = this.getParentInvocation().getOutermostMacroAccess()
+ }
+
+ override string toString() { result = this.getMacro().getHead() }
+
+ /** Gets the name of the invoked macro. */
+ string getMacroName() {
+ result = getMacro().getName()
+ }
+}
+
+/**
+ * A macro invocation (macro expansion).
+ */
+class MacroInvocation extends MacroAccess {
+ MacroInvocation() {
+ macroinvocations(this,_,_,1)
+ }
+
+ /**
+ * Gets an element that occurs in this macro invocation or a nested macro
+ * invocation.
+ */
+ Locatable getAnExpandedElement() { inmacroexpansion(result,this) }
+
+ /**
+ * Gets an element that is (partially) affected by a macro
+ * invocation. This is a superset of the set of expanded elements and
+ * includes elements that are not completely enclosed by the expansion as
+ * well.
+ */
+ Locatable getAnAffectedElement() {
+ inmacroexpansion(result,this) or macrolocationbind(this, result.getLocation())
+ }
+
+ /**
+ * Gets an element that is either completely in the macro expansion, or
+ * (if it is a statement) 'almost' in the macro expansion (for instance
+ * up to a trailing semicolon). Useful for common patterns in which
+ * macros are almost syntactically complete elements but not quite.
+ */
+ Locatable getAGeneratedElement() {
+ result = this.getAnExpandedElement() or
+ result.(Stmt).getGeneratingMacro() = this
+ }
+
+ Function getEnclosingFunction() {
+ result = this.getAnAffectedElement().(Expr).getEnclosingFunction()
+ }
+
+ /**
+ * Gets the top-level expression associated with this macro invocation,
+ * if any. Note that this predicate will fail if the top-level expanded
+ * element is a statement rather than an expression.
+ */
+ Expr getExpr() {
+ result = getAnExpandedElement() and
+ not (result.getParent() = getAnExpandedElement())
+ }
+
+ /**
+ * Gets the top-level statement associated with this macro invocation, if
+ * any. Note that this predicate will fail if the top-level expanded
+ * element is an expression rather than a statement.
+ */
+ Stmt getStmt() {
+ result = getAnExpandedElement() and
+ not (result.getParent() = getAnExpandedElement())
+ }
+
+ /**
+ * Gets the `i`th _unexpanded_ argument of this macro invocation, where the
+ * first argument has `i = 0`. The result has been expanded for macro
+ * parameters but _not_ for macro invocations. This means that for macro
+ * invocations not inside a `#define`, which can have no macro parameters in
+ * their arguments, the result is equivalent to what is in the source text,
+ * modulo whitespace.
+ *
+ * In the following code example, the argument of the outermost invocation is
+ * `ID(1)` in unexpanded form and `1` in expanded form.
+ *
+ * ```
+ * #define ID(x) x
+ * ID(ID(1))
+ * ```
+ *
+ * In the following example code, the last line contains an invocation of
+ * macro `A` and a child invocation of macro `ID`. The argument to `ID` is
+ * `1` in both unexpanded and expanded form because macro parameters (here,
+ * `x`) are expanded in both cases.
+ *
+ * ```
+ * #define ID(x) x
+ * #define A(x) ID(x)
+ * A(1)
+ * ```
+ *
+ * The `...` parameter in variadic macros counts as one parameter that always
+ * receives one argument, which may contain commas.
+ *
+ * Use `getExpandedArgument` to get the expanded form.
+ */
+ string getUnexpandedArgument(int i) {
+ macro_argument_unexpanded(this, i, result)
+ }
+
+ /**
+ * Gets the `i`th _expanded_ argument of this macro invocation, where the
+ * first argument has `i = 0`. The result has been expanded for macros _and_
+ * macro parameters. If the macro definition does not use this argument, the
+ * extractor will avoid computing the expanded form for efficiency, and the
+ * result will be "".
+ *
+ * See the documentation of `getUnexpandedArgument` for examples of the
+ * differences between expanded and unexpanded arguments.
+ */
+ string getExpandedArgument(int i) {
+ macro_argument_expanded(this, i, result)
+ }
+}
+
+/**
+ * A top-level expression generated by a macro invocation.
+ */
+class MacroInvocationExpr extends Expr {
+ MacroInvocationExpr() {
+ exists(MacroInvocation i | this = i.getExpr())
+ }
+
+ /**
+ * Gets the macro invocation of which this is the top-level expression.
+ */
+ MacroInvocation getInvocation() {
+ result.getExpr() = this
+ }
+
+ /** Gets the name of the invoked macro. */
+ string getMacroName() {
+ result = getInvocation().getMacroName()
+ }
+}
+
+/**
+ * A top-level statement generated by a macro invocation.
+ */
+class MacroInvocationStmt extends Stmt {
+ MacroInvocationStmt() {
+ exists(MacroInvocation i | this = i.getStmt())
+ }
+
+ /**
+ * Gets the macro invocation of which this is the top-level statement.
+ */
+ MacroInvocation getInvocation() {
+ result.getStmt() = this
+ }
+
+ /** Gets the name of the invoked macro. */
+ string getMacroName() {
+ result = getInvocation().getMacroName()
+ }
+}
+
+/** Holds if `l` is the location of a macro. */
+predicate macroLocation(Location l) {
+ macrolocationbind(_, l)
+}
+
+/** Holds if `element` is in the expansion of a macro. */
+predicate inMacroExpansion(Locatable element) {
+ inmacroexpansion(element,_) or
+ (macroLocation(element.getLocation()) and
+ not topLevelMacroAccess(element))
+}
+
+/**
+ * Holds if `ma` is a `MacroAccess` that is not nested inside another
+ * macro invocation.
+ */
+private predicate topLevelMacroAccess(MacroAccess ma) {
+ not exists(ma.getParentInvocation())
+}
+
+/**
+ * Holds if `element` is in the expansion of a macro from
+ * a system header.
+ */
+predicate inSystemMacroExpansion(Locatable element) {
+ exists (MacroInvocation m
+ | element = m.getAnExpandedElement() and
+ not exists (m.getMacro().getLocation().getFile().getRelativePath()))
+}
+
+/** Holds if `element` is affected by a macro. */
+predicate affectedByMacro(Locatable element) {
+ inMacroExpansion(element) or
+ affectedbymacroexpansion(element,_)
+}
+
+/** Holds if there is a macro invocation on line `line` of file `f`. */
+predicate macroLine(File f, int line) {
+ exists(MacroInvocation mi, Location l |
+ l = mi.getLocation() and
+ l.getFile() = f and
+ (l.getStartLine() = line or l.getEndLine() = line)
+ )
+}
+
+/** Holds if there might be a macro invocation at location `l`. */
+predicate possibleMacroLocation(Location l) {
+ macroLine(l.getFile(), l.getStartLine()) or
+ macroLine(l.getFile(), l.getEndLine())
+}
diff --git a/cpp/ql/src/semmle/code/cpp/Member.qll b/cpp/ql/src/semmle/code/cpp/Member.qll
new file mode 100644
index 000000000000..92769486ae98
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/Member.qll
@@ -0,0 +1,2 @@
+import semmle.code.cpp.Element
+import semmle.code.cpp.Type
diff --git a/cpp/ql/src/semmle/code/cpp/NameQualifiers.qll b/cpp/ql/src/semmle/code/cpp/NameQualifiers.qll
new file mode 100644
index 000000000000..f44e6e42d4c5
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/NameQualifiers.qll
@@ -0,0 +1,126 @@
+import cpp
+
+/**
+ * A C++ name qualifier, for example `N::`.
+ */
+class NameQualifier extends NameQualifiableElement, @namequalifier {
+ /**
+ * Gets the expression ultimately qualified by the chain of name
+ * qualifiers. For example, `f()` in `N1::N2::f()`.
+ */
+ Expr getExpr() {
+ result = getQualifiedElement+()
+ }
+
+ /** Gets a location for this name qualifier. */
+ override Location getLocation() {
+ namequalifiers(this,_,_,result)
+ }
+
+ /**
+ * Gets the name qualifier that qualifies this name qualifier, if any.
+ * This is used for name qualifier chains, for example the name qualifier
+ * `N2::` has a name qualifier `N1::` in the chain `N1::N2::f()`.
+ */
+ override NameQualifier getNameQualifier() {
+ namequalifiers(result,this,_,_)
+ }
+
+ /**
+ * Gets the element qualified by this name qualifier. For example, `f()`
+ * in `N::f()`.
+ */
+ NameQualifiableElement getQualifiedElement() {
+ namequalifiers(this,result,_,_)
+ }
+
+ /**
+ * Gets the qualifying element of this name qualifier. For example, `N`
+ * in `N::f()`.
+ */
+ NameQualifyingElement getQualifyingElement() {
+ exists (NameQualifyingElement nqe
+ | namequalifiers(this,_,nqe,_) and
+ if nqe instanceof SpecialNameQualifyingElement
+ then (exists (Access a
+ | a = getQualifiedElement() and
+ result = a.getTarget().getDeclaringType())
+ or
+ exists (FunctionCall c
+ | c = getQualifiedElement() and
+ result = c.getTarget().getDeclaringType()))
+ else result = nqe)
+ }
+
+ override string toString() {
+ exists (NameQualifyingElement nqe
+ | namequalifiers(this,_,nqe,_)
+ and result = nqe.getName() + "::")
+ }
+}
+
+/**
+ * A C++ element that can be qualified with a name. This is in practice
+ * either an expression or a name qualifier. For instance, in
+ * `N1::N2::f()`, there are two name-qualifiable elements: the expression
+ * `f()` and the name qualifier `N2::`. The former is qualified by `N2` and
+ * the latter is qualified by `N1`.
+ */
+class NameQualifiableElement extends Element, @namequalifiableelement {
+ /** Gets the name qualifier associated with this element. */
+ NameQualifier getNameQualifier() {
+ namequalifiers(result,this,_,_)
+ }
+
+ /**
+ * Holds if this element has a globally qualified name. For example,
+ * `::x` is globally qualified. It is used to refer to `x` in the global
+ * namespace.
+ */
+ predicate hasGlobalQualifiedName() {
+ getNameQualifier*().getQualifyingElement() instanceof GlobalNamespace
+ }
+
+ /**
+ * Holds if this element has a `__super`-qualified name. For example:
+ * `__super::get()`. Note: `__super` is non-standard C++ extension, only
+ * supported by some C++ compilers.
+ */
+ predicate hasSuperQualifiedName() {
+ exists(NameQualifier nq, SpecialNameQualifyingElement snqe |
+ nq = getNameQualifier*()
+ and namequalifiers(nq,_,snqe,_)
+ and snqe.getName() = "__super"
+ )
+ }
+}
+
+/**
+ * A C++ element that can qualify a name. For example, `N` in `N::f()`. A
+ * name-qualifying element is either a namespace or a user-defined type.
+ */
+class NameQualifyingElement extends Element, @namequalifyingelement {
+ /**
+ * Gets a name qualifier for which this is the qualifying namespace or
+ * user-defined type. For example: class `X` is the
+ * `NameQualifyingElement` and `X::` is the `NameQualifier`.
+ */
+ NameQualifier getANameQualifier() {
+ namequalifiers(result,_,this,_)
+ }
+
+ /** Gets the name of this namespace or user-defined type. */
+ string getName() {
+ none()
+ }
+}
+
+/**
+ * A special name-qualifying element. For example: `__super`.
+ */
+library class SpecialNameQualifyingElement extends NameQualifyingElement, @specialnamequalifyingelement {
+ /** Gets the name of this special qualifying element. */
+ override string getName() {
+ specialnamequalifyingelements(this,result)
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/Namespace.qll b/cpp/ql/src/semmle/code/cpp/Namespace.qll
new file mode 100644
index 000000000000..0b84ba288297
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/Namespace.qll
@@ -0,0 +1,237 @@
+import semmle.code.cpp.Element
+import semmle.code.cpp.Type
+import semmle.code.cpp.metrics.MetricNamespace
+
+/**
+ * A C++ namespace.
+ *
+ * Note that namespaces are somewhat nebulous entities, as they do not in
+ * general have a single well-defined location in the source code. The
+ * related notion of a `NamespaceDeclarationEntry` is rather more concrete,
+ * and should be used when a location is required. For example, the `std::`
+ * namespace is particularly nebulous, as parts of it are defined across a
+ * wide range of headers. As a more extreme example, the global namespace
+ * is never explicitly declared, but might correspond to a large proportion
+ * of the source code.
+ */
+class Namespace extends NameQualifyingElement, @namespace {
+
+ /**
+ * Gets the location of the namespace. Most namespaces do not have a
+ * single well-defined source location, so a dummy location is returned,
+ * unless the namespace has exactly one declaration entry.
+ */
+ override Location getLocation() {
+ if strictcount(getADeclarationEntry()) = 1 then
+ result = getADeclarationEntry().getLocation()
+ else
+ (
+ result instanceof UnknownDefaultLocation
+ )
+ }
+
+ /** Gets the simple name of this namespace. */
+ override string getName() { namespaces(this,result) }
+
+ /** Holds if this element is named `name`. */
+ predicate hasName(string name) { name = this.getName() }
+
+ /** Holds if the namespace is anonymous. */
+ predicate isAnonymous() {
+ hasName("(unnamed namespace)")
+ }
+
+ /** Gets the name of the parent namespace, if it exists. */
+ private string getParentName() {
+ result = this.getParentNamespace().getName() and
+ result != ""
+ }
+
+ /** Gets the qualified name of this namespace. For example: `a::b`. */
+ string getQualifiedName() {
+ if exists (getParentName())
+ then result = getParentNamespace().getQualifiedName() + "::" + getName()
+ else result = getName()
+ }
+
+ /** Gets the parent namespace, if any. */
+ Namespace getParentNamespace() {
+ namespacembrs(result,this) or
+ (not namespacembrs(_, this) and result instanceof GlobalNamespace)
+ }
+
+ /** Gets a child declaration of this namespace. */
+ Declaration getADeclaration() { namespacembrs(this,result) }
+
+ /** Gets a child namespace of this namespace. */
+ Namespace getAChildNamespace() { namespacembrs(this,result) }
+
+ /** Holds if this namespace may be from source. */
+ override predicate fromSource() { this.getADeclaration().fromSource() }
+
+ /**
+ * Holds if this namespace is in a library.
+ *
+ * DEPRECATED: never holds.
+ */
+ deprecated override
+ predicate fromLibrary() { not this.fromSource() }
+
+ /** Gets the metric namespace. */
+ MetricNamespace getMetrics() { result = this }
+
+ override string toString() { result = this.getQualifiedName() }
+
+ /** Gets a declaration of (part of) this namespace. */
+ NamespaceDeclarationEntry getADeclarationEntry() {
+ result.getNamespace() = this
+ }
+
+ /** Gets a file which declares (part of) this namespace. */
+ File getAFile() {
+ result = this.getADeclarationEntry().getLocation().getFile()
+ }
+
+}
+
+/**
+ * A declaration of (part of) a C++ namespace.
+ *
+ * This corresponds to a single `namespace N { ... }` occurrence in the
+ * source code.
+ */
+class NamespaceDeclarationEntry extends Locatable, @namespace_decl {
+ /**
+ * Get the namespace that this declaration entry corresponds to. There
+ * is a one-to-many relationship between `Namespace` and
+ * `NamespaceDeclarationEntry`.
+ */
+ Namespace getNamespace() { namespace_decls(this,result,_,_) }
+
+ override string toString() { result = this.getNamespace().toString() }
+
+ /**
+ * Gets the location of the token preceding the namespace declaration
+ * entry's body.
+ *
+ * For named declarations, such as "namespace MyStuff { ... }", this will
+ * give the "MyStuff" token.
+ *
+ * For anonymous declarations, such as "namespace { ... }", this will
+ * give the "namespace" token.
+ */
+ override Location getLocation() { namespace_decls(this,_,result,_) }
+
+ /**
+ * Gets the location of the namespace declaration entry's body. For
+ * example: the "{ ... }" in "namespace N { ... }".
+ */
+ Location getBodyLocation() { namespace_decls(this,_,_,result) }
+}
+
+/**
+ * A C++ `using` directive or `using` declaration.
+ */
+abstract class UsingEntry extends Locatable, @using {
+ override Location getLocation() { usings(this,_,result) }
+}
+
+/**
+ * A C++ `using` declaration. For example:
+ *
+ * `using std::string;`
+ */
+class UsingDeclarationEntry extends UsingEntry {
+ UsingDeclarationEntry() { not exists(Namespace n | usings(this,n,_)) }
+
+ /**
+ * Gets the declaration that is referenced by this using declaration. For
+ * example, `std::string` in `using std::string`.
+ */
+ Declaration getDeclaration() { usings(this,result,_) }
+
+ override string toString() {
+ result = "using " + this.getDeclaration().toString()
+ }
+}
+
+/**
+ * A C++ `using` directive. For example:
+ *
+ * `using namespace std;`
+ */
+class UsingDirectiveEntry extends UsingEntry {
+ UsingDirectiveEntry() { exists(Namespace n | usings(this,n,_)) }
+
+ /**
+ * Gets the namespace that is referenced by this using directive. For
+ * example, `std` in `using namespace std`.
+ */
+ Namespace getNamespace() { usings(this,result,_) }
+
+ override string toString() {
+ result = "using namespace " + this.getNamespace().toString()
+ }
+}
+
+/**
+ * Holds if `g` is an instance of `GlobalNamespace`. This predicate
+ * is used suppress a warning in `GlobalNamespace.getADeclaration()`
+ * by providing a fake use of `this`.
+ */
+private predicate suppressWarningForUnused(GlobalNamespace g) { any() }
+
+/**
+ * The C/C++ global namespace.
+ */
+class GlobalNamespace extends Namespace {
+
+ GlobalNamespace() { this.hasName("") }
+
+ override Declaration getADeclaration() {
+ suppressWarningForUnused(this) and
+ not exists(DeclStmt d |
+ d.getADeclaration() = result and
+ not result instanceof Function
+ ) and
+ not exists(ConditionDeclExpr cde | cde.getVariable() = result) and
+ not exists(Enum e | e.getAnEnumConstant() = result) and
+ not result instanceof Parameter and
+ not result instanceof ProxyClass and
+ not result instanceof TemplateParameter and
+ not result instanceof LocalVariable and
+ not namespacembrs(_, result) and
+ not result.isMember()
+ }
+
+ /** Gets a child namespace of the global namespace. */
+ override Namespace getAChildNamespace() {
+ suppressWarningForUnused(this) and
+ not (namespacembrs(result, _))
+ }
+
+ override Namespace getParentNamespace() {
+ none()
+ }
+
+ /**
+ * DEPRECATED: use `getName()`.
+ */
+ deprecated string getFullName() {
+ result = this.getName()
+ }
+
+ override string toString() {
+ result = "(global namespace)"
+ }
+
+}
+
+/**
+ * The C++ `std::` namespace.
+ */
+class StdNamespace extends Namespace {
+ StdNamespace() {
+ this.hasName("std") and this.getParentNamespace() instanceof GlobalNamespace
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ObjectiveC.qll b/cpp/ql/src/semmle/code/cpp/ObjectiveC.qll
new file mode 100644
index 000000000000..f168e551faa2
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ObjectiveC.qll
@@ -0,0 +1,192 @@
+import semmle.code.cpp.Class
+private import semmle.code.cpp.internal.Type
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C class.
+ */
+deprecated class ObjectiveClass extends Class {
+ ObjectiveClass() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C protocol.
+ */
+deprecated class Protocol extends Class {
+ Protocol() { none() }
+
+ /**
+ * Holds if the type implements the protocol, either because the type
+ * itself does, or because it is a type conforming to the protocol.
+ */
+ predicate isImplementedBy(Type t) { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * A type which conforms to a protocol. Use `getAProtocol` to get a
+ * protocol that this type conforms to.
+ */
+deprecated class TypeConformingToProtocol extends DerivedType {
+ TypeConformingToProtocol() { none() }
+
+ /** Gets a protocol that this type conforms to. */
+ Protocol getAProtocol() { none() }
+
+ /** Gets the size of this type. */
+ override int getSize() { none() }
+
+ override int getAlignment() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C `@autoreleasepool` statement, for example
+ * `@autoreleasepool { int x; int y; }`.
+ */
+deprecated class AutoReleasePoolStmt extends Stmt {
+ AutoReleasePoolStmt() { none() }
+
+ override string toString() { none() }
+
+ /** Gets the body statement of this `@autoreleasepool` statement. */
+ Stmt getStmt() { none() }
+
+ override predicate mayBeImpure() { none() }
+
+ override predicate mayBeGloballyImpure() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C `@synchronized statement`, for example
+ * `@synchronized (x) { [x complicationOperation]; }`.
+ */
+deprecated class SynchronizedStmt extends Stmt {
+ SynchronizedStmt() { none() }
+
+ override string toString() { none() }
+
+ /** Gets the expression which gives the object to be locked. */
+ Expr getLockedObject() { none() }
+
+ /** Gets the body statement of this `@synchronized` statement. */
+ Stmt getStmt() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C for-in statement.
+ */
+deprecated class ForInStmt extends Loop {
+ ForInStmt() { none() }
+
+ /**
+ * Gets the condition expression of the `while` statement that the
+ * `for...in` statement desugars into.
+ */
+ override Expr getCondition() { none() }
+
+ override Expr getControllingExpr() { none() }
+
+ /** Gets the collection that the loop iterates over. */
+ Expr getCollection() { none() }
+
+ /** Gets the body of the loop. */
+ override Stmt getStmt() { none() }
+
+ override string toString() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C category or class extension.
+ */
+deprecated class Category extends Class {
+ Category() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C class extension.
+ */
+deprecated class ClassExtension extends Category {
+ ClassExtension() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C try statement.
+ */
+deprecated class ObjcTryStmt extends TryStmt {
+ ObjcTryStmt() { none() }
+
+ override string toString() { none() }
+
+ /** Gets the finally clause of this try statement, if any. */
+ FinallyBlock getFinallyClause() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C `@finally` block.
+ */
+deprecated class FinallyBlock extends Block {
+ FinallyBlock() { none() }
+
+ /** Gets the try statement corresponding to this finally block. */
+ ObjcTryStmt getTryStmt() {
+ none()
+ }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C `@property`.
+ */
+deprecated class Property extends Declaration {
+ Property() { none() }
+
+ /** Gets the name of this property. */
+ override string getName() { none() }
+
+ /**
+ * Gets nothing (provided for compatibility with Declaration).
+ *
+ * For the attribute list following the `@property` keyword, use
+ * `getAnAttribute()`.
+ */
+ override Specifier getASpecifier() { none() }
+
+ /**
+ * Gets an attribute of this property (such as `readonly`, `nonatomic`,
+ * or `getter=isEnabled`).
+ */
+ Attribute getAnAttribute() { none() }
+
+ override Location getADeclarationLocation() { result = getLocation() }
+ override Location getDefinitionLocation() { result = getLocation() }
+ override Location getLocation() { none() }
+
+ /** Gets the type of this property. */
+ Type getType() { none() }
+
+ /**
+ * Gets the instance method which is called to get the value of this
+ * property.
+ */
+ MemberFunction getGetter() { none() }
+
+ /**
+ * Gets the instance method which is called to set the value of this
+ * property (if it is a writable property).
+ */
+ MemberFunction getSetter() { none() }
+
+ /**
+ * Gets the instance variable which stores the property value (if this
+ * property was explicitly or automatically `@synthesize`d).
+ */
+ MemberVariable getInstanceVariable() { none() }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/PODType03.qll b/cpp/ql/src/semmle/code/cpp/PODType03.qll
new file mode 100644
index 000000000000..5b47f80af979
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/PODType03.qll
@@ -0,0 +1,112 @@
+/**
+ * Provides predicates to determine whether a type is an aggregate or POD
+ * (Plain Old Data), as defined by C++03.
+ */
+
+import cpp
+
+/**
+ * Holds if `t` is a scalar type, according to the rules specified in
+ * C++03 3.9(10):
+ *
+ * Arithmetic types (3.9.1), enumeration types, pointer types, and
+ * pointer to member types (3.9.2), and cv-qualified versions of these
+ * types (3.9.3) are collectively called scalar types.
+ */
+predicate isScalarType03(Type t) {
+ exists (Type ut
+ | ut = t.getUnderlyingType()
+ | ut instanceof ArithmeticType or
+ ut instanceof Enum or
+ ut instanceof FunctionPointerType or
+ ut instanceof PointerToMemberType or
+ ut instanceof PointerType or
+ isScalarType03(ut.(SpecifiedType).getUnspecifiedType()))
+}
+
+/**
+ * Holds if `c` is an aggregate class, according to the rules specified in
+ * C++03 8.5.1(1):
+ *
+ * An aggregate [class] is ... a class (clause 9) with no user-declared
+ * constructors (12.1), no private or protected non-static data members
+ * (clause 11), no base classes (clause 10), and no virtual functions
+ * (10.3).
+ */
+predicate isAggregateClass03(Class c) {
+ not (c instanceof TemplateClass) and
+ not exists (Constructor cons
+ | cons.getDeclaringType() = c and
+ not cons.isCompilerGenerated()) and
+ not exists (Variable v
+ | v.getDeclaringType() = c and
+ not v.isStatic()
+ | v.hasSpecifier("private") or
+ v.hasSpecifier("protected")) and
+ not exists (c.getABaseClass()) and
+ not exists (VirtualFunction f
+ | f.getDeclaringType() = c)
+}
+
+/**
+ * Holds if `t` is an aggregate type, according to the rules specified in
+ * C++03 8.5.1(1):
+ *
+ * An aggregate is an array or a class (clause 9) with no user-declared
+ * constructors (12.1), no private or protected non-static data members
+ * (clause 11), no base classes (clause 10), and no virtual functions
+ * (10.3).
+ */
+predicate isAggregateType03(Type t) {
+ exists (Type ut
+ | ut = t.getUnderlyingType()
+ | ut instanceof ArrayType or
+ isAggregateClass03(ut))
+}
+
+/**
+ * Holds if `c` is a POD class, according to the rules specified in
+ * C++03 9(4):
+ *
+ * A POD-struct is an aggregate class that has no non-static data members
+ * of type non-POD-struct, non-POD-union (or array of such types) or
+ * reference, and has no user-defined copy assignment operator and no
+ * user-defined destructor. Similarly, a POD-union is an aggregate union
+ * that has no non-static data members of type non-POD-struct,
+ * non-POD-union (or array of such types) or reference, and has no
+ * user-defined copy assignment operator and no user-defined destructor.
+ * A POD class is a class that is either a POD-struct or a POD-union.
+ */
+predicate isPODClass03(Class c) {
+ isAggregateClass03(c) and
+ not exists (Variable v
+ | v.getDeclaringType() = c and
+ not v.isStatic()
+ | not isPODType03(v.getType()) or
+ exists (ArrayType at
+ | at = v.getType() and
+ not isPODType03(at.getBaseType())) or
+ v.getType() instanceof ReferenceType) and
+ not exists (CopyAssignmentOperator o | o.getDeclaringType() = c and
+ not o.isCompilerGenerated()) and
+ not exists (Destructor dest | dest.getDeclaringType() = c and
+ not dest.isCompilerGenerated())
+}
+
+/**
+ * Holds if `t` is a POD type, according to the rules specified in
+ * C++03 3.9(10):
+ *
+ * Scalar types, POD-struct types, POD-union types (clause 9), arrays of
+ * such types and cv-qualified versions of these types (3.9.3) are
+ * collectively called POD types.
+ */
+predicate isPODType03(Type t)
+{
+ exists (Type ut
+ | ut = t.getUnderlyingType()
+ | isScalarType03(ut) or
+ isPODClass03(ut) or
+ exists (ArrayType at | at = ut and isPODType03(at.getBaseType())) or
+ isPODType03(ut.(SpecifiedType).getUnspecifiedType()))
+}
diff --git a/cpp/ql/src/semmle/code/cpp/Parameter.qll b/cpp/ql/src/semmle/code/cpp/Parameter.qll
new file mode 100644
index 000000000000..7653a60344b9
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/Parameter.qll
@@ -0,0 +1,143 @@
+import semmle.code.cpp.Location
+import semmle.code.cpp.Declaration
+private import semmle.code.cpp.internal.Type
+
+/**
+ * A C/C++ function parameter or catch block parameter.
+ *
+ * For catch block parameters, there is a one-to-one correspondence between
+ * the `Parameter` and its `ParameterDeclarationEntry`.
+ *
+ * For function parameters, there is a one-to-many relationship between
+ * `Parameter` and `ParameterDeclarationEntry`, because one function can
+ * have multiple declarations.
+ */
+class Parameter extends LocalScopeVariable, @parameter {
+
+ /**
+ * Gets the canonical name, or names, of this parameter.
+ *
+ * The canonical names are the first non-empty category from the
+ * following list:
+ * 1. The name given to the parameter at the function's definition or
+ * (for catch block parameters) at the catch block.
+ * 2. A name given to the parameter at a function declaration.
+ * 3. The name "p#i" where i is the index of the parameter.
+ */
+ override string getName() {
+ exists (VariableDeclarationEntry vde
+ | vde = getANamedDeclarationEntry() and result = vde.getName()
+ | vde.isDefinition() or not getANamedDeclarationEntry().isDefinition())
+ or
+ (not exists(getANamedDeclarationEntry()) and
+ result = "p#" + this.getIndex().toString())
+ }
+
+ /**
+ * Gets the name of this parameter, including it's type.
+ *
+ * For example: `int p`.
+ */
+ string getTypedName() {
+ exists (string typeString, string nameString
+ | (if exists(getType().getName())
+ then typeString = getType().getName()
+ else typeString = "")
+ and
+ (if exists(getName())
+ then nameString = getName()
+ else nameString = "")
+ and
+ (if typeString != "" and nameString != ""
+ then result = typeString + " " + nameString
+ else result = typeString + nameString))
+ }
+
+ private VariableDeclarationEntry getANamedDeclarationEntry() {
+ result = getAnEffectiveDeclarationEntry() and result.getName() != ""
+ }
+
+ /**
+ * Gets a declaration entry corresponding to this declaration.
+ *
+ * This predicate is the same as getADeclarationEntry(), except that for
+ * parameters of instantiated function templates, gives the declaration
+ * entry of the prototype instantiation of the parameter (as
+ * non-prototype instantiations don't have declaration entries of their
+ * own).
+ */
+ private VariableDeclarationEntry getAnEffectiveDeclarationEntry() {
+ if getFunction().isConstructedFrom(_)
+ then exists (Parameter prototype
+ | prototype = result.getVariable() and
+ prototype.getIndex() = getIndex() and
+ getFunction().isConstructedFrom(prototype.getFunction()))
+ else result = getADeclarationEntry()
+ }
+
+ /**
+ * Gets the name of this parameter in the given block (which should be
+ * the body of a function with which the parameter is associated).
+ *
+ * DEPRECATED: this method was used in a previous implementation of
+ * getName, but is no longer in use.
+ */
+ deprecated string getNameInBlock(Block b) {
+ exists (ParameterDeclarationEntry pde
+ | pde.getFunctionDeclarationEntry().getBlock() = b and
+ this.getFunction().getBlock() = b and
+ pde.getVariable() = this and
+ result = pde.getName())
+ }
+
+ /**
+ * Holds if this parameter has a name.
+ *
+ * In other words, this predicate holds precisely when the result of
+ * `getName()` is not "p#i" (where `i` is the index of the parameter).
+ */
+ predicate isNamed() { exists(getANamedDeclarationEntry()) }
+
+ /**
+ * Gets the function to which this parameter belongs, if it is a function
+ * parameter.
+ */
+ override Function getFunction() { params(this,result,_,_) }
+
+ /**
+ * Gets the catch block to which this parameter belongs, if it is a catch
+ * block parameter.
+ */
+ Block getCatchBlock() { params(this,result,_,_) }
+
+ /**
+ * Gets the zero-based index of this parameter.
+ *
+ * For catch block parameters, this is always zero.
+ */
+ int getIndex() { params(this,_,result,_) }
+
+ /**
+ * Gets the type of this parameter.
+ *
+ * Function parameters of array type are a special case in C/C++,
+ * as they are syntactic sugar for parameters of pointer type. The
+ * result is an array type for such parameters.
+ */
+ override Type getType() { params(this,_,_,unresolve(result)) }
+
+ /**
+ * Gets the canonical location, or locations, of this parameter.
+ *
+ * 1. For catch block parameters, gets the obvious location.
+ * 2. For parameters of functions which have a definition, gets the
+ * location within the function definition.
+ * 3. For parameters of functions which don't have a definition, gets all
+ * of the declaration locations.
+ */
+ override Location getLocation() {
+ exists(VariableDeclarationEntry vde | vde = getAnEffectiveDeclarationEntry() and result = vde.getLocation() |
+ vde.isDefinition() or not getAnEffectiveDeclarationEntry().isDefinition()
+ )
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/Preprocessor.qll b/cpp/ql/src/semmle/code/cpp/Preprocessor.qll
new file mode 100644
index 000000000000..751a37baa916
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/Preprocessor.qll
@@ -0,0 +1,223 @@
+import semmle.code.cpp.Location
+import semmle.code.cpp.Element
+
+/**
+ * A C/C++ preprocessor directive.
+ *
+ * For example: `#ifdef`, `#line`, or `#pragma`.
+ */
+class PreprocessorDirective extends Locatable, @preprocdirect {
+ override string toString() { result = "Preprocessor directive" }
+ override Location getLocation() { preprocdirects(this,_,result) }
+ string getHead() { preproctext(this,result,_) }
+
+ /**
+ * Gets a preprocessor branching directive whose condition affects
+ * whether this directive is performed.
+ *
+ * From a lexical point of view, this returns all `#if`, `#ifdef`,
+ * `#ifndef`, or `#elif` directives which occur before this directive and
+ * have a matching `#endif` which occurs after this directive.
+ */
+ PreprocessorBranch getAGuard() {
+ exists(PreprocessorEndif e, int line |
+ result.getEndIf() = e and
+ e.getFile() = getFile() and
+ result.getFile() = getFile() and
+ line = this.getLocation().getStartLine() and
+ result.getLocation().getStartLine() < line and
+ line < e.getLocation().getEndLine()
+ )
+ }
+}
+
+/**
+ * A C/C++ preprocessor branch related directive: `#if`, `#ifdef`,
+ * `#ifndef`, `#elif`, `#else` or `#endif`.
+ */
+abstract class PreprocessorBranchDirective extends PreprocessorDirective {
+ /**
+ * Gets the `#if`, `#ifdef` or `#ifndef` directive which matches this
+ * branching directive.
+ *
+ * If this branch directive was unbalanced, then there will be no
+ * result. Conversely, if the branch matches different `#if` directives
+ * in different translation units, then there can be more than one
+ * result.
+ */
+ PreprocessorBranch getIf() {
+ result = (PreprocessorIf)this or
+ result = (PreprocessorIfdef)this or
+ result = (PreprocessorIfndef)this or
+ preprocpair(result, this)
+ }
+
+ /**
+ * Gets the `#endif` directive which matches this branching directive.
+ *
+ * If this branch directive was unbalanced, then there will be no
+ * result. Conversely, if the branch matched different `#endif`
+ * directives in different translation units, then there can be more than
+ * one result.
+ */
+ PreprocessorEndif getEndIf() {
+ preprocpair(getIf(), result)
+ }
+
+ /**
+ * Gets the next `#elif`, `#else` or `#endif` matching this branching
+ * directive.
+ *
+ * For example `somePreprocessorBranchDirective.getIf().getNext()` gets
+ * the second directive in the same construct as
+ * `somePreprocessorBranchDirective`.
+ */
+ PreprocessorBranchDirective getNext() {
+ getIf() = result.getIf() and
+ getLocation().getStartLine() < result.getLocation().getStartLine() and
+ not exists(PreprocessorBranchDirective other |
+ getIf() = other.getIf() and
+ getLocation().getStartLine() < other.getLocation().getStartLine() and
+ other.getLocation().getStartLine() < result.getLocation().getStartLine()
+ )
+ }
+}
+
+/**
+ * A C/C++ preprocessor branching directive: `#if`, `#ifdef`, `#ifndef`, or
+ * `#elif`.
+ *
+ * A branching directive can have its condition evaluated at compile-time,
+ * and as a result, the preprocessor will either take the branch, or not
+ * take the branch.
+ *
+ * However, there are also situations in which a branch's condition isn't
+ * evaluated. The obvious case of this is when the directive is contained
+ * within a branch which wasn't taken. There is also a much more subtle
+ * case involving header guard branches: suitably clever compilers can
+ * notice that a branch is a header guard, and can then subsequently ignore
+ * a `#include` for the file being guarded. It is for this reason that
+ * `wasTaken()` always holds on header guard branches, but `wasNotToken()`
+ * rarely holds on header guard branches.
+ */
+class PreprocessorBranch extends PreprocessorBranchDirective, @ppd_branch {
+ /**
+ * Holds if at least one translation unit evaluated this directive's
+ * condition and subsequently took the branch.
+ */
+ predicate wasTaken() {
+ preproctrue(this)
+ }
+
+ /**
+ * Holds if at least one translation unit evaluated this directive's
+ * condition but then didn't take the branch.
+ *
+ * If `#else` is the next matching directive, then this means that the
+ * `#else` was taken instead.
+ */
+ predicate wasNotTaken() {
+ preprocfalse(this)
+ }
+
+ /**
+ * Holds if this directive was either taken by all translation units
+ * which evaluated it, or was not taken by any translation unit which
+ * evaluated it.
+ */
+ predicate wasPredictable() {
+ not ( wasTaken() and wasNotTaken() )
+ }
+}
+
+/**
+ * A C/C++ preprocessor `#if` directive.
+ *
+ * For the related notion of a directive which causes branching (which
+ * includes `#if`, plus also `#ifdef`, `#ifndef`, and `#elif`), see
+ * `PreprocessorBranch`.
+ */
+class PreprocessorIf extends PreprocessorBranch, @ppd_if {
+ override string toString() { result = "#if " + this.getHead() }
+}
+
+/**
+ * A C/C++ preprocessor `#ifdef` directive.
+ *
+ * The syntax `#ifdef X` is shorthand for `#if defined(X)`.
+ */
+class PreprocessorIfdef extends PreprocessorBranch, @ppd_ifdef {
+ override string toString() { result = "#ifdef " + this.getHead() }
+}
+
+/**
+ * A C/C++ preprocessor `#ifndef` directive.
+ *
+ * The syntax `#ifndef X` is shorthand for `#if !defined(X)`.
+ */
+class PreprocessorIfndef extends PreprocessorBranch, @ppd_ifndef {
+ override string toString() { result = "#ifndef " + this.getHead() }
+}
+
+/**
+ * A C/C++ preprocessor `#else` directive.
+ */
+class PreprocessorElse extends PreprocessorBranchDirective, @ppd_else {
+ override string toString() { result = "#else" }
+}
+
+/**
+ * A C/C++ preprocessor `#elif` directive.
+ */
+class PreprocessorElif extends PreprocessorBranch, @ppd_elif {
+ override string toString() { result = "#elif " + this.getHead() }
+}
+
+/**
+ * A C/C++ preprocessor `#endif` directive.
+ */
+class PreprocessorEndif extends PreprocessorBranchDirective, @ppd_endif {
+ override string toString() { result = "#endif" }
+}
+
+/**
+ * A C/C++ preprocessor `#warning` directive.
+ */
+class PreprocessorWarning extends PreprocessorDirective, @ppd_warning {
+ override string toString() { result = "#warning " + this.getHead() }
+}
+
+/**
+ * A C/C++ preprocessor `#error` directive.
+ */
+class PreprocessorError extends PreprocessorDirective, @ppd_error {
+ override string toString() { result = "#error " + this.getHead() }
+}
+
+/**
+ * A C/C++ preprocessor `#undef` directive.
+ */
+class PreprocessorUndef extends PreprocessorDirective, @ppd_undef {
+ override string toString() { result = "#undef " + this.getHead() }
+
+ /**
+ * Gets the name of the macro that is undefined.
+ */
+ string getName() {
+ result = getHead()
+ }
+}
+
+/**
+ * A C/C++ preprocessor `#pragma` directive.
+ */
+class PreprocessorPragma extends PreprocessorDirective, @ppd_pragma {
+ override string toString() { result = "#pragma " + this.getHead() }
+}
+
+/**
+ * A C/C++ preprocessor `#line` directive.
+ */
+class PreprocessorLine extends PreprocessorDirective, @ppd_line {
+ override string toString() { result = "#line " + this.getHead() }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/PrintAST.ql b/cpp/ql/src/semmle/code/cpp/PrintAST.ql
new file mode 100644
index 000000000000..78ee141cce90
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/PrintAST.ql
@@ -0,0 +1,8 @@
+/**
+ * @name Print AST
+ * @description Outputs a representation of the Abstract Syntax Tree.
+ * @id cpp/print-ast
+ */
+
+import cpp
+import PrintAST
diff --git a/cpp/ql/src/semmle/code/cpp/PrintAST.qll b/cpp/ql/src/semmle/code/cpp/PrintAST.qll
new file mode 100644
index 000000000000..dccda86c8b0f
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/PrintAST.qll
@@ -0,0 +1,182 @@
+import cpp
+
+private newtype TPrintASTConfiguration = MkPrintASTConfiguration()
+
+class PrintASTConfiguration extends TPrintASTConfiguration {
+ string toString() {
+ result = "PrintASTConfiguration"
+ }
+
+ predicate shouldPrintFunction(Function func) {
+ any()
+ }
+}
+
+private predicate shouldPrintFunction(Function func) {
+ exists(PrintASTConfiguration config |
+ config.shouldPrintFunction(func)
+ )
+}
+
+private Locatable getAChild(Locatable parent) {
+ result = getChild(parent, _)
+}
+
+private Function getEnclosingFunction(Locatable ast) {
+ getAChild*(result) = ast
+}
+
+private int getEntryPointIndex(Function func) {
+ if func instanceof Constructor then
+ result = count(func.(Constructor).getAnInitializer())
+ else
+ result = 0
+}
+
+private Locatable getChild(Locatable parent, int childIndex) {
+ exists(Function func, Stmt entryPoint |
+ parent = func and
+ result = entryPoint and
+ entryPoint = func.getEntryPoint() and
+ childIndex = getEntryPointIndex(func)
+ ) or
+ exists(Function func, Expr childExpr |
+ parent = func and
+ result = childExpr and
+ (
+ childExpr = func.(Constructor).getInitializer(childIndex) or
+ childExpr = func.(Destructor).getDestruction(childIndex - 1)
+ )
+ ) or
+ exists(Stmt parentStmt |
+ parentStmt = parent and
+ (
+ parentStmt.getChild(childIndex).(Expr).getFullyConverted() = result or
+ parentStmt.getChild(childIndex).(Stmt) = result
+ )
+ ) or
+ exists(Expr parentExpr, Expr childExpr |
+ parent = parentExpr and
+ result = childExpr and
+ childExpr = parentExpr.getChild(childIndex).getFullyConverted()
+ ) or
+ exists(Conversion parentConv, Expr childExpr |
+ parent = parentConv and
+ result = childExpr and
+ childExpr = parentConv.getExpr() and
+ childIndex = 0
+ ) or
+ exists(DeclStmt declStmt, DeclarationEntry childEntry |
+ parent = declStmt and
+ result = childEntry and
+ childEntry = declStmt.getDeclarationEntry(childIndex)
+ ) or
+ exists(VariableDeclarationEntry declEntry, Initializer init |
+ parent = declEntry and
+ result = init and
+ init = declEntry.getVariable().getInitializer() and
+ childIndex = 0
+ ) or
+ exists(Initializer init, Expr expr |
+ parent = init and
+ result = expr and
+ expr = init.getExpr().getFullyConverted() and
+ childIndex = 0
+ )
+}
+
+private string getTypeString(Locatable ast) {
+ if ast instanceof Expr then (
+ exists(Expr expr |
+ expr = ast and
+ result = expr.getValueCategoryString() + ": " + expr.getType().toString()
+ )
+ )
+ else if ast instanceof DeclarationEntry then (
+ result = ast.(DeclarationEntry).getType().toString()
+ )
+ else (
+ result = ""
+ )
+}
+
+private string getExtraInfoString(Locatable ast) {
+ if ast instanceof Cast then (
+ result = ast.(Cast).getSemanticConversionString()
+ )
+ else (
+ result = ""
+ )
+}
+
+private string getValueString(Locatable ast) {
+ if exists(ast.(Expr).getValue()) then
+ result = "=" + ast.(Expr).getValue()
+ else
+ result = ""
+}
+
+private Locatable getChildByRank(Locatable parent, int rankIndex) {
+ result = rank[rankIndex + 1](Locatable child, int id |
+ child = getChild(parent, id) |
+ child order by id
+ )
+}
+
+language[monotonicAggregates]
+private int getDescendantCount(Locatable ast) {
+ result = 1 + sum(Locatable child |
+ child = getChildByRank(ast, _) |
+ getDescendantCount(child)
+ )
+}
+
+private Locatable getParent(Locatable ast) {
+ ast = getAChild(result)
+}
+
+private int getUniqueId(Locatable ast) {
+ shouldPrintFunction(getEnclosingFunction(ast)) and
+ if not exists(getParent(ast)) then
+ result = 0
+ else
+ exists(Locatable parent |
+ parent = getParent(ast) and
+ if ast = getChildByRank(parent, 0) then
+ result = 1 + getUniqueId(parent)
+ else
+ exists(int childIndex, Locatable previousChild |
+ ast = getChildByRank(parent, childIndex) and
+ previousChild = getChildByRank(parent, childIndex - 1) and
+ result = getUniqueId(previousChild) +
+ getDescendantCount(previousChild)
+ )
+ )
+}
+
+query predicate printAST(string functionLocation,
+ string function, int nodeId, int parentId, int childIndex, string ast,
+ string extra, string value, string type, string astLocation) {
+ exists(Function func, Locatable astNode |
+ shouldPrintFunction(func) and
+ func = getEnclosingFunction(astNode) and
+ nodeId = getUniqueId(astNode) and
+ if nodeId = 0 then (
+ parentId = -1 and
+ childIndex = 0
+ )
+ else (
+ exists(Locatable parent |
+ astNode = getChild(parent, childIndex) and
+ parentId = getUniqueId(parent)
+ )
+ ) and
+ functionLocation = func.getLocation().toString() and
+ function = func.getFullSignature() and
+ ast = astNode.toString() and
+ extra = getExtraInfoString(astNode) and
+ value = getValueString(astNode) and
+ type = getTypeString(astNode) and
+ astLocation = astNode.getLocation().toString()
+ )
+}
diff --git a/cpp/ql/src/semmle/code/cpp/Specifier.qll b/cpp/ql/src/semmle/code/cpp/Specifier.qll
new file mode 100644
index 000000000000..188dfa418544
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/Specifier.qll
@@ -0,0 +1,310 @@
+import semmle.code.cpp.Element
+private import semmle.code.cpp.internal.Type
+
+/**
+ * A C/C++ specifier: `friend`, `auto`, `register`, `static`, `extern`,
+ * `mutable`, `inline`, `virtual`, or `explicit`.
+ */
+class Specifier extends Element, @specifier {
+
+ /** Gets a dummy location for the specifier. */
+ override Location getLocation() {
+ suppressUnusedThis(this) and
+ result instanceof UnknownDefaultLocation
+ }
+
+ /** Gets the name of this specifier. */
+ string getName() { specifiers(this,result) }
+
+ /** Holds if the name of this specifier is `name`. */
+ predicate hasName(string name) { name = this.getName() }
+
+ override string toString() { result = this.getName() }
+}
+
+/**
+ * A C/C++ function specifier: `inline`, `virtual`, or `explicit`.
+ */
+class FunctionSpecifier extends Specifier {
+ FunctionSpecifier() {
+ this.hasName("inline") or
+ this.hasName("virtual") or
+ this.hasName("explicit")
+ }
+}
+
+/**
+ * A C/C++ storage class specifier: `auto`, `register`, `static`, `extern`,
+ * or `mutable".
+ */
+class StorageClassSpecifier extends Specifier {
+ StorageClassSpecifier() {
+ this.hasName("auto") or
+ this.hasName("register") or
+ this.hasName("static") or
+ this.hasName("extern") or
+ this.hasName("mutable")
+ }
+}
+
+/**
+ * A C++ access specifier: `public`, `protected`, or `private`.
+ */
+class AccessSpecifier extends Specifier {
+ AccessSpecifier() {
+ this.hasName("public") or
+ this.hasName("protected") or
+ this.hasName("private")
+ }
+
+ /**
+ * Gets the visibility of a field with access specifier `this` if it is
+ * directly inherited with access specifier `baseAccess`. For example:
+ *
+ * ```
+ * class A { protected int f; };
+ * class B : private A {};
+ * ```
+ *
+ * In this example, `this` is `protected`, `baseAccess` is `private`, and
+ * `result` is `private` because the visibility of field `f` in class `B`
+ * is `private`.
+ *
+ * This method encodes the rules of N4140 11.2/1, tabulated here:
+ *
+ * ```
+ * `this` | `baseAccess` | `result`
+ * (access in base) | (base class specifier) | (access in derived)
+ * ----------------------------------------------------------
+ * private | private | N/A
+ * private | protected | N/A
+ * private | public | N/A
+ * protected | private | private
+ * protected | protected | protected
+ * protected | public | protected
+ * public | private | private
+ * public | protected | protected
+ * public | public | public
+ * ```
+ */
+ AccessSpecifier accessInDirectDerived(AccessSpecifier baseAccess) {
+ this.getName() != "private" and (
+ // Alphabetically, "private" < "protected" < "public". This disjunction
+ // encodes that `result` is the minimum access of `this` and
+ // `baseAccess`.
+ baseAccess.getName() < this.getName() and result = baseAccess or
+ baseAccess.getName() >= this.getName() and result = this
+ )
+ }
+}
+
+/**
+ * An attribute introduced by GNU's `__attribute__((name))` syntax,
+ * Microsoft's `__declspec(name)` syntax, Microsoft's `[name]` syntax, the
+ * C++11 standard `[[name]]` syntax, or the C++11 `alignas` syntax.
+ */
+class Attribute extends Element, @attribute {
+ /**
+ * Gets the name of this attribute.
+ *
+ * As examples, this is "noreturn" for `__attribute__((__noreturn__))`,
+ * "fallthrough" for `[[clang::fallthrough]]`, and "dllimport" for
+ * `__declspec(dllimport)`.
+ *
+ * Note that the name does not include the namespace. For example, the
+ * name of `[[clang::fallthrough]]` is "fallthrough".
+ */
+ string getName() { attributes(this, _, result, _, _) }
+
+ override Location getLocation() { attributes(this, _, _, _, result) }
+
+ /** Holds if the name of this attribute is `name`. */
+ predicate hasName(string name) { name = this.getName() }
+
+ override string toString() { result = this.getName() }
+
+ /** Gets the `i`th argument of the attribute. */
+ AttributeArgument getArgument(int i) {
+ result.getAttribute() = this and result.getIndex() = i
+ }
+
+ /** Gets an argument of the attribute. */
+ AttributeArgument getAnArgument() {
+ result = getArgument(_)
+ }
+}
+
+/**
+ * An attribute introduced by GNU's `__attribute__((name))` syntax, for
+ * example: `__attribute__((__noreturn__))`.
+ */
+class GnuAttribute extends Attribute, @gnuattribute {
+}
+
+/**
+ * An attribute introduced by the C++11 standard `[[name]]` syntax, for
+ * example: `[[clang::fallthrough]]`.
+ */
+class StdAttribute extends Attribute, @stdattribute {
+ /**
+ * Gets the namespace of this attribute.
+ *
+ * As examples, this is "" for `[[carries_dependency]]`, and "clang" for
+ * `[[clang::fallthrough]]`.
+ */
+ string getNamespace() { attributes(this, _, _, result, _) }
+
+ /**
+ * Holds if this attribute has the given namespace and name.
+ */
+ predicate hasQualifiedName(string namespace, string name) {
+ namespace = getNamespace() and hasName(name)
+ }
+}
+
+/**
+ * An attribute introduced by Microsoft's `__declspec(name)` syntax, for
+ * example: `__declspec(dllimport)`.
+ */
+class Declspec extends Attribute, @declspec {
+}
+
+/**
+ * An attribute introduced by Microsoft's "[name]" syntax, for example "[SA_Pre(Deref=1,Access=SA_Read)]".
+ */
+class MicrosoftAttribute extends Attribute, @msattribute {
+ AttributeArgument getNamedArgument(string name) {
+ result = getAnArgument() and result.getName() = name
+ }
+}
+
+/**
+ * A C++11 `alignas` construct.
+ *
+ * Though it doesn't use the attribute syntax, `alignas(...)` is presented
+ * as an `Attribute` for consistency with the `[[align(...)]]` attribute.
+ */
+class AlignAs extends Attribute, @alignas {
+ override string toString() { result = "alignas(...)" }
+}
+
+/**
+ * A GNU `format` attribute of the form `__attribute__((format(archetype, format-index, first-arg)))`
+ * that declares a function to accept a `printf` style format string.
+ */
+class FormatAttribute extends GnuAttribute {
+ FormatAttribute() {
+ getName() = "format"
+ }
+
+ /**
+ * Gets the archetype of this format attribute, for example
+ * `"printf"`.
+ */
+ string getArchetype() {
+ result = getArgument(0).getValueText()
+ }
+
+ /**
+ * Gets the index in (1-based) format attribute notation associated
+ * with the first argument of the function.
+ */
+ private int firstArgumentNumber() {
+ if exists(MemberFunction f | f.getAnAttribute() = this and not f.isStatic()) then (
+ // 1 is `this`, so the first parameter is 2
+ result = 2
+ ) else (
+ result = 1
+ )
+ }
+
+ /**
+ * Gets the (0-based) index of the format string,
+ * according to this attribute.
+ */
+ int getFormatIndex() {
+ result = getArgument(1).getValueInt() - firstArgumentNumber()
+ }
+
+ /**
+ * Gets the (0-based) index of the first format argument (if any),
+ * according to this attribute.
+ */
+ int getFirstFormatArgIndex() {
+ exists(int val |
+ val = getArgument(2).getValueInt() and
+ result = val - firstArgumentNumber() and
+ not val = 0 // indicates a `vprintf` style format function with arguments not directly available.
+ )
+ }
+}
+
+/**
+ * An argument to an `Attribute`.
+ */
+class AttributeArgument extends Element, @attribute_arg {
+ /**
+ * Gets the name of this argument, if it is a named argument. Named
+ * arguments are a Microsoft feature, so only a `MicrosoftAttribute` can
+ * have a named argument.
+ */
+ string getName() {
+ attribute_arg_name(this, result)
+ }
+
+ /**
+ * Gets the text for the value of this argument, if its value is
+ * a string or a number.
+ */
+ string getValueText() {
+ attribute_arg_value(this, result)
+ }
+
+ /**
+ * Gets the value of this argument, if its value is integral.
+ */
+ int getValueInt() {
+ result = getValueText().toInt()
+ }
+
+ /**
+ * Gets the value of this argument, if its value is a type.
+ */
+ Type getValueType() {
+ attribute_arg_type(this, unresolve(result))
+ }
+
+ /**
+ * Gets the attribute to which this is an argument.
+ */
+ Attribute getAttribute() {
+ attribute_args(this, _, result, _, _)
+ }
+
+ /**
+ * Gets the zero-based index of this argument in the containing
+ * attribute's argument list.
+ */
+ int getIndex() {
+ attribute_args(this, _, _, result, _)
+ }
+
+ override Location getLocation() {
+ attribute_args(this, _, _, _, result)
+ }
+
+ override string toString() {
+ if exists (@attribute_arg_empty self | self = this)
+ then result = "empty argument"
+ else exists (string prefix, string tail
+ | (if exists(getName())
+ then prefix = getName() + "="
+ else prefix = "") and
+ (if exists (@attribute_arg_type self | self = this)
+ then tail = getValueType().getName()
+ else tail = getValueText()) and
+ result = prefix + tail)
+ }
+}
+
+private predicate suppressUnusedThis(Specifier s) { any() }
diff --git a/cpp/ql/src/semmle/code/cpp/Struct.qll b/cpp/ql/src/semmle/code/cpp/Struct.qll
new file mode 100644
index 000000000000..ff34b35ea498
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/Struct.qll
@@ -0,0 +1,42 @@
+import semmle.code.cpp.Type
+import semmle.code.cpp.Class
+
+/**
+ * A C/C++ structure or union.
+ */
+class Struct extends Class {
+
+ Struct() { usertypes(this,_,1) or usertypes(this,_,3) }
+
+ override string explain() { result = "struct " + this.getName() }
+
+ override predicate isDeeplyConstBelow() { any() } // No subparts
+}
+
+/**
+ * A C++ struct that is directly enclosed by a function.
+ */
+class LocalStruct extends Struct {
+ LocalStruct() {
+ isLocal()
+ }
+}
+
+/**
+ * A C++ nested struct. See 11.12.
+ */
+class NestedStruct extends Struct {
+ NestedStruct() {
+ this.isMember()
+ }
+
+ /** Whether this member is private. */
+ predicate isPrivate() { this.hasSpecifier("private") }
+
+ /** Whether this member is protected. */
+ predicate isProtected() { this.hasSpecifier("protected") }
+
+ /** Whether this member is public. */
+ predicate isPublic() { this.hasSpecifier("public") }
+
+}
diff --git a/cpp/ql/src/semmle/code/cpp/TestFile.qll b/cpp/ql/src/semmle/code/cpp/TestFile.qll
new file mode 100644
index 000000000000..c546ae04adb8
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/TestFile.qll
@@ -0,0 +1,90 @@
+import semmle.code.cpp.File
+
+/**
+ * The `gtest/gtest.h` file.
+ */
+private class GoogleTestHeader extends File {
+ GoogleTestHeader() {
+ getBaseName() = "gtest.h" and
+ getParentContainer().getBaseName() = "gtest"
+ }
+}
+
+/**
+ * A test using the Google Test library.
+ */
+private class GoogleTest extends MacroInvocation {
+ GoogleTest() {
+ // invocation of a macro from Google Test.
+ this.getMacro().getFile() instanceof GoogleTestHeader
+ }
+}
+
+/**
+ * The `boost/test` directory.
+ */
+private class BoostTestFolder extends Folder {
+ BoostTestFolder() {
+ getBaseName() = "test" and
+ getParentContainer().getBaseName() = "boost"
+ }
+}
+
+/**
+ * A test using the Boost Test library.
+ */
+private class BoostTest extends MacroInvocation {
+ BoostTest() {
+ // invocation of a macro from Boost Test.
+ this.getMacro().getFile().getParentContainer+()
+ instanceof BoostTestFolder
+ }
+}
+
+/**
+ * The `cppunit` directory.
+ */
+private class CppUnitFolder extends Folder {
+ CppUnitFolder() {
+ getBaseName() = "cppunit"
+ }
+}
+
+/**
+ * A class from the `cppunit` directory.
+ */
+private class CppUnitClass extends Class {
+ CppUnitClass() {
+ getFile().getParentContainer+() instanceof CppUnitFolder and
+ getNamespace().getParentNamespace*().getName() = "CppUnit"
+ }
+}
+
+/**
+ * A test using the CppUnit library.
+ */
+private class CppUnitTest extends Element {
+ CppUnitTest() {
+ (
+ // class with a base class from cppunit.
+ this.(Class).getABaseClass*() instanceof CppUnitClass and
+
+ // class itself is not a part of cppunit.
+ not this instanceof CppUnitClass
+ ) or (
+ // any member function of a test is also test code
+ this.(Function).getDeclaringType() instanceof CppUnitTest
+ )
+ }
+}
+
+/**
+ * A file that contains one or more test cases.
+ */
+class TestFile extends File {
+ TestFile() {
+ exists(GoogleTest test | test.getFile() = this) or
+ exists(BoostTest test | test.getFile() = this) or
+ exists(CppUnitTest test | test.getFile() = this)
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/Type.qll b/cpp/ql/src/semmle/code/cpp/Type.qll
new file mode 100644
index 000000000000..68c7fbfd674e
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/Type.qll
@@ -0,0 +1,1216 @@
+import semmle.code.cpp.Element
+import semmle.code.cpp.Member
+import semmle.code.cpp.Function
+private import semmle.code.cpp.internal.Type
+
+/**
+ * A C/C++ type.
+ */
+class Type extends Locatable, @type {
+ /**
+ * Gets the name of this type.
+ */
+ string getName() {
+ none()
+ }
+
+ /**
+ * Holds if this type is called `name`.
+ */
+ predicate hasName(string name) { name = this.getName() }
+
+ /**
+ * Holds if this declaration has a specifier called `name`, recursively looking
+ * through `typedef` and `decltype`. For example, in the context of
+ * `typedef const int *restrict t`, the type `volatile t` has specifiers
+ * `volatile` and `restrict` but not `const` since the `const` is attached to
+ * the type being pointed to rather than the pointer itself.
+ */
+ // This predicate should not be overridden, but it cannot be declared `final`
+ // because there is a similarly-named predicate in Declaration, and UserType
+ // inherits from both Type and Declaration and must override it to resolve
+ // the ambiguity.
+ predicate hasSpecifier(string name) {
+ this.getASpecifier().hasName(name)
+ }
+
+ /**
+ * Gets a specifier of this type, recursively looking through `typedef` and
+ * `decltype`. For example, in the context of `typedef const int *restrict
+ * t`, the type `volatile t` has specifiers `volatile` and `restrict` but not
+ * `const` since the `const` is attached to the type being pointed to rather
+ * than the pointer itself.
+ */
+ // This predicate should not be overridden, but it cannot be declared `final`
+ // because there is a similarly-named predicate in Declaration, and UserType
+ // inherits from both Type and Declaration and must override it to resolve
+ // the ambiguity.
+ Specifier getASpecifier() {
+ typespecifiers(this,result)
+ or
+ result = this.internal_getAnAdditionalSpecifier()
+ }
+
+ /**
+ * Gets an attribute of this type.
+ */
+ Attribute getAnAttribute() { typeattributes(this,result) }
+
+ /**
+ * Internal -- should be `protected` when QL supports such a flag. Subtypes
+ * override this to recursively get specifiers that are not attached directly
+ * to this `@type` in the database but arise through type aliases such as
+ * `typedef` and `decltype`.
+ */
+ Specifier internal_getAnAdditionalSpecifier() { none() }
+
+ /**
+ * Holds if this type is const.
+ */
+ predicate isConst() { this.hasSpecifier("const") }
+
+ /**
+ * Holds if this type is volatile.
+ */
+ predicate isVolatile() { this.hasSpecifier("volatile") }
+
+ /**
+ * Holds if this type refers to type `t` (by default,
+ * a type always refers to itself).
+ */
+ predicate refersTo(Type t) { refersToDirectly*(t) }
+
+ /**
+ * Holds if this type refers to type `t` directly.
+ */
+ predicate refersToDirectly(Type t) { none() }
+
+ /**
+ * Gets this type after typedefs have been resolved.
+ *
+ * The result of this predicate will be the type itself, except in the case of a TypedefType or a Decltype,
+ * in which case the result will be type which results from (possibly recursively) resolving typedefs.
+ */
+ Type getUnderlyingType() { result = this }
+
+ /**
+ * Gets this type after specifiers have been deeply stripped and typedefs have been resolved.
+ *
+ * For example, starting with `const i64* const` in the context of `typedef long long i64;`, this predicate will return `long long*`.
+ */
+ Type getUnspecifiedType() { unspecifiedtype(this, unresolve(result)) }
+
+ /**
+ * Gets this type after any top-level specifiers and typedefs have been stripped.
+ *
+ * For example, starting with `const i64* const`, this predicate will return `const i64*`.
+ */
+ Type stripTopLevelSpecifiers() { result = this }
+
+ /**
+ * Gets the size of this type in bytes.
+ */
+ int getSize() {
+ builtintypes(this, _, _, result, _, _)
+ or pointerishsize(this, result, _)
+ or usertypesize(this, result, _)
+ }
+
+ /**
+ * Gets the alignment of this type in bytes.
+ */
+ int getAlignment() {
+ builtintypes(this, _, _, _, _, result)
+ or pointerishsize(this, _, result)
+ or usertypesize(this, _, result)
+ }
+
+ /**
+ * Gets the pointer indirection level of this type.
+ */
+ int getPointerIndirectionLevel() {
+ result = 0
+ }
+
+ /**
+ * Gets a detailed string representation explaining the AST of this type
+ * (with all specifiers and nested constructs such as pointers). This is
+ * intended to help debug queries and is a very expensive operation; not
+ * to be used in production queries.
+ *
+ * An example output is "const {pointer to {const {char}}}".
+ */
+ string explain() { result = "type" } // Concrete base impl to allow filters on Type
+
+ /**
+ * Holds if this type is constant and only contains constant types.
+ * For instance, a `char *const` is a constant type, but not deeply constant,
+ * because while the pointer can't be modified the character can. The type
+ * `const char *const*` is a deeply constant type though - both the pointer
+ * and what it points to are immutable.
+ */
+ predicate isDeeplyConst() { this.isConst() and this.isDeeplyConstBelow() }
+
+ /**
+ * Holds if this type is constant and only contains constant types, excluding
+ * the type itself. It is implied by Type.isDeeplyConst() and is just used to
+ * implement that predicate.
+ * For example, `const char *const` is deeply constant and deeply constant below,
+ * but `const char *` is only deeply constant below (the pointer can be changed,
+ * but not the underlying char). `char *const` is neither (it is just `const`).
+ */
+ predicate isDeeplyConstBelow() { none() } // Concrete base impl to allow filters on Type
+
+ /**
+ * Gets as many places as possible where this type is used by name in the source after macros have been replaced
+ * (in particular, therefore, this will find type name uses caused by macros). Note that all type name uses within
+ * instantiations are currently excluded - this is too draconian in the absence of indexing prototype instantiations
+ * of functions, and is likely to improve in the future. At present, the method takes the conservative approach of
+ * giving valid type name uses, but not necessarily *all* type name uses.
+ */
+ Element getATypeNameUse() {
+ // An explicit cast to a type referring to T uses T. We exclude casts within instantiations,
+ // since they do not appear directly in the source.
+ exists(Cast c |
+ not(c.isImplicit())
+ and c.getType().refersTo(this)
+ and result = c
+ and not c.getEnclosingFunction().isConstructedFrom(_)
+ )
+
+ // A class derivation from a type referring to T uses T. We exclude class derivations within
+ // instantiations, since they do not appear directly in the source.
+ or exists(ClassDerivation cd |
+ cd.getBaseType().refersTo(this)
+ and result = cd
+ and not cd.getDerivedClass() instanceof ClassTemplateInstantiation
+ )
+
+ // A new, new array, or placement new expression with a type that refers to T uses T.
+ // We exclude news within instantiations, since they do not appear directly in the source.
+ or exists(Expr e |
+ (
+ e instanceof NewArrayExpr
+ or e instanceof NewExpr
+ )
+ and e.getType().refersTo(this)
+ and result = e
+ and not e.getEnclosingFunction().isConstructedFrom(_)
+ )
+
+ // The declaration of a function that returns a type referring to T uses T. We exclude
+ // declarations of function template instantiations, since their return types do not
+ // appear directly in the source. We also exclude constructors and destructors, since
+ // they are indexed with a dummy return type of void that does not appear in the source.
+ or exists(FunctionDeclarationEntry fde, Type t |
+ (
+ if exists(fde.getTypedefType()) then
+ t = fde.getTypedefType()
+ else
+ t = fde.getType()
+ )
+ and t.refersTo(this)
+ and result = fde
+ and not fde.getDeclaration().isConstructedFrom(_)
+ and not(fde.getDeclaration() instanceof Constructor)
+ and not(fde.getDeclaration() instanceof Destructor)
+ )
+
+ // A function call that provides an explicit template argument that refers to T uses T.
+ // We exclude calls within instantiations, since they do not appear directly in the source.
+ or exists(FunctionCall c |
+ c.getAnExplicitTemplateArgument().refersTo(this)
+ and result = c
+ and not c.getEnclosingFunction().isConstructedFrom(_)
+ )
+
+ // Qualifying an expression with a type that refers to T uses T. We exclude qualifiers
+ // within instantiations, since they do not appear directly in the source.
+ or exists(NameQualifier nq |
+ nq.getQualifyingElement().(Type).refersTo(this)
+ and result = nq
+ and not nq.getExpr().getEnclosingFunction().isConstructedFrom(_)
+ )
+
+ // Calculating the size of a type that refers to T uses T. We exclude sizeofs within
+ // instantiations, since they do not appear directly in the source.
+ or exists(SizeofTypeOperator soto |
+ soto.getTypeOperand().refersTo(this)
+ and result = soto
+ and not soto.getEnclosingFunction().isConstructedFrom(_)
+ )
+
+ // A typedef of a type that refers to T uses T.
+ or exists(TypeDeclarationEntry tde |
+ tde.getDeclaration().(TypedefType).getBaseType().refersTo(this)
+ and result = tde
+ )
+
+ // Using something declared within a type that refers to T uses T.
+ or exists(UsingDeclarationEntry ude |
+ ude.getDeclaration().getDeclaringType().refersTo(this)
+ and result = ude
+ )
+
+ // The declaration of a variable with a type that refers to T uses T. We exclude declarations within
+ // instantiations, since those do not appear directly in the source.
+ or exists(VariableDeclarationEntry vde |
+ vde.getType().refersTo(this)
+ and result = vde
+ and not exists(LocalScopeVariable sv | sv = vde.getDeclaration() and sv.getFunction().isConstructedFrom(_))
+ and not exists(MemberVariable mv | mv = vde.getDeclaration() and mv.getDeclaringType() instanceof ClassTemplateInstantiation)
+ )
+ }
+
+ /**
+ * Holds if this type involves a reference.
+ */
+ predicate involvesReference() {
+ none()
+ }
+
+ /**
+ * Holds if this type involves a template parameter.
+ */
+ predicate involvesTemplateParameter() {
+ none()
+ }
+
+ /**
+ * Gets this type with any typedefs resolved. For example, given
+ * `typedef C T`, this would resolve `const T&` to `const C&`.
+ * Note that this will only work if the resolved type actually appears
+ * on its own elsewhere in the program.
+ */
+ Type resolveTypedefs() {
+ result = this
+ }
+
+ /**
+ * Gets the type stripped of pointers, references and cv-qualifiers, and resolving typedefs.
+ * For example, given `typedef const C& T`, `stripType` returns `C`.
+ */
+ Type stripType() {
+ result = this
+ }
+
+ override Location getLocation() {
+ suppressUnusedThis(this) and
+ result instanceof UnknownDefaultLocation
+ }
+}
+
+/**
+ * A C/C++ built-in primitive type (int, float, void, and so on). See 4.1.1.
+ */
+class BuiltInType extends Type, @builtintype {
+ override string toString() { result = this.getName() }
+
+ override string getName() { builtintypes(this,result,_,_,_,_) }
+
+ override string explain() { result = this.getName() }
+
+ override predicate isDeeplyConstBelow() { any() } // No subparts
+}
+
+/**
+ * An erroneous type.
+ */
+class ErroneousType extends BuiltInType {
+
+ ErroneousType() { builtintypes(this,_,1,_,_,_) }
+
+}
+
+/**
+ * The unknown type.
+ */
+class UnknownType extends BuiltInType {
+
+ UnknownType() { builtintypes(this,_,2,_,_,_) }
+
+}
+
+private predicate isArithmeticType(@builtintype type, int kind) {
+ builtintypes(type, _, kind, _, _, _) and
+ (kind >= 4) and
+ (kind != 34) // Exclude decltype(nullptr)
+}
+
+/**
+ * The C/C++ arithmetic types. See 4.1.1.
+ */
+class ArithmeticType extends BuiltInType {
+ ArithmeticType() {
+ isArithmeticType(this, _)
+ }
+}
+
+/**
+ * A C/C++ integral or enum type.
+ * The definition of "integral type" in the C++ Standard excludes enum types,
+ * but because an enum type holds a value of its underlying integral type,
+ * it is often useful to have a common category that includes both integral
+ * and enum types.
+ */
+class IntegralOrEnumType extends Type {
+ IntegralOrEnumType() {
+ // Integral type
+ exists(int kind |
+ isArithmeticType(this, kind) and
+ (kind < 24 or kind = 33 or (35 <= kind and kind <= 37) or
+ kind = 43 or kind = 44)
+ ) or
+ // Enum type
+ (
+ usertypes(this, _, 4) or
+ usertypes(this, _, 13)
+ )
+ }
+}
+
+/**
+ * The C/C++ integral types. See 4.1.1.
+ */
+class IntegralType extends ArithmeticType, IntegralOrEnumType {
+ /** Holds if this integral type is signed. */
+ predicate isSigned() {
+ builtintypes(this,_,_,_,-1,_)
+ }
+
+ /** Holds if this integral type is unsigned. */
+ predicate isUnsigned() {
+ builtintypes(this,_,_,_,1,_)
+ }
+
+ /** Holds if this integral type is explicitly signed. */
+ predicate isExplicitlySigned() {
+ builtintypes(this,_,7,_,_,_) or builtintypes(this,_,10,_,_,_) or builtintypes(this,_,13,_,_,_) or
+ builtintypes(this,_,16,_,_,_) or builtintypes(this,_,19,_,_,_) or
+ builtintypes(this,_,37,_,_,_)
+ }
+
+ /** Holds if this integral type is explicitly unsigned. */
+ predicate isExplicitlyUnsigned() {
+ builtintypes(this,_,6,_,_,_) or builtintypes(this,_,9,_,_,_) or builtintypes(this,_,12,_,_,_) or
+ builtintypes(this,_,15,_,_,_) or builtintypes(this,_,18,_,_,_) or
+ builtintypes(this,_,36,_,_,_)
+ }
+
+ /** Holds if this integral type is implicitly signed. */
+ predicate isImplicitlySigned() {
+ builtintypes(this,_,5,_,-1,_) or builtintypes(this,_,8,_,-1,_) or builtintypes(this,_,11,_,-1,_) or
+ builtintypes(this,_,14,_,-1,_) or builtintypes(this,_,17,_,-1,_) or
+ builtintypes(this,_,35,_,-1,_)
+ }
+
+ /**
+ * Gets the unsigned type corresponding to this integral type. For
+ * example on a `short`, this would give the type `unsigned short`.
+ */
+ IntegralType getUnsigned() {
+ (builtintypes(this,_, 5,_,_,_) or builtintypes(this,_, 6,_,_,_) or builtintypes(this,_, 7,_,_,_)) and builtintypes(result,_, 6,_,_,_)
+ or (builtintypes(this,_, 8,_,_,_) or builtintypes(this,_, 9,_,_,_) or builtintypes(this,_,10,_,_,_)) and builtintypes(result,_, 9,_,_,_)
+ or (builtintypes(this,_,11,_,_,_) or builtintypes(this,_,12,_,_,_) or builtintypes(this,_,13,_,_,_)) and builtintypes(result,_,12,_,_,_)
+ or (builtintypes(this,_,14,_,_,_) or builtintypes(this,_,15,_,_,_) or builtintypes(this,_,16,_,_,_)) and builtintypes(result,_,15,_,_,_)
+ or (builtintypes(this,_,17,_,_,_) or builtintypes(this,_,18,_,_,_) or builtintypes(this,_,19,_,_,_)) and builtintypes(result,_,18,_,_,_)
+ or (builtintypes(this,_,35,_,_,_) or builtintypes(this,_,36,_,_,_) or builtintypes(this,_,37,_,_,_)) and builtintypes(result,_,36,_,_,_)
+ }
+}
+
+/**
+ * The C/C++ boolean type. See 4.2.
+ */
+class BoolType extends IntegralType {
+
+ BoolType() { builtintypes(this,_,4,_,_,_) }
+
+}
+
+/**
+ * The C/C++ character types. See 4.3.
+ */
+abstract class CharType extends IntegralType { }
+
+/**
+ * The C/C++ char type (which is different to signed char and unsigned char).
+ */
+class PlainCharType extends CharType {
+ PlainCharType() {
+ builtintypes(this,_,5,_,_,_)
+ }
+}
+
+/**
+ * The C/C++ unsigned char type (which is different to plain char, even when chars are unsigned by default).
+ */
+class UnsignedCharType extends CharType {
+ UnsignedCharType() {
+ builtintypes(this,_,6,_,_,_)
+ }
+}
+
+/**
+ * The C/C++ signed char type (which is different to plain char, even when chars are signed by default).
+ */
+class SignedCharType extends CharType {
+ SignedCharType() {
+ builtintypes(this,_,7,_,_,_)
+ }
+}
+
+/**
+ * The C/C++ short types. See 4.3.
+ */
+class ShortType extends IntegralType {
+
+ ShortType() {
+ builtintypes(this,_,8,_,_,_) or builtintypes(this,_,9,_,_,_) or builtintypes(this,_,10,_,_,_)
+ }
+
+}
+
+/**
+ * The C/C++ integer types. See 4.4.
+ */
+class IntType extends IntegralType {
+
+ IntType() {
+ builtintypes(this,_,11,_,_,_) or builtintypes(this,_,12,_,_,_) or builtintypes(this,_,13,_,_,_)
+ }
+
+}
+
+/**
+ * The C/C++ long types. See 4.4.
+ */
+class LongType extends IntegralType {
+
+ LongType() {
+ builtintypes(this,_,14,_,_,_) or builtintypes(this,_,15,_,_,_) or builtintypes(this,_,16,_,_,_)
+ }
+
+}
+
+/**
+ * The C/C++ long long types. See 4.4.
+ */
+class LongLongType extends IntegralType {
+
+ LongLongType() {
+ builtintypes(this,_,17,_,_,_) or builtintypes(this,_,18,_,_,_) or builtintypes(this,_,19,_,_,_)
+ }
+
+}
+
+/**
+ * The GNU C __int128 types.
+ */
+class Int128Type extends IntegralType {
+
+ Int128Type() {
+ builtintypes(this,_,35,_,_,_) or builtintypes(this,_,36,_,_,_) or builtintypes(this,_,37,_,_,_)
+ }
+
+}
+
+/**
+ * The C/C++ floating point types. See 4.5.
+ */
+class FloatingPointType extends ArithmeticType {
+
+ FloatingPointType() {
+ exists(int kind | builtintypes(this,_,kind,_,_,_) and ((kind >= 24 and kind <= 32) or (kind = 38)))
+ }
+
+}
+
+/**
+ * The C/C++ float type.
+ */
+class FloatType extends FloatingPointType {
+
+ FloatType() { builtintypes(this,_,24,_,_,_) }
+
+}
+
+/**
+ * The C/C++ double type.
+ */
+class DoubleType extends FloatingPointType {
+
+ DoubleType() { builtintypes(this,_,25,_,_,_) }
+
+}
+
+/**
+ * The C/C++ long double type.
+ */
+class LongDoubleType extends FloatingPointType {
+
+ LongDoubleType() { builtintypes(this,_,26,_,_,_) }
+
+}
+
+/**
+ * The GNU C __float128 type.
+ */
+class Float128Type extends FloatingPointType {
+
+ Float128Type() { builtintypes(this,_,38,_,_,_) }
+
+}
+
+/**
+ * The GNU C _Decimal32 type.
+ */
+class Decimal32Type extends FloatingPointType {
+
+ Decimal32Type() { builtintypes(this,_,40,_,_,_) }
+
+}
+
+/**
+ * The GNU C _Decimal64 type.
+ */
+class Decimal64Type extends FloatingPointType {
+
+ Decimal64Type() { builtintypes(this,_,41,_,_,_) }
+
+}
+
+/**
+ * The GNU C _Decimal128 type.
+ */
+class Decimal128Type extends FloatingPointType {
+
+ Decimal128Type() { builtintypes(this,_,42,_,_,_) }
+
+}
+
+/**
+ * The C/C++ void type. See 4.7.
+ */
+class VoidType extends BuiltInType {
+
+ VoidType() { builtintypes(this,_,3,_,_,_) }
+
+}
+
+/**
+ * The C/C++ wide character type.
+ */
+class WideCharType extends IntegralType {
+
+ WideCharType() { builtintypes(this,_,33,_,_,_) }
+
+}
+
+/**
+ * The C/C++ `char16_t` type.
+ */
+class Char16Type extends IntegralType {
+
+ Char16Type() { builtintypes(this,_,43,_,_,_) }
+
+}
+
+/**
+ * The C/C++ `char32_t` type.
+ */
+class Char32Type extends IntegralType {
+
+ Char32Type() { builtintypes(this,_,44,_,_,_) }
+
+}
+
+/**
+ * The type of the C++11 nullptr constant.
+ *
+ * Note that this is not `nullptr_t`, as `nullptr_t` is defined as:
+ * ```
+ * typedef decltype(nullptr) nullptr_t;
+ * ```
+ * Instead, this is the unspeakable type given by `decltype(nullptr)`.
+ */
+class NullPointerType extends BuiltInType {
+ NullPointerType() { builtintypes(this,_,34,_,_,_) }
+}
+
+/**
+ * A C/C++ derived type.
+ *
+ * These are pointer and reference types, array and vector types, and const and volatile types.
+ * In all cases, the type is formed from a single base type.
+ */
+class DerivedType extends Type, @derivedtype {
+ override string toString() { result = this.getName() }
+
+ override string getName() { derivedtypes(this,result,_,_) }
+
+ /**
+ * Gets the base type of this derived type.
+ *
+ * This predicate strips off one level of decoration from a type. For example, it returns `char*` for the PointerType `char**`,
+ * `const int` for the ReferenceType `const int&`, and `long` for the SpecifiedType `volatile long`.
+ */
+ Type getBaseType() { derivedtypes(this,_,_,unresolve(result)) }
+
+ override predicate refersToDirectly(Type t) { t = this.getBaseType() }
+
+ override predicate involvesReference() {
+ getBaseType().involvesReference()
+ }
+
+ override predicate involvesTemplateParameter() {
+ getBaseType().involvesTemplateParameter()
+ }
+
+ override Type stripType() {
+ result = getBaseType().stripType()
+ }
+
+ predicate isAutoReleasing() {
+ this.hasSpecifier("__autoreleasing") or
+ this.(PointerType).getBaseType().hasSpecifier("__autoreleasing")
+ }
+
+ predicate isStrong() {
+ this.hasSpecifier("__strong") or
+ this.(PointerType).getBaseType().hasSpecifier("__strong")
+ }
+
+ predicate isUnsafeRetained() {
+ this.hasSpecifier("__unsafe_unretained") or
+ this.(PointerType).getBaseType().hasSpecifier("__unsafe_unretained")
+ }
+
+ predicate isWeak() {
+ this.hasSpecifier("__weak") or
+ this.(PointerType).getBaseType().hasSpecifier("__weak")
+ }
+}
+
+/**
+ * An instance of the C++11 decltype operator.
+ */
+class Decltype extends Type, @decltype {
+
+ /**
+ * The expression whose type is being obtained by this decltype.
+ */
+ Expr getExpr() {
+ decltypes(this, result, _, _)
+ }
+
+ /**
+ * The type immediately yielded by this decltype.
+ */
+ Type getBaseType() {
+ decltypes(this, _, unresolve(result), _)
+ }
+
+ /**
+ * Whether an extra pair of parentheses around the expression would change the semantics of this decltype.
+ *
+ * The following example shows the effect of an extra pair of parentheses:
+ * struct A { double x; };
+ * const A* a = new A();
+ * decltype( a->x ); // type is double
+ * decltype((a->x)); // type is const double&
+ * Consult the C++11 standard for more details.
+ */
+ predicate parenthesesWouldChangeMeaning() {
+ decltypes(this, _, _, true)
+ }
+
+ override Type getUnderlyingType() {
+ result = getBaseType().getUnderlyingType()
+ }
+
+ override Type stripTopLevelSpecifiers() {
+ result = getBaseType().stripTopLevelSpecifiers()
+ }
+
+ override Type stripType() {
+ result = getBaseType().stripType()
+ }
+
+ override Type resolveTypedefs() {
+ result = getBaseType().resolveTypedefs()
+ }
+
+ override Location getLocation() {
+ result = getExpr().getLocation()
+ }
+
+ override string toString() {
+ result = "decltype(...)"
+ }
+
+ override string getName() {
+ none()
+ }
+
+ override int getSize() {
+ result = getBaseType().getSize()
+ }
+
+ override int getAlignment() {
+ result = getBaseType().getAlignment()
+ }
+
+ override int getPointerIndirectionLevel() {
+ result = getBaseType().getPointerIndirectionLevel()
+ }
+
+ override string explain() {
+ result = "decltype resulting in {" + this.getBaseType().explain() + "}"
+ }
+
+ override predicate involvesReference() {
+ getBaseType().involvesReference()
+ }
+
+ override predicate involvesTemplateParameter() {
+ getBaseType().involvesTemplateParameter()
+ }
+
+ override predicate isDeeplyConst() {
+ this.getBaseType().isDeeplyConst()
+ }
+
+ override predicate isDeeplyConstBelow() {
+ this.getBaseType().isDeeplyConstBelow()
+ }
+
+ override Specifier internal_getAnAdditionalSpecifier() {
+ result = this.getBaseType().getASpecifier()
+ }
+}
+
+/**
+ * A C/C++ pointer type. See 4.9.1.
+ */
+class PointerType extends DerivedType {
+
+ PointerType() { derivedtypes(this,_,1,_) }
+
+ override int getPointerIndirectionLevel() {
+ result = 1 + this.getBaseType().getPointerIndirectionLevel()
+ }
+
+ override string explain() { result = "pointer to {" + this.getBaseType().explain() + "}" }
+
+ override predicate isDeeplyConstBelow() { this.getBaseType().isDeeplyConst() }
+
+ override Type resolveTypedefs() {
+ result.(PointerType).getBaseType() = getBaseType().resolveTypedefs()
+ }
+}
+
+/**
+ * A C++ reference type. See 4.9.1.
+ *
+ * For C++11 code bases, this includes both lvalue references (&) and rvalue references (&&).
+ * To distinguish between them, use the LValueReferenceType and RValueReferenceType classes.
+ */
+class ReferenceType extends DerivedType {
+
+ ReferenceType() { derivedtypes(this,_,2,_) or derivedtypes(this,_,8,_) }
+
+ override int getPointerIndirectionLevel() {
+ result = getBaseType().getPointerIndirectionLevel()
+ }
+
+ override string explain() { result = "reference to {" + this.getBaseType().explain() + "}" }
+
+ override predicate isDeeplyConst() { this.getBaseType().isDeeplyConst() } // No such thing as a const reference type
+
+ override predicate isDeeplyConstBelow() { this.getBaseType().isDeeplyConst() }
+
+ override predicate involvesReference() {
+ any()
+ }
+
+ override Type resolveTypedefs() {
+ result.(ReferenceType).getBaseType() = getBaseType().resolveTypedefs()
+ }
+}
+
+/**
+ * A C++11 lvalue reference type (e.g. int&).
+ */
+class LValueReferenceType extends ReferenceType {
+ LValueReferenceType() { derivedtypes(this,_,2,_) }
+}
+
+/**
+ * A C++11 rvalue reference type (e.g. int&&).
+ */
+class RValueReferenceType extends ReferenceType {
+ RValueReferenceType() { derivedtypes(this,_,8,_) }
+
+ override string explain() { result = "rvalue " + super.explain() }
+}
+
+/**
+ * A type with specifiers.
+ */
+class SpecifiedType extends DerivedType {
+
+ SpecifiedType() { derivedtypes(this,_,3,_) }
+
+ override int getSize() { result = this.getBaseType().getSize() }
+
+ override int getAlignment() { result = this.getBaseType().getAlignment() }
+
+ override int getPointerIndirectionLevel() {
+ result = this.getBaseType().getPointerIndirectionLevel()
+ }
+
+ /** all the specifiers of this type as a string in a fixed order (the order
+ only depends on the specifiers, not on the source program). This is intended
+ for debugging queries only and is an expensive operation. */
+ string getSpecifierString() {
+ internalSpecString(this, result, 1)
+ }
+
+ override string explain() { result = this.getSpecifierString() + "{" + this.getBaseType().explain() + "}" }
+
+ override predicate isDeeplyConst() { this.getASpecifier().getName() = "const" and this.getBaseType().isDeeplyConstBelow() }
+
+ override predicate isDeeplyConstBelow() { this.getBaseType().isDeeplyConstBelow() }
+
+ override Specifier internal_getAnAdditionalSpecifier() {
+ result = this.getBaseType().getASpecifier()
+ }
+
+ override Type resolveTypedefs() {
+ result.(SpecifiedType).getBaseType() = getBaseType().resolveTypedefs()
+ and result.getASpecifier() = getASpecifier()
+ }
+
+ override Type stripTopLevelSpecifiers() {
+ result = getBaseType().stripTopLevelSpecifiers()
+ }
+}
+
+/**
+ * A C/C++ array type. See 4.9.1.
+ */
+class ArrayType extends DerivedType {
+
+ ArrayType() { derivedtypes(this,_,4,_) }
+
+ predicate hasArraySize() { arraysizes(this,_,_,_) }
+ int getArraySize() { arraysizes(this,result,_,_) }
+
+ int getByteSize() { arraysizes(this,_,result,_) }
+
+ override int getAlignment() { arraysizes(this, _, _, result) }
+
+ /**
+ * Gets the size of this array (only valid for arrays declared to be of a constant
+ * size, will fail for all others).
+ */
+ override int getSize() {
+ result = this.getByteSize()
+ }
+
+ override string explain() {
+ if exists(this.getArraySize()) then
+ result = "array of " + this.getArraySize().toString() + " {" + this.getBaseType().explain() + "}"
+ else
+ result = "array of {" + this.getBaseType().explain() + "}"
+ }
+
+ override predicate isDeeplyConst() { this.getBaseType().isDeeplyConst() } // No such thing as a const array type
+
+ override predicate isDeeplyConstBelow() { this.getBaseType().isDeeplyConst() }
+}
+
+/**
+ * A GNU/Clang vector type.
+ *
+ * In both Clang and GNU compilers, vector types can be introduced using the
+ * __attribute__((vector_size(byte_size))) syntax. The Clang compiler also
+ * allows vector types to be introduced using the ext_vector_type,
+ * neon_vector_type, and neon_polyvector_type attributes (all of which take
+ * an element type rather than a byte size).
+ */
+class GNUVectorType extends DerivedType {
+
+ GNUVectorType() { derivedtypes(this,_,5,_) }
+
+ /**
+ * Get the number of elements in this vector type.
+ *
+ * For vector types declared using Clang's ext_vector_type, neon_vector_type,
+ * or neon_polyvector_type attribute, this is the value which appears within
+ * the attribute. For vector types declared using the vector_size attribute,
+ * the number of elements is the value in the attribute divided by the size
+ * of a single element.
+ */
+ int getNumElements() { arraysizes(this,result,_,_) }
+
+ /**
+ * Gets the size, in bytes, of this vector type.
+ *
+ * For vector types declared using the vector_size attribute, this is the
+ * value which appears within the attribute. For vector types declared using
+ * Clang's ext_vector_type, neon_vector_type, or neon_polyvector_type
+ * attribute, the byte size is the value in the attribute multiplied by the
+ * byte size of a single element.
+ */
+ override int getSize() { arraysizes(this,_,result,_) }
+
+ override int getAlignment() { arraysizes(this, _, _, result) }
+
+ override string explain() { result = "GNU " + getNumElements() + " element vector of {" + this.getBaseType().explain() + "}" }
+
+ override predicate isDeeplyConstBelow() { this.getBaseType().isDeeplyConst() }
+
+}
+
+/**
+ * A C/C++ pointer to function. See 7.7.
+ */
+class FunctionPointerType extends FunctionPointerIshType {
+ FunctionPointerType() {
+ derivedtypes(this,_,6,_)
+ }
+
+ override int getPointerIndirectionLevel() {
+ result = 1
+ }
+
+ override string explain() { result = "pointer to {" + this.getBaseType().(RoutineType).explain() + "}" }
+}
+
+/**
+ * A C/C++ reference to function.
+ */
+class FunctionReferenceType extends FunctionPointerIshType {
+ FunctionReferenceType() {
+ derivedtypes(this,_,7,_)
+ }
+
+ override int getPointerIndirectionLevel() {
+ result = getBaseType().getPointerIndirectionLevel()
+ }
+
+ override string explain() { result = "reference to {" + this.getBaseType().(RoutineType).explain() + "}" }
+}
+
+/**
+ * A block type, for example int(^)(char, float).
+ *
+ * Block types (along with blocks themselves) are a language extension
+ * supported by Clang, and by Apple's branch of GCC.
+ */
+class BlockType extends FunctionPointerIshType {
+ BlockType() {
+ derivedtypes(this,_,10,_)
+ }
+
+ override int getPointerIndirectionLevel() {
+ result = 0
+ }
+
+ override string explain() { result = "block of {" + this.getBaseType().(RoutineType).explain() + "}" }
+}
+
+/**
+ * A C/C++ pointer to function, or a block.
+ */
+class FunctionPointerIshType extends DerivedType {
+ FunctionPointerIshType() {
+ derivedtypes(this,_,6, _) or
+ derivedtypes(this,_,7, _) or
+ derivedtypes(this,_,10,_)
+ }
+
+ /** the return type of this function pointer type */
+ Type getReturnType() {
+ exists(RoutineType t | derivedtypes(this,_,_,t) and result = t.getReturnType())
+ }
+
+ /** the type of the ith argument of this function pointer type */
+ Type getParameterType(int i) {
+ exists(RoutineType t | derivedtypes(this,_,_,t) and result = t.getParameterType(i))
+ }
+
+ /** the type of an argument of this function pointer type */
+ Type getAParameterType() {
+ exists(RoutineType t | derivedtypes(this,_,_,t) and result = t.getAParameterType())
+ }
+
+ /** the number of arguments of this function pointer type */
+ int getNumberOfParameters() {
+ result = count(int i | exists(this.getParameterType(i)))
+ }
+
+ override predicate involvesTemplateParameter() {
+ getReturnType().involvesTemplateParameter()
+ or getAParameterType().involvesTemplateParameter()
+ }
+
+ override predicate isDeeplyConstBelow() { this.getBaseType().isDeeplyConst() }
+}
+
+/**
+ * A C++ pointer to member. See 15.5.
+ */
+class PointerToMemberType extends Type, @ptrtomember {
+ /** a printable representation of this named element */
+ override string toString() { result = this.getName() }
+
+ /** the name of this type */
+ override string getName() { result = "..:: *" }
+
+ /** the base type of this pointer to member type */
+ Type getBaseType() { ptrtomembers(this,unresolve(result),_) }
+
+ /** the class referred by this pointer to member type */
+ Type getClass() { ptrtomembers(this,_,unresolve(result)) }
+
+ override predicate refersToDirectly(Type t) {
+ t = this.getBaseType() or
+ t = this.getClass()
+ }
+
+ override int getPointerIndirectionLevel() {
+ result = 1 + this.getBaseType().getPointerIndirectionLevel()
+ }
+
+ override string explain() { result = "pointer to member of " + this.getClass().toString() + " with type {" + this.getBaseType().explain() + "}" }
+
+ override predicate involvesTemplateParameter() {
+ getBaseType().involvesTemplateParameter()
+ }
+
+ override predicate isDeeplyConstBelow() { this.getBaseType().isDeeplyConst() }
+}
+
+/**
+ * A C/C++ routine type. This is what results from stripping away the pointer from a function pointer type.
+ */
+class RoutineType extends Type, @routinetype {
+ /** a printable representation of this named element */
+ override string toString() { result = this.getName() }
+
+ override string getName() { result = "..()(..)" }
+
+ Type getParameterType(int n) { routinetypeargs(this,n,unresolve(result)) }
+
+ Type getAParameterType() { routinetypeargs(this,_,unresolve(result)) }
+
+ Type getReturnType() { routinetypes(this, unresolve(result)) }
+
+ override string explain() {
+ result = "function returning {" + this.getReturnType().explain() +
+ "} with arguments (" + this.explainParameters(0) + ")"
+ }
+
+ /**
+ * Gets a string with the `explain()` values for the parameters of
+ * this function, for instance "int,int".
+ *
+ * The integer argument is the index of the first parameter to explain.
+ */
+ private string explainParameters(int i) {
+ (i = 0 and result = "" and not exists(this.getAParameterType()))
+ or
+ (
+ exists(this.getParameterType(i)) and
+ if i < max(int j | exists(this.getParameterType(j))) then
+ // Not the last one
+ result = this.getParameterType(i).explain() + "," + this.explainParameters(i+1)
+ else
+ // Last parameter
+ result = this.getParameterType(i).explain()
+ )
+ }
+
+ override predicate refersToDirectly(Type t) {
+ t = this.getReturnType() or
+ t = this.getAParameterType()
+ }
+
+ override predicate isDeeplyConst() { none() } // Current limitation: no such thing as a const routine type
+
+ override predicate isDeeplyConstBelow() { none() } // Current limitation: no such thing as a const routine type
+
+ override predicate involvesTemplateParameter() {
+ getReturnType().involvesTemplateParameter()
+ or getAParameterType().involvesTemplateParameter()
+ }
+}
+
+/**
+ * A C++ typename template parameter.
+ */
+class TemplateParameter extends UserType
+{
+ TemplateParameter() { usertypes(this, _, 7) or usertypes(this, _, 8) }
+
+ override string getName() { usertypes(this, result, _) }
+
+ override predicate involvesTemplateParameter() {
+ any()
+ }
+}
+
+/** A C++ template template parameter, e.g. template <template <typename,typename> class T>. */
+class TemplateTemplateParameter extends TemplateParameter
+{
+ TemplateTemplateParameter() {
+ usertypes(this, _, 8)
+ }
+}
+
+/**
+ * A type representing the use of the C++11 auto keyword.
+ */
+class AutoType extends TemplateParameter
+{
+ AutoType() { usertypes(this, "auto", 7) }
+
+ override Location getLocation() {
+ suppressUnusedThis(this) and
+ result instanceof UnknownDefaultLocation
+ }
+}
+
+//
+// Internal implementation predicates
+//
+
+predicate allSpecifiers(int i, string s) {
+ s = rank[i](string t | specifiers(_, t) | t)
+}
+
+predicate internalSpecString(Type t, string res, int i) {
+ (if allSpecifiers(i, t.getASpecifier().getName())
+ then exists(string spec, string rest
+ | allSpecifiers(i, spec) and res = spec + " " + rest
+ and internalSpecString(t, rest, i+1))
+ else (allSpecifiers(i, _) and internalSpecString(t, res, i+1)))
+ or (i = count(Specifier s) + 1 and res = "")
+}
+
+private predicate suppressUnusedThis(Type t) { any() }
+
+/** A source code location referring to a type */
+class TypeMention extends Locatable, @type_mention {
+ override string toString() {result = "mention of " + getMentionedType()}
+
+ /**
+ * Gets the type being referenced by this type mention.
+ */
+ Type getMentionedType() { type_mentions(this, result, _, _) }
+
+ override Location getLocation() { type_mentions(this, _, result, _)}
+}
+
diff --git a/cpp/ql/src/semmle/code/cpp/TypedefType.qll b/cpp/ql/src/semmle/code/cpp/TypedefType.qll
new file mode 100644
index 000000000000..08bf9ea22611
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/TypedefType.qll
@@ -0,0 +1,87 @@
+import semmle.code.cpp.Type
+private import semmle.code.cpp.internal.Type
+
+/**
+ * A C/C++ typedef type. See 4.9.1.
+ */
+class TypedefType extends UserType {
+
+ TypedefType() { usertypes(this,_,5) }
+
+ /**
+ * Gets the base type of this typedef type.
+ */
+ Type getBaseType() { typedefbase(this,unresolve(result)) }
+
+ override Type getUnderlyingType() { result = this.getBaseType().getUnderlyingType() }
+
+ override Type stripTopLevelSpecifiers() {
+ result = getBaseType().stripTopLevelSpecifiers()
+ }
+
+ override int getSize() { result = this.getBaseType().getSize() }
+
+ override int getAlignment() { result = this.getBaseType().getAlignment() }
+
+ override int getPointerIndirectionLevel() {
+ result = this.getBaseType().getPointerIndirectionLevel()
+ }
+
+ override string explain() { result = "typedef {" + this.getBaseType().explain() + "} as \"" + this.getName() + "\"" }
+
+ override predicate isDeeplyConst() { this.getBaseType().isDeeplyConst() } // Just an alias
+
+ override predicate isDeeplyConstBelow() { this.getBaseType().isDeeplyConstBelow() } // Just an alias
+
+ override Specifier internal_getAnAdditionalSpecifier() {
+ result = this.getBaseType().getASpecifier()
+ }
+
+ override predicate involvesReference() {
+ getBaseType().involvesReference()
+ }
+
+ override Type resolveTypedefs() {
+ result = getBaseType().resolveTypedefs()
+ }
+
+ override Type stripType() {
+ result = getBaseType().stripType()
+ }
+}
+
+/**
+ * A C++ typedef type that is directly enclosed by a function.
+ */
+class LocalTypedefType extends TypedefType {
+ LocalTypedefType() {
+ isLocal()
+ }
+}
+
+/**
+ * A C++ typedef type that is directly enclosed by a class, struct or union.
+ */
+class NestedTypedefType extends TypedefType {
+ NestedTypedefType() {
+ this.isMember()
+ }
+
+ /**
+ * DEPRECATED
+ * Holds if this member is private.
+ */
+ deprecated predicate isPrivate() { this.hasSpecifier("private") }
+
+ /**
+ * DEPRECATED
+ * Holds if this member is protected.
+ */
+ deprecated predicate isProtected() { this.hasSpecifier("protected") }
+
+ /**
+ * DEPRECATED
+ * Holds if this member is public.
+ */
+ deprecated predicate isPublic() { this.hasSpecifier("public") }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/Union.qll b/cpp/ql/src/semmle/code/cpp/Union.qll
new file mode 100644
index 000000000000..b0e609b4cc68
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/Union.qll
@@ -0,0 +1,43 @@
+import semmle.code.cpp.Type
+import semmle.code.cpp.Struct
+
+/**
+ * A C/C++ union. See C.8.2.
+ */
+class Union extends Struct {
+
+ Union() { usertypes(this,_,3) }
+
+ override string explain() { result = "union " + this.getName() }
+
+ override predicate isDeeplyConstBelow() { any() } // No subparts
+
+}
+
+/**
+ * A C++ union that is directly enclosed by a function.
+ */
+class LocalUnion extends Union {
+ LocalUnion() {
+ isLocal()
+ }
+}
+
+/**
+ * A C++ nested union.
+ */
+class NestedUnion extends Union {
+ NestedUnion() {
+ this.isMember()
+ }
+
+ /** Whether this member is private. */
+ predicate isPrivate() { this.hasSpecifier("private") }
+
+ /** Whether this member is protected. */
+ predicate isProtected() { this.hasSpecifier("protected") }
+
+ /** Whether this member is public. */
+ predicate isPublic() { this.hasSpecifier("public") }
+
+}
diff --git a/cpp/ql/src/semmle/code/cpp/UserType.qll b/cpp/ql/src/semmle/code/cpp/UserType.qll
new file mode 100644
index 000000000000..91e76b14d7cc
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/UserType.qll
@@ -0,0 +1,114 @@
+import semmle.code.cpp.Declaration
+import semmle.code.cpp.Type
+import semmle.code.cpp.Member
+import semmle.code.cpp.Function
+private import semmle.code.cpp.internal.Type
+
+/**
+ * A C/C++ user-defined type. Examples include `Class`, `Struct`, `Union`,
+ * `Enum`, and `TypedefType`.
+ */
+class UserType extends Type, Declaration, NameQualifyingElement, AccessHolder, @usertype {
+ UserType() {
+ isClass(this) implies this = resolve(_)
+ }
+
+ /** the name of this type */
+ override string getName() { usertypes(this,result,_) }
+
+ /** the simple name of this type, without any template parameters */
+ string getSimpleName() {
+ result = getName().regexpReplaceAll("<.*", "")
+ }
+
+ override predicate hasName(string name) {
+ usertypes(this,name,_)
+ }
+ predicate isAnonymous() {
+ getName().matches("(unnamed%")
+ }
+
+ override predicate hasSpecifier(string s) {
+ Type.super.hasSpecifier(s)
+ }
+ override Specifier getASpecifier() {
+ result = Type.super.getASpecifier()
+ }
+
+ override Location getLocation() {
+ if isDefined() then
+ result = this.getDefinitionLocation()
+ else
+ result = this.getADeclarationLocation()
+ }
+
+ override TypeDeclarationEntry getADeclarationEntry() {
+ if type_decls(_, unresolve(this), _) then
+ type_decls(result, unresolve(this), _)
+ else
+ exists(Class t | this.(Class).isConstructedFrom(t) and result = t.getADeclarationEntry())
+ }
+
+ override Location getADeclarationLocation() {
+ result = getADeclarationEntry().getLocation()
+ }
+
+ override TypeDeclarationEntry getDefinition() {
+ result = getADeclarationEntry() and
+ result.isDefinition()
+ }
+
+ /** the location of the definition */
+ override Location getDefinitionLocation() {
+ if exists(getDefinition()) then
+ result = getDefinition().getLocation()
+ else
+ exists(Class t | this.(Class).isConstructedFrom(t) and result = t.getDefinition().getLocation())
+ }
+
+ /** Gets the function that directly encloses this type (if any). */
+ Function getEnclosingFunction() {
+ enclosingfunction(this,result)
+ }
+
+ /** Whether this is a local type (i.e. a type that has a directly-enclosing function). */
+ predicate isLocal() {
+ exists(getEnclosingFunction())
+ }
+
+ // Dummy implementations of inherited methods. This class must not be
+ // made abstract, because it is important that it captures the @usertype
+ // type exactly - but this is not apparent from its subclasses
+
+ Declaration getADeclaration() { none() }
+
+ override string explain() { result = this.getName() }
+
+ // further overridden in LocalClass
+ override AccessHolder getEnclosingAccessHolder() {
+ result = this.getDeclaringType()
+ }
+}
+
+/**
+ * A particular definition or forward declaration of a C/C++ user-defined type.
+ */
+class TypeDeclarationEntry extends DeclarationEntry, @type_decl {
+ override UserType getDeclaration() { result = getType() }
+ override string getName() { result = getType().getName() }
+
+ /**
+ * The type which is being declared or defined.
+ */
+ override Type getType() { type_decls(this,unresolve(result),_) }
+
+ override Location getLocation() { type_decls(this,_,result) }
+ override predicate isDefinition() { type_def(this) }
+ override string getASpecifier() { none() }
+
+ /**
+ * A top level type declaration entry is not declared within a function, function declaration,
+ * class or typedef.
+ */
+ predicate isTopLevel() { type_decl_top(this) }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/Variable.qll b/cpp/ql/src/semmle/code/cpp/Variable.qll
new file mode 100644
index 000000000000..b1417dbe8ad9
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/Variable.qll
@@ -0,0 +1,409 @@
+import semmle.code.cpp.Element
+import semmle.code.cpp.exprs.Access
+import semmle.code.cpp.Initializer
+private import semmle.code.cpp.internal.Type
+
+/**
+ * A C/C++ variable.
+ *
+ * For local variables, there is a one-to-one correspondence between
+ * `Variable` and `VariableDeclarationEntry`.
+ *
+ * For other types of variable, there is a one-to-many relationship between
+ * `Variable` and `VariableDeclarationEntry`. For example, a `Parameter`
+ * can have multiple declarations.
+ */
+class Variable extends Declaration, @variable {
+
+ /** Gets the initializer of this variable, if any. */
+ Initializer getInitializer() { result.getDeclaration() = this }
+
+ /** Holds if this variable has an initializer. */
+ predicate hasInitializer() { exists(this.getInitializer()) }
+
+ /** Gets an access to this variable. */
+ VariableAccess getAnAccess() { result.getTarget() = this }
+
+ /**
+ * Gets a specifier of this variable. This includes `extern`, `static`,
+ * `auto`, `private`, `protected`, `public`. Specifiers of the *type* of
+ * this variable, such as `const` and `volatile`, are instead accessed
+ * through `this.getType().getASpecifier()`.
+ */
+ override Specifier getASpecifier() { varspecifiers(this,result) }
+
+ /** Gets an attribute of this variable. */
+ Attribute getAnAttribute() { varattributes(this,result) }
+
+ /** Holds if this variable is `const`. */
+ predicate isConst() { this.getType().isConst() }
+
+ /** Holds if this variable is `volatile`. */
+ predicate isVolatile() { this.getType().isVolatile() }
+
+ /** Gets the name of this variable. */
+ override string getName() { none() }
+
+ /** Gets the type of this variable. */
+ Type getType() { none() }
+
+ /** Gets the type of this variable, after typedefs have been resolved. */
+ Type getUnderlyingType() { result = this.getType().getUnderlyingType() }
+
+ /**
+ * Gets the type of this variable prior to deduction caused by the C++11
+ * `auto` keyword.
+ *
+ * If the type of this variable was not declared with the C++11 `auto`
+ * keyword, then this predicate does not hold.
+ *
+ * If the type of this variable is completely `auto`, then `result` is an
+ * instance of `AutoType`. For example:
+ *
+ * `auto four = 4;`
+ *
+ * If the type of this variable is partially `auto`, then a descendant of
+ * `result` is an instance of `AutoType`. For example:
+ *
+ * `const auto& c = container;`
+ */
+ Type getTypeWithAuto() { autoderivation(this, unresolve(result)) }
+
+ /**
+ * Holds if the type of this variable is declared using the C++ `auto`
+ * keyword.
+ */
+ predicate declaredUsingAutoType() { autoderivation(this, _) }
+
+ override VariableDeclarationEntry getADeclarationEntry() {
+ result.getDeclaration() = this
+ }
+
+ override Location getADeclarationLocation() {
+ result = getADeclarationEntry().getLocation()
+ }
+
+ override VariableDeclarationEntry getDefinition() {
+ result = getADeclarationEntry() and
+ result.isDefinition()
+ }
+
+ override Location getDefinitionLocation() {
+ result = getDefinition().getLocation()
+ }
+
+ override Location getLocation() {
+ if exists(getDefinition()) then
+ result = this.getDefinitionLocation()
+ else
+ result = this.getADeclarationLocation()
+ }
+
+ /**
+ * Gets an expression that is assigned to this variable somewhere in the
+ * program.
+ */
+ Expr getAnAssignedValue() {
+ result = this.getInitializer().getExpr()
+ or
+ exists (ConstructorFieldInit cfi
+ | cfi.getTarget() = this and result = cfi.getExpr())
+ or
+ exists (AssignExpr ae
+ | ae.getLValue().(Access).getTarget() = this and result = ae.getRValue())
+ }
+
+ /**
+ * Gets an assignment expression that assigns to this variable.
+ * For example: `x=...` or `x+=...`.
+ */
+ Assignment getAnAssignment() {
+ result.getLValue() = this.getAnAccess()
+ }
+
+ /**
+ * Holds if this variable is constructed from `v` as a result
+ * of template instantiation. If so, it originates either from a template
+ * variable or from a variable nested in a template class.
+ */
+ predicate isConstructedFrom(Variable v) {
+ variable_instantiation(this, v)
+ }
+
+ /**
+ * Gets an argument used to instantiate this variable from a template
+ * variable.
+ */
+ Type getATemplateArgument() {
+ exists(int i | this.getTemplateArgument(i) = result)
+ }
+
+ /**
+ * Gets a particular argument used to instantiate this variable from a
+ * template variable.
+ */
+ Type getTemplateArgument(int index) {
+ variable_template_argument(this, index, unresolve(result))
+ }
+
+ /**
+ * Holds if this is a compiler-generated variable. For example, a
+ * [range-based for loop](http://en.cppreference.com/w/cpp/language/range-for)
+ * typically has three compiler-generated variables, named `__range`,
+ * `__begin`, and `__end`:
+ *
+ * `for (char c : str) { ... }`
+ */
+ predicate isCompilerGenerated() { compgenerated(this) }
+}
+
+/**
+ * A particular declaration or definition of a C/C++ variable.
+ */
+class VariableDeclarationEntry extends DeclarationEntry, @var_decl {
+ override Variable getDeclaration() { result = getVariable() }
+
+ /**
+ * Gets the variable which is being declared or defined.
+ */
+ Variable getVariable() { var_decls(this,result,_,_,_) }
+
+ /**
+ * Gets the name, if any, used for the variable at this declaration or
+ * definition.
+ *
+ * In most cases, this will be the name of the variable itself. The only
+ * case in which it can differ is in a parameter declaration entry,
+ * because the parameter may have a different name in the declaration
+ * than in the definition. For example:
+ *
+ * ```
+ * // Declaration. Parameter is named "x".
+ * int f(int x);
+ *
+ * // Definition. Parameter is named "y".
+ * int f(int y) { return y; }
+ * ```
+ */
+ override string getName() { var_decls(this,_,_,result,_) and result != "" }
+
+ /**
+ * Gets the type of the variable which is being declared or defined.
+ */
+ override Type getType() { var_decls(this,_,unresolve(result),_,_) }
+
+ override Location getLocation() { var_decls(this,_,_,_,result) }
+
+ /**
+ * Holds if this is a definition of a variable.
+ *
+ * This always holds for local variables and member variables, but need
+ * not hold for global variables. In the case of function parameters,
+ * this holds precisely when the enclosing `FunctionDeclarationEntry` is
+ * a definition.
+ */
+ override predicate isDefinition() { var_def(this) }
+
+ override string getASpecifier() { var_decl_specifiers(this,result) }
+}
+
+/**
+ * A parameter as described within a particular declaration or definition
+ * of a C/C++ function.
+ */
+class ParameterDeclarationEntry extends VariableDeclarationEntry {
+ ParameterDeclarationEntry() { param_decl_bind(this,_,_) }
+
+ /**
+ * Gets the function declaration or definition which this parameter
+ * description is part of.
+ */
+ FunctionDeclarationEntry getFunctionDeclarationEntry() {
+ param_decl_bind(this,_,result)
+ }
+
+ /**
+ * Gets the zero-based index of this parameter.
+ */
+ int getIndex() { param_decl_bind(this,result,_) }
+
+ override string toString() {
+ if exists(getName())
+ then result = super.toString()
+ else exists (string idx
+ | idx = ((getIndex() + 1).toString() + "th")
+ .replaceAll("1th","1st")
+ .replaceAll("2th","2nd")
+ .replaceAll("3th","3rd")
+ .replaceAll("11st","11th")
+ .replaceAll("12nd","12th")
+ .replaceAll("13rd","13th")
+ | if exists(getCanonicalName())
+ then result = "declaration of " + getCanonicalName() +
+ " as anonymous " + idx + " parameter"
+ else result = "declaration of " + idx + " parameter")
+ }
+
+ /**
+ * Gets the name of this `ParameterDeclarationEntry` including it's type.
+ *
+ * For example: "int p".
+ */
+ string getTypedName() {
+ exists(string typeString, string nameString |
+ if exists(getType().getName()) then typeString = getType().getName() else typeString = "" and
+ if exists(getName()) then nameString = getName() else nameString = "" and
+ if (typeString != "" and nameString != "") then (
+ result = typeString + " " + nameString
+ ) else (
+ result = typeString + nameString
+ )
+ )
+ }
+}
+
+/**
+ * A C/C++ variable with block scope [N4140 3.3.3]. In other words, a local
+ * variable or a function parameter.
+ */
+class LocalScopeVariable extends Variable, @localscopevariable {
+ /** Gets the function to which this variable belongs. */
+ /*abstract*/ Function getFunction() { none() }
+}
+
+/**
+ * DEPRECATED: use `LocalScopeVariable` instead.
+ */
+deprecated class StackVariable extends Variable {
+ StackVariable() { this instanceof LocalScopeVariable }
+ Function getFunction() {
+ result = this.(LocalScopeVariable).getFunction()
+ }
+}
+
+/**
+ * A C/C++ local variable. In other words, any variable that has block
+ * scope [N4140 3.3.3], but is not a function parameter.
+ */
+class LocalVariable extends LocalScopeVariable, @localvariable {
+ override string getName() { localvariables(this,_,result) }
+
+ override Type getType() { localvariables(this,unresolve(result),_) }
+
+ override Function getFunction() {
+ exists(DeclStmt s | s.getADeclaration() = this and s.getEnclosingFunction() = result)
+ }
+}
+
+/**
+ * A C/C++ variable which has global scope or namespace scope.
+ */
+class GlobalOrNamespaceVariable extends Variable, @globalvariable {
+ override string getName() { globalvariables(this,_,result) }
+
+ override Type getType() { globalvariables(this,unresolve(result),_) }
+
+ override Element getEnclosingElement() { none() }
+}
+
+/**
+ * A C/C++ variable which has namespace scope.
+ */
+class NamespaceVariable extends GlobalOrNamespaceVariable {
+ NamespaceVariable() {
+ exists(Namespace n | namespacembrs(n, this))
+ }
+}
+
+/**
+ * A C/C++ variable which has global scope.
+ *
+ * Note that variables declared in anonymous namespaces have namespace scope,
+ * even though they are accessed in the same manner as variables declared in
+ * the enclosing scope of said namespace (which may be the global scope).
+ */
+class GlobalVariable extends GlobalOrNamespaceVariable {
+ GlobalVariable() {
+ not this instanceof NamespaceVariable
+ }
+}
+
+/**
+ * A C structure member or C++ member variable.
+ *
+ * This includes static member variables in C++. To exclude static member
+ * variables, use `Field` instead of `MemberVariable`.
+ */
+class MemberVariable extends Variable, @membervariable {
+ MemberVariable() {
+ this.isMember()
+ }
+
+ /** Holds if this member is private. */
+ predicate isPrivate() { this.hasSpecifier("private") }
+
+ /** Holds if this member is protected. */
+ predicate isProtected() { this.hasSpecifier("protected") }
+
+ /** Holds if this member is public. */
+ predicate isPublic() { this.hasSpecifier("public") }
+
+ override string getName() { membervariables(this,_,result) }
+
+ override Type getType() {
+ if (strictcount(this.getAType()) = 1) then (
+ result = this.getAType()
+ ) else (
+ // In rare situations a member variable may have multiple types in
+ // different translation units. In that case, we return the unspecified
+ // type.
+ result = this.getAType().getUnspecifiedType()
+ )
+ }
+
+ /** Holds if this member is mutable. */
+ predicate isMutable() {
+ getADeclarationEntry().hasSpecifier("mutable")
+ }
+
+ private Type getAType() { membervariables(this,unresolve(result),_) }
+}
+
+/**
+ * A C/C++ function pointer variable.
+ */
+class FunctionPointerVariable extends Variable {
+ FunctionPointerVariable() {
+ this.getType() instanceof FunctionPointerType
+ }
+}
+
+/**
+ * A C/C++ function pointer member variable.
+ */
+class FunctionPointerMemberVariable extends MemberVariable {
+ FunctionPointerMemberVariable() {
+ this instanceof FunctionPointerVariable
+ }
+}
+
+/**
+ * A C++14 variable template.
+ */
+class TemplateVariable extends Variable {
+ TemplateVariable() { is_variable_template(this) }
+ Variable getAnInstantiation() { result.isConstructedFrom(this) }
+}
+
+/**
+ * A non-static local variable or parameter that is not part of an
+ * uninstantiated template. Uninstantiated templates are purely syntax, and
+ * only on instantiation will they be complete with information about types,
+ * conversions, call targets, etc.
+ */
+class SemanticStackVariable extends LocalScopeVariable {
+ SemanticStackVariable() {
+ not this.isStatic() and
+ not this.isFromUninstantiatedTemplate(_)
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/XML.qll b/cpp/ql/src/semmle/code/cpp/XML.qll
new file mode 100644
index 000000000000..eaa2eefb8f9f
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/XML.qll
@@ -0,0 +1,282 @@
+/**
+ * A library for working with XML files and their content.
+ */
+
+import semmle.code.cpp.Location
+
+/** An XML element that has a location. */
+abstract class XMLLocatable extends @xmllocatable {
+ /** The source location for this element. */
+ Location getLocation() { xmllocations(this,result) }
+
+ /**
+ * Whether this element has the specified location information,
+ * including file path, start line, start column, end line and end column.
+ */
+ predicate hasLocationInfo(string filepath, int startline, int startcolumn, int endline, int endcolumn) {
+ exists(File f, Location l | l = this.getLocation() |
+ locations_default(l,f,startline,startcolumn,endline,endcolumn) and
+ filepath = f.getAbsolutePath()
+ )
+ }
+
+ /** A printable representation of this element. */
+ abstract string toString();
+}
+
+/**
+ * An `XMLParent` is either an `XMLElement` or an `XMLFile`,
+ * both of which can contain other elements.
+ */
+class XMLParent extends @xmlparent {
+ /**
+ * A printable representation of this XML parent.
+ * (Intended to be overridden in subclasses.)
+ */
+ abstract string getName();
+
+ /** The file to which this XML parent belongs. */
+ XMLFile getFile() { result = this or xmlElements(this,_,_,_,result) }
+
+ /** The child element at a specified index of this XML parent. */
+ XMLElement getChild(int index) { xmlElements(result, _, this, index, _) }
+
+ /** A child element of this XML parent. */
+ XMLElement getAChild() { xmlElements(result,_,this,_,_) }
+
+ /** A child element of this XML parent with the given `name`. */
+ XMLElement getAChild(string name) { xmlElements(result,_,this,_,_) and result.hasName(name) }
+
+ /** A comment that is a child of this XML parent. */
+ XMLComment getAComment() { xmlComments(result,_,this,_) }
+
+ /** A character sequence that is a child of this XML parent. */
+ XMLCharacters getACharactersSet() { xmlChars(result,_,this,_,_,_) }
+
+ /** The depth in the tree. (Overridden in XMLElement.) */
+ int getDepth() { result = 0 }
+
+ /** The number of child XML elements of this XML parent. */
+ int getNumberOfChildren() {
+ result = count(XMLElement e | xmlElements(e,_,this,_,_))
+ }
+
+ /** The number of places in the body of this XML parent where text occurs. */
+ int getNumberOfCharacterSets() {
+ result = count(int pos | xmlChars(_,_,this,pos,_,_))
+ }
+
+ /**
+ * Append the character sequences of this XML parent from left to right, separated by a space,
+ * up to a specified (zero-based) index.
+ */
+ string charsSetUpTo(int n) {
+ (n = 0 and xmlChars(_,result,this,0,_,_)) or
+ (n > 0 and exists(string chars | xmlChars(_,chars,this,n,_,_) |
+ result = this.charsSetUpTo(n-1) + " " + chars))
+ }
+
+ /** Append all the character sequences of this XML parent from left to right, separated by a space. */
+ string allCharactersString() {
+ exists(int n | n = this.getNumberOfCharacterSets() |
+ (n = 0 and result = "") or
+ (n > 0 and result = this.charsSetUpTo(n-1))
+ )
+ }
+
+ /** The text value contained in this XML parent. */
+ string getTextValue() {
+ result = allCharactersString()
+ }
+
+ /** A printable representation of this XML parent. */
+ string toString() { result = this.getName() }
+}
+
+/** An XML file. */
+class XMLFile extends XMLParent, File {
+ XMLFile() {
+ xmlEncoding(this,_)
+ }
+
+ /** A printable representation of this XML file. */
+ override
+ string toString() { result = XMLParent.super.toString() }
+
+ /** The name of this XML file. */
+ override
+ string getName() { files(this,result,_,_,_) }
+
+ /** The path of this XML file. */
+ string getPath() { files(this,_,result,_,_) }
+
+ /** The path of the folder that contains this XML file. */
+ string getFolder() {
+ result = this.getPath().substring(0, this.getPath().length()-this.getName().length())
+ }
+
+ /** The encoding of this XML file. */
+ string getEncoding() { xmlEncoding(this,result) }
+
+ /** The XML file itself. */
+ override
+ XMLFile getFile() { result = this }
+
+ /** A top-most element in an XML file. */
+ XMLElement getARootElement() { result = this.getAChild() }
+
+ /** A DTD associated with this XML file. */
+ XMLDTD getADTD() { xmlDTDs(result,_,_,_,this) }
+}
+
+/** A "Document Type Definition" of an XML file. */
+class XMLDTD extends @xmldtd {
+ /** The name of the root element of this DTD. */
+ string getRoot() { xmlDTDs(this,result,_,_,_) }
+
+ /** The public ID of this DTD. */
+ string getPublicId() { xmlDTDs(this,_,result,_,_) }
+
+ /** The system ID of this DTD. */
+ string getSystemId() { xmlDTDs(this,_,_,result,_) }
+
+ /** Whether this DTD is public. */
+ predicate isPublic() { not xmlDTDs(this,_,"",_,_) }
+
+ /** The parent of this DTD. */
+ XMLParent getParent() { xmlDTDs(this,_,_,_,result) }
+
+ /** A printable representation of this DTD. */
+ string toString() {
+ (this.isPublic() and result = this.getRoot() + " PUBLIC '" +
+ this.getPublicId() + "' '" +
+ this.getSystemId() + "'") or
+ (not this.isPublic() and result = this.getRoot() +
+ " SYSTEM '" +
+ this.getSystemId() + "'")
+ }
+}
+
+/** An XML tag in an XML file. */
+class XMLElement extends @xmlelement, XMLParent, XMLLocatable {
+ /** Whether this XML element has the given `name`. */
+ predicate hasName(string name) { name = getName() }
+
+ /** The name of this XML element. */
+ override
+ string getName() { xmlElements(this,result,_,_,_) }
+
+ /** The XML file in which this XML element occurs. */
+ override
+ XMLFile getFile() { xmlElements(this,_,_,_,result) }
+
+ /** The parent of this XML element. */
+ XMLParent getParent() { xmlElements(this,_,result,_,_) }
+
+ /** The index of this XML element among its parent's children. */
+ int getIndex() { xmlElements(this, _, _, result, _) }
+
+ /** Whether this XML element has a namespace. */
+ predicate hasNamespace() { xmlHasNs(this,_,_) }
+
+ /** The namespace of this XML element, if any. */
+ XMLNamespace getNamespace() { xmlHasNs(this,result,_) }
+
+ /** The index of this XML element among its parent's children. */
+ int getElementPositionIndex() { xmlElements(this,_,_,result,_) }
+
+ /** The depth of this element within the XML file tree structure. */
+ override
+ int getDepth() { result = this.getParent().getDepth() + 1 }
+
+ /** An XML attribute of this XML element. */
+ XMLAttribute getAnAttribute() { result.getElement() = this }
+
+ /** The attribute with the specified `name`, if any. */
+ XMLAttribute getAttribute(string name) {
+ result.getElement() = this and result.getName() = name
+ }
+
+ /** Whether this XML element has an attribute with the specified `name`. */
+ predicate hasAttribute(string name) {
+ exists(XMLAttribute a| a = this.getAttribute(name))
+ }
+
+ /** The value of the attribute with the specified `name`, if any. */
+ string getAttributeValue(string name) {
+ result = this.getAttribute(name).getValue()
+ }
+
+ /** A printable representation of this XML element. */
+ override
+ string toString() { result = XMLParent.super.toString() }
+}
+
+/** An attribute that occurs inside an XML element. */
+class XMLAttribute extends @xmlattribute, XMLLocatable {
+ /** The name of this attribute. */
+ string getName() { xmlAttrs(this,_,result,_,_,_) }
+
+ /** The XML element to which this attribute belongs. */
+ XMLElement getElement() { xmlAttrs(this,result,_,_,_,_) }
+
+ /** Whether this attribute has a namespace. */
+ predicate hasNamespace() { xmlHasNs(this,_,_) }
+
+ /** The namespace of this attribute, if any. */
+ XMLNamespace getNamespace() { xmlHasNs(this,result,_) }
+
+ /** The value of this attribute. */
+ string getValue() { xmlAttrs(this,_,_,result,_,_) }
+
+ /** A printable representation of this XML attribute. */
+ override string toString() { result = this.getName() + "=" + this.getValue() }
+}
+
+/** A namespace used in an XML file */
+class XMLNamespace extends @xmlnamespace {
+ /** The prefix of this namespace. */
+ string getPrefix() { xmlNs(this,result,_,_) }
+
+ /** The URI of this namespace. */
+ string getURI() { xmlNs(this,_,result,_) }
+
+ /** Whether this namespace has no prefix. */
+ predicate isDefault() { this.getPrefix() = "" }
+
+ /** A printable representation of this XML namespace. */
+ string toString() {
+ (this.isDefault() and result = this.getURI()) or
+ (not this.isDefault() and result = this.getPrefix() + ":" + this.getURI())
+ }
+}
+
+/** A comment of the form `` is an XML comment. */
+class XMLComment extends @xmlcomment, XMLLocatable {
+ /** The text content of this XML comment. */
+ string getText() { xmlComments(this,result,_,_) }
+
+ /** The parent of this XML comment. */
+ XMLParent getParent() { xmlComments(this,_,result,_) }
+
+ /** A printable representation of this XML comment. */
+ override string toString() { result = this.getText() }
+}
+
+/**
+ * A sequence of characters that occurs between opening and
+ * closing tags of an XML element, excluding other elements.
+ */
+class XMLCharacters extends @xmlcharacters, XMLLocatable {
+ /** The content of this character sequence. */
+ string getCharacters() { xmlChars(this,result,_,_,_,_) }
+
+ /** The parent of this character sequence. */
+ XMLParent getParent() { xmlChars(this,_,result,_,_,_) }
+
+ /** Whether this character sequence is CDATA. */
+ predicate isCDATA() { xmlChars(this,_,_,_,1,_) }
+
+ /** A printable representation of this XML character sequence. */
+ override string toString() { result = this.getCharacters() }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/commons/Alloc.qll b/cpp/ql/src/semmle/code/cpp/commons/Alloc.qll
new file mode 100644
index 000000000000..e0a3f5427313
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/commons/Alloc.qll
@@ -0,0 +1,118 @@
+import cpp
+
+/**
+ * A library routine that allocates memory.
+ */
+predicate allocationFunction(Function f)
+{
+ exists(string name |
+ f.hasQualifiedName(name) and
+ (
+ name = "malloc" or
+ name = "calloc" or
+ name = "realloc" or
+ name = "strdup" or
+ name = "wcsdup" or
+ name = "_strdup" or
+ name = "_wcsdup" or
+ name = "_mbsdup"
+ )
+ )
+}
+
+/**
+ * A call to a library routine that allocates memory.
+ */
+predicate allocationCall(FunctionCall fc)
+{
+ allocationFunction(fc.getTarget()) and
+ (
+ // realloc(ptr, 0) only frees the pointer
+ fc.getTarget().hasQualifiedName("realloc") implies
+ not fc.getArgument(1).getValue() = "0"
+ )
+}
+
+/**
+ * A library routine that frees memory.
+ */
+predicate freeFunction(Function f, int argNum)
+{
+ exists(string name |
+ f.hasQualifiedName(name) and
+ (
+ (name = "free" and argNum = 0) or
+ (name = "realloc" and argNum = 0)
+ )
+ )
+}
+
+/**
+ * A call to a library routine that frees memory.
+ */
+predicate freeCall(FunctionCall fc, Expr arg)
+{
+ exists(int argNum |
+ freeFunction(fc.getTarget(), argNum) and
+ arg = fc.getArgument(argNum)
+ )
+}
+
+/**
+ * Is e some kind of allocation or deallocation (`new`, `alloc`, `realloc`, `delete`, `free` etc)?
+ */
+predicate isMemoryManagementExpr(Expr e) {
+ isAllocationExpr(e) or isDeallocationExpr(e)
+}
+
+/**
+ * Is e an allocation from stdlib.h (`malloc`, `realloc` etc)?
+ */
+predicate isStdLibAllocationExpr(Expr e)
+{
+ allocationCall(e)
+}
+
+/**
+ * Is e some kind of allocation (`new`, `alloc`, `realloc` etc)?
+ */
+predicate isAllocationExpr(Expr e) {
+ allocationCall(e)
+ or e instanceof NewExpr
+ or e instanceof NewArrayExpr
+}
+
+/**
+ * Is e some kind of allocation (`new`, `alloc`, `realloc` etc) with a fixed size?
+ */
+predicate isFixedSizeAllocationExpr(Expr allocExpr, int size) {
+exists (FunctionCall fc, string name | fc = allocExpr and name = fc.getTarget().getName() |
+ (
+ name = "malloc" and
+ size = fc.getArgument(0).getValue().toInt()
+ ) or (
+ name = "alloca" and
+ size = fc.getArgument(0).getValue().toInt()
+ ) or (
+ name = "calloc" and
+ size = fc.getArgument(0).getValue().toInt() * fc.getArgument(1).getValue().toInt()
+ ) or (
+ name = "realloc" and
+ size = fc.getArgument(1).getValue().toInt() and
+ size > 0 // realloc(ptr, 0) only frees the pointer
+ )
+ ) or (
+ size = allocExpr.(NewExpr).getAllocatedType().getSize()
+ ) or (
+ size = allocExpr.(NewArrayExpr).getAllocatedType().getSize()
+ )
+}
+
+/**
+ * Is e some kind of deallocation (`delete`, `free`, `realloc` etc)?
+ */
+predicate isDeallocationExpr(Expr e) {
+ freeCall(e, _)
+ or e instanceof DeleteExpr
+ or e instanceof DeleteArrayExpr
+}
diff --git a/cpp/ql/src/semmle/code/cpp/commons/Assertions.qll b/cpp/ql/src/semmle/code/cpp/commons/Assertions.qll
new file mode 100644
index 000000000000..3c5cb96962b0
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/commons/Assertions.qll
@@ -0,0 +1,73 @@
+import cpp
+
+/**
+ * An assertion, that is, a condition that is only false if there is a bug in
+ * the program. To add support for more, define additional subclasses. A
+ * typical subclass will extend extend either `MacroInvocation` (for assertion
+ * macros) or `FunctionCall` (for assertion functions).
+ */
+abstract class Assertion extends Locatable {
+ /** Gets the expression whose truth is being asserted. */
+ abstract Expr getAsserted();
+}
+
+/**
+ * A libc assert, as defined in assert.h. A macro with the head
+ * "assert(expr)" that expands to a conditional expression which
+ * may terminate the program.
+ */
+class LibcAssert extends MacroInvocation, Assertion {
+
+ LibcAssert() {
+ this.getMacro().getHead() = "assert(expr)"
+ }
+
+ override Expr getAsserted() {
+ exists(ConditionalExpr ce | this.getAGeneratedElement() = ce |
+ result = ce.getCondition())
+ }
+}
+
+/**
+ * A macro assert that expands to an if statement; the head is taken
+ * to be "Assert(x, y)", but further alternatives could be added.
+ */
+class MacroAssert extends MacroInvocation, Assertion {
+
+ MacroAssert() {
+ this.getMacro().getHead() = "Assert(x, y)"
+ }
+
+ override Expr getAsserted() {
+ exists(IfStmt i | this.getAGeneratedElement() = i |
+ result = i.getCondition())
+ }
+}
+
+/**
+ * An assertion that is not completely disabled in release builds but returns a
+ * Boolean value to enable recovery from unexpected anomalous behavior. This
+ * style of assert is advocated by the _Power of 10_ rules and the _NASA JPL
+ * Coding Standard_.
+ */
+class RecoverableAssert extends MacroInvocation, Assertion {
+ RecoverableAssert() {
+ this.getMacro().getHead().matches("c\\_assert(%")
+ }
+
+ private
+ Expr getAnAssertedExpr() {
+ result = this.getAGeneratedElement() and
+ not result.getLocation().getStartColumn() = this.getLocation().getStartColumn()
+ }
+
+ override Expr getAsserted() {
+ result = this.getAnAssertedExpr() and
+ not result.getParent() = this.getAnAssertedExpr() and
+ // Remove spurious "string literals" that arise when the macro
+ // uses #stringification
+ not result.(Literal).getType().getUnspecifiedType().(ArrayType).getBaseType() instanceof CharType
+ }
+}
+
+/* More assertion definitions go here. */
diff --git a/cpp/ql/src/semmle/code/cpp/commons/Buffer.qll b/cpp/ql/src/semmle/code/cpp/commons/Buffer.qll
new file mode 100644
index 000000000000..b184832e1661
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/commons/Buffer.qll
@@ -0,0 +1,103 @@
+import cpp
+
+/**
+ * Holds if `sizeof(s)` occurs as part of the parameter of a dynamic
+ * memory allocation (`malloc`, `realloc`, etc.), except if `sizeof(s)`
+ * only ever occurs as the immediate parameter to allocations.
+ *
+ * For example, holds for `s` if it occurs as
+ * ```
+ * malloc(sizeof(s) + 100 * sizeof(char))
+ * ```
+ * but not if it only ever occurs as
+ * ```
+ * malloc(sizeof(s))
+ * ```
+*/
+private predicate isDynamicallyAllocatedWithDifferentSize(Class s) {
+ exists(SizeofTypeOperator sof |
+ sof.getTypeOperand().getUnspecifiedType() = s |
+ // Check all ancestor nodes except the immediate parent for
+ // allocations.
+ isStdLibAllocationExpr(sof.getParent().(Expr).getParent+())
+ )
+}
+
+/**
+ * Holds if `v` is a member variable of `c` that looks like it might be variable sized in practice. For
+ * example:
+ * ```
+ * struct myStruct { // c
+ * int amount;
+ * char data[1]; // v
+ * };
+ * ```
+ * This requires that `v` is an array of size 0 or 1, and `v` is the last member of `c`. In addition,
+ * there must be at least one instance where a `c` pointer is allocated with additional space.
+ */
+predicate memberMayBeVarSize(Class c, MemberVariable v) {
+ exists(int i |
+ i = max(int j | c.getCanonicalMember(j) instanceof Field | j) and
+ v = c.getCanonicalMember(i) and
+ v.getType().getUnspecifiedType().(ArrayType).getSize() <= 1
+ ) and
+ isDynamicallyAllocatedWithDifferentSize(c)
+}
+
+/**
+ * Get the size in bytes of the buffer pointed to by an expression (if this can be determined).
+ */
+int getBufferSize(Expr bufferExpr, Element why) {
+ exists(Variable bufferVar | bufferVar = bufferExpr.(VariableAccess).getTarget() |
+ (
+ // buffer is a fixed size array
+ result = bufferVar.getType().getUnspecifiedType().(ArrayType).getSize() and
+ why = bufferVar and
+ not memberMayBeVarSize(_, bufferVar)
+ ) or (
+ // buffer is an initialized array
+ // e.g. int buffer[] = {1, 2, 3};
+ why = bufferVar.getInitializer().getExpr() and
+ result = why.(Expr).getType().(ArrayType).getSize() and
+ not exists(bufferVar.getType().getUnspecifiedType().(ArrayType).getSize())
+ ) or exists(Class parentClass, VariableAccess parentPtr |
+ // buffer is the parentPtr->bufferVar of a 'variable size struct'
+ memberMayBeVarSize(parentClass, bufferVar) and
+ why = bufferVar and
+ parentPtr = bufferExpr.(VariableAccess).getQualifier() and
+ parentPtr.getTarget().getType().getUnspecifiedType().(PointerType).getBaseType() = parentClass and
+ result =
+ getBufferSize(parentPtr, _) +
+ bufferVar.getType().getSize() -
+ parentClass.getSize()
+ )
+ ) or exists(Expr def |
+ // buffer is assigned with an allocation
+ definitionUsePair(_, def, bufferExpr) and
+ exprDefinition(_, def, why) and
+ isFixedSizeAllocationExpr(why, result)
+ ) or exists(Expr def, Expr e, Element why2 |
+ // buffer is assigned with another buffer
+ definitionUsePair(_, def, bufferExpr) and
+ exprDefinition(_, def, e) and
+ result = getBufferSize(e, why2) and
+ (
+ why = def or
+ why = why2
+ )
+ ) or exists(Type bufferType |
+ // buffer is the address of a variable
+ why = bufferExpr.(AddressOfExpr).getAddressable() and
+ bufferType = why.(Variable).getType() and
+ result = bufferType.getSize() and
+ not bufferType instanceof ReferenceType and
+ not any(Union u).getAMemberVariable() = why
+ ) or exists(Union bufferType |
+ // buffer is the address of a union member; in this case, we
+ // take the size of the union itself rather the union member, since
+ // it's usually OK to access that amount (e.g. clearing with memset).
+ why = bufferExpr.(AddressOfExpr).getAddressable() and
+ bufferType.getAMemberVariable() = why and
+ result = bufferType.getSize()
+ )
+}
diff --git a/cpp/ql/src/semmle/code/cpp/commons/CommonType.qll b/cpp/ql/src/semmle/code/cpp/commons/CommonType.qll
new file mode 100644
index 000000000000..99496da0cf70
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/commons/CommonType.qll
@@ -0,0 +1,153 @@
+import semmle.code.cpp.Type
+
+/**
+ * The C/C++ char* type.
+ */
+class CharPointerType extends PointerType {
+
+ CharPointerType() { this.getBaseType() instanceof CharType }
+
+}
+
+/**
+ * The C/C++ int* type.
+ */
+class IntPointerType extends PointerType {
+
+ IntPointerType() { this.getBaseType() instanceof IntType }
+
+}
+
+
+/**
+ * The C/C++ void* type.
+ */
+class VoidPointerType extends PointerType {
+
+ VoidPointerType() { this.getBaseType() instanceof VoidType }
+
+}
+
+/**
+ * The C/C++ size_t type.
+ */
+class Size_t extends Type {
+ Size_t() {
+ this.getUnderlyingType() instanceof IntegralType and
+ this.hasName("size_t")
+ }
+}
+
+/**
+ * The C/C++ ssize_t type.
+ */
+class Ssize_t extends Type {
+ Ssize_t() {
+ this.getUnderlyingType() instanceof IntegralType and
+ this.hasName("ssize_t")
+ }
+}
+
+/**
+ * The C/C++ ptrdiff_t type.
+ */
+class Ptrdiff_t extends Type {
+ Ptrdiff_t() {
+ this.getUnderlyingType() instanceof IntegralType and
+ this.hasName("ptrdiff_t")
+ }
+}
+
+/**
+ * The C/C++ intmax_t type.
+ */
+class Intmax_t extends Type {
+ Intmax_t() {
+ this.getUnderlyingType() instanceof IntegralType and
+ this.hasName("intmax_t")
+ }
+}
+
+/**
+ * The C/C++ uintmax_t type.
+ */
+class Uintmax_t extends Type {
+ Uintmax_t() {
+ this.getUnderlyingType() instanceof IntegralType and
+ this.hasName("uintmax_t")
+ }
+}
+
+/**
+ * The C/C++ wchar_t type.
+ */
+class Wchar_t extends Type {
+ Wchar_t() {
+ this.getUnderlyingType() instanceof IntegralType and
+ this.hasName("wchar_t")
+ }
+}
+
+/**
+ * The type that the Microsoft C/C++ `__int8` type specifier is a
+ * synonym for. Note that since `__int8` is not a distinct type,
+ * `MicrosoftInt8Type` corresponds to an existing `IntegralType` as
+ * well.
+ *
+ * This class is meaningless if a Microsoft compiler was not used.
+ */
+class MicrosoftInt8Type extends IntegralType {
+ MicrosoftInt8Type() {
+ this instanceof CharType and
+ not isExplicitlyUnsigned() and
+ not isExplicitlySigned()
+ }
+}
+
+/**
+ * The type that the Microsoft C/C++ `__int16` type specifier is a
+ * synonym for. Note that since `__int16` is not a distinct type,
+ * `MicrosoftInt16Type` corresponds to an existing `IntegralType` as
+ * well.
+ *
+ * This class is meaningless if a Microsoft compiler was not used.
+ */
+class MicrosoftInt16Type extends IntegralType {
+ MicrosoftInt16Type() {
+ this instanceof ShortType and
+ not isExplicitlyUnsigned() and
+ not isExplicitlySigned()
+ }
+}
+
+/**
+ * The type that the Microsoft C/C++ `__int32` type specifier is a
+ * synonym for. Note that since `__int32` is not a distinct type,
+ * `MicrosoftInt32Type` corresponds to an existing `IntegralType` as
+ * well.
+ *
+ * This class is meaningless if a Microsoft compiler was not used.
+ */
+class MicrosoftInt32Type extends IntegralType {
+ MicrosoftInt32Type() {
+ this instanceof IntType and
+ not isExplicitlyUnsigned() and
+ not isExplicitlySigned()
+ }
+}
+
+/**
+ * The type that the Microsoft C/C++ `__int64` type specifier is a
+ * synonym for. Note that since `__int64` is not a distinct type,
+ * `MicrosoftInt64Type` corresponds to an existing `IntegralType` as
+ * well.
+ *
+ * This class is meaningless if a Microsoft compiler was not used.
+ */
+class MicrosoftInt64Type extends IntegralType {
+ MicrosoftInt64Type() {
+ this instanceof LongLongType and
+ not isExplicitlyUnsigned() and
+ not isExplicitlySigned()
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/commons/Dependency.qll b/cpp/ql/src/semmle/code/cpp/commons/Dependency.qll
new file mode 100644
index 000000000000..3c12621ef7c1
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/commons/Dependency.qll
@@ -0,0 +1,523 @@
+import semmle.code.cpp.Element
+import semmle.code.cpp.Declaration
+import semmle.code.cpp.Function
+import semmle.code.cpp.Variable
+
+/**
+ * Options that control the dependencies generated by
+ * this library.
+ */
+class DependencyOptions extends string
+{
+ DependencyOptions() {
+ this = "DependencyOptions"
+ }
+
+ /**
+ * Holds if dependencies should only be generated in templates rather than
+ * in both templates and instantiations, where possible. This is expensive
+ * to compute, but tends to produce dependencies that are easier to read.
+ */
+ cached predicate preferTemplateDeps() {
+ any()
+ }
+}
+
+/**
+ * Gets the `DependencyOptions`.
+ */
+DependencyOptions getDependencyOptions()
+{
+ any()
+}
+
+/**
+ * An Element that can be the source of a transitive dependency. This is any
+ * Element that is not in a template instantiation, plus declarations of template
+ * specializations (even though they are technically in an instantiation) because
+ * we need to generate (at least) a dependency from them to the general declaration.
+ */
+class DependsSource extends Element {
+ DependsSource() {
+ // not inside a template instantiation
+ not exists(Element other | isFromTemplateInstantiation(other)) or
+
+ // allow DeclarationEntrys of template specializations
+ this.(DeclarationEntry).getDeclaration().(Function).isConstructedFrom(_) or
+ this.(DeclarationEntry).getDeclaration().(Class).isConstructedFrom(_)
+ }
+}
+
+/**
+ * A program element which can be the target of inter-function or inter-file dependencies.
+ *
+ * This is the union of Declaration, DeclarationEntry and Macro, minus various kinds of declaration:
+ * * FriendDecl is not included, as a friend declaration cannot be the target of a dependency (nor, as it happens, can they be a source).
+ * * TemplateParameter and related UserTypes are not included, as they are intrinsic sub-components of their associated template.
+ * * Template instantiations are excluded, as the template itself is more useful as a dependency target.
+ * * Stack variables and local types are excluded, as they are lexically tied to their enclosing function, and intra-function dependencies
+ * can only be inter-file dependencies in pathological cases.
+ * * Builtin functions and macros are excluded, as dependencies on them do not translate to inter-file dependencies (note that static functions
+ * and declarations within anonymous namespaces cannot be excluded for this reason, as the declaration can be in a header).
+ * * DeclarationEntrys are only needed if they're not definitions, for the definition to declaration dependency.
+ */
+class Symbol extends DependsSource {
+ Symbol() {
+ (
+ exists(EnumConstant ec | this = ec and not ec.getDeclaringEnum() instanceof LocalEnum) or
+ (this instanceof Macro and this.getFile().getAbsolutePath() != "") or
+ (this instanceof DeclarationEntry and
+ not this.(VariableDeclarationEntry).getVariable() instanceof LocalScopeVariable and
+ not this.(FunctionDeclarationEntry).getFunction() instanceof BuiltInFunction and
+ not this.(TypeDeclarationEntry).getType() instanceof LocalEnum and
+ not this.(TypeDeclarationEntry).getType() instanceof LocalClass and
+ not this.(TypeDeclarationEntry).getType() instanceof LocalTypedefType and
+ not this.(TypeDeclarationEntry).getType() instanceof TemplateParameter
+ ) or
+ (this instanceof NamespaceDeclarationEntry)
+ )
+ }
+
+ /**
+ * Gets an element which depends upon this symbol.
+ *
+ * To a first approximation, dependent elements can be thought of as occurrences of the symbol's name: instances of `VariableAccess`
+ * for `Variable` symbols, instances of `MacroInvocation` for `Macro` symbols, and so on.
+ *
+ * category:
+ * 1 - C/C++ compile-time dependency
+ * 2 - C/C++ link-time dependency (or transitive dependency with a link-time component)
+ */
+ cached
+ Element getADependentElement(int category) {
+ dependsOnFull(result, this, category)
+ }
+}
+
+/**
+ * Associates a Declaration with it's DeclarationEntries, or (for a template
+ * instantiation) with the DeclarationEntries of its template.
+ */
+cached predicate getDeclarationEntries(Declaration decl, DeclarationEntry de)
+{
+ (
+ decl = de.getDeclaration() or
+ decl.(Function).isConstructedFrom(de.getDeclaration()) or
+ decl.(Class).isConstructedFrom(de.getDeclaration())
+ ) and
+ /*
+ * ParameterDeclarationEntries are special, as (a) they can only be accessed
+ * from within the definition, and (b) non-definition PDEs may be commonly
+ * included. Thus, for PDEs, we point only to the definition.
+ */
+ (de instanceof ParameterDeclarationEntry implies de.isDefinition())
+}
+
+/**
+ * A 'simple' dependency from src to dest. This type of dependency
+ * does not make any special account of templates.
+ *
+ * Consider using Symbol.getADependentElement() rather than directly
+ * accessing this predicate.
+ */
+predicate dependsOnSimple(Element src, Element dest) {
+ dependsOnSimpleInline(src, dest) or
+ dependency_macroUse(src, dest)
+}
+
+/**
+ * A 'simple' dependency that might be inlined.
+ */
+private
+predicate dependsOnSimpleInline(Element src, Element dest) {
+ dependency_functionUse(src, dest) or
+ dependency_typeUse(src, dest) or
+ dependency_variableUse(src, dest) or
+ dependency_usingDeclaration(src, dest) or
+ dependency_usingNamespace(src, dest) or
+ dependency_enumConstantUse(src, dest) or
+ dependency_outOfLineDeclaration(src, dest) or
+ dependency_outOfLineInitializer(src, dest) or
+ dependency_functionSpecialization(src, dest) or
+ dependency_classSpecialization(src, dest)
+}
+
+/**
+ * Holds if a simple, non-template dependency exists between two Locations
+ * specified by the parameters.
+ */
+private predicate dependsLocation(File f1, int sl1, int sc1, int el1, int ec1, File f2, int sl2, int sc2, int el2, int ec2) {
+ exists(Element src, Element dest, Location loc1, Location loc2 |
+ dependsOnSimpleInline(src, dest) and
+ src instanceof DependsSource and
+ loc1 = src.getLocation() and
+ f1 = loc1.getFile() and
+ sl1 = loc1.getStartLine() and
+ sc1 = loc1.getStartColumn() and
+ el1 = loc1.getEndLine() and
+ ec1 = loc1.getEndColumn() and
+ loc2 = dest.getLocation() and
+ f2 = loc2.getFile() and
+ sl2 = loc2.getStartLine() and
+ sc2 = loc2.getStartColumn() and
+ el2 = loc2.getEndLine() and
+ ec2 = loc2.getEndColumn()
+ )
+}
+
+/**
+ * Holds if a simple dependency from `loc` to `loc2` in a template has a
+ * non-template alternative?
+ * (if `DependencyOptions.preferTemplateDeps()` is enabled)
+ */
+private predicate dependsNonTemplateAlternative(Location loc1, Location loc2) {
+ getDependencyOptions().preferTemplateDeps() and
+ exists(Element src, Element dest |
+ dependsOnSimpleInline(src, dest) and
+ src.isFromTemplateInstantiation(_) and
+ src.getLocation() = loc1 and
+ dest.getLocation() = loc2
+ ) and
+ dependsLocation(loc1.getFile(), loc1.getStartLine(), loc1.getStartColumn(), loc1.getEndLine(), loc1.getEndColumn(), loc2.getFile(), loc2.getStartLine(), loc2.getStartColumn(), loc2.getEndLine(), loc2.getEndColumn())
+}
+
+/**
+ * A simple dependency from src to a declaration dest, where the definition is not
+ * needed at compile time.
+ */
+predicate dependsOnDeclOnly(Element src, Element dest) {
+ dependency_functionUse(src, dest) or
+ dependency_variableUse(src, dest) or
+ dependency_pointerTypeUse(src, dest)
+}
+
+/**
+ * A dependency from src to dest. This predicate inlines
+ * template dependencies.
+ */
+private predicate dependsOnViaTemplate(Declaration src, Element dest) {
+ // A template instantiation depends on everything that anything
+ // inside it depends upon. This effectively inlines the things
+ // inside at the point where the template is called or
+ // referenced.
+ exists(Element internal, Location internalLocation, Location destLocation |
+ // internal is an element in the template {function or class} instantiation that cannot
+ // itself be a transitive dependency source
+ internal.isFromTemplateInstantiation(src) and
+
+ // don't generate template dependencies through a member function of a template class;
+ // these dependencies are also generated through the class, which has to be referenced
+ // somewhere anyway.
+ not exists(Class c |
+ internal.isFromTemplateInstantiation(c) and
+ src.getDeclaringType() = c
+ ) and
+
+ // dest is anything that the internal element depends upon
+ dependsOnSimpleInline(internal, dest) and
+
+ // is there something in the template (not the instantiation) that's generating
+ // (better) dependencies from internal anyway?
+ internalLocation = internal.getLocation() and
+ destLocation = dest.getLocation() and
+ not dependsNonTemplateAlternative(internalLocation, destLocation)
+ )
+}
+
+/**
+ * Holds if `src` is related to `dest` by one `dependsOnSimple` and any
+ * number of `dependsOnViaTemplate` steps.
+ *
+ * Consider using `Symbol.getADependentElement()` rather than directly
+ * accessing this predicate.
+ */
+predicate dependsOnTransitive(DependsSource src, Element dest) {
+ exists(Element mid1 |
+ // begin with a simple step
+ dependsOnSimpleInline(src, mid1) and
+
+ // any number of recursive steps
+ (
+ mid1 = dest or // mid1 is not necessarily a Declaration
+ dependsOnViaTemplate+(mid1, dest)
+ )
+ ) or dependency_macroUse(src, dest)
+}
+
+/**
+ * A dependency that targets a TypeDeclarationEntry.
+ */
+private predicate dependsOnTDE(Element src, Type t, TypeDeclarationEntry dest) {
+ dependsOnTransitive(src, t) and
+ getDeclarationEntries(t, dest)
+}
+
+/**
+ * A dependency that targets a visible TypeDeclarationEntry.
+ */
+private pragma[noopt] predicate dependsOnVisibleTDE(Element src, Type t, TypeDeclarationEntry dest) {
+ dependsOnTDE(src, t, dest) and
+ exists(File g | g = dest.getFile() |
+ exists(File f | f = src.getFile() |
+ f.getAnIncludedFile*() = g
+ )
+ )
+}
+
+/**
+ * A dependency that targets a DeclarationEntry
+ */
+private predicate dependsOnDeclarationEntry(Element src, DeclarationEntry dest) {
+ exists(Type t |
+ // dependency from a Type use -> unique visible TDE
+ dependsOnVisibleTDE(src, t, dest) and
+ strictcount(TypeDeclarationEntry alt |
+ dependsOnVisibleTDE(src, t, alt)
+ ) = 1
+ ) or exists(TypedefType mid |
+ // dependency from a TypedefType use -> any (visible) TDE
+ dependsOnTransitive(src, mid) and
+ getDeclarationEntries(mid, (TypeDeclarationEntry)dest)
+ ) or exists(Declaration mid |
+ // dependency from a Variable / Function use -> any (visible) declaration entry
+ dependsOnTransitive(src, mid) and
+ not mid instanceof Type and
+ not mid instanceof EnumConstant and
+
+ getDeclarationEntries(mid, (DeclarationEntry)dest) and
+ not dest instanceof TypeDeclarationEntry
+ ) or exists(Declaration mid |
+ // dependency from a Type / Variable / Function use -> any (visible) definition
+ dependsOnTransitive(src, mid) and
+ not mid instanceof EnumConstant and
+
+ getDeclarationEntries(mid, (DeclarationEntry)dest) and
+
+ // must be definition
+ dest.(DeclarationEntry).isDefinition()
+ )
+}
+
+/**
+ * The full dependsOn relation, made up of dependsOnTransitive plus some logic
+ * to fix up the results for Declarations to most reasonable DeclarationEntrys.
+ */
+private predicate dependsOnFull(DependsSource src, Symbol dest, int category) {
+ (
+ // direct result
+ dependsOnTransitive(src, dest) and
+ category = 1
+ ) or (
+ // result to a visible DeclarationEntry
+ dependsOnDeclarationEntry(src, dest) and
+ src.getFile().getAnIncludedFile*() = dest.getFile() and
+ category = 1
+ ) or exists(Declaration mid |
+ // dependency from a Variable / Function use -> non-visible definition (link time)
+ dependsOnTransitive(src, mid) and
+ not mid instanceof EnumConstant and
+
+ getDeclarationEntries(mid, (DeclarationEntry)dest) and
+ not dest instanceof TypeDeclarationEntry and
+
+ // must be definition
+ dest.(DeclarationEntry).isDefinition() and
+
+ // must not be visible (else covered above)
+ not src.getFile().getAnIncludedFile*() = dest.getFile() and
+
+ // filter out FDEs that are only defined in the dummy link target
+ (
+ (
+ dest instanceof FunctionDeclarationEntry and
+ isLinkerAwareExtracted()
+ ) implies exists(LinkTarget lt | not lt.isDummy() |
+ lt.getAFunction() = dest.(FunctionDeclarationEntry).getFunction()
+ )
+ ) and
+
+ category = 2
+ )
+}
+
+/**
+ * A dependency caused by a function call / use.
+ */
+private
+predicate dependency_functionUse(Element src, Function dest) {
+ funbind(src, dest)
+}
+
+/**
+ * A Type which refers to a UserType.
+ */
+private cached predicate refersToUserType(Type a, UserType b) {
+ a.refersTo(b)
+}
+
+/**
+ * A Type which refers to a type directly, without using a pointer or reference.
+ */
+private predicate refersToDirectlyNonPointer(Type a, Type b) {
+ a.refersToDirectly(b) and
+ not a instanceof PointerType and
+ not a instanceof ReferenceType
+}
+
+/**
+ * A Type which refers to a UserType, but only through a pointer or reference.
+ */
+private cached predicate refersToUserTypePointer(Type a, UserType b) {
+ refersToUserType(a, b) and
+ not refersToDirectlyNonPointer*(a, b)
+}
+
+/**
+ * A dependency caused by a type use.
+ */
+private
+predicate dependency_typeUse(Element src, UserType dest) {
+ refersToUserType(typeUsedBy(src), dest)
+}
+
+/**
+ * A dependency caused by a pointer/reference type use only.
+ */
+predicate dependency_pointerTypeUse(Element src, UserType dest) {
+ refersToUserTypePointer(typeUsedBy(src), dest)
+}
+
+/**
+ * The Types that must be defined for a particular Element.
+ */
+private
+Type typeUsedBy(Element src) {
+ (
+ result = src.(VariableDeclarationEntry).getType() and not src.(VariableDeclarationEntry).getVariable().declaredUsingAutoType()
+ ) or (
+ result = src.(FunctionDeclarationEntry).getType()
+ ) or (
+ result = src.(Cast).getType() and not src.(Cast).isImplicit()
+ ) or (
+ result = src.(ClassDerivation).getBaseClass()
+ ) or (
+ result = src.(TypeDeclarationEntry).getType().(TypedefType).getBaseType()
+ ) or (
+ result = src.(TypeDeclarationEntry).getDeclaration().(Enum).getExplicitUnderlyingType()
+ ) or (
+ result = src.(SizeofTypeOperator).getTypeOperand()
+ ) or exists(Function f |
+ funbind(src, f) and result = f.getATemplateArgument()
+ ) or (
+ result = src.(NewExpr).getType() and not result.(Class).hasConstructor()
+ ) or (
+ result = src.(NewArrayExpr).getType() and not result.(ArrayType).getBaseType().(Class).hasConstructor()
+ ) or (
+ result = src.(DeleteExpr).getExpr().getType() and not result.(PointerType).getBaseType().(Class).hasDestructor()
+ ) or (
+ result = src.(DeleteArrayExpr).getExpr().getType() and not result.(PointerType).getBaseType().(Class).hasDestructor()
+ )
+}
+
+/**
+ * A dependency caused by a variable use.
+ */
+private
+predicate dependency_variableUse(VariableAccess src, Variable dest) {
+ src.getTarget() = dest and
+ not dest instanceof LocalScopeVariable
+}
+
+/**
+ * A dependency caused by an enum constant use.
+ */
+private
+predicate dependency_enumConstantUse(EnumConstantAccess src, EnumConstant dest) {
+ src.getTarget() = dest
+}
+
+/**
+ * A dependency caused by a macro access.
+ */
+private
+predicate dependency_macroUse(MacroAccess src, Macro dest) {
+ src.getMacro() = dest
+}
+
+/**
+ * A dependency caused by a 'using' declaration 'using X::Y'.
+ */
+private
+predicate dependency_usingDeclaration(UsingDeclarationEntry src, Declaration dest) {
+ src.getDeclaration() = dest
+}
+
+/**
+ * A dependency caused by a 'using' directive 'using namespace X'.
+ */
+private
+predicate dependency_usingNamespace(UsingDirectiveEntry src, NamespaceDeclarationEntry dest) {
+ exists(Namespace nsdecl |
+ nsdecl = src.getNamespace() and
+ dest.getNamespace() = nsdecl and
+ dest.getFile().getAnIncludedFile*() = src.getFile() and
+ (
+ dest.getFile() = src.getFile() implies
+ dest.getLocation().getStartLine() < src.getLocation().getStartLine()
+ ) and
+ none() // temporarily disabled until we have suitable UI in Architect
+ )
+}
+
+/**
+ * A dependency from the definition of a class member to a corresponding declaration. This
+ * ensures that an externally defined class member has a dependency on (something in) the
+ * class definition.
+ */
+private
+predicate dependency_outOfLineDeclaration(DeclarationEntry src, DeclarationEntry dest) {
+ src.getDeclaration().hasDeclaringType() and
+ src.isDefinition() and
+ (
+ dest.getDeclaration() = src.getDeclaration() or
+
+ // also permit out of line declarations to jump from the declaration of a specialized
+ // function to it's definition in the primary template. Note that the specialization
+ // in this case may be on a template class parameter.
+ src.getDeclaration().(Function).isConstructedFrom(dest.getDeclaration())
+ ) and
+ not dest.isDefinition()
+}
+
+/**
+ * A dependency from an initialization of a (static) class member to a corresponding
+ * declaration.
+ */
+private
+predicate dependency_outOfLineInitializer(Initializer src, DeclarationEntry dest) {
+ src.getDeclaration().hasDeclaringType() and
+ dest.getDeclaration() = src.getDeclaration() and
+ not dest.isDefinition()
+}
+
+/**
+ * A dependency from a template function specialization to the general one.
+ */
+private
+predicate dependency_functionSpecialization(DeclarationEntry src, DeclarationEntry dest) {
+ exists(FunctionTemplateSpecialization fts |
+ src.getDeclaration() = fts and
+ dest.getDeclaration() = fts.getPrimaryTemplate()
+ )
+}
+
+/**
+ * A dependency from a template class specialization to the most general one.
+ */
+private
+predicate dependency_classSpecialization(DeclarationEntry src, DeclarationEntry dest) {
+ exists(ClassTemplateSpecialization cts |
+ src.getDeclaration() = cts and
+ dest.getDeclaration() = cts.getPrimaryTemplate()
+ )
+}
diff --git a/cpp/ql/src/semmle/code/cpp/commons/Environment.qll b/cpp/ql/src/semmle/code/cpp/commons/Environment.qll
new file mode 100644
index 000000000000..d882f6f6e18e
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/commons/Environment.qll
@@ -0,0 +1,44 @@
+/**
+ * Reading from the environment, for example with 'getenv'.
+ */
+
+import cpp
+
+/**
+ * An expression that reads from an environment variable.
+ */
+class EnvironmentRead extends Expr {
+ EnvironmentRead() {
+ readsEnvironment(this, _)
+ }
+
+ /**
+ * The name of the environment variable.
+ */
+ string getEnvironmentVariable() {
+ // Conveniently, it's always the first argument to the call
+ this.(Call).getArgument(0).(TextLiteral).getValue() = result
+ }
+
+ /**
+ * A very short description of the source, suitable for use in
+ * an error message.
+ */
+ string getSourceDescription() {
+ readsEnvironment(this, result)
+ }
+}
+
+private predicate readsEnvironment(Expr read, string sourceDescription) {
+ exists(FunctionCall call, string name |
+ read = call and
+ call.getTarget().hasGlobalName(name) and
+ (name = "getenv" or name = "secure_getenv" or name = "_wgetenv") and
+ sourceDescription = name) or
+ exists(MessageExpr getObjectKey, MessageExpr getEnviron |
+ read = getObjectKey and
+ getObjectKey.getTarget().getQualifiedName().matches("NSDictionary%::-objectForKey:") and
+ getObjectKey.getQualifier() = getEnviron and
+ getEnviron.getTarget().getQualifiedName().matches("NSProcessInfo%:-environment") and
+ sourceDescription = "NSProcessInfo")
+}
diff --git a/cpp/ql/src/semmle/code/cpp/commons/File.qll b/cpp/ql/src/semmle/code/cpp/commons/File.qll
new file mode 100644
index 000000000000..602eccb33b05
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/commons/File.qll
@@ -0,0 +1,42 @@
+import cpp
+
+/**
+ * A call to a library function that opens a file.
+ */
+predicate fopenCall(FunctionCall fc)
+{
+ exists(Function f | f = fc.getTarget() |
+ f.hasQualifiedName("fopen") or
+ f.hasQualifiedName("open") or
+ f.hasQualifiedName("_open") or
+ f.hasQualifiedName("_wopen") or
+ f.hasQualifiedName("CreateFile") or
+ f.hasQualifiedName("CreateFileA") or
+ f.hasQualifiedName("CreateFileW") or
+ f.hasQualifiedName("CreateFileTransacted") or
+ f.hasQualifiedName("CreateFileTransactedA") or
+ f.hasQualifiedName("CreateFileTransactedW")
+ )
+}
+
+/**
+ * A call to a library function that closes a file.
+ */
+predicate fcloseCall(FunctionCall fc, Expr closed)
+{
+ exists(Function f | f = fc.getTarget() |
+ (
+ f.hasQualifiedName("fclose") and
+ closed = fc.getArgument(0)
+ ) or (
+ f.hasQualifiedName("close") and
+ closed = fc.getArgument(0)
+ ) or (
+ f.hasQualifiedName("_close") and
+ closed = fc.getArgument(0)
+ ) or (
+ f.hasQualifiedName("CloseHandle") and
+ closed = fc.getArgument(0)
+ )
+ )
+}
\ No newline at end of file
diff --git a/cpp/ql/src/semmle/code/cpp/commons/NULL.qll b/cpp/ql/src/semmle/code/cpp/commons/NULL.qll
new file mode 100644
index 000000000000..0204d752ecc7
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/commons/NULL.qll
@@ -0,0 +1,15 @@
+import semmle.code.cpp.Macro
+
+/** A macro defining NULL. */
+class NULLMacro extends Macro {
+ NULLMacro() {
+ this.getHead() = "NULL"
+ }
+}
+
+/** A use of the NULL macro. */
+class NULL extends Literal {
+ NULL() {
+ exists(NULLMacro nm | this = nm.getAnInvocation().getAnExpandedElement())
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/commons/NullTermination.qll b/cpp/ql/src/semmle/code/cpp/commons/NullTermination.qll
new file mode 100644
index 000000000000..7b27ea913a53
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/commons/NullTermination.qll
@@ -0,0 +1,124 @@
+import cpp
+private import semmle.code.cpp.models.interfaces.ArrayFunction
+private import semmle.code.cpp.models.implementations.Strcat
+
+private predicate mayAddNullTerminatorHelper(Expr e, VariableAccess va, Expr e0) {
+ exists(LocalScopeVariable v0, Expr val |
+ exprDefinition(v0, e, val) and
+ val.getAChild*() = va and
+ mayAddNullTerminator(e0, v0.getAnAccess())
+ )
+}
+
+/**
+ * Holds if the expression `e` may add a null terminator to the string in
+ * variable `v`.
+ */
+predicate mayAddNullTerminator(Expr e, VariableAccess va) {
+ // Assignment: dereferencing or array access
+ exists(AssignExpr ae |
+ e = ae |
+ (
+ // *v = x, *v++ = x, etc.
+ ae.getLValue().(PointerDereferenceExpr).getOperand().getAChild*() = va
+ or
+ // v[x] = y
+ ae.getLValue().(ArrayExpr).getArrayBase() = va
+ )
+ and
+ // Rule out assignments where the assigned value is a non-zero constant
+ not ae.getRValue().getFullyConverted().getValue().toInt() != 0
+ )
+ or
+ // Assignment to another stack variable
+ exists(Expr e0, BasicBlock bb, int pos, BasicBlock bb0, int pos0 |
+ mayAddNullTerminatorHelper(e, va, e0) and
+ bb.getNode(pos) = e and
+ bb0.getNode(pos0) = e0 |
+ bb = bb0 and pos < pos0
+ or
+ bb.getASuccessor+() = bb0
+ )
+ // Assignment to non-stack variable
+ or
+ exists(AssignExpr ae |
+ e = ae |
+ not ae.getLValue().(VariableAccess).getTarget() instanceof LocalScopeVariable and
+ ae.getRValue().getAChild*() = va
+ )
+ or
+ // Function call: library function, varargs function, function
+ // containing assembler code, or function where the relevant
+ // parameter is potentially added a null terminator.
+ exists(Call c, Function f, int i |
+ e = c and
+ f = c.getTarget() and
+ not functionArgumentMustBeNullTerminated(f, i) and
+ c.getAnArgumentSubExpr(i) = va |
+ not f.hasEntryPoint() and not functionArgumentMustBeNullTerminated(f, i) or
+ mayAddNullTerminator(_, f.getParameter(i).getAnAccess()) or
+ f.isVarargs() and i >= f.getNumberOfParameters() or
+ exists(AsmStmt s | s.getEnclosingFunction() = f)
+ )
+ or
+ // Call without target (e.g., function pointer call)
+ exists(Call c |
+ e = c and
+ not exists(c.getTarget()) and
+ c.getAnArgumentSubExpr(_) = va
+ )
+}
+
+/**
+ * Holds if `f` is a (library) function whose `i`th argument must be null
+ * terminated.
+ */
+predicate functionArgumentMustBeNullTerminated(Function f, int i) {
+ (
+ f.(ArrayFunction).hasArrayWithNullTerminator(i) and
+ f.(ArrayFunction).hasArrayInput(i)
+ )
+ or
+ f instanceof StrcatFunction and i = 0
+ or
+ f.hasName("strlen") and i = 0
+ or
+ f.hasName("strcmp") and i in [0 .. 1]
+ or
+ f.hasName("strchr") and i = 0
+ or
+ f.hasName("strstr") and i in [0 .. 1]
+}
+
+/**
+ * Holds if `va` is a variable access where the contents must be null terminated.
+ */
+predicate variableMustBeNullTerminated(VariableAccess va) {
+ exists(FunctionCall fc |
+ // Call to a function that requires null termination
+ exists(int i |
+ functionArgumentMustBeNullTerminated(fc.getTarget(), i) and
+ fc.getArgument(i) = va
+ )
+ or
+ // Call to a wrapper function that requires null termination
+ // (not itself adding a null terminator)
+ exists(Function wrapper, int i, Parameter p, VariableAccess use |
+ fc.getTarget() = wrapper and
+ fc.getArgument(i) = va and
+ p = wrapper.getParameter(i) and
+ parameterUsePair(p, use) and
+ variableMustBeNullTerminated(use) and
+ // Simplified: check that `p` may not be null terminated on *any*
+ // path to `use` (including the one found via `parameterUsePair`)
+ not exists(Expr e, BasicBlock bb1, int pos1, BasicBlock bb2, int pos2 |
+ mayAddNullTerminator(e, p.getAnAccess()) and
+ bb1.getNode(pos1) = e and
+ bb2.getNode(pos2) = use |
+ bb1 = bb2 and pos1 < pos2
+ or
+ bb1.getASuccessor+() = bb2
+ )
+ )
+ )
+}
diff --git a/cpp/ql/src/semmle/code/cpp/commons/PolymorphicClass.qll b/cpp/ql/src/semmle/code/cpp/commons/PolymorphicClass.qll
new file mode 100644
index 000000000000..46157ed54b97
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/commons/PolymorphicClass.qll
@@ -0,0 +1,10 @@
+import cpp
+
+/**
+ * A C++ class or structure which (possibly by inheritance) has at least one virtual method.
+ */
+class PolymorphicClass extends Class {
+ PolymorphicClass() {
+ exists(MemberFunction f | this.getABaseClass*() = f.getDeclaringType() and f.isVirtual())
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/commons/Printf.qll b/cpp/ql/src/semmle/code/cpp/commons/Printf.qll
new file mode 100644
index 000000000000..5125c972f4bb
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/commons/Printf.qll
@@ -0,0 +1,1007 @@
+/**
+ * A library for dealing with `printf`-like formatting strings.
+ */
+import semmle.code.cpp.Type
+import semmle.code.cpp.commons.CommonType
+import semmle.code.cpp.commons.StringAnalysis
+import semmle.code.cpp.models.interfaces.FormattingFunction
+import semmle.code.cpp.models.implementations.Printf
+
+/**
+ * A function that can be identified as a `printf` style formatting
+ * function by it's use of the GNU `format` attribute.
+ */
+class AttributeFormattingFunction extends FormattingFunction {
+ FormatAttribute printf_attrib;
+
+ AttributeFormattingFunction() {
+ printf_attrib = getAnAttribute() and
+ (
+ printf_attrib.getArchetype() = "printf" or
+ printf_attrib.getArchetype() = "__printf__"
+ ) and
+ exists(printf_attrib.getFirstFormatArgIndex()) // exclude `vprintf` style format functions
+ }
+
+ override int getFormatParameterIndex() {
+ result = printf_attrib.getFormatIndex()
+ }
+}
+
+/**
+ * A standard function such as `vprintf` that has a format parameter
+ * and a variable argument list of type `va_arg`.
+ */
+predicate primitiveVariadicFormatter(TopLevelFunction f, int formatParamIndex, boolean wide) {
+ f.getName().regexpMatch("_?_?va?[fs]?n?w?printf(_s)?(_p)?(_l)?")
+ and (
+ if f.getName().matches("%\\_l")
+ then formatParamIndex = f.getNumberOfParameters() - 3
+ else formatParamIndex = f.getNumberOfParameters() - 2
+ ) and if f.getName().matches("%w%") then wide = true else wide = false
+}
+
+private
+predicate callsVariadicFormatter(Function f, int formatParamIndex, boolean wide) {
+ exists(FunctionCall fc, int i |
+ variadicFormatter(fc.getTarget(), i, wide)
+ and fc.getEnclosingFunction() = f
+ and fc.getArgument(i) = f.getParameter(formatParamIndex).getAnAccess()
+ )
+}
+
+/**
+ * Holds if `f` is a function such as `vprintf` that has a format parameter
+ * (at `formatParamIndex`) and a variable argument list of type `va_arg`.
+ */
+predicate variadicFormatter(Function f, int formatParamIndex, boolean wide) {
+ primitiveVariadicFormatter(f, formatParamIndex, wide)
+ or (
+ not f.isVarargs()
+ and callsVariadicFormatter(f, formatParamIndex, wide)
+ )
+}
+
+/**
+ * A function not in the standard library which takes a `printf`-like formatting
+ * string and a variable number of arguments.
+ */
+class UserDefinedFormattingFunction extends FormattingFunction {
+ UserDefinedFormattingFunction() {
+ isVarargs() and callsVariadicFormatter(this, _, _)
+ }
+
+ override int getFormatParameterIndex() { callsVariadicFormatter(this, result, _) }
+
+ override predicate isWideCharDefault() { callsVariadicFormatter(this, _, true) }
+}
+
+/**
+ * The Objective C method `stringWithFormat:`.
+ */
+class NsstringStringWithFormat extends FormattingFunction {
+ NsstringStringWithFormat() {
+ getQualifiedName().matches("NSString%::+stringWithFormat:") or
+ getQualifiedName().matches("NSString%::+localizedStringWithFormat:")
+ }
+
+ override int getFormatParameterIndex() {
+ result = 0
+ }
+}
+
+/**
+ * A call to one of the formatting functions.
+ */
+class FormattingFunctionCall extends Expr {
+ FormattingFunctionCall() {
+ this.(Call).getTarget() instanceof FormattingFunction
+ }
+
+ /**
+ * Gets the formatting function being called.
+ */
+ FormattingFunction getTarget() {
+ result = this.(Call).getTarget()
+ }
+
+ /**
+ * Gets the `i`th argument for this call.
+ *
+ * The range of `i` is from `0` to `getNumberOfArguments() - 1`.
+ */
+ Expr getArgument(int i) {
+ result = this.(Call).getArgument(i)
+ }
+
+ /**
+ * Gets the number of actual parameters in this call; use
+ * `getArgument(i)` with `i` between `0` and `result - 1` to
+ * retrieve actuals.
+ */
+ int getNumberOfArguments() {
+ result = this.(Call).getNumberOfArguments()
+ }
+
+ /**
+ * Gets the index at which the format string occurs in the argument list.
+ */
+ int getFormatParameterIndex() {
+ result = this.getTarget().(FormattingFunction).getFormatParameterIndex()
+ }
+
+ /**
+ * Gets the format expression used in this call.
+ */
+ Expr getFormat() {
+ result = this.getArgument(this.getFormatParameterIndex())
+ }
+
+ /**
+ * Gets the nth argument to the format (including width and precision arguments).
+ */
+ Expr getFormatArgument(int n) {
+ exists(int i |
+ result = this.getArgument(i)
+ and n >= 0
+ and n = i - getTarget().(FormattingFunction).getFirstFormatArgumentIndex()
+ )
+ }
+
+ /**
+ * Gets the argument corresponding to the nth conversion specifier
+ */
+ Expr getConversionArgument(int n) {
+ exists(FormatLiteral fl, int b, int o |
+ fl = this.getFormat() and
+ b = sum(int i, int toSum | (i < n) and (toSum = fl.getNumArgNeeded(i)) | toSum) and
+ o = fl.getNumArgNeeded(n) and
+ o > 0 and
+ result = this.getFormatArgument(b+o-1))
+ }
+
+ /**
+ * Gets the argument corresponding to the nth conversion specifier's
+ * minimum field width (has no result if that conversion specifier has
+ * an explicit minimum field width).
+ */
+ Expr getMinFieldWidthArgument(int n) {
+ exists(FormatLiteral fl, int b |
+ fl = this.getFormat() and
+ b = sum(int i, int toSum | (i < n) and (toSum = fl.getNumArgNeeded(i)) | toSum) and
+ fl.hasImplicitMinFieldWidth(n) and
+ result = this.getFormatArgument(b))
+ }
+
+ /**
+ * Gets the argument corresponding to the nth conversion specifier's
+ * precision (has no result if that conversion specifier has an explicit
+ * precision).
+ */
+ Expr getPrecisionArgument(int n) {
+ exists(FormatLiteral fl, int b, int o |
+ fl = this.getFormat() and
+ b = sum(int i, int toSum | (i < n) and (toSum = fl.getNumArgNeeded(i)) | toSum) and
+ (if fl.hasImplicitMinFieldWidth(n) then o=1 else o=0) and
+ fl.hasImplicitPrecision(n) and
+ result = this.getFormatArgument(b+o))
+ }
+
+ /**
+ * Gets the number of arguments to this call that are parameters to the
+ * format string.
+ */
+ int getNumFormatArgument() {
+ result = count(this.getFormatArgument(_))
+ }
+}
+
+/**
+ * A class to represent format strings that occur as arguments to invocations of formatting functions.
+ */
+class FormatLiteral extends Literal {
+ FormatLiteral() {
+ exists(FormattingFunctionCall ffc | ffc.getFormat() = this) and
+ this instanceof StringLiteral
+ }
+
+ /**
+ * Gets the function call where this format string is used.
+ */
+ FormattingFunctionCall getUse() {
+ result.getFormat() = this
+ }
+
+ /**
+ * Holds if the default meaning of `%s` is a `wchar_t *`, rather than
+ * a `char *` (either way, `%S` will have the opposite meaning).
+ */
+ predicate isWideCharDefault() {
+ getUse().getTarget().(FormattingFunction).isWideCharDefault()
+ }
+
+ /**
+ * Holds if this `FormatLiteral` is in a context that supports
+ * Microsoft rules and extensions.
+ */
+ predicate isMicrosoft() {
+ getFile().compiledAsMicrosoft()
+ }
+
+ /**
+ * Gets the format string, with '%%' replaced by '_' (to avoid processing
+ * '%%' as a format specifier).
+ */
+ string getFormat() {
+ result = this.getValue().replaceAll("%%", "_")
+ }
+
+ /**
+ * Gets the number of conversion specifiers (not counting `%%`)
+ */
+ int getNumConvSpec() {
+ result = count(this.getFormat().indexOf("%"))
+ }
+
+ /**
+ * Gets the position in the string at which the nth conversion specifier
+ * starts.
+ */
+ int getConvSpecOffset(int n) {
+ n = 0 and result = this.getFormat().indexOf("%", 0, 0)
+ or n > 0 and exists(int p | n = p + 1 and result = this.getFormat().indexOf("%", 0, this.getConvSpecOffset(p)+2))
+ }
+
+ // these predicates gets a regular expressions to match each individual
+ // parts of a conversion specifier.
+ private string getParameterFieldRegexp() {
+ // the parameter field is a posix extension, for example `%5$i` uses the fifth
+ // parameter as an integer, regardless of the position of this substring in the
+ // format string.
+ result = "(?:[1-9][0-9]*\\$)?"
+ }
+ private string getFlagRegexp() {
+ if isMicrosoft() then (
+ result = "[-+ #0']*"
+ ) else (
+ result = "[-+ #0'I]*"
+ )
+ }
+ private string getFieldWidthRegexp() {
+ result = "(?:[1-9][0-9]*|\\*|\\*[0-9]+\\$)?"
+ }
+ private string getPrecRegexp() {
+ result = "(?:\\.(?:[0-9]*|\\*|\\*[0-9]+\\$))?"
+ }
+ private string getLengthRegexp() {
+ if isMicrosoft() then (
+ result = "(?:hh?|ll?|L|q|j|z|t|w|I32|I64|I)?"
+ ) else (
+ result = "(?:hh?|ll?|L|q|j|z|Z|t)?"
+ )
+ }
+ private string getConvCharRegexp() {
+ if isMicrosoft() then (
+ result = "[aAcCdeEfFgGimnopsSuxXZ@]"
+ ) else (
+ result = "[aAcCdeEfFgGimnopsSuxX@]"
+ )
+ }
+
+ /**
+ * Gets a regular expression used for matching a whole conversion specifier.
+ */
+ string getConvSpecRegexp() {
+ // capture groups: 1 - entire conversion spec, including "%"
+ // 2 - parameters
+ // 3 - flags
+ // 4 - minimum field width
+ // 5 - precision
+ // 6 - length
+ // 7 - conversion character
+ // NB: this matches "%%" with conversion character "%"
+ result =
+ "(?s)(\\%("+
+ this.getParameterFieldRegexp()+")(" +
+ this.getFlagRegexp()+")("+
+ this.getFieldWidthRegexp()+")("+
+ this.getPrecRegexp()+")("+
+ this.getLengthRegexp()+")("+
+ this.getConvCharRegexp()+")"+
+ "|\\%\\%).*"
+ }
+
+ /**
+ * Holds if the arguments are a parsing of a conversion specifier to this format string.
+ * @param n which conversion specifier to parse
+ * @param spec the whole conversion specifier
+ * @param params the parameter field of the conversion specifier (empty string if none is given)
+ * @param flags the flags of the conversion specifier (empty string if none are given)
+ * @param width the minimum field width of the conversion specifier (empty string if none is given)
+ * @param prec the precision of the conversion specifier (empty string if none is given)
+ * @param len the length flag of the conversion specifier (empty string if none is given)
+ * @param conv the conversion character of the conversion specifier ("%" for specifier "%%")
+ */
+ predicate parseConvSpec(int n, string spec, string params, string flags, string width, string prec, string len, string conv) {
+ exists(int offset, string fmt, string rst, string regexp |
+ offset = this.getConvSpecOffset(n) and
+ fmt = this.getFormat() and
+ rst = fmt.substring(offset, fmt.length()) and
+ regexp = this.getConvSpecRegexp() and
+ ((spec = rst.regexpCapture(regexp, 1) and
+ params = rst.regexpCapture(regexp, 2) and
+ flags = rst.regexpCapture(regexp, 3) and
+ width = rst.regexpCapture(regexp, 4) and
+ prec = rst.regexpCapture(regexp, 5) and
+ len = rst.regexpCapture(regexp, 6) and
+ conv = rst.regexpCapture(regexp, 7))
+ or
+ (spec = rst.regexpCapture(regexp, 1) and
+ not exists(rst.regexpCapture(regexp, 2)) and
+ params = "" and
+ flags = "" and
+ width = "" and
+ prec = "" and
+ len = "" and
+ conv = "%")))
+ }
+
+ /**
+ * Gets the nth conversion specifier (including the initial `%`).
+ */
+ string getConvSpec(int n) {
+ exists(int offset, string fmt, string rst, string regexp |
+ offset = this.getConvSpecOffset(n) and
+ fmt = this.getFormat() and
+ rst = fmt.substring(offset, fmt.length()) and
+ regexp = this.getConvSpecRegexp() and
+ result = rst.regexpCapture(regexp, 1))
+ }
+
+ /**
+ * Gets the parameter field of the nth conversion specifier (for example, `1$`).
+ */
+ string getParameterField(int n) {
+ this.parseConvSpec(n, _, result, _, _, _, _, _)
+ }
+
+ /**
+ * Gets the flags of the nth conversion specifier.
+ */
+ string getFlags(int n) {
+ this.parseConvSpec(n, _, _, result, _, _, _, _)
+ }
+
+ /**
+ * Holds if the nth conversion specifier has alternate flag ("#").
+ */
+ predicate hasAlternateFlag(int n) { this.getFlags(n).matches("%#%") }
+
+ /**
+ * Holds if the nth conversion specifier has zero padding flag ("0").
+ */
+ predicate isZeroPadded(int n) { this.getFlags(n).matches("%0%") and not this.isLeftAdjusted(n) }
+
+ /**
+ * Holds if the nth conversion specifier has flag left adjustment flag
+ * ("-"). Note that this overrides the zero padding flag.
+ */
+ predicate isLeftAdjusted(int n) { this.getFlags(n).matches("%-%") }
+
+ /**
+ * Holds if the nth conversion specifier has the blank flag (" ").
+ */
+ predicate hasBlank(int n) { this.getFlags(n).matches("% %") }
+
+ /**
+ * Holds if the nth conversion specifier has the explicit sign flag ("+").
+ */
+ predicate hasSign(int n) { this.getFlags(n).matches("%+%") }
+
+ /**
+ * Holds if the nth conversion specifier has the thousands grouping flag ("'").
+ */
+ predicate hasThousandsGrouping(int n) { this.getFlags(n).matches("%'%") }
+
+ /**
+ * Holds if the nth conversion specifier has the alternative digits flag ("I").
+ */
+ predicate hasAlternativeDigits(int n) { this.getFlags(n).matches("%I%") }
+
+ /**
+ * Gets the minimum field width of the nth conversion specifier
+ * (empty string if none is given).
+ */
+ string getMinFieldWidthOpt(int n) { this.parseConvSpec(n, _, _, _, result, _, _, _) }
+
+ /**
+ * Holds if the nth conversion specifier has a minimum field width.
+ */
+ predicate hasMinFieldWidth(int n) { this.getMinFieldWidthOpt(n) != "" }
+
+ /**
+ * Holds if the nth conversion specifier has an explicitly given minimum
+ * field width.
+ */
+ predicate hasExplicitMinFieldWidth(int n) { this.getMinFieldWidthOpt(n).regexpMatch("[0-9]+") }
+
+ /**
+ * Holds if the nth conversion specifier has an implicitly given minimum
+ * field width (either "*" or "*i$" for some number i).
+ */
+ predicate hasImplicitMinFieldWidth(int n) { this.getMinFieldWidthOpt(n).regexpMatch("\\*.*") }
+
+ /**
+ * Gets the minimum field width of the nth conversion specifier.
+ */
+ int getMinFieldWidth(int n) { result = this.getMinFieldWidthOpt(n).toInt() }
+
+ /**
+ * Gets the precision of the nth conversion specifier (empty string if none is given).
+ */
+ string getPrecisionOpt(int n) { this.parseConvSpec(n, _, _, _, _, result, _, _) }
+
+ /**
+ * Holds if the nth conversion specifier has a precision.
+ */
+ predicate hasPrecision(int n) { this.getPrecisionOpt(n) != "" }
+
+ /**
+ * Holds if the nth conversion specifier has an explicitly given precision.
+ */
+ predicate hasExplicitPrecision(int n) { this.getPrecisionOpt(n).regexpMatch("\\.[0-9]*") }
+
+ /**
+ * Holds if the nth conversion specifier has an implicitly given precision
+ * (either "*" or "*i$" for some number i).
+ */
+ predicate hasImplicitPrecision(int n) { this.getPrecisionOpt(n).regexpMatch("\\.\\*.*") }
+
+ /**
+ * Gets the precision of the nth conversion specifier.
+ */
+ int getPrecision(int n) {
+ if this.getPrecisionOpt(n) = "." then
+ result = 0
+ else
+ result = this.getPrecisionOpt(n).regexpCapture("\\.([0-9]*)", 1).toInt()
+ }
+
+ /**
+ * Gets the length flag of the nth conversion specifier.
+ */
+ string getLength(int n) { this.parseConvSpec(n, _, _, _, _, _, result, _) }
+
+ /**
+ * Gets the conversion character of the nth conversion specifier.
+ */
+ string getConversionChar(int n) { this.parseConvSpec(n, _, _, _, _, _, _, result) }
+
+ /**
+ * Gets the size of pointers in the target this formatting function is
+ * compiled for.
+ */
+ private int targetBitSize() { result = this.getFullyConverted().getType().getSize() }
+
+ private LongType getLongType() {
+ (
+ this.targetBitSize() = 4 and result.getSize() = min(LongType l | | l.getSize())
+ ) or (
+ this.targetBitSize() = 8 and result.getSize() = max(LongType l | | l.getSize())
+ ) or (
+ this.targetBitSize() != 4 and
+ this.targetBitSize() != 8
+ )
+ }
+
+ private Intmax_t getIntmax_t() {
+ (
+ this.targetBitSize() = 4 and result.getSize() = min(Intmax_t l | | l.getSize())
+ ) or (
+ this.targetBitSize() = 8 and result.getSize() = max(Intmax_t l | | l.getSize())
+ ) or (
+ this.targetBitSize() != 4 and
+ this.targetBitSize() != 8
+ )
+ }
+
+ private Size_t getSize_t() {
+ (
+ this.targetBitSize() = 4 and result.getSize() = min(Size_t l | | l.getSize())
+ ) or (
+ this.targetBitSize() = 8 and result.getSize() = max(Size_t l | | l.getSize())
+ ) or (
+ this.targetBitSize() != 4 and
+ this.targetBitSize() != 8
+ )
+ }
+
+ private Ssize_t getSsize_t() {
+ (
+ this.targetBitSize() = 4 and result.getSize() = min(Ssize_t l | | l.getSize())
+ ) or (
+ this.targetBitSize() = 8 and result.getSize() = max(Ssize_t l | | l.getSize())
+ ) or (
+ this.targetBitSize() != 4 and
+ this.targetBitSize() != 8
+ )
+ }
+
+ private Ptrdiff_t getPtrdiff_t() {
+ (
+ this.targetBitSize() = 4 and result.getSize() = min(Ptrdiff_t l | | l.getSize())
+ ) or (
+ this.targetBitSize() = 8 and result.getSize() = max(Ptrdiff_t l | | l.getSize())
+ ) or (
+ this.targetBitSize() != 4 and
+ this.targetBitSize() != 8
+ )
+ }
+
+ /**
+ * Gets the family of integral types required by the nth conversion
+ * specifier's length flag.
+ */
+ Type getIntegralConversion(int n) {
+ exists(string len | len = this.getLength(n) and
+ ((len="hh" and result instanceof IntType)
+ or (len="h" and result instanceof IntType)
+ or (len="l" and result = this.getLongType())
+ or ((len="ll" or len="q")
+ and result instanceof LongLongType)
+ or (len="L" and result instanceof IntType) // doesn't affect integral conversion
+ or (len="j" and result = this.getIntmax_t())
+ or ((len="z" or len="Z")
+ and (result = this.getSize_t() or result = this.getSsize_t()))
+ or (len="t" and result = this.getPtrdiff_t())
+ or (len="I" and result instanceof IntType)
+ or (len="I32" and exists(MicrosoftInt32Type t |
+ t.getUnsigned() = result.(IntegralType).getUnsigned()
+ ))
+ or (len="I64" and exists(MicrosoftInt64Type t |
+ t.getUnsigned() = result.(IntegralType).getUnsigned()
+ ))
+ or (len="" and result instanceof IntType)
+ ))
+ }
+
+ /**
+ * Gets the family of integral types output / displayed by the nth
+ * conversion specifier's length flag.
+ */
+ Type getIntegralDisplayType(int n) {
+ exists(string len | len = this.getLength(n) and
+ ((len="hh" and result instanceof CharType)
+ or (len="h" and result instanceof ShortType)
+ or (len="l" and result = this.getLongType())
+ or ((len="ll" or len="q")
+ and result instanceof LongLongType)
+ or (len="L" and result instanceof IntType) // doesn't affect integral conversion
+ or (len="j" and result = this.getIntmax_t())
+ or ((len="z" or len="Z")
+ and (result = this.getSize_t() or result = this.getSsize_t()))
+ or (len="t" and result = this.getPtrdiff_t())
+ or (len="I" and result instanceof IntType)
+ or (len="I32" and exists(MicrosoftInt32Type t |
+ t.getUnsigned() = result.(IntegralType).getUnsigned()
+ ))
+ or (len="I64" and exists(MicrosoftInt64Type t |
+ t.getUnsigned() = result.(IntegralType).getUnsigned()
+ ))
+ or (len="" and result instanceof IntType)))
+ }
+
+ /**
+ * Gets the family of floating point types required by the nth conversion
+ * specifier's length flag.
+ */
+ FloatingPointType getFloatingPointConversion(int n) {
+ exists(string len | len = this.getLength(n) and
+ if len="L" then
+ result instanceof LongDoubleType
+ else
+ result instanceof DoubleType)
+ }
+
+ /**
+ * Gets the family of pointer types required by the nth conversion
+ * specifier's length flag.
+ */
+ PointerType getStorePointerConversion(int n) {
+ exists(IntegralType base |
+ exists(string len | len = this.getLength(n) |
+ (len="hh" and base instanceof CharType)
+ or (len="h" and base instanceof ShortType)
+ or (len="l" and base = this.getLongType())
+ or (len="ll" and base instanceof LongLongType)
+ or (len="q" and base instanceof LongLongType)
+ )
+ and base.isSigned() and base = result.getBaseType()
+ )
+ }
+
+ /**
+ * Gets the argument type required by the nth conversion specifier.
+ */
+ Type getConversionType(int n) {
+ result = getConversionType1(n) or
+ result = getConversionType1b(n) or
+ result = getConversionType2(n) or
+ result = getConversionType3(n) or
+ result = getConversionType4(n) or
+ result = getConversionType5(n) or
+ result = getConversionType6(n) or
+ result = getConversionType7(n) or
+ result = getConversionType8(n) or
+ result = getConversionType9(n) or
+ result = getConversionType10(n)
+ }
+
+ private Type getConversionType1(int n) {
+ exists(string cnv | cnv = this.getConversionChar(n) |
+ cnv.regexpMatch("d|i") and result = this.getIntegralConversion(n)
+ and not result.getUnderlyingType().(IntegralType).isExplicitlySigned()
+ and not result.getUnderlyingType().(IntegralType).isExplicitlyUnsigned()
+ )
+ }
+
+ /**
+ * Gets the 'effective' char type character, that is, 'c' (meaning a `char`) or
+ * 'C' (meaning a `wchar_t`).
+ * - in the base case this is the same as the format type character.
+ * - for a `wprintf` or similar function call, the meanings are reversed.
+ * - the size prefixes 'l'/'w' (long) and 'h' (short) override the
+ * type character to effectively 'C' or 'c' respectively.
+ */
+ private string getEffectiveCharConversionChar(int n) {
+ exists(string len, string conv | this.parseConvSpec(n, _, _, _, _, _, len, conv) and (conv = "c" or conv = "C") |
+ (len = "l" and result = "C") or
+ (len = "w" and result = "C") or
+ (len = "h" and result = "c") or
+ (len != "l" and len != "w" and len != "h" and (result = "c" or result = "C") and (if isWideCharDefault() then result != conv else result = conv))
+ )
+ }
+
+ private Type getConversionType1b(int n) {
+ exists(string cnv | cnv = this.getEffectiveCharConversionChar(n) |
+ (
+ cnv = "c" and
+ result instanceof CharType and
+ not result.(CharType).isExplicitlySigned() and
+ not result.(CharType).isExplicitlyUnsigned()
+ ) or (
+ cnv = "C" and
+ isMicrosoft() and
+ result instanceof WideCharType
+ ) or (
+ cnv = "C" and
+ not isMicrosoft() and
+ result.hasName("wint_t")
+ )
+ )
+ }
+
+ private Type getConversionType2(int n) {
+ exists(string cnv | cnv = this.getConversionChar(n) |
+ cnv.regexpMatch("o|u|x|X") and
+ result = this.getIntegralConversion(n) and
+ result.getUnderlyingType().(IntegralType).isUnsigned()
+ )
+ }
+
+ private Type getConversionType3(int n) {
+ exists(string cnv | cnv = this.getConversionChar(n) |
+ cnv.regexpMatch("a|A|e|E|f|F|g|G") and result = this.getFloatingPointConversion(n)
+ )
+ }
+
+ /**
+ * Gets the 'effective' string type character, that is, 's' (meaning a char string) or
+ * 'S' (meaning a wide string).
+ * - in the base case this is the same as the format type character.
+ * - for a `wprintf` or similar function call, the meanings are reversed.
+ * - the size prefixes 'l'/'w' (long) and 'h' (short) override the
+ * type character to effectively 'S' or 's' respectively.
+ */
+ private string getEffectiveStringConversionChar(int n) {
+ exists(string len, string conv | this.parseConvSpec(n, _, _, _, _, _, len, conv) and (conv = "s" or conv = "S") |
+ (len = "l" and result = "S") or
+ (len = "w" and result = "S") or
+ (len = "h" and result = "s") or
+ (len != "l" and len != "w" and len != "h" and (result = "s" or result = "S") and (if isWideCharDefault() then result != conv else result = conv))
+ )
+ }
+
+ private Type getConversionType4(int n) {
+ exists(string cnv, CharType t | cnv = this.getEffectiveStringConversionChar(n) |
+ cnv="s" and t = result.(PointerType).getBaseType()
+ and not t.isExplicitlySigned()
+ and not t.isExplicitlyUnsigned()
+ )
+ }
+
+ private Type getConversionType5(int n) {
+ exists(string cnv | cnv = this.getEffectiveStringConversionChar(n) |
+ cnv="S" and result.(PointerType).getBaseType().hasName("wchar_t")
+ )
+ }
+
+ private Type getConversionType6(int n) {
+ exists(string cnv | cnv = this.getConversionChar(n) |
+ cnv="p" and result instanceof VoidPointerType
+ )
+ }
+
+ private Type getConversionType7(int n) {
+ exists(string cnv | cnv = this.getConversionChar(n) |
+ cnv="n" and result = this.getStorePointerConversion(n)
+ )
+ }
+
+ private IntPointerType getConversionType8(int n) {
+ exists(string cnv | cnv = this.getConversionChar(n) |
+ cnv="n" and not exists(this.getStorePointerConversion(n)) and
+ result.getBaseType().(IntType).isSigned() and
+ not result.getBaseType().(IntType).isExplicitlySigned()
+ )
+ }
+
+ private Type getConversionType9(int n) {
+ this.getConversionChar(n) = "Z" and
+ (
+ this.getLength(n) = "l" or
+ this.getLength(n) = "w"
+ ) and exists(Type t |
+ t.getName() = "UNICODE_STRING" and
+ result.(PointerType).getBaseType() = t
+ )
+ }
+
+ private Type getConversionType10(int n) {
+ this.getConversionChar(n) = "Z" and
+ not this.getLength(n) = "l" and
+ not this.getLength(n) = "w" and
+ exists(Type t |
+ t.getName() = "ANSI_STRING" and
+ result.(PointerType).getBaseType() = t
+ )
+ }
+
+ /**
+ * Gets the number of arguments required by the nth conversion specifier
+ * of this format string.
+ */
+ int getNumArgNeeded(int n) {
+ exists(this.getConvSpecOffset(n)) and
+ not this.getConversionChar(n) = "%" and
+ exists(int n1, int n2, int n3 |
+ (if this.hasImplicitMinFieldWidth(n) then n1=1 else n1=0) and
+ (if this.hasImplicitPrecision(n) then n2=1 else n2=0) and
+ (if this.getConversionChar(n)="m" then n3=0 else n3=1) and
+ result = n1 + n2 + n3)
+ }
+
+ /**
+ * Gets the number of arguments needed by this format string.
+ */
+ int getNumArgNeeded() {
+ if this.getParameterField(_) != "" then (
+ // At least one conversion specifier has a parameter field, in which case,
+ // they all should have.
+ result = max(string s | this.getParameterField(_) = s + "$" | s.toInt())
+ ) else (
+ result = sum(int n, int toSum | (toSum = this.getNumArgNeeded(n)) | toSum)
+ )
+ }
+
+ /**
+ * Holds if all conversion specifiers of this format string have been
+ * parsed by the library (this does not hold if one or more unrecognized
+ * format specifiers are present in the format string).
+ */
+ predicate specsAreKnown() {
+ this.getNumConvSpec() = count(int n | exists(this.getNumArgNeeded(n)))
+ }
+
+ /**
+ * Gets the maximum length of the string that can be produced by the nth
+ * conversion specifier of this format string; has no result if this cannot
+ * be determined.
+ */
+ int getMaxConvertedLength(int n) {
+ exists(int len |
+ (if this.hasExplicitMinFieldWidth(n) then
+ result = len.maximum(this.getMinFieldWidth(n))
+ else
+ not this.hasImplicitMinFieldWidth(n) and result = len)
+ and
+ (this.getConversionChar(n)="%" and
+ len = 1
+ or (
+ this.getConversionChar(n).toLowerCase()="c" and
+ if (this.getEffectiveCharConversionChar(n)="C" and
+ not isMicrosoft() and
+ not isWideCharDefault()) then (
+ len = 6 // MB_LEN_MAX
+ // the wint_t (wide character) argument is converted
+ // to a multibyte sequence by a call to the wcrtomb(3)
+ ) else (
+ len = 1 // e.g. 'a'
+ )
+ ) or this.getConversionChar(n).toLowerCase()="f" and
+ exists(int dot, int afterdot |
+ (if this.getPrecision(n) = 0 then dot = 0 else dot = 1)
+ and
+ (if this.hasExplicitPrecision(n) then
+ afterdot = this.getPrecision(n)
+ else
+ not this.hasImplicitPrecision(n) and afterdot = 6)
+ and
+ len = 1 + 309 + dot + afterdot) // e.g. -1e308="-100000"...
+ or this.getConversionChar(n).toLowerCase()="e" and
+ exists(int dot, int afterdot |
+ (if this.getPrecision(n) = 0 then dot = 0 else dot = 1)
+ and
+ (if this.hasExplicitPrecision(n) then
+ afterdot = this.getPrecision(n)
+ else
+ not this.hasImplicitPrecision(n) and afterdot = 6)
+ and
+ len = 1 + 1 + dot + afterdot + 1 + 1 + 3) // -1e308="-1.000000e+308"
+ or this.getConversionChar(n).toLowerCase()="g" and
+ exists(int dot, int afterdot |
+ (if this.getPrecision(n) = 0 then dot = 0 else dot = 1)
+ and
+ (if this.hasExplicitPrecision(n) then
+ afterdot = this.getPrecision(n)
+ else
+ not this.hasImplicitPrecision(n) and afterdot = 6)
+ and
+ // note: this could be displayed in the style %e or %f;
+ // however %f is only used when 'P > X >= -4'
+ // where P is the precision (default 6, minimum 1)
+ // and X is the exponent
+ // using a precision of P - 1 - X (i.e. to P significant figures)
+ // in other words the number is displayed to P significant figures if that is enough to express
+ // it with no trailing zeroes and at most four leading zeroes beyond the significant figures
+ // (e.g. 123456, 0.000123456 are just OK)
+ // so case %f can be at most P characters + 4 zeroes, sign, dot = P + 6
+ len = (afterdot.maximum(1) + 6).maximum(1 + 1 + dot + afterdot + 1 + 1 + 3)) // (e.g. "-1.59203e-319")
+ or (this.getConversionChar(n).toLowerCase()="d" or this.getConversionChar(n).toLowerCase()="i") and
+ // e.g. -2^31 = "-2147483648"
+ exists(int sizeBits |
+ sizeBits = min(int bits |
+ bits = getIntegralDisplayType(n).getSize() * 8 or
+ exists(IntegralType t | t = getUse().getConversionArgument(n).getType().getUnderlyingType() | t.isSigned() and bits = t.getSize() * 8)
+ ) and
+ len = 1 + ((sizeBits - 1) / 10.0.log2()).ceil()
+ // this calculation is as %u (below) only we take out the sign bit (- 1) and allow a whole
+ // character for it to be expressed as '-'.
+ )
+ or this.getConversionChar(n).toLowerCase()="u" and
+ // e.g. 2^32 - 1 = "4294967295"
+ exists(int sizeBits |
+ sizeBits = min(int bits |
+ bits = getIntegralDisplayType(n).getSize() * 8 or
+ exists(IntegralType t | t = getUse().getConversionArgument(n).getType().getUnderlyingType() | t.isUnsigned() and bits = t.getSize() * 8)
+ ) and
+ len = (sizeBits / 10.0.log2()).ceil()
+ // convert the size from bits to decimal characters, and round up as you can't have
+ // fractional characters (10.0.log2() is the number of bits expressed per decimal character)
+ )
+ or this.getConversionChar(n).toLowerCase()="x" and
+ // e.g. "12345678"
+ exists(int sizeBytes, int baseLen |
+ sizeBytes = min(int bytes |
+ bytes = getIntegralDisplayType(n).getSize() or
+ exists(IntegralType t | t = getUse().getConversionArgument(n).getType().getUnderlyingType() | t.isUnsigned() and bytes = t.getSize())
+ ) and (
+ baseLen = sizeBytes * 2
+ ) and (
+ if hasAlternateFlag(n) then len = 2 + baseLen else len = baseLen // "0x"
+ )
+ )
+ or this.getConversionChar(n).toLowerCase()="p" and
+ exists(PointerType ptrType, int baseLen | (
+ ptrType = getFullyConverted().getType()
+ ) and (
+ baseLen = max(ptrType.getSize() * 2) // e.g. "0x1234567812345678"; exact format is platform dependent
+ ) and (
+ if hasAlternateFlag(n) then len = 2 + baseLen else len = baseLen // "0x"
+ )
+ )
+ or this.getConversionChar(n).toLowerCase()="o" and
+ // e.g. 2^32 - 1 = "37777777777"
+ exists(int sizeBits, int baseLen |
+ sizeBits = min(int bits |
+ bits = getIntegralDisplayType(n).getSize() * 8 or
+ exists(IntegralType t | t = getUse().getConversionArgument(n).getType().getUnderlyingType() | t.isUnsigned() and bits = t.getSize() * 8)
+ ) and (
+ baseLen = (sizeBits / 3.0).ceil()
+ ) and (
+ if hasAlternateFlag(n) then len = 1 + baseLen else len = baseLen // "0"
+ )
+ )
+ or this.getConversionChar(n).toLowerCase()="s" and
+ len = min(int v |
+ (v = this.getPrecision(n)) or
+ (v = this.getUse().getFormatArgument(n).(AnalysedString).getMaxLength() - 1) // (don't count null terminator)
+ )
+ )
+ )
+ }
+
+ /**
+ * Gets the maximum length of the string that can be produced by the nth
+ * conversion specifier of this format string, except that float to string
+ * conversions are assumed to be 8 characters. This is helpful for
+ * determining whether a buffer overflow is caused by long float to string
+ * conversions.
+ */
+ int getMaxConvertedLengthLimited(int n) {
+ if this.getConversionChar(n).toLowerCase() = "f" then (
+ result = getMaxConvertedLength(n).minimum(8)
+ ) else (
+ result = getMaxConvertedLength(n)
+ )
+ }
+
+ /**
+ * Gets the constant part of the format string just before the nth
+ * conversion specifier. If `n` is zero, this will be the constant prefix
+ * before the 0th specifier, otherwise it is the string between the end
+ * of the n-1th specifier and the nth specifier. Has no result if `n`
+ * is negative or not strictly less than the number of conversion
+ * specifiers.
+ */
+ string getConstantPart(int n) {
+ if n=0 then
+ result = this.getFormat().substring(0, this.getConvSpecOffset(0))
+ else
+ result = this.getFormat().substring(this.getConvSpecOffset(n-1)+this.getConvSpec(n-1).length(), this.getConvSpecOffset(n))
+ }
+
+ /**
+ * Gets the constant part of the format string after the last conversion
+ * specifier.
+ */
+ string getConstantSuffix() {
+ exists(int n | n = this.getNumConvSpec() and
+ (if n > 0 then
+ result = this.getFormat().substring(this.getConvSpecOffset(n-1)+this.getConvSpec(n-1).length(), this.getFormat().length())
+ else
+ result = this.getFormat()))
+ }
+
+ private int getMaxConvertedLengthAfter(int n) {
+ if n=this.getNumConvSpec() then
+ result = this.getConstantSuffix().length() + 1
+ else
+ result = this.getConstantPart(n).length()+this.getMaxConvertedLength(n)+this.getMaxConvertedLengthAfter(n+1)
+ }
+
+ private int getMaxConvertedLengthAfterLimited(int n) {
+ if n=this.getNumConvSpec() then
+ result = this.getConstantSuffix().length() + 1
+ else
+ result = this.getConstantPart(n).length()+this.getMaxConvertedLengthLimited(n)+this.getMaxConvertedLengthAfterLimited(n+1)
+ }
+
+ /**
+ * Gets the maximum length of the string that can be produced by this format
+ * string. Has no result if this cannot be determined.
+ */
+ int getMaxConvertedLength() {
+ result = this.getMaxConvertedLengthAfter(0)
+ }
+
+ /**
+ * Gets the maximum length of the string that can be produced by this format
+ * string, except that float to string conversions are assumed to be 8
+ * characters. This is helpful for determining whether a buffer overflow
+ * is caused by long float to string conversions.
+ */
+ int getMaxConvertedLengthLimited() {
+ result = this.getMaxConvertedLengthAfterLimited(0)
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/commons/Scanf.qll b/cpp/ql/src/semmle/code/cpp/commons/Scanf.qll
new file mode 100644
index 000000000000..6c1c4ae6fd10
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/commons/Scanf.qll
@@ -0,0 +1,280 @@
+/**
+ * A library for dealing with scanf-like formatting strings. This is similar to
+ * printf.qll but the format specification for scanf is quite different.
+ */
+import semmle.code.cpp.Type
+
+/**
+ * A `scanf`-like standard library function.
+ */
+abstract class ScanfFunction extends Function
+{
+ /**
+ * Gets the position at which the input string or stream parameter occurs,
+ * if this function does not read from standard input.
+ */
+ abstract int getInputParameterIndex();
+
+ /**
+ * Gets the position at which the format parameter occurs.
+ */
+ abstract int getFormatParameterIndex();
+
+ /**
+ * Holds if the default meaning of `%s` is a `wchar_t*` string
+ * (rather than a `char*`).
+ */
+ predicate isWideCharDefault()
+ {
+ exists(getName().indexOf("wscanf"))
+ }
+}
+
+/**
+ * The standard function `scanf` (and variations).
+ */
+class Scanf extends ScanfFunction
+{
+ Scanf()
+ {
+ this instanceof TopLevelFunction and
+ (
+ hasName("scanf") or // scanf(format, args...)
+ hasName("wscanf") or // wscanf(format, args...)
+ hasName("_scanf_l") or // _scanf_l(format, locale, args...)
+ hasName("_wscanf_l") // _wscanf_l(format, locale, args...)
+ )
+ }
+
+ override int getInputParameterIndex() { none() }
+ override int getFormatParameterIndex() { result = 0 }
+}
+
+/**
+ * The standard function `fscanf` (and variations).
+ */
+class Fscanf extends ScanfFunction
+{
+ Fscanf()
+ {
+ this instanceof TopLevelFunction and
+ (
+ hasName("fscanf") or // fscanf(src_stream, format, args...)
+ hasName("fwscanf") or // fwscanf(src_stream, format, args...)
+ hasName("_fscanf_l") or // _fscanf_l(src_stream, format, locale, args...)
+ hasName("_fwscanf_l") // _fwscanf_l(src_stream, format, locale, args...)
+ )
+ }
+
+ override int getInputParameterIndex() { result = 0 }
+ override int getFormatParameterIndex() { result = 1 }
+}
+
+/**
+ * The standard function `sscanf` (and variations).
+ */
+class Sscanf extends ScanfFunction
+{
+ Sscanf()
+ {
+ this instanceof TopLevelFunction and
+ (
+ hasName("sscanf") or // sscanf(src_stream, format, args...)
+ hasName("swscanf") or // swscanf(src, format, args...)
+ hasName("_sscanf_l") or // _sscanf_l(src, format, locale, args...)
+ hasName("_swscanf_l") // _swscanf_l(src, format, locale, args...)
+ )
+ }
+
+ override int getInputParameterIndex() { result = 0 }
+ override int getFormatParameterIndex() { result = 1 }
+}
+
+/**
+ * The standard(ish) function `snscanf` (and variations).
+ */
+class Snscanf extends ScanfFunction
+{
+ Snscanf()
+ {
+ this instanceof TopLevelFunction and
+ (
+ hasName("_snscanf") or // _snscanf(src, max_amount, format, args...)
+ hasName("_snwscanf") // _snwscanf(src, max_amount, format, args...)
+ // note that the max_amount is not a limit on the output length, it's an input length
+ // limit used with non null-terminated strings.
+ )
+ }
+
+ override int getInputParameterIndex() { result = 0 }
+ override int getFormatParameterIndex() { result = 2 }
+}
+
+/**
+ * A call to one of the `scanf` functions.
+ */
+class ScanfFunctionCall extends FunctionCall
+{
+ ScanfFunctionCall()
+ {
+ this.getTarget() instanceof ScanfFunction
+ }
+
+ /**
+ * Gets the `scanf`-like function that is called.
+ */
+ ScanfFunction getScanfFunction()
+ {
+ result = getTarget()
+ }
+
+ /**
+ * Gets the position at which the input string or stream parameter occurs,
+ * if this function call does not read from standard input.
+ */
+ int getInputParameterIndex()
+ {
+ result = getScanfFunction().getInputParameterIndex()
+ }
+
+ /**
+ * Gets the position at which the format parameter occurs.
+ */
+ int getFormatParameterIndex()
+ {
+ result = getScanfFunction().getFormatParameterIndex()
+ }
+
+ /**
+ * Gets the format expression used in this call.
+ */
+ Expr getFormat()
+ {
+ result = this.getArgument(this.getFormatParameterIndex())
+ }
+
+ /**
+ * Holds if the default meaning of `%s` is a `wchar_t*` string
+ * (rather than a `char*`).
+ */
+ predicate isWideCharDefault()
+ {
+ getScanfFunction().isWideCharDefault()
+ }
+}
+
+/**
+ * A class to represent format strings that occur as arguments to invocations of `scanf` functions.
+ */
+class ScanfFormatLiteral extends Expr {
+ ScanfFormatLiteral() {
+ exists(ScanfFunctionCall sfc | sfc.getFormat() = this) and
+ this.isConstant()
+ }
+
+ /** the function call where this format string is used */
+ ScanfFunctionCall getUse() {
+ result.getFormat() = this
+ }
+
+ /** Holds if the default meaning of `%s` is a `wchar_t*` (rather than a `char*`). */
+ predicate isWideCharDefault() {
+ getUse().getTarget().(ScanfFunction).isWideCharDefault()
+ }
+
+ /**
+ * Gets the format string itself, transformed as follows:
+ * - '%%' is replaced with '_'
+ * (this avoids accidentally processing them as format specifiers)
+ * - '%*' is replaced with '_'
+ * (%*any is matched but not assigned to an argument)
+ */
+ string getFormat() {
+ result = this.getValue().replaceAll("%%", "_").replaceAll("%*", "_")
+ }
+
+ /**
+ * Gets the number of conversion specifiers (not counting `%%` and `%*`...).
+ */
+ int getNumConvSpec() {
+ result = count(this.getFormat().indexOf("%"))
+ }
+
+ /**
+ * Gets the position in the string at which the nth conversion specifier starts.
+ */
+ int getConvSpecOffset(int n) {
+ n = 0 and result = this.getFormat().indexOf("%", 0, 0)
+ or n > 0 and exists(int p | n = p + 1 and result = this.getFormat().indexOf("%", 0, this.getConvSpecOffset(p) + 2))
+ }
+
+ /**
+ * Gets the regular expression to match each individual part of a conversion specifier.
+ */
+ private string getMaxWidthRegexp() { result = "(?:[1-9][0-9]*)?" }
+ private string getLengthRegexp() { result = "(?:hh?|ll?|L|q|j|z|t)?" }
+ private string getConvCharRegexp() { result = "[aAcCdeEfFgGimnopsSuxX]" }
+
+ /**
+ * Gets the regular expression used for matching a whole conversion specifier.
+ */
+ string getConvSpecRegexp() {
+ // capture groups: 1 - entire conversion spec, including "%"
+ // 2 - maximum width
+ // 3 - length modifier
+ // 4 - conversion character
+ result = "(\\%("+this.getMaxWidthRegexp()+")("+this.getLengthRegexp()+")("+this.getConvCharRegexp()+")).*"
+ }
+
+ /**
+ * Holds if the arguments are a parsing of a conversion specifier to this format string.
+ * @param n which conversion specifier to parse
+ * @param spec the whole conversion specifier
+ * @param width the maximum width option of this input (empty string if none is given)
+ * @param len the length flag of this input (empty string if none is given)
+ * @param conv the conversion character of this input
+ */
+ predicate parseConvSpec(int n, string spec, string width, string len, string conv) {
+ exists(int offset, string fmt, string rst, string regexp |
+ offset = this.getConvSpecOffset(n) and
+ fmt = this.getFormat() and
+ rst = fmt.substring(offset, fmt.length()) and
+ regexp = this.getConvSpecRegexp() and (
+ spec = rst.regexpCapture(regexp, 1) and
+ width = rst.regexpCapture(regexp, 2) and
+ len = rst.regexpCapture(regexp, 3) and
+ conv = rst.regexpCapture(regexp, 4)
+ )
+ )
+ }
+
+ /**
+ * Gets the maximum width option of the nth input (empty string if none is given).
+ */
+ string getMaxWidthOpt(int n) { exists(string spec, string len, string conv | this.parseConvSpec(n, spec, result, len, conv)) }
+
+ /**
+ * Gets the maximum width of the nth input.
+ */
+ int getMaxWidth(int n) { result = this.getMaxWidthOpt(n).toInt() }
+
+ /**
+ * Gets the length flag of the nth conversion specifier.
+ */
+ string getLength(int n) { exists(string spec, string width, string conv | this.parseConvSpec(n, spec, width, result, conv)) }
+
+ /**
+ * Gets the conversion character of the nth conversion specifier.
+ */
+ string getConversionChar(int n) { exists(string spec, string width, string len | this.parseConvSpec(n, spec, width, len, result)) }
+
+ /**
+ * Gets the maximum length of the string that can be produced by the nth
+ * conversion specifier of this format string; fails if no estimate is
+ * possible (or implemented).
+ */
+ int getMaxConvertedLength(int n) {
+ (this.getConversionChar(n).toLowerCase() = "s") and
+ (result = this.getMaxWidth(n))
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/commons/Strcat.qll b/cpp/ql/src/semmle/code/cpp/commons/Strcat.qll
new file mode 100644
index 000000000000..5c5ba9c1e4d0
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/commons/Strcat.qll
@@ -0,0 +1,21 @@
+import cpp
+
+/**
+ * DEPRECATED: use `semmle.code.cpp.models.implementations.Strcat.qll` instead.
+ *
+ * A function that concatenates the string from its second argument
+ * to the string from its first argument, for example `strcat`.
+ */
+class StrcatFunction extends Function {
+ StrcatFunction() {
+ exists(string name | name = getName()|
+ name = "strcat" // strcat(dst, src)
+ or name = "strncat" // strncat(dst, src, max_amount)
+ or name = "wcscat" // wcscat(dst, src)
+ or name = "_mbscat" // _mbscat(dst, src)
+ or name = "wcsncat" // wcsncat(dst, src, max_amount)
+ or name = "_mbsncat" // _mbsncat(dst, src, max_amount)
+ or name = "_mbsncat_l" // _mbsncat_l(dst, src, max_amount, locale)
+ )
+ }
+}
\ No newline at end of file
diff --git a/cpp/ql/src/semmle/code/cpp/commons/StringAnalysis.qll b/cpp/ql/src/semmle/code/cpp/commons/StringAnalysis.qll
new file mode 100644
index 000000000000..f61bac3963f6
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/commons/StringAnalysis.qll
@@ -0,0 +1,73 @@
+import semmle.code.cpp.exprs.Expr
+import semmle.code.cpp.controlflow.SSA
+
+/**
+ * Holds if a value can flow directly from one expr to another.
+ */
+predicate canValueFlow(Expr fromExpr, Expr toExpr)
+{
+ (
+ // value propagated via a definition use pair
+ exists(Variable v, SsaDefinition def | fromExpr = def.getAnUltimateDefiningValue(v) |
+ toExpr = def.getAUse(v)
+ )
+ ) or (
+ // expr -> containing parenthesized expression
+ fromExpr = toExpr.(ParenthesisExpr).getExpr()
+ ) or (
+ // R value -> containing assignment expression ('=' assignment)
+ fromExpr = toExpr.(AssignExpr).getRValue()
+ ) or (
+ // then -> containing ternary (? :) operator
+ fromExpr = toExpr.(ConditionalExpr).getThen()
+ ) or (
+ // else -> containing ternary (? :) operator
+ fromExpr = toExpr.(ConditionalExpr).getElse()
+ )
+}
+
+/**
+ * An analysed null terminated string.
+ */
+class AnalysedString extends Expr
+{
+ AnalysedString()
+ {
+ this.getType().getUnspecifiedType() instanceof ArrayType or
+ this.getType().getUnspecifiedType() instanceof PointerType
+ }
+
+ /**
+ * Gets the maximum length (including null) this string can be, when this
+ * can be calculated.
+ */
+ int getMaxLength()
+ {
+ // take the longest AnalysedString it's value could 'flow' from; however if even one doesn't
+ // return a value (this essentially means 'infinity') we can't return a value either.
+ result = max(AnalysedString expr, int toMax | (canValueFlow*(expr, this)) and (toMax = expr.(StringLiteral).getOriginalLength()) | toMax) // maximum length
+ and
+ forall(AnalysedString expr | canValueFlow(expr, this) | exists(expr.getMaxLength())) // all sources return a value (recursive)
+ }
+}
+
+/**
+ * A call to a strlen like function.
+ */
+class StrlenCall extends FunctionCall {
+ StrlenCall() {
+ this.getTarget().hasQualifiedName("strlen") or
+ this.getTarget().hasQualifiedName("wcslen") or
+ this.getTarget().hasQualifiedName("_mbslen") or
+ this.getTarget().hasQualifiedName("_mbslen_l") or
+ this.getTarget().hasQualifiedName("_mbstrlen") or
+ this.getTarget().hasQualifiedName("_mbstrlen_l")
+ }
+
+ /**
+ * The string argument passed into this strlen-like call.
+ */
+ Expr getStringExpr() {
+ result = this.getArgument(0)
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/commons/StructLikeClass.qll b/cpp/ql/src/semmle/code/cpp/commons/StructLikeClass.qll
new file mode 100644
index 000000000000..ee5ac634b13d
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/commons/StructLikeClass.qll
@@ -0,0 +1,101 @@
+import semmle.code.cpp.Class
+
+/**
+ * A class that is either a `struct` or just has getters and setters
+ * for its members. In either case it just stores data and has no
+ * real encapsulation.
+ */
+class StructLikeClass extends Class {
+
+ StructLikeClass() {
+ this instanceof Struct
+ or
+ (
+ forall(MemberFunction f | f = this.getAMemberFunction() |
+ exists(MemberVariable v | setter(v, f, this) or getter(v, f, this)) or
+ f instanceof Constructor or
+ f instanceof Destructor or
+ // Allow the copy and move assignment ops - still struct-like
+ f instanceof CopyAssignmentOperator or
+ f instanceof MoveAssignmentOperator
+ )
+ )
+ }
+
+ /**
+ * Gets a setter function in this class, setting the given variable.
+ * This is a function whose name begins "set"... that assigns to this variable and no other
+ * member variable of the class. In addition, it takes a single parameter of
+ * type the type of the corresponding member variable.
+ */
+ MemberFunction getASetter(MemberVariable v) {
+ setter(v, result, this)
+ }
+
+ /**
+ * Gets a getter function in this class, getting the given variable.
+ * This is a function whose name begins "get"... that reads this variable and no other
+ * member variable of the class. In addition, its return type is the type
+ * of the corresponding member variable.
+ */
+ MemberFunction getAGetter(MemberVariable v) {
+ getter(v, result, this)
+ }
+
+}
+
+/**
+ * Holds if `f` is a setter member function for `v`, in class `c`.
+ * See `StructLikeClass.getASetter`.
+ */
+predicate setter(MemberVariable v, MemberFunction f, Class c) {
+ f.getDeclaringType() = c and
+ v.getDeclaringType() = c and
+ f.getName().matches("set%") and
+ v.getAnAssignedValue().getEnclosingFunction() = f and
+ not exists(MemberVariable v2 |
+ v2.getDeclaringType() = c and
+ v2.getAnAssignedValue().getEnclosingFunction() = f and
+ v2 != v
+ ) and
+ f.getNumberOfParameters() = 1 and
+ sameBaseType(f.getParameter(0).getType(), v.getType())
+}
+
+/**
+ * Holds if `f` is a getter member function for `v`, in class `c`.
+ * See `StructLikeClass.getAGetter`.
+ */
+predicate getter(MemberVariable v, MemberFunction f, Class c) {
+ f.getDeclaringType() = c and
+ v.getDeclaringType() = c and
+ f.getName().matches("get%") and
+ v.getAnAccess().getEnclosingFunction() = f and
+ not exists(MemberVariable v2 |
+ v2.getDeclaringType() = c and
+ v2.getAnAccess().getEnclosingFunction() = f and
+ v2 != v
+ ) and
+ f.getNumberOfParameters() = 0 and
+ sameBaseType(f.getType(), v.getType())
+}
+
+/**
+ * Holds if `t1` and `t2` are the same type up to typedefs, specifiers,
+ * and removing a single layer of pointers or references (but not arrays).
+ * Equates, for example, `const int*` with `int`, but not `int**` with `int`
+ * or `int[]` with `int`.
+ */
+predicate sameBaseType(Type t1, Type t2) {
+ exists (Type base1, Type base2 |
+ base1 = t1.getUnderlyingType().getUnspecifiedType() and
+ base2 = t2.getUnspecifiedType().getUnspecifiedType() and
+ (
+ base1 = base2 or
+ base1.(PointerType).getBaseType() = base2 or
+ base2.(PointerType).getBaseType() = base1 or
+ base1.(ReferenceType).getBaseType() = base2 or
+ base2.(ReferenceType).getBaseType() = base1
+ )
+ )
+}
diff --git a/cpp/ql/src/semmle/code/cpp/commons/Synchronization.qll b/cpp/ql/src/semmle/code/cpp/commons/Synchronization.qll
new file mode 100644
index 000000000000..0fe8077a94e7
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/commons/Synchronization.qll
@@ -0,0 +1,215 @@
+/**
+ * Utilities for analyzing synchronization primitives, such
+ * as mutexes and semaphores.
+ */
+import cpp
+
+/**
+ * A type that acts as a mutex. This class is extended below and and may
+ * be extended in `Options.qll`.
+ */
+abstract class MutexType extends Type {
+ /**
+ * Holds if `fc` is a call that always locks mutex `arg`
+ * of this type.
+ */
+ abstract predicate mustlockAccess(FunctionCall fc, Expr arg);
+
+ /**
+ * Holds if `fc` is a call that tries to lock mutex `arg`
+ * of this type, but may return without success.
+ */
+ abstract predicate trylockAccess(FunctionCall fc, Expr arg);
+
+ /**
+ * Holds if `fc` is a call that unlocks mutex `arg`
+ * of this type.
+ */
+ abstract predicate unlockAccess(FunctionCall fc, Expr arg);
+
+ /**
+ * Holds if `fc` is n call that locks or tries to lock mutex
+ * `arg` of this type.
+ */
+ predicate lockAccess(FunctionCall fc, Expr arg) {
+ this.mustlockAccess(fc, arg) or
+ this.trylockAccess(fc, arg)
+ }
+
+ /**
+ * Holds if `fc` is a call that locks or tries to lock any
+ * mutex of this type.
+ */
+ FunctionCall getLockAccess() {
+ result = getMustlockAccess() or
+ result = getTrylockAccess()
+ }
+
+ /**
+ * Holds if `fc` is a call that always locks any mutex of this type.
+ */
+ FunctionCall getMustlockAccess() {
+ this.mustlockAccess(result, _)
+ }
+
+ /**
+ * Holds if `fc` is a call that tries to lock any mutex of this type,
+ * by may return without success.
+ */
+ FunctionCall getTrylockAccess() {
+ this.trylockAccess(result, _)
+ }
+
+ /**
+ * Holds if `fc` is a call that unlocks any mutex of this type.
+ */
+ FunctionCall getUnlockAccess() {
+ this.unlockAccess(result, _)
+ }
+
+ /**
+ * DEPRECATED: use mustlockAccess(fc, arg) instead
+ */
+ deprecated Function getMustlockFunction() {
+ result = getMustlockAccess().getTarget()
+ }
+
+ /**
+ * DEPRECATED: use trylockAccess(fc, arg) instead
+ */
+ deprecated Function getTrylockFunction() {
+ result = getTrylockAccess().getTarget()
+ }
+
+ /**
+ * DEPRECATED: use lockAccess(fc, arg) instead
+ */
+ deprecated Function getLockFunction() {
+ result = getLockAccess().getTarget()
+ }
+
+ /**
+ * DEPRECATED: use unlockAccess(fc, arg) instead
+ */
+ deprecated Function getUnlockFunction() {
+ result = getUnlockAccess().getTarget()
+ }
+}
+
+/**
+ * A function that looks like a lock function.
+ */
+private Function mustlockCandidate() {
+ exists (string name
+ | name = result.getName()
+ | name = "lock" or
+ name.suffix(name.length() - 10) = "mutex_lock")
+}
+
+/**
+ * A function that looks like a try-lock function.
+ */
+private Function trylockCandidate() {
+ exists (string name
+ | name = result.getName()
+ | name = "try_lock" or
+ name.suffix(name.length() - 13) = "mutex_trylock")
+}
+
+/**
+ * A function that looks like an unlock function.
+ */
+private Function unlockCandidate() {
+ exists (string name
+ | name = result.getName()
+ | name = "unlock" or
+ name.suffix(name.length() - 12) = "mutex_unlock")
+}
+
+/**
+ * Gets a type that is a parameter to a function, or it's declaring type
+ * (i.e. it's `this`). If the function is a locking related function,
+ * these can be thought of as candidates for the mutex is it locking or
+ * unlocking. It is narrowed down in `DefaultMutexType` by requiring that
+ * it must be a class type with both a lock and an unlock function.
+ */
+private Class lockArgTypeCandidate(Function fcn) {
+ result = fcn.getDeclaringType() or
+ result = fcn.getAParameter().getType().stripType()
+}
+
+/**
+ * A class or struct type that has both a lock and an unlock function
+ * candidate, and is therefore a mutex.
+ *
+ * This excludes types like `std::weak_ptr` which has a lock
+ * method, but not an unlock method, and is not a mutex.)
+ */
+class DefaultMutexType extends MutexType {
+ DefaultMutexType() {
+ this = lockArgTypeCandidate(mustlockCandidate())
+ and
+ this = lockArgTypeCandidate(unlockCandidate())
+ }
+
+ private predicate lockArgType(FunctionCall fc, Expr arg) {
+ exists(int n |
+ arg = fc.getArgument(n) and
+ fc.getTarget().getParameter(n).getType().stripType() = this
+ ) or (
+ fc.getTarget().getDeclaringType() = this and
+ arg = fc.getQualifier()
+ ) or (
+ // if we're calling our own method with an implicit `this`,
+ // let `arg` be the function call, since we don't really have
+ // anything else to use.
+ fc.getTarget().getDeclaringType() = this and
+ not exists(fc.getQualifier()) and
+ arg = fc
+ )
+ }
+
+ override predicate mustlockAccess(FunctionCall fc, Expr arg) {
+ fc.getTarget() = mustlockCandidate() and
+ lockArgType(fc, arg)
+ }
+
+ override predicate trylockAccess(FunctionCall fc, Expr arg) {
+ fc.getTarget() = trylockCandidate() and
+ lockArgType(fc, arg)
+ }
+
+ override predicate unlockAccess(FunctionCall fc, Expr arg) {
+ fc.getTarget() = unlockCandidate() and
+ lockArgType(fc, arg)
+ }
+}
+
+/** Get the mutex argument of a call to lock or unlock. */
+private predicate lockArg(Expr arg, MutexType argType, FunctionCall call) {
+ argType = arg.getUnderlyingType().stripType() and
+ (
+ arg = call.getQualifier() or
+ arg = call.getAnArgument()
+ )
+ // note: this seems to arbitrarily care about argument types, rather
+ // than parameter types as elsewhere. As a result `mustlockCall`,
+ // for example, has slightly different results from
+ // `MutexType.mustlockAccess`.
+}
+
+predicate lockCall(Expr arg, FunctionCall call) {
+ exists(MutexType t | lockArg(arg, t, call) and call = t.getLockAccess())
+}
+
+predicate mustlockCall(Expr arg, FunctionCall call) {
+ exists(MutexType t | lockArg(arg, t, call) and call = t.getMustlockAccess())
+}
+
+predicate trylockCall(Expr arg, FunctionCall call) {
+ exists(MutexType t | lockArg(arg, t, call) and call = t.getTrylockAccess())
+}
+
+predicate unlockCall(Expr arg, FunctionCall call) {
+ exists(MutexType t | lockArg(arg, t, call) and call = t.getUnlockAccess())
+}
diff --git a/cpp/ql/src/semmle/code/cpp/commons/VoidContext.qll b/cpp/ql/src/semmle/code/cpp/commons/VoidContext.qll
new file mode 100644
index 000000000000..652fecb419e4
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/commons/VoidContext.qll
@@ -0,0 +1,38 @@
+import semmle.code.cpp.exprs.Expr
+
+/**
+ * An expression that is used to qualify some other expression.
+ */
+class Qualifier extends Expr {
+ Qualifier() {
+ exists(VariableAccess a | a.getQualifier() = this)
+ or exists(Call c | c.getQualifier() = this)
+ or exists(VacuousDestructorCall v | v.getQualifier() = this)
+ }
+}
+
+/**
+ * An expression that occurs in a void context, i.e. either as the toplevel expression of
+ * an expression statement or on the left hand side of the comma operator.
+ *
+ * Expressions that are explicitly cast to void are not considered to be in void context.
+ */
+class ExprInVoidContext extends Expr {
+ ExprInVoidContext() {
+ exprInVoidContext(this)
+ }
+}
+
+private predicate exprInVoidContext(Expr e) {
+ ( exists(ExprStmt s |
+ s = e.getParent()
+ and not exists(StmtExpr se |
+ s = se.getStmt().(Block).getLastStmt()))
+ or exists(ConditionalExpr c | c.getThen() = e and c instanceof ExprInVoidContext)
+ or exists(ConditionalExpr c | c.getElse() = e and c instanceof ExprInVoidContext)
+ or exists(CommaExpr c | c.getLeftOperand() = e)
+ or exists(CommaExpr c | c.getRightOperand() = e and c instanceof ExprInVoidContext)) and
+ not e instanceof Qualifier and
+ not e.getActualType() instanceof VoidType
+}
+
diff --git a/cpp/ql/src/semmle/code/cpp/commons/unix/Constants.qll b/cpp/ql/src/semmle/code/cpp/commons/unix/Constants.qll
new file mode 100644
index 000000000000..c3174c87b879
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/commons/unix/Constants.qll
@@ -0,0 +1,97 @@
+/**
+ * Standard Unix constants.
+ */
+import cpp
+
+bindingset[input]
+int parseOctal(string input) {
+ input.charAt(0) = "0"
+ and
+ result = strictsum(int ix
+ | ix in [0 .. input.length()]
+ | 8.pow(input.length() - (ix+1))*input.charAt(ix).toInt())
+}
+
+int s_isuid() {
+ result = parseOctal("04000")
+}
+
+int s_isgid() {
+ result = parseOctal("02000")
+}
+
+int s_isvtx() {
+ result = parseOctal("01000")
+}
+
+int s_irusr() {
+ result = parseOctal("0400")
+}
+
+int s_iwusr() {
+ result = parseOctal("0200")
+}
+
+int s_ixusr() {
+ result = parseOctal("0100")
+}
+
+int s_irwxu() {
+ result = s_irusr().bitOr(s_iwusr()).bitOr(s_ixusr())
+}
+
+int s_irgrp() {
+ result = s_irusr().bitShiftRight(3)
+}
+
+int s_iwgrp() {
+ result = s_iwusr().bitShiftRight(3)
+}
+
+int s_ixgrp() {
+ result = s_ixusr().bitShiftRight(3)
+}
+
+int s_irwxg() {
+ result = s_irwxu().bitShiftRight(3)
+}
+
+int s_iroth() {
+ result = s_irgrp().bitShiftRight(3)
+}
+
+int s_iwoth() {
+ result = s_iwgrp().bitShiftRight(3)
+}
+
+int s_ixoth() {
+ result = s_ixgrp().bitShiftRight(3)
+}
+
+int s_irwxo() {
+ result = s_irwxg().bitShiftRight(3)
+}
+
+int o_accmode() {
+ result = parseOctal("0003")
+}
+
+int o_rdonly() {
+ result = parseOctal("00")
+}
+
+int o_wronly() {
+ result = parseOctal("01")
+}
+
+int o_rdwr() {
+ result = parseOctal("02")
+}
+
+int o_creat() {
+ result = parseOctal("0100")
+}
+
+int o_excl() {
+ result = parseOctal("0200")
+}
\ No newline at end of file
diff --git a/cpp/ql/src/semmle/code/cpp/controlflow/BasicBlocks.qll b/cpp/ql/src/semmle/code/cpp/controlflow/BasicBlocks.qll
new file mode 100644
index 000000000000..2b38a46ac990
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/controlflow/BasicBlocks.qll
@@ -0,0 +1,287 @@
+import cpp
+private import internal.PrimitiveBasicBlocks
+private import internal.ConstantExprs
+/*
+ * `BasicBlock`s are refinements of `PrimitiveBasicBlock`s, taking
+ * impossible CFG edges into account (using the `successors_adapted`
+ * relation). The refinement manifests itself in two changes:
+ *
+ * - The successor relation on `BasicBlock`s uses `successors_adapted`
+ * (instead of `successors_extended` used by `PrimtiveBasicBlock`s). Consequently,
+ * some edges between `BasicBlock`s may be removed. Example:
+ * ```
+ * x = 1; // s1
+ * if (true) { // s2
+ * x = 2; // s3
+ * } else {
+ * x = 3; // s4
+ * }
+ * ```
+ * The `BasicBlock` successor edge from the basic block containing `s1`
+ * and `s2` to the basic block containing `s4` is removed.
+ *
+ * - `PrimitiveBasicBlock`s may be split up into two or more
+ * `BasicBlock`s: Internal nodes of `PrimitiveBasicBlock`s whose
+ * predecessor edges have been removed (unreachable code) will be entry
+ * points of new `BasicBlock`s. Consequently, each entry point of a
+ * `PrimitiveBasicBlock` will also be an entry point of a `BasicBlock`,
+ * but the converse does not necessarily hold. Example:
+ * ```
+ * x = 1; // s5
+ * abort(); // s6
+ * x = 2; // s7
+ * ```
+ * `s5`-`s7` belong to the same `PrimitiveBasicBlock`, but the CFG edge
+ * from `s6` to `s7` is impossible, so `s7` will be the entry point of
+ * its own (unreachable) `BasicBlock`.
+ *
+ * Note that, although possible, two or more `PrimitiveBasicBlock`s are
+ * never merged to one `BasicBlock`: Consider the first example above;
+ * it would be possible to define a single `BasicBlock` consisting of
+ * `s1`-`s3`, however, the result would be counter-intuitive.
+ */
+
+private import Cached
+private cached module Cached {
+ /**
+ * Any node that is the entry point of a primitive basic block is
+ * also the entry point of a basic block. In addition, all nodes
+ * with a primitive successor, where the predecessor has been pruned
+ * (that is, `getAPredecessor()` does not exist while a predecessor
+ * using the primitive `successors_extended` relation does exist), is also
+ * considered a basic block entry node.
+ */
+ cached
+ predicate basic_block_entry_node(ControlFlowNode node) {
+ primitive_basic_block_entry_node(node) or
+ non_primitive_basic_block_entry_node(node)
+ }
+
+ private predicate non_primitive_basic_block_entry_node(ControlFlowNode node) {
+ not primitive_basic_block_entry_node(node) and
+ not exists(node.getAPredecessor()) and
+ successors_extended(node, _)
+ }
+
+ /**
+ * Holds if basic block `bb` equals a primitive basic block.
+ *
+ * There are two situations in which this is *not* the case:
+ *
+ * - Either the entry node of `bb` does not correspond to an
+ * entry node of a primitive basic block, or
+ * - The primitive basic block with the same entry node contains
+ * a (non-entry) node which is the entry node of a non-primitive
+ * basic block (that is, the primitive basic block has been split
+ * up).
+ *
+ * This predicate is used for performance optimization only:
+ * Whenever a `BasicBlock` equals a `PrimitiveBasicBlock`, we can
+ * reuse predicates already computed for `PrimitiveBasicBlocks`.
+ */
+ private predicate equalsPrimitiveBasicBlock(BasicBlock bb) {
+ primitive_basic_block_entry_node(bb)
+ and
+ not exists(int i |
+ i > 0 and
+ non_primitive_basic_block_entry_node(bb.(PrimitiveBasicBlock).getNode(i))
+ )
+ }
+
+ /** Holds if `node` is the `pos`th control-flow node in basic block `bb`. */
+ cached predicate basic_block_member(ControlFlowNode node, BasicBlock bb, int pos) {
+ equalsPrimitiveBasicBlock(bb) and primitive_basic_block_member(node, bb, pos) // reuse already computed relation
+ or
+ non_primitive_basic_block_member(node, bb, pos)
+ }
+
+ private predicate non_primitive_basic_block_member(ControlFlowNode node, BasicBlock bb, int pos) {
+ (not equalsPrimitiveBasicBlock(bb) and node = bb and pos = 0)
+ or
+ (not (node instanceof BasicBlock) and
+ exists (ControlFlowNode pred
+ | successors_extended(pred,node)
+ | non_primitive_basic_block_member(pred, bb, pos - 1)))
+ }
+
+ /** Gets the number of control-flow nodes in the basic block `bb`. */
+ cached int bb_length(BasicBlock bb) {
+ if equalsPrimitiveBasicBlock(bb) then
+ result = bb.(PrimitiveBasicBlock).length() // reuse already computed relation
+ else
+ result = strictcount(ControlFlowNode node | basic_block_member(node, bb, _))
+ }
+
+ /** Successor relation for basic blocks. */
+ cached
+ predicate bb_successor_cached(BasicBlock pred, BasicBlock succ) {
+ exists(ControlFlowNode last |
+ basic_block_member(last, pred, bb_length(pred)-1) and
+ last.getASuccessor() = succ
+ )
+ }
+}
+
+predicate bb_successor = bb_successor_cached/2;
+
+/**
+ * A basic block in the C/C++ control-flow graph.
+ *
+ * A basic block is a simple sequence of control-flow nodes,
+ * connected to each other and nothing else:
+ *
+ * ```
+ * A - B - C - D ABCD is a basic block
+ * ```
+ *
+ * Any incoming or outgoing edges break the block into two:
+ *
+ * ```
+ * A - B > C - D AB is a basic block and CD is a basic block (C has two incoming edges)
+ *
+ *
+ * A - B < C - D AB is a basic block and CD is a basic block (B has two outgoing edges)
+ * ```
+ */
+class BasicBlock extends @cfgnode {
+
+ BasicBlock() {
+ basic_block_entry_node(this)
+ }
+
+ /** Gets a textual representation of this element. */
+ string toString() {
+ result = "BasicBlock"
+ }
+
+ predicate contains(ControlFlowNode node) {
+ basic_block_member(node, this, _)
+ }
+
+ ControlFlowNode getNode(int pos) {
+ basic_block_member(result, this, pos)
+ }
+
+ ControlFlowNode getANode() {
+ basic_block_member(result, this, _)
+ }
+
+ BasicBlock getASuccessor() {
+ bb_successor(this, result)
+ }
+
+ BasicBlock getAPredecessor() {
+ bb_successor(result, this)
+ }
+
+ BasicBlock getATrueSuccessor() {
+ result.getStart() = this.getEnd().getATrueSuccessor()
+ }
+
+ BasicBlock getAFalseSuccessor() {
+ result.getStart() = this.getEnd().getAFalseSuccessor()
+ }
+
+ ControlFlowNode getEnd() {
+ basic_block_member(result, this, bb_length(this)-1)
+ }
+
+ ControlFlowNode getStart() {
+ result = this
+ }
+
+ /** Gets the number of `ControlFlowNode`s in this basic block. */
+ int length() {
+ result = bb_length(this)
+ }
+
+ /**
+ * Holds if this element is at the specified location.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `filepath`.
+ * For more information, see
+ * [LGTM locations](https://lgtm.com/help/ql/locations).
+ *
+ * Yields no result if this basic block spans multiple source files.
+ */
+ predicate hasLocationInfo(string filepath, int startline, int startcolumn, int endline, int endcolumn) {
+ hasLocationInfoInternal(filepath, startline, startcolumn, filepath, endline, endcolumn)
+ }
+
+ pragma[noinline] private
+ predicate hasLocationInfoInternal(string file, int line, int col, string endf, int endl, int endc) {
+ this.getStart().getLocation().hasLocationInfo(file, line, col, _, _)
+ and
+ this.getEnd().getLocation().hasLocationInfo(endf, _, _, endl, endc)
+ }
+
+ Function getEnclosingFunction() {
+ result = this.getStart().getControlFlowScope()
+ }
+
+ /**
+ * Holds if this basic block is in a loop of the control-flow graph. This
+ * includes loops created by `goto` statements. This predicate may not hold
+ * even if this basic block is syntactically inside a `while` loop if the
+ * necessary back edges are unreachable.
+ */
+ predicate inLoop() {
+ this.getASuccessor+() = this
+ }
+
+ /**
+ * DEPRECATED since version 1.11: this predicate does not match the standard
+ * definition of _loop header_.
+ *
+ * Holds if this basic block is in a loop of the control-flow graph and
+ * additionally has an incoming edge that is not part of any loop containing
+ * this basic block. A typical example would be the basic block that computes
+ * `x > 0` in an outermost loop `while (x > 0) { ... }`.
+ */
+ deprecated
+ predicate isLoopHeader() {
+ this.inLoop() and exists(BasicBlock pred | pred = this.getAPredecessor() and not pred = this.getASuccessor+())
+ }
+
+ /**
+ * Holds if control flow may reach this basic block from a function entry
+ * point or a `catch` clause of a reachable `try` statement.
+ */
+ predicate isReachable() {
+ exists(Function f | f.getBlock() = this)
+ or
+ exists(TryStmt t, BasicBlock tryblock | this = t.getACatchClause() and tryblock.isReachable() and tryblock.contains(t))
+ or
+ exists(BasicBlock pred | pred.getASuccessor() = this and pred.isReachable())
+ }
+
+ /** Means `not isReachable()`. */
+ predicate isUnreachable() {
+ not this.isReachable()
+ }
+
+}
+
+/** Correct relation for reachability of ControlFlowNodes. */
+predicate unreachable(ControlFlowNode n) {
+ exists(BasicBlock bb | bb.contains(n) and bb.isUnreachable())
+}
+
+/**
+ * An entry point of a function.
+ */
+class EntryBasicBlock extends BasicBlock {
+ EntryBasicBlock() {
+ exists (Function f | this = f.getEntryPoint())
+ }
+}
+
+/**
+ * A basic block whose last node is the exit point of a function.
+ */
+class ExitBasicBlock extends BasicBlock {
+ ExitBasicBlock() {
+ getEnd() instanceof Function or
+ aborting(getEnd())
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/controlflow/ControlFlowGraph.qll b/cpp/ql/src/semmle/code/cpp/controlflow/ControlFlowGraph.qll
new file mode 100644
index 000000000000..b255a2153caf
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/controlflow/ControlFlowGraph.qll
@@ -0,0 +1,173 @@
+import cpp
+import BasicBlocks
+private import semmle.code.cpp.controlflow.internal.ConstantExprs
+
+/**
+ * A control-flow node is either a statement or an expression; in addition,
+ * functions are control-flow nodes representing the exit point of the
+ * function. The graph represents one possible evaluation order out of all the
+ * ones the compiler might have picked.
+ *
+ * Control-flow nodes have successors and predecessors at the expression level,
+ * so control flow is accurately represented in expressions as well as between
+ * statements. Statements and initializers precede their contained expressions,
+ * and expressions deeper in the tree precede those higher up; for example, the
+ * statement `x = y + 1` gets a control-flow graph that looks like
+ *
+ * ```
+ * ExprStmt -> y -> 1 -> (+) -> x -> (=)
+ * ```
+ *
+ * The first control-flow node in a function is the body of the function (a
+ * block), and the last is the function itself, which is used to represent the
+ * exit point.
+ *
+ * Each `throw` expression or `Handler` has a path (along any necessary
+ * destructor calls) to its nearest enclosing `Handler` within the same
+ * function, or to the exit point of the function if there is no such
+ * `Handler`. There are no edges from function calls to `Handler`s.
+ */
+class ControlFlowNode extends Locatable, @cfgnode {
+
+ ControlFlowNode getASuccessor() { successors_adapted(this,result) }
+
+ ControlFlowNode getAPredecessor() { this = result.getASuccessor() }
+
+ /** Gets the function containing this control-flow node. */
+ abstract Function getControlFlowScope();
+
+ /** Gets the smallest statement containing this control-flow node. */
+ abstract Stmt getEnclosingStmt();
+
+ /**
+ * Holds if this node is the top-level expression of a conditional statement,
+ * meaning that `this.getATrueSuccessor()` or `this.getAFalseSuccessor()`
+ * will have a result.
+ */
+ predicate isCondition() {
+ exists(this.getATrueSuccessor()) or
+ exists(this.getAFalseSuccessor())
+ }
+
+ /**
+ * Gets a node such that the control-flow edge `(this, result)` may be
+ * taken when this expression is true.
+ */
+ ControlFlowNode getATrueSuccessor() {
+ truecond(this,result) and result = getASuccessor()
+ }
+
+ /**
+ * Gets a node such that the control-flow edge `(this, result)` may be
+ * taken when this expression is false.
+ */
+ ControlFlowNode getAFalseSuccessor() {
+ falsecond(this,result) and result = getASuccessor()
+ }
+
+ BasicBlock getBasicBlock() {
+ result.getANode() = this
+ }
+}
+
+import Cached
+private cached module Cached {
+ /**
+ * Holds if the control-flow node `n` is reachable, meaning that either
+ * it is an entry point, or there exists a path in the control-flow
+ * graph of its function that connects an entry point to it.
+ * Compile-time constant conditions are taken into account, so that
+ * the call to `f` is not reachable in `if (0) f();` even if the
+ * `if` statement as a whole is reachable.
+ */
+ cached
+ predicate reachable(ControlFlowNode n)
+ {
+ exists(Function f | f.getEntryPoint() = n)
+ or
+ // Okay to use successors_extended directly here
+ (not successors_extended(_,n) and not successors_extended(n,_))
+ or
+ reachable(n.getAPredecessor())
+ or
+ n instanceof CatchBlock
+ }
+
+ /** Holds if `condition` always evaluates to a nonzero value. */
+ cached
+ predicate conditionAlwaysTrue(Expr condition) {
+ conditionAlways(condition, true)
+ }
+
+ /** Holds if `condition` always evaluates to zero. */
+ cached
+ predicate conditionAlwaysFalse(Expr condition) {
+ conditionAlways(condition, false)
+ or
+ // If a loop condition evaluates to false upon entry, it will always
+ // be false
+ loopConditionAlwaysUponEntry(_, condition, false)
+ }
+
+ /**
+ * The condition `condition` for the loop `loop` is provably `true` upon entry.
+ * That is, at least one iteration of the loop is guaranteed.
+ */
+ cached
+ predicate loopConditionAlwaysTrueUponEntry(ControlFlowNode loop, Expr condition) {
+ loopConditionAlwaysUponEntry(loop, condition, true)
+ }
+}
+
+private predicate conditionAlways(Expr condition, boolean b) {
+ exists(ConditionEvaluator x, int val |
+ val = x.getValue(condition) |
+ val != 0 and b = true
+ or
+ val = 0 and b = false
+ )
+}
+
+private predicate loopConditionAlwaysUponEntry(ControlFlowNode loop, Expr condition, boolean b) {
+ exists(LoopEntryConditionEvaluator x, int val |
+ x.isLoopEntry(condition, loop) and
+ val = x.getValue(condition) |
+ val != 0 and b = true
+ or
+ val = 0 and b = false
+ )
+}
+
+/**
+ * An abstract class that can be extended to add additional edges to the
+ * control-flow graph. Instances of this class correspond to the source nodes
+ * of such edges, and the predicate `getAnEdgeTarget` should be overridden to
+ * produce the target nodes of each source.
+ *
+ * Changing the control-flow graph in some queries and not others can be
+ * expensive in execution time and disk space. Most cached predicates in the
+ * library depend on the control-flow graph, so these predicates will be
+ * computed and cached for each variation of the control-flow graph
+ * that is used.
+ *
+ * Edges added by this class will still be removed by the library if they
+ * appear to be unreachable. See the documentation on `ControlFlowNode` for
+ * more information about the control-flow graph.
+ */
+abstract class AdditionalControlFlowEdge extends @cfgnode {
+ /** Gets a target node of this edge, where the source node is `this`. */
+ abstract ControlFlowNode getAnEdgeTarget();
+
+ string toString() { result = this.(ControlFlowNode).toString() }
+}
+
+/**
+ * Holds if there is a control-flow edge from `source` to `target` in either
+ * the extractor-generated control-flow graph or in a subclass of
+ * `AdditionalControlFlowEdge`. Use this relation instead of `successors`.
+ */
+predicate successors_extended(@cfgnode source, @cfgnode target) {
+ successors(source, target)
+ or
+ source.(AdditionalControlFlowEdge).getAnEdgeTarget() = target
+}
diff --git a/cpp/ql/src/semmle/code/cpp/controlflow/Dataflow.qll b/cpp/ql/src/semmle/code/cpp/controlflow/Dataflow.qll
new file mode 100644
index 000000000000..0f5126666cf2
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/controlflow/Dataflow.qll
@@ -0,0 +1,150 @@
+/**
+ * Provides a simple data flow analysis to find expressions that are definitely
+ * null or that may be null.
+ */
+import cpp
+import Nullness
+import Dereferenced
+
+/**
+ * INTERNAL: Do not use.
+ * A string that identifies a data flow analysis along with a set of member
+ * predicates that implement this analysis.
+ */
+abstract class DataflowAnnotation extends string {
+ DataflowAnnotation() { this = "pointer-null" or this = "pointer-valid" }
+
+ abstract predicate isDefault();
+ abstract predicate generatedOn(Expr e);
+ abstract predicate generatedBy(LocalScopeVariable v, ControlFlowNode src, ControlFlowNode dest);
+ abstract predicate killedBy(LocalScopeVariable v, ControlFlowNode src, ControlFlowNode dest);
+
+ predicate marks(Expr e) {
+ (this.generatedOn(e) and reachable(e))
+ or
+ this.marks(e.(AssignExpr).getRValue())
+ or
+ exists(LocalScopeVariable v | this.marks(v, e) and e = v.getAnAccess())
+ }
+
+ predicate marks(LocalScopeVariable v, ControlFlowNode n) {
+ (
+ v.getAnAccess().getEnclosingFunction().getBlock() = n and
+ this.isDefault()
+ )
+ or
+ (
+ this.marks(n.(Initializer).getExpr()) and
+ v.getInitializer() = n
+ )
+ or
+ exists(ControlFlowNode pred |
+ this.generatedBy(v, pred, n)
+ and not this.killedBy(v, pred, n)
+ and reachable(pred)
+ )
+ or
+ exists(ControlFlowNode pred |
+ this.assignedBy(v, pred, n)
+ and not this.killedBy(v, pred, n)
+ and reachable(pred)
+ )
+ or
+ exists(ControlFlowNode pred |
+ this.preservedBy(v, pred, n)
+ and not this.killedBy(v, pred, n)
+ and reachable(pred)
+ )
+ }
+
+ predicate preservedBy(LocalScopeVariable v, ControlFlowNode src, ControlFlowNode dest) {
+ this.marks(v, src) and
+ src.getASuccessor() = dest and
+ not v.getInitializer() = dest and
+ not v.getAnAssignment() = src
+ }
+
+ predicate assignedBy(LocalScopeVariable v, ControlFlowNode src, ControlFlowNode dest) {
+ this.marks(src.(AssignExpr).getRValue()) and
+ src = v.getAnAssignment() and
+ src.getASuccessor() = dest
+ }
+}
+
+/**
+ * INTERNAL: Do not use.
+ * Two analyses relating to nullness: `"pointer-null"` and `"pointer-valid"`.
+ * These analyses mark expressions that are possibly null or possibly non-null,
+ * respectively.
+ */
+class NullnessAnnotation extends DataflowAnnotation {
+ NullnessAnnotation() { this = "pointer-null" or this = "pointer-valid" }
+
+ override predicate isDefault() { this = "pointer-valid" }
+
+ override predicate generatedOn(Expr e) {
+ exists(Variable v |
+ v.getAnAccess() = e and
+ (v instanceof GlobalVariable or v instanceof Field) and
+ this.isDefault())
+ or
+ (e instanceof Call and this = "pointer-valid")
+ or
+ (nullValue(e) and this = "pointer-null")
+ }
+
+ override predicate killedBy(LocalScopeVariable v, ControlFlowNode src, ControlFlowNode dest) {
+ src.(AnalysedExpr).getNullSuccessor(v) = dest and this = "pointer-valid"
+ or
+ src.(AnalysedExpr).getNonNullSuccessor(v) = dest and this = "pointer-null"
+ or
+ dest = src.getASuccessor() and callByReference(src, v) and not this.isDefault()
+ or
+ dest = src.getASuccessor() and deref(v, src) and this = "pointer-null"
+ }
+
+ override predicate generatedBy(LocalScopeVariable v, ControlFlowNode src, ControlFlowNode dest) {
+ dest = src.getASuccessor() and
+ callByReference(src, v) and
+ this.isDefault()
+ }
+}
+
+/**
+ * Holds if evaluation of `op` dereferences `v`.
+ */
+predicate deref(Variable v, Expr op) {
+ dereferencedByOperation(op, v.getAnAccess())
+}
+
+/**
+ * Holds if `call` passes `v` by reference, either with an explicit address-of
+ * operator or implicitly as a C++ reference. Both const and non-const
+ * references are included.
+ */
+predicate callByReference(Call call, Variable v) {
+ exists(Expr arg |
+ call.getAnArgument() = arg and
+ (
+ arg.(AddressOfExpr).getAChild() = v.getAnAccess()
+ or
+ (v.getAnAccess() = arg and arg.getConversion*() instanceof ReferenceToExpr)
+ )
+ )
+}
+
+/**
+ * Holds if a simple data-flow analysis determines that `e` is definitely null.
+ */
+predicate definitelyNull(Expr e) {
+ "pointer-null".(NullnessAnnotation).marks(e)
+ and
+ not "pointer-valid".(NullnessAnnotation).marks(e)
+}
+
+/**
+ * Holds if a simple data-flow analysis determines that `e` may be null.
+ */
+predicate maybeNull(Expr e) {
+ "pointer-null".(NullnessAnnotation).marks(e)
+}
diff --git a/cpp/ql/src/semmle/code/cpp/controlflow/DefinitionsAndUses.qll b/cpp/ql/src/semmle/code/cpp/controlflow/DefinitionsAndUses.qll
new file mode 100644
index 000000000000..ce650df961f1
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/controlflow/DefinitionsAndUses.qll
@@ -0,0 +1,410 @@
+import cpp
+private import semmle.code.cpp.controlflow.LocalScopeVariableReachability
+private import semmle.code.cpp.dataflow.EscapesTree
+
+/**
+ * Computed relation: A "definition-use-pair" for a particular variable.
+ * Intuitively, this means that `def` is an assignment to `var`, and
+ * `use` is a read of `var` at which the value assigned by `def` may
+ * be read. (There can be more than one definition reaching a single
+ * use, and a single definition can reach many uses.)
+ */
+predicate definitionUsePair(SemanticStackVariable var, Expr def, Expr use) {
+ exists(Use u |
+ u = use
+ and
+ def.(Def).reaches(true, var, u)
+ and
+ u.getVariable(false) = var
+ )
+}
+
+/**
+ * Holds if the definition `def` of some stack variable can reach `node`, which
+ * is a definition or use, without crossing definitions of the same variable.
+ */
+predicate definitionReaches(Expr def, Expr node) {
+ def.(Def).reaches(true, _, (DefOrUse)node)
+}
+
+private predicate hasAddressOfAccess(SemanticStackVariable var) {
+ var.getAnAccess().isAddressOfAccessNonConst()
+}
+
+/**
+ * A use/use pair is a pair of uses of a particular variable `var`
+ * where the same value might be read (meaning that there is a
+ * control-flow path from `first` to `second` without crossing
+ * a definition of `var`).
+ */
+predicate useUsePair(SemanticStackVariable var, Expr first, Expr second) {
+ (
+ /* If the address of `var` is used anywhere, we require that
+ * a definition of `var` can reach the first use. This is to
+ * rule out examples such as this:
+ * ```
+ * int x = 0;
+ * int& y = x;
+ * use(x);
+ * y = 1;
+ * use(x); // not a use-use pair with the use above
+ * ```
+ */
+ hasAddressOfAccess(var)
+ implies
+ definitionUsePair(var, _, first)
+ )
+ and
+ // If `first` is both a def and a use, like `x` in `f(x)` when `f` takes a
+ // reference parameter, it'll play the role of a use first and a def second.
+ // We are not interested in uses that follow its role as a def.
+ not definition(var, first)
+ and
+ exists(Use u |
+ u = second
+ and
+ first.(Use).reaches(false, var, u)
+ and
+ u.getVariable(false) = var
+ )
+}
+
+/**
+ * Holds if `va` is a use of the parameter `p` that could
+ * observe the passed-in value.
+ */
+predicate parameterUsePair(Parameter p, VariableAccess va) {
+ not parameterIsOverwritten(_, p) and va.getTarget() = p
+ or
+ exists(ParameterDef pd | pd.reaches(true, p, (Use)va))
+}
+
+/**
+ * Utility class: A definition or use of a stack variable.
+ */
+library
+class DefOrUse extends @cfgnode {
+ DefOrUse() {
+ // Uninstantiated templates are purely syntax, and only on instantiation
+ // will they be complete with information about types, conversions, call
+ // targets, etc.
+ not this.(Element).isFromUninstantiatedTemplate(_)
+ }
+
+ /**
+ * Gets the target variable of this definition or use.
+ *
+ * The `isDef` parameter is needed in order to ensure disjointness
+ * of definitions and uses; in a variable initialization such as
+ * `int x = y`, `y` is both a definition of `x`, as well as a use of
+ * `y`, and `isDef` is used to distinguish the two situations.
+ */
+ abstract SemanticStackVariable getVariable(boolean isDef);
+
+ pragma[noinline]
+ private predicate reaches_helper(boolean isDef, SemanticStackVariable v, BasicBlock bb, int i) {
+ getVariable(isDef) = v and
+ bb.getNode(i) = this
+ }
+
+ /**
+ * Holds if the value of `v` in this control-flow node reaches
+ * `defOrUse` along some control-flow path without crossing a
+ * definition of `v`.
+ */
+ cached
+ predicate reaches(boolean isDef, SemanticStackVariable v, DefOrUse defOrUse) {
+ /* Implementation detail: this predicate and its private auxiliary
+ * predicates are instances of the more general predicates in
+ * LocalScopeVariableReachability.qll, and should be kept in sync.
+ *
+ * Unfortunately, caching of abstract predicates does not work well, so the
+ * predicates are duplicated for now.
+ */
+ exists(BasicBlock bb, int i |
+ reaches_helper(isDef, v, bb, i) |
+ exists(int j |
+ j > i
+ and
+ (bbDefAt(bb, j, v, defOrUse) or bbUseAt(bb, j, v, defOrUse))
+ and
+ not exists(int k | firstBarrierAfterThis(isDef, k, v) and k < j)
+ )
+ or
+ not firstBarrierAfterThis(isDef, _, v) and
+ bbSuccessorEntryReachesDefOrUse(bb, v, defOrUse, _)
+ )
+ }
+
+ private predicate firstBarrierAfterThis(boolean isDef, int j, SemanticStackVariable v) {
+ exists(BasicBlock bb, int i |
+ getVariable(isDef) = v
+ and
+ bb.getNode(i) = this
+ and
+ j = min(int k | bbBarrierAt(bb, k, v, _) and k > i)
+ )
+ }
+
+ /** Gets a textual representation of this element. */
+ string toString() { result = "DefOrUse" }
+}
+
+library
+class Def extends DefOrUse {
+ Def() {
+ definition(_, this)
+ }
+
+ override SemanticStackVariable getVariable(boolean isDef) {
+ definition(result, this) and isDef = true
+ }
+}
+
+/** Holds if parameter `p` is potentially overwritten in the body of `f`. */
+private predicate parameterIsOverwritten(Function f, Parameter p) {
+ f.getAParameter() = p and
+ definitionBarrier(p, _)
+}
+
+library
+class ParameterDef extends DefOrUse {
+ ParameterDef() {
+ // Optimization: parameters that are not overwritten do not require
+ // reachability analysis
+ exists(Function f | parameterIsOverwritten(f, _) | this = f.getEntryPoint())
+ }
+
+ override SemanticStackVariable getVariable(boolean isDef) {
+ exists(Function f | parameterIsOverwritten(f, result) | this = f.getEntryPoint())
+ and
+ isDef = true
+ }
+}
+
+library
+class Use extends DefOrUse {
+ Use() {
+ useOfVar(_, this)
+ }
+
+ override SemanticStackVariable getVariable(boolean isDef) {
+ useOfVar(result, this) and isDef = false
+ }
+}
+
+private predicate bbUseAt(BasicBlock bb, int i, SemanticStackVariable v, Use use) {
+ bb.getNode(i) = use
+ and
+ use.getVariable(false) = v
+}
+
+private predicate bbDefAt(BasicBlock bb, int i, SemanticStackVariable v, Def def) {
+ bb.getNode(i) = def
+ and
+ def.getVariable(true) = v
+}
+
+private predicate bbBarrierAt(BasicBlock bb, int i, SemanticStackVariable v, ControlFlowNode node) {
+ bb.getNode(i) = node
+ and
+ definitionBarrier(v, node)
+}
+
+/**
+ * Holds if the entry node of a _successor_ of basic block `bb` can
+ * reach `defOrUse` without going through a barrier for `v`.
+ * `defOrUse` may either be in the successor block, or in another
+ * basic block reachable from the successor.
+ *
+ * `skipsFirstLoopAlwaysTrueUponEntry` indicates whether the first loop
+ * on the path to `defOrUse` (if any), where the condition is provably
+ * true upon entry, is skipped (including the step from `bb` to the
+ * successor).
+ */
+private predicate bbSuccessorEntryReachesDefOrUse(BasicBlock bb, SemanticStackVariable v, DefOrUse defOrUse, boolean skipsFirstLoopAlwaysTrueUponEntry) {
+ exists(BasicBlock succ, boolean succSkipsFirstLoopAlwaysTrueUponEntry |
+ bbSuccessorEntryReachesLoopInvariant(bb, succ, skipsFirstLoopAlwaysTrueUponEntry, succSkipsFirstLoopAlwaysTrueUponEntry) |
+ bbEntryReachesDefOrUseLocally(succ, v, defOrUse) and
+ succSkipsFirstLoopAlwaysTrueUponEntry = false and
+ not excludeReachesFunction(bb.getEnclosingFunction())
+ or
+ not bbBarrierAt(succ, _, v, _) and
+ bbSuccessorEntryReachesDefOrUse(succ, v, defOrUse, succSkipsFirstLoopAlwaysTrueUponEntry)
+ )
+}
+
+private predicate bbEntryReachesDefOrUseLocally(BasicBlock bb, SemanticStackVariable v, DefOrUse defOrUse) {
+ exists(int n |
+ bbDefAt(bb, n, v, defOrUse) or bbUseAt(bb, n, v, defOrUse) |
+ not exists(int m | m < n | bbBarrierAt(bb, m, v, _))
+ )
+}
+
+/**
+ * Holds if `barrier` is either a (potential) definition of `v` or follows an
+ * access that gets the address of `v`. In both cases, the value of
+ * `v` after `barrier` cannot be assumed to be the same as before.
+ */
+predicate definitionBarrier(SemanticStackVariable v, ControlFlowNode barrier) {
+ definition(v, barrier)
+ or
+ exists(VariableAccess va |
+ /* `va = barrier` does not work, as that could generate an
+ * incorrect use-use pair (a barrier must exist _between_
+ * uses):
+ * ```
+ * x = 0;
+ * int& y = x; // use1
+ * y = 1;
+ * use(x); // use2
+ * ```
+ */
+ va.getASuccessor() = barrier and
+ va.getTarget() = v and
+ va.isAddressOfAccessNonConst() and
+ not exists(Call c | c.passesByReferenceNonConst(_, va)) // handled in definitionByReference
+ )
+}
+
+/**
+ * Holds if `def` is a (potential) assignment to stack variable `v`. That is,
+ * the variable may hold another value in the control-flow node(s)
+ * following `def` than before.
+ */
+predicate definition(SemanticStackVariable v, Expr def) {
+ def = v.getInitializer().getExpr()
+ or
+ variableAccessedAsValue(
+ v.getAnAccess(), def.(Assignment).getLValue().getFullyConverted())
+ or
+ variableAccessedAsValue(
+ v.getAnAccess(), def.(CrementOperation).getOperand().getFullyConverted())
+ or
+ exists(AsmStmt asmStmt |
+ def = asmStmt.getAChild() and
+ def = v.getAnAccess().getParent*())
+ or
+ definitionByReference(v.getAnAccess(), def)
+}
+
+/**
+ * Holds if `def` is a (definite) assignment to the stack variable `v`. `e` is
+ * the assigned expression.
+ */
+predicate exprDefinition(SemanticStackVariable v, ControlFlowNode def, Expr e) {
+ (
+ def = v.getInitializer().getExpr() and
+ def = e and
+ not v.getType() instanceof ReferenceType
+ )
+ or
+ exists(AssignExpr assign |
+ def = assign and
+ assign.getLValue() = v.getAnAccess() and
+ e = assign.getRValue()
+ )
+}
+
+pragma[noinline]
+private predicate containsAssembly(Function f) {
+ f = any(AsmStmt s).getEnclosingFunction()
+}
+
+/**
+ * Holds if `va` is a variable passed by reference as argument `def`, where the
+ * callee potentially assigns the corresponding parameter. The
+ * definitions-and-uses library models assignment by reference as if it happens
+ * on evaluation of the argument, `def`.
+ *
+ * All library functions except `std::move` are assumed to assign
+ * call-by-reference parameters, and source code functions are assumed to
+ * assign call-by-reference parameters that are accessed somewhere within the
+ * function. The latter is an over-approximation, but avoids having to take
+ * aliasing of the parameter into account.
+ */
+predicate definitionByReference(VariableAccess va, Expr def) {
+ exists(Call c, int i |
+ c.passesByReferenceNonConst(i, va)
+ and
+ def = c.getArgument(i)
+ and
+ forall(Function f |
+ f = c.getTarget() and f.hasEntryPoint() |
+ exists(f.getParameter(i).getAnAccess())
+ or
+ f.isVarargs() and i >= f.getNumberOfParameters()
+ or
+ // If the callee contains an AsmStmt, then it is better to
+ // be conservative and assume that the parameter can be
+ // modified.
+ containsAssembly(f)
+ )
+ )
+ or
+ // Extractor artifact when using templates; an expression call where the
+ // target expression is an unknown literal. Since we cannot know what
+ // these calls represent, assume they assign all their arguments
+ exists(ExprCall c, Literal l |
+ l = c.getExpr() and
+ c.getAnArgument() = va and
+ not exists(l.getValue()) and
+ def = va
+ )
+}
+
+private predicate accessInSizeof(VariableAccess use) {
+ use.getParent+() instanceof SizeofOperator
+}
+
+/**
+ * Holds if `use` is a non-definition use of stack variable `v`. This will not
+ * include accesses on the LHS of an assignment (which don't retrieve the
+ * variable value), but _will_ include accesses in increment/decrement
+ * operations.
+ */
+predicate useOfVar(SemanticStackVariable v, VariableAccess use) {
+ use = v.getAnAccess() and
+ not exists(AssignExpr e | e.getLValue() = use) and
+ // sizeof accesses are resolved at compile-time
+ not accessInSizeof(use)
+}
+
+/**
+ * Same as `useOfVar(v, use)`, but with the extra condition that the
+ * access `use` actually reads the value of the stack variable `v` at
+ * run-time. (Non-examples include `&x` and function calls where the
+ * callee does not use the relevant parameter.)
+ */
+predicate useOfVarActual(SemanticStackVariable v, VariableAccess use) {
+ useOfVar(v, use) and
+ exists(Expr e |
+ variableAccessedAsValue(use, e) and
+ not exists(AssignExpr assign |
+ e = assign.getLValue().getFullyConverted()
+ )
+ ) and
+ // A call to a function that does not use the relevant parameter
+ not exists(Call c, int i |
+ c.getArgument(i) = use and
+ c.getTarget().hasEntryPoint() and
+ not exists(c.getTarget().getParameter(i).getAnAccess())
+ )
+}
+
+/**
+ * A function that should be excluded from 'reaches' analysis.
+ *
+ * The current implementation performs badly in some cases where a
+ * function has both a huge number of def/uses and a huge number of
+ * basic blocks, typically in generated code. We exclude these
+ * functions based on the former because it is cheaper to calculate.
+ */
+private predicate excludeReachesFunction(Function f) {
+ exists(int defOrUses |
+ defOrUses =
+ count(Def def | def.(ControlFlowNode).getControlFlowScope() = f) +
+ count(Use use | use.(ControlFlowNode).getControlFlowScope() = f) and
+ defOrUses >= 13000
+ )
+}
diff --git a/cpp/ql/src/semmle/code/cpp/controlflow/Dereferenced.qll b/cpp/ql/src/semmle/code/cpp/controlflow/Dereferenced.qll
new file mode 100644
index 000000000000..69ffc314d374
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/controlflow/Dereferenced.qll
@@ -0,0 +1,107 @@
+import cpp
+import Nullness
+
+/**
+ * Holds if the call `fc` will dereference argument `i`.
+ */
+predicate callDereferences(FunctionCall fc, int i)
+{
+ exists(string name |
+ fc.getTarget().hasQualifiedName(name) and
+ (
+ (name = "bcopy" and i in [0..1]) or
+ (name = "memcpy" and i in [0..1]) or
+ (name = "memmove" and i in [0..1]) or
+ (name = "strcpy" and i in [0..1]) or
+ (name = "strncpy" and i in [0..1]) or
+ (name = "strdup" and i = 0) or
+ (name = "strndup" and i = 0) or
+ (name = "strlen" and i = 0) or
+ (name = "printf" and fc.getArgument(i).getType() instanceof PointerType) or
+ (name = "fprintf" and fc.getArgument(i).getType() instanceof PointerType) or
+ (name = "sprintf" and fc.getArgument(i).getType() instanceof PointerType) or
+ (name = "snprintf" and fc.getArgument(i).getType() instanceof PointerType) or
+ (name = "vprintf" and fc.getArgument(i).getType() instanceof PointerType) or
+ (name = "vfprintf" and fc.getArgument(i).getType() instanceof PointerType) or
+ (name = "vsprintf" and fc.getArgument(i).getType() instanceof PointerType) or
+ (name = "vsnprintf" and fc.getArgument(i).getType() instanceof PointerType)
+ )
+ )
+}
+
+/**
+ * Holds if evaluation of `op` dereferences `e`.
+ */
+predicate dereferencedByOperation(Expr op, Expr e)
+{
+ exists(PointerDereferenceExpr deref |
+ deref.getAChild() = e and deref = op and
+ not deref.getParent*() instanceof SizeofOperator)
+ or
+ exists(CrementOperation crement |
+ dereferencedByOperation(e, op) and crement.getOperand() = e)
+ or
+ exists(ArrayExpr ae |
+ (not ae.getParent() instanceof AddressOfExpr and
+ not ae.getParent*() instanceof SizeofOperator) and
+ ae = op and
+ (
+ (e = ae.getArrayBase() and e.getType() instanceof PointerType)
+ or
+ (e = ae.getArrayOffset() and e.getType() instanceof PointerType)
+ )
+ )
+ or
+ exists(AddressOfExpr addof, ArrayExpr ae |
+ dereferencedByOperation(addof, op) and addof.getOperand() = ae and
+ (e = ae.getArrayBase() or e = ae.getArrayOffset()) and
+ e.getType() instanceof PointerType)
+ or
+ exists(UnaryArithmeticOperation arithop |
+ dereferencedByOperation(arithop, op) and e = arithop.getAnOperand() and e.getType() instanceof PointerType)
+ or
+ exists(BinaryArithmeticOperation arithop |
+ dereferencedByOperation(arithop, op) and e = arithop.getAnOperand() and e.getType() instanceof PointerType)
+ or
+
+ exists(FunctionCall fc, int i |
+ (callDereferences(fc, i) or functionCallDereferences(fc, i))
+ and e = fc.getArgument(i) and op = fc)
+ or
+ // ptr->Field
+ e = op.(FieldAccess).getQualifier() and isClassPointerType(e.getType())
+ or
+ // ptr->method()
+ e = op.(Call).getQualifier() and isClassPointerType(e.getType())
+}
+
+private predicate isClassPointerType(Type t) {
+ t.getUnderlyingType().(PointerType).getBaseType().getUnderlyingType() instanceof Class
+}
+
+/**
+ * Holds if `e` will be dereferenced after being evaluated.
+ */
+predicate dereferenced(Expr e)
+{
+ dereferencedByOperation(_, e)
+}
+
+pragma[noinline]
+private predicate functionCallDereferences(FunctionCall fc, int i)
+{
+ functionDereferences(fc.getTarget(), i)
+}
+
+/**
+ * Holds if the body of a function `f` is likely to dereference its `i`th
+ * parameter unconditionally. This analysis does not account for reassignment.
+ */
+predicate functionDereferences(Function f, int i)
+{
+ exists(VariableAccess access, Parameter p |
+ p = f.getParameter(i) and
+ dereferenced(access) and
+ access = p.getAnAccess() and
+ not checkedValid(p, access))
+}
diff --git a/cpp/ql/src/semmle/code/cpp/controlflow/Dominance.qll b/cpp/ql/src/semmle/code/cpp/controlflow/Dominance.qll
new file mode 100644
index 000000000000..6bb4838e2be1
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/controlflow/Dominance.qll
@@ -0,0 +1,85 @@
+/**
+ * Provides dominance predicates for control-flow nodes.
+ *
+ * These variations of the _dominance relation_ are used for computing SSA
+ * form. Formally, a node `d` _dominates_ a node `n` if all paths from the
+ * function entry point to `n` go through `d`; this applies within a function
+ * and only for nodes reachable from the entry point. Unreachable nodes are not
+ * part the dominance relation.
+ */
+import cpp
+
+
+/*
+ * In rare cases, the same node is used in multiple control-flow scopes. This
+ * confuses the dominance analysis, so this predicate is used to exclude them.
+ */
+private predicate
+hasMultiScopeNode(Function f) {
+ exists (ControlFlowNode node |
+ node.getControlFlowScope() = f
+ and node.getControlFlowScope() != f)
+}
+
+/** Holds if `entry` is the entry point of a function. */
+predicate functionEntry(ControlFlowNode entry) {
+ exists (Function function |
+ function.getEntryPoint() = entry
+ and not hasMultiScopeNode(function))
+}
+
+/**
+ * Holds if `dest` is an immediate successor of `src` in the control-flow graph.
+ */
+private predicate nodeSucc(ControlFlowNode src, ControlFlowNode dest) {
+ src.getASuccessor() = dest
+}
+
+/**
+ * Holds if `dominator` is an immediate dominator of `node` in the control-flow
+ * graph.
+ */
+predicate iDominates(ControlFlowNode dominator, ControlFlowNode node) = idominance(functionEntry/1,nodeSucc/2)(_, dominator, node)
+
+/**
+ * Holds if `dominator` is a strict dominator of `node` in the control-flow
+ * graph. Being strict means that `dominator != node`.
+ */
+predicate strictlyDominates(ControlFlowNode dominator, ControlFlowNode node) {
+ iDominates+(dominator, node)
+}
+
+/**
+ * Holds if `dominator` is a dominator of `node` in the control-flow graph. This
+ * is reflexive.
+ */
+predicate dominates(ControlFlowNode dominator, ControlFlowNode node) {
+ strictlyDominates(dominator, node) or dominator = node
+}
+
+/*
+ * Dominance predicates for basic blocks.
+ */
+
+/**
+ * Holds if `dominator` is an immediate dominator of `node` in the control-flow
+ * graph of basic blocks.
+ */
+predicate bbIDominates(BasicBlock dom, BasicBlock node) = idominance(functionEntry/1, bb_successor/2)(_, dom, node)
+
+/**
+ * Holds if `dominator` is a strict dominator of `node` in the control-flow
+ * graph of basic blocks. Being strict means that `dominator != node`.
+ */
+predicate bbStrictlyDominates(BasicBlock dominator, BasicBlock node) {
+ bbIDominates+(dominator, node)
+}
+
+
+/**
+ * Holds if `dominator` is a dominator of `node` in the control-flow graph of
+ * basic blocks. This is reflexive.
+ */
+predicate bbDominates(BasicBlock dominator, BasicBlock node) {
+ bbStrictlyDominates(dominator, node) or dominator = node
+}
diff --git a/cpp/ql/src/semmle/code/cpp/controlflow/Guards.qll b/cpp/ql/src/semmle/code/cpp/controlflow/Guards.qll
new file mode 100644
index 000000000000..a0042c16ae46
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/controlflow/Guards.qll
@@ -0,0 +1,310 @@
+import cpp
+import semmle.code.cpp.controlflow.BasicBlocks
+import semmle.code.cpp.controlflow.SSA
+import semmle.code.cpp.controlflow.Dominance
+
+/**
+ * A Boolean condition that guards one or more basic blocks. This includes
+ * operands of logical operators but not switch statements.
+ */
+class GuardCondition extends Expr {
+
+ GuardCondition() {
+ is_condition(this)
+ }
+
+ /**
+ * Holds if this condition controls `block`, meaning that `block` is only
+ * entered if the value of this condition is `testIsTrue`.
+ *
+ * Illustration:
+ *
+ * ```
+ * [ (testIsTrue) ]
+ * [ this ----------------succ ---- controlled ]
+ * [ | | ]
+ * [ (testIsFalse) | ------ ... ]
+ * [ other ]
+ * ```
+ *
+ * The predicate holds if all paths to `controlled` go via the `testIsTrue`
+ * edge of the control-flow graph. In other words, the `testIsTrue` edge
+ * must dominate `controlled`. This means that `controlled` must be
+ * dominated by both `this` and `succ` (the target of the `testIsTrue`
+ * edge). It also means that any other edge into `succ` must be a back-edge
+ * from a node which is dominated by `succ`.
+ *
+ * The short-circuit boolean operations have slightly surprising behavior
+ * here: because the operation itself only dominates one branch (due to
+ * being short-circuited) then it will only control blocks dominated by the
+ * true (for `&&`) or false (for `||`) branch.
+ */
+ cached predicate controls(BasicBlock controlled, boolean testIsTrue) {
+ /* This condition must determine the flow of control; that is, this
+ * node must be a top-level condition. */
+ this.controlsBlock(controlled, testIsTrue)
+ or
+ exists (BinaryLogicalOperation binop, GuardCondition lhs, GuardCondition rhs
+ | this = binop and
+ lhs = binop.getLeftOperand() and
+ rhs = binop.getRightOperand() and
+ lhs.controls(controlled, testIsTrue) and
+ rhs.controls(controlled, testIsTrue))
+ or
+ exists (GuardCondition ne, GuardCondition operand
+ | this = operand and
+ operand = ne.(NotExpr).getOperand() and
+ ne.controls(controlled, testIsTrue.booleanNot()))
+ }
+
+ /** Holds if (determined by this guard) `left < right + k` evaluates to `isLessThan` if this expression evaluates to `testIsTrue`. */
+ cached predicate comparesLt(Expr left, Expr right, int k, boolean isLessThan, boolean testIsTrue) {
+ compares_lt(this, left, right, k, isLessThan, testIsTrue)
+ }
+
+ /** Holds if (determined by this guard) `left < right + k` must be `isLessThan` in `block`.
+ If `isLessThan = false` then this implies `left >= right + k`. */
+ cached predicate ensuresLt(Expr left, Expr right, int k, BasicBlock block, boolean isLessThan) {
+ exists(boolean testIsTrue |
+ compares_lt(this, left, right, k, isLessThan, testIsTrue) and this.controls(block, testIsTrue)
+ )
+ }
+
+ /** Holds if (determined by this guard) `left == right + k` evaluates to `areEqual` if this expression evaluates to `testIsTrue`. */
+ cached predicate comparesEq(Expr left, Expr right, int k, boolean areEqual, boolean testIsTrue) {
+ compares_eq(this, left, right, k, areEqual, testIsTrue)
+ }
+
+ /** Holds if (determined by this guard) `left == right + k` must be `areEqual` in `block`.
+ If `areEqual = false` then this implies `left != right + k`. */
+ cached predicate ensuresEq(Expr left, Expr right, int k, BasicBlock block, boolean areEqual) {
+ exists(boolean testIsTrue |
+ compares_eq(this, left, right, k, areEqual, testIsTrue) and this.controls(block, testIsTrue)
+ )
+ }
+
+ /**
+ * Holds if this condition controls `block`, meaning that `block` is only
+ * entered if the value of this condition is `testIsTrue`. This helper
+ * predicate does not necessarily hold for binary logical operations like
+ * `&&` and `||`. See the detailed explanation on predicate `controls`.
+ */
+ private predicate controlsBlock(BasicBlock controlled, boolean testIsTrue) {
+ exists(BasicBlock thisblock
+ | thisblock.contains(this)
+ | exists(BasicBlock succ
+ | testIsTrue = true and succ = this.getATrueSuccessor() or
+ testIsTrue = false and succ = this.getAFalseSuccessor()
+ | bbDominates(succ, controlled) and
+ forall(BasicBlock pred
+ | pred.getASuccessor() = succ
+ | pred = thisblock or bbDominates(succ, pred) or not reachable(pred))))
+ }
+}
+
+private predicate is_condition(Expr guard) {
+ guard.isCondition() or
+ is_condition(guard.(BinaryLogicalOperation).getAnOperand()) or
+ exists(NotExpr cond | is_condition(cond) and cond.getOperand() = guard)
+}
+
+
+ /* Simplify conditions in the source to the canonical form l op r + k.
+ */
+
+/* Simplification of equality expressions */
+
+/**
+ * Holds if `left == right + k` is `areEqual` given that test is `testIsTrue`.
+ *
+ * Beware making mistaken logical implications here relating `areEqual` and `testIsTrue`.
+ */
+private predicate compares_eq(Expr test, Expr left, Expr right, int k, boolean areEqual, boolean testIsTrue) {
+ /* The simple case where the test *is* the comparison so areEqual = testIsTrue xor eq. */
+ exists(boolean eq | simple_comparison_eq(test, left, right, k, eq) |
+ areEqual = true and testIsTrue = eq or areEqual = false and testIsTrue = eq.booleanNot()
+ )
+ or
+ logical_comparison_eq(test, left, right, k, areEqual, testIsTrue)
+ or
+ /* a == b + k => b == a - k */
+ exists(int mk | k = -mk | compares_eq(test, right, left, mk, areEqual, testIsTrue))
+ or
+ complex_eq(test, left, right, k, areEqual, testIsTrue)
+ or
+ /* (x is true => (left == right + k)) => (!x is false => (left == right + k)) */
+ exists(boolean isFalse | testIsTrue = isFalse.booleanNot() |
+ compares_eq(test.(NotExpr).getOperand(), left, right, k, areEqual, isFalse)
+ )
+}
+
+/** If `test => part` and `part => left == right + k` then `test => left == right + k`.
+ Similarly for the case where `test` is false. */
+private
+predicate logical_comparison_eq(BinaryLogicalOperation test, Expr left, Expr right, int k, boolean areEqual, boolean testIsTrue) {
+ exists(boolean partIsTrue, Expr part |
+ test.impliesValue(part, partIsTrue, testIsTrue) |
+ compares_eq(part, left, right, k, areEqual, partIsTrue)
+ )
+}
+
+/** Rearrange various simple comparisons into `left == right + k` form. */
+private predicate simple_comparison_eq(ComparisonOperation cmp, Expr left, Expr right, int k, boolean areEqual) {
+ left = cmp.getLeftOperand() and cmp.getOperator() = "==" and right = cmp.getRightOperand() and k = 0 and areEqual = true
+ or
+ left = cmp.getLeftOperand() and cmp.getOperator() = "!=" and right = cmp.getRightOperand() and k = 0 and areEqual = false
+}
+
+private predicate complex_eq(ComparisonOperation cmp, Expr left, Expr right, int k, boolean areEqual, boolean testIsTrue) {
+ sub_eq(cmp, left, right, k, areEqual, testIsTrue)
+ or
+ add_eq(cmp, left, right, k, areEqual, testIsTrue)
+}
+
+
+/* left - x == right + c => left == right + (c+x)
+ left == (right - x) + c => left == right + (c-x) */
+private predicate sub_eq(ComparisonOperation cmp, Expr left, Expr right, int k, boolean areEqual, boolean testIsTrue) {
+ exists(SubExpr lhs, int c, int x | compares_eq(cmp, lhs, right, c, areEqual, testIsTrue) and
+ left = lhs.getLeftOperand() and x = int_value(lhs.getRightOperand())
+ and k = c + x
+ )
+ or
+ exists(SubExpr rhs, int c, int x | compares_eq(cmp, left, rhs, c, areEqual, testIsTrue) and
+ right = rhs.getLeftOperand() and x = int_value(rhs.getRightOperand())
+ and k = c - x
+ )
+}
+
+/* left + x == right + c => left == right + (c-x)
+ left == (right + x) + c => left == right + (c+x) */
+private predicate add_eq(ComparisonOperation cmp, Expr left, Expr right, int k, boolean areEqual, boolean testIsTrue) {
+ exists(AddExpr lhs, int c, int x | compares_eq(cmp, lhs, right, c, areEqual, testIsTrue) and
+ (left = lhs.getLeftOperand() and x = int_value(lhs.getRightOperand())
+ or
+ left = lhs.getRightOperand() and x = int_value(lhs.getLeftOperand())
+ )
+ and k = c - x
+ )
+ or
+ exists(AddExpr rhs, int c, int x | compares_eq(cmp, left, rhs, c, areEqual, testIsTrue) and
+ (right = rhs.getLeftOperand() and x = int_value(rhs.getRightOperand())
+ or
+ right = rhs.getRightOperand() and x = int_value(rhs.getLeftOperand())
+ )
+ and k = c + x
+ )
+}
+
+/* Simplification of inequality expressions
+ * Simplify conditions in the source to the canonical form l < r + k.
+ */
+
+/** Holds if `left < right + k` evaluates to `isLt` given that test is `testIsTrue`. */
+private predicate compares_lt(Expr test, Expr left, Expr right, int k, boolean isLt, boolean testIsTrue) {
+ /* In the simple case, the test is the comparison, so isLt = testIsTrue */
+ simple_comparison_lt(test, left, right, k) and isLt = true and testIsTrue = true
+ or
+ simple_comparison_lt(test, left, right, k) and isLt = false and testIsTrue = false
+ or
+ logical_comparison_lt(test, left, right, k, isLt, testIsTrue)
+ or
+ complex_lt(test, left, right, k, isLt, testIsTrue)
+ or
+ /* (not (left < right + k)) => (left >= right + k) */
+ exists(boolean isGe | isLt = isGe.booleanNot() |
+ compares_ge(test, left, right, k, isGe, testIsTrue)
+ )
+ or
+ /* (x is true => (left < right + k)) => (!x is false => (left < right + k)) */
+ exists(boolean isFalse | testIsTrue = isFalse.booleanNot() |
+ compares_lt(test.(NotExpr).getOperand(), left, right, k, isLt, isFalse)
+ )
+}
+
+/** `(a < b + k) => (b > a - k) => (b >= a + (1-k))` */
+private predicate compares_ge(Expr test, Expr left, Expr right, int k, boolean isGe, boolean testIsTrue) {
+ exists(int onemk | k = 1 - onemk | compares_lt(test, right, left, onemk, isGe, testIsTrue))
+}
+
+/** If `test => part` and `part => left < right + k` then `test => left < right + k`.
+ Similarly for the case where `test` evaluates false. */
+private
+predicate logical_comparison_lt(BinaryLogicalOperation test, Expr left, Expr right, int k, boolean isLt, boolean testIsTrue) {
+ exists(boolean partIsTrue, Expr part |
+ test.impliesValue(part, partIsTrue, testIsTrue) |
+ compares_lt(part, left, right, k, isLt, partIsTrue)
+ )
+}
+
+/** Rearrange various simple comparisons into `left < right + k` form. */
+private predicate simple_comparison_lt(ComparisonOperation cmp, Expr left, Expr right, int k) {
+ left = cmp.getLeftOperand() and cmp.getOperator() = "<" and right = cmp.getRightOperand() and k = 0
+ or
+ left = cmp.getLeftOperand() and cmp.getOperator() = "<=" and right = cmp.getRightOperand() and k = 1
+ or
+ right = cmp.getLeftOperand() and cmp.getOperator() = ">" and left = cmp.getRightOperand() and k = 0
+ or
+ right = cmp.getLeftOperand() and cmp.getOperator() = ">=" and left = cmp.getRightOperand() and k = 1
+}
+
+private predicate complex_lt(ComparisonOperation cmp, Expr left, Expr right, int k, boolean isLt, boolean testIsTrue) {
+ sub_lt(cmp, left, right, k, isLt, testIsTrue)
+ or
+ add_lt(cmp, left, right, k, isLt, testIsTrue)
+}
+
+
+/* left - x < right + c => left < right + (c+x)
+ left < (right - x) + c => left < right + (c-x) */
+private predicate sub_lt(ComparisonOperation cmp, Expr left, Expr right, int k, boolean isLt, boolean testIsTrue) {
+ exists(SubExpr lhs, int c, int x | compares_lt(cmp, lhs, right, c, isLt, testIsTrue) and
+ left = lhs.getLeftOperand() and x = int_value(lhs.getRightOperand())
+ and k = c + x
+ )
+ or
+ exists(SubExpr rhs, int c, int x | compares_lt(cmp, left, rhs, c, isLt, testIsTrue) and
+ right = rhs.getLeftOperand() and x = int_value(rhs.getRightOperand())
+ and k = c - x
+ )
+}
+
+/* left + x < right + c => left < right + (c-x)
+ left < (right + x) + c => left < right + (c+x) */
+private predicate add_lt(ComparisonOperation cmp, Expr left, Expr right, int k, boolean isLt, boolean testIsTrue) {
+ exists(AddExpr lhs, int c, int x | compares_lt(cmp, lhs, right, c, isLt, testIsTrue) and
+ (left = lhs.getLeftOperand() and x = int_value(lhs.getRightOperand())
+ or
+ left = lhs.getRightOperand() and x = int_value(lhs.getLeftOperand())
+ )
+ and k = c - x
+ )
+ or
+ exists(AddExpr rhs, int c, int x | compares_lt(cmp, left, rhs, c, isLt, testIsTrue) and
+ (right = rhs.getLeftOperand() and x = int_value(rhs.getRightOperand())
+ or
+ right = rhs.getRightOperand() and x = int_value(rhs.getLeftOperand())
+ )
+ and k = c + x
+ )
+}
+
+/** The int value of integer constant expression. */
+private int int_value(Expr e) {
+ e.getUnderlyingType() instanceof IntegralType
+ and
+ result = e.getValue().toInt()
+}
+
+/** An `SsaDefinition` with an additional predicate `isLt`. */
+class GuardedSsa extends SsaDefinition {
+
+ /** Holds if this `SsaDefinition` is guarded such that `this(var) < gt + k` is `testIsTrue` in `block`. */
+ predicate isLt(LocalScopeVariable var, Expr gt, int k, BasicBlock block, boolean testIsTrue) {
+ exists(Expr luse, GuardCondition test | this.getAUse(var) = luse |
+ test.ensuresLt(luse, gt, k, block, testIsTrue)
+ )
+ }
+
+}
+
diff --git a/cpp/ql/src/semmle/code/cpp/controlflow/LocalScopeVariableReachability.qll b/cpp/ql/src/semmle/code/cpp/controlflow/LocalScopeVariableReachability.qll
new file mode 100644
index 000000000000..f89171263959
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/controlflow/LocalScopeVariableReachability.qll
@@ -0,0 +1,340 @@
+import cpp
+
+/**
+ * A reachability analysis for control-flow nodes involving stack variables.
+ * This defines sources, sinks, and any other configurable aspect of the
+ * analysis. Multiple analyses can coexist. To create an analysis, extend this
+ * class with a subclass whose characteristic predicate is a unique singleton
+ * string. For example, write
+ *
+ * ```
+ * class MyAnalysisConfiguration extends LocalScopeVariableReachability {
+ * MyAnalysisConfiguration() { this = "MyAnalysisConfiguration" }
+ * // Override `isSource` and `isSink`.
+ * // Override `isBarrier`.
+ * }
+ * ```
+ *
+ * Then, to query whether there is flow between some source and sink, call the
+ * `reaches` predicate on an instance of `MyAnalysisConfiguration`.
+ */
+abstract class LocalScopeVariableReachability extends string {
+ bindingset[this]
+ LocalScopeVariableReachability() { length() >= 0 }
+
+ /** Holds if `node` is a source for the reachability analysis using variable `v`. */
+ abstract predicate isSource(ControlFlowNode node, LocalScopeVariable v);
+
+ /** Holds if `sink` is a (potential) sink for the reachability analysis using variable `v`. */
+ abstract predicate isSink(ControlFlowNode node, LocalScopeVariable v);
+
+ /** Holds if `node` is a barrier for the reachability analysis using variable `v`. */
+ abstract predicate isBarrier(ControlFlowNode node, LocalScopeVariable v);
+
+ /**
+ * Holds if the source node `source` can reach the sink `sink` without crossing
+ * a barrier. This is (almost) equivalent to the following QL predicate but
+ * uses basic blocks internally for better performance:
+ *
+ * ```
+ * predicate reaches(ControlFlowNode source, SemanticStackVariable v, ControlFlowNode sink) {
+ * reachesImpl(source, v, sink)
+ * and
+ * isSink(sink, v)
+ * }
+ *
+ * predicate reachesImpl(ControlFlowNode source, SemanticStackVariable v, ControlFlowNode sink) {
+ * sink = source.getASuccessor() and isSource(source, v)
+ * or
+ * exists(ControlFlowNode mid | reachesImpl(source, v, mid) |
+ * not isBarrier(mid, v)
+ * and
+ * sink = mid.getASuccessor()
+ * )
+ * }
+ * ```
+ *
+ * In addition to using a better performing implementation, this analysis
+ * accounts for loops where the condition is provably true upon entry.
+ */
+ predicate reaches(ControlFlowNode source, SemanticStackVariable v, ControlFlowNode sink) {
+ /* Implementation detail: the predicates in this class are a generalization of
+ * those in DefinitionsAndUses.qll, and should be kept in sync.
+ *
+ * Unfortunately, caching of abstract predicates does not work well, so the
+ * predicates in DefinitionsAndUses.qll cannot use this library.
+ */
+ exists(BasicBlock bb, int i |
+ isSource(source, v) and
+ bb.getNode(i) = source and
+ not bb.isUnreachable() |
+ exists(int j |
+ j > i
+ and
+ sink = bb.getNode(j)
+ and
+ isSink(sink, v)
+ and
+ not exists(int k | isBarrier(bb.getNode(k), v) | k in [i + 1 .. j - 1])
+ )
+ or
+ not exists(int k | isBarrier(bb.getNode(k), v) | k > i) and
+ bbSuccessorEntryReaches(bb, v, sink, _)
+ )
+ }
+
+ private predicate bbSuccessorEntryReaches(BasicBlock bb, SemanticStackVariable v, ControlFlowNode node, boolean skipsFirstLoopAlwaysTrueUponEntry) {
+ exists(BasicBlock succ, boolean succSkipsFirstLoopAlwaysTrueUponEntry |
+ bbSuccessorEntryReachesLoopInvariant(bb, succ, skipsFirstLoopAlwaysTrueUponEntry, succSkipsFirstLoopAlwaysTrueUponEntry) |
+ bbEntryReachesLocally(succ, v, node) and
+ succSkipsFirstLoopAlwaysTrueUponEntry = false
+ or
+ not isBarrier(succ.getNode(_), v) and
+ bbSuccessorEntryReaches(succ, v, node, succSkipsFirstLoopAlwaysTrueUponEntry)
+ )
+ }
+
+ private predicate bbEntryReachesLocally(BasicBlock bb, SemanticStackVariable v, ControlFlowNode node) {
+ exists(int n |
+ node = bb.getNode(n) and isSink(node, v) |
+ not exists(int m | m < n | isBarrier(bb.getNode(m), v))
+ )
+ }
+}
+
+/**
+ * Holds if `bb` contains the entry point `loop` for a loop at position `i`.
+ * The condition of that loop is provably true upon entry but not provably
+ * true in general (if it were, the false-successor had already been removed
+ * from the CFG).
+ *
+ * Examples:
+ * ```
+ * for (int i = 0; i < 2; i++) { } // always true upon entry
+ * for (int i = 0; true; i++) { } // always true
+ * ```
+ */
+private predicate bbLoopEntryConditionAlwaysTrueAt(BasicBlock bb, int i, ControlFlowNode loop) {
+ exists(Expr condition |
+ loopConditionAlwaysTrueUponEntry(loop, condition) and
+ not conditionAlwaysTrue(condition) and
+ bb.getNode(i) = loop
+ )
+}
+
+/**
+ * Basic block `pred` ends with a condition belonging to a loop, and that
+ * condition is provably true upon entry. Basic block `succ` is a successor
+ * of `pred`, and `skipsLoop` indicates whether `succ` is the false-successor
+ * of `pred`.
+ */
+private predicate bbLoopConditionAlwaysTrueUponEntrySuccessor(BasicBlock pred, BasicBlock succ, boolean skipsLoop) {
+ succ = pred.getASuccessor() and
+ exists(ControlFlowNode last |
+ last = pred.getEnd() and
+ loopConditionAlwaysTrueUponEntry(_, last) and
+ if succ = pred.getAFalseSuccessor() then
+ skipsLoop = true
+ else
+ skipsLoop = false
+ )
+}
+
+/**
+ * Loop invariant for `bbSuccessorEntryReaches`:
+ *
+ * - `succ` is a successor of `pred`.
+ * - `predSkipsFirstLoopAlwaysTrueUponEntry`: whether the path from
+ * `pred` (via `succ`) skips the first loop where the condition is
+ * provably true upon entry.
+ * - `succSkipsFirstLoopAlwaysTrueUponEntry`: whether the path from
+ * `succ` skips the first loop where the condition is provably true
+ * upon entry.
+ * - If `pred` contains the entry point of a loop where the condition
+ * is provably true upon entry, then `succ` is not allowed to skip
+ * that loop (`succSkipsFirstLoopAlwaysTrueUponEntry = false`).
+ */
+predicate bbSuccessorEntryReachesLoopInvariant(BasicBlock pred, BasicBlock succ, boolean predSkipsFirstLoopAlwaysTrueUponEntry, boolean succSkipsFirstLoopAlwaysTrueUponEntry) {
+ succ = pred.getASuccessor() and
+ (succSkipsFirstLoopAlwaysTrueUponEntry = true or succSkipsFirstLoopAlwaysTrueUponEntry = false) and
+ (
+ // The edge from `pred` to `succ` is from a loop condition provably
+ // true upon entry, so the value of `predSkipsFirstLoopAlwaysTrueUponEntry`
+ // is determined by whether the true edge or the false edge is chosen,
+ // regardless of the value of `succSkipsFirstLoopAlwaysTrueUponEntry`.
+ bbLoopConditionAlwaysTrueUponEntrySuccessor(pred, succ, predSkipsFirstLoopAlwaysTrueUponEntry)
+ or
+ (
+ // The edge from `pred` to `succ` is _not_ from a loop condition provably
+ // true upon entry, so the values of `predSkipsFirstLoopAlwaysTrueUponEntry`
+ // and `succSkipsFirstLoopAlwaysTrueUponEntry` must be the same.
+ not bbLoopConditionAlwaysTrueUponEntrySuccessor(pred, _, _) and
+ succSkipsFirstLoopAlwaysTrueUponEntry = predSkipsFirstLoopAlwaysTrueUponEntry and
+ // Moreover, if `pred` contains the entry point of a loop where the
+ // condition is provably true upon entry, then `succ` is not allowed
+ // to skip that loop, and hence `succSkipsFirstLoopAlwaysTrueUponEntry = false`.
+ (bbLoopEntryConditionAlwaysTrueAt(pred, _, _) implies succSkipsFirstLoopAlwaysTrueUponEntry = false)
+ )
+ )
+}
+
+/**
+ * Reachability analysis for control-flow nodes involving stack variables.
+ * Unlike `LocalScopeVariableReachability`, this analysis takes variable
+ * reassignments into account.
+ *
+ * This class is used like `LocalScopeVariableReachability`, except that
+ * subclasses should override `isSourceActual` and `isSinkActual` instead of
+ * `isSource` and `isSink`, and that there is a `reachesTo` predicate in
+ * addition to `reaches`.
+ */
+abstract class LocalScopeVariableReachabilityWithReassignment extends LocalScopeVariableReachability {
+ bindingset[this]
+ LocalScopeVariableReachabilityWithReassignment() { length() >= 0 }
+
+ /** Override this predicate rather than `isSource` (`isSource` is used internally). */
+ abstract predicate isSourceActual(ControlFlowNode node, LocalScopeVariable v);
+
+ /** Override this predicate rather than `isSink` (`isSink` is used internally). */
+ abstract predicate isSinkActual(ControlFlowNode node, LocalScopeVariable v);
+
+ /**
+ * Holds if the source node `source` can reach the sink `sink` without crossing
+ * a barrier, taking reassignments into account. This is (almost) equivalent
+ * to the following QL predicate, but uses basic blocks internally for better
+ * performance:
+ *
+ * ```
+ * predicate reaches(ControlFlowNode source, SemanticStackVariable v, ControlFlowNode sink) {
+ * reachesImpl(source, v, sink)
+ * and
+ * isSinkActual(sink, v)
+ * }
+ *
+ * predicate reachesImpl(ControlFlowNode source, SemanticStackVariable v, ControlFlowNode sink) {
+ * isSourceActual(source, v)
+ * and
+ * (
+ * sink = source.getASuccessor()
+ * or
+ * exists(ControlFlowNode mid, SemanticStackVariable v0 | reachesImpl(source, v0, mid) |
+ * // ordinary successor
+ * not isBarrier(mid, v) and
+ * sink = mid.getASuccessor() and
+ * v = v0
+ * or
+ * // reassigned from v0 to v
+ * exprDefinition(v, mid, v0.getAnAccess()) and
+ * sink = mid.getASuccessor()
+ * )
+ * )
+ * }
+ * ```
+ *
+ * In addition to using a better performing implementation, this analysis
+ * accounts for loops where the condition is provably true upon entry.
+ */
+ override predicate reaches(ControlFlowNode source, SemanticStackVariable v, ControlFlowNode sink) {
+ reachesTo(source, v, sink, _)
+ }
+
+ /**
+ * As `reaches`, but also specifies the last variable it was reassigned to (`v0`).
+ */
+ predicate reachesTo(ControlFlowNode source, SemanticStackVariable v, ControlFlowNode sink, SemanticStackVariable v0) {
+ exists(ControlFlowNode def |
+ actualSourceReaches(source, v, def, v0) and
+ LocalScopeVariableReachability.super.reaches(def, v0, sink) and
+ isSinkActual(sink, v0)
+ )
+ }
+
+ private predicate actualSourceReaches(ControlFlowNode source, SemanticStackVariable v, ControlFlowNode def, SemanticStackVariable v0) {
+ isSourceActual(source, v) and def = source and v0 = v
+ or
+ exists(ControlFlowNode source1, SemanticStackVariable v1 |
+ actualSourceReaches(source, v, source1, v1) |
+ reassignment(source1, v1, def, v0)
+ )
+ }
+
+ private predicate reassignment(ControlFlowNode source, SemanticStackVariable v, ControlFlowNode def, SemanticStackVariable v0) {
+ LocalScopeVariableReachability.super.reaches(source, v, def) and
+ exprDefinition(v0, def, v.getAnAccess())
+ }
+
+ final override predicate isSource(ControlFlowNode node, LocalScopeVariable v) {
+ isSourceActual(node, v)
+ or
+ // Reassignment generates a new (non-actual) source
+ reassignment(_, _, node, v)
+ }
+
+ final override predicate isSink(ControlFlowNode node, LocalScopeVariable v) {
+ isSinkActual(node, v)
+ or
+ // Reassignment generates a new (non-actual) sink
+ exprDefinition(_, node, v.getAnAccess())
+ }
+}
+
+/**
+ * Same as `LocalScopeVariableReachability`, but `isBarrier` works on control-flow
+ * edges rather than nodes and is therefore parameterized by the original
+ * source node as well. Otherwise, this class is used like
+ * `LocalScopeVariableReachability`.
+ */
+abstract class LocalScopeVariableReachabilityExt extends string {
+ bindingset[this]
+ LocalScopeVariableReachabilityExt() { length() >= 0 }
+
+ /** `node` is a source for the reachability analysis using variable `v`. */
+ abstract predicate isSource(ControlFlowNode node, LocalScopeVariable v);
+
+ /** `sink` is a (potential) sink for the reachability analysis using variable `v`. */
+ abstract predicate isSink(ControlFlowNode node, LocalScopeVariable v);
+
+ /** `node` is a barrier for the reachability analysis using variable `v` and starting from `source`. */
+ abstract predicate isBarrier(ControlFlowNode source, ControlFlowNode node, ControlFlowNode next, LocalScopeVariable v);
+
+ /** See `LocalScopeVariableReachability.reaches`. */
+ predicate reaches(ControlFlowNode source, SemanticStackVariable v, ControlFlowNode sink) {
+ exists(BasicBlock bb, int i |
+ isSource(source, v) and
+ bb.getNode(i) = source and
+ not bb.isUnreachable() |
+ exists(int j |
+ j > i
+ and
+ sink = bb.getNode(j)
+ and
+ isSink(sink, v)
+ and
+ not exists(int k | isBarrier(source, bb.getNode(k), bb.getNode(k + 1), v) | k in [i .. j - 1])
+ )
+ or
+ not exists(int k | isBarrier(source, bb.getNode(k), bb.getNode(k + 1), v) | k >= i) and
+ bbSuccessorEntryReaches(source, bb, v, sink, _)
+ )
+ }
+
+ private predicate bbSuccessorEntryReaches(ControlFlowNode source, BasicBlock bb, SemanticStackVariable v, ControlFlowNode node, boolean skipsFirstLoopAlwaysTrueUponEntry) {
+ exists(BasicBlock succ, boolean succSkipsFirstLoopAlwaysTrueUponEntry |
+ bbSuccessorEntryReachesLoopInvariant(bb, succ, skipsFirstLoopAlwaysTrueUponEntry, succSkipsFirstLoopAlwaysTrueUponEntry) and
+ not isBarrier(source, bb.getEnd(), succ.getStart(), v) |
+ bbEntryReachesLocally(source, succ, v, node) and
+ succSkipsFirstLoopAlwaysTrueUponEntry = false
+ or
+ not exists(int k | isBarrier(source, succ.getNode(k), succ.getNode(k + 1), v)) and
+ bbSuccessorEntryReaches(source, succ, v, node, succSkipsFirstLoopAlwaysTrueUponEntry)
+ )
+ }
+
+ private predicate bbEntryReachesLocally(ControlFlowNode source, BasicBlock bb, SemanticStackVariable v, ControlFlowNode node) {
+ isSource(source, v) and
+ exists(int n |
+ node = bb.getNode(n) and isSink(node, v) |
+ not exists(int m | m < n | isBarrier(source, bb.getNode(m), bb.getNode(m + 1), v))
+ )
+ }
+}
\ No newline at end of file
diff --git a/cpp/ql/src/semmle/code/cpp/controlflow/Nullness.qll b/cpp/ql/src/semmle/code/cpp/controlflow/Nullness.qll
new file mode 100644
index 000000000000..af2429fecb32
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/controlflow/Nullness.qll
@@ -0,0 +1,281 @@
+import cpp
+import DefinitionsAndUses
+
+/**
+ * A C/C++ literal whose value is considered null.
+ */
+abstract class NullValue extends Expr
+{
+}
+
+/**
+ * A C/C++ literal whose value is zero.
+ */
+class Zero extends NullValue
+{
+ Zero() { this.(Literal).getValue() = "0" }
+}
+
+/**
+ * Holds if `var` is null when `checkExpr` evaluates to a true value.
+ */
+cached
+predicate nullCheckExpr(Expr checkExpr, Variable var)
+{
+ exists(LocalScopeVariable v, AnalysedExpr expr |
+ var = v and
+ checkExpr = expr
+ |
+ exists(NotExpr notexpr, AnalysedExpr child |
+ expr = notexpr and notexpr.getOperand() = child and validCheckExpr(child, v))
+ or
+ exists(EQExpr eq, AnalysedExpr child, NullValue zero, int i |
+ expr = eq and eq.getChild(i) = child and
+ validCheckExpr(child, v) and eq.getChild(1-i) = zero)
+ or
+ exists(NEExpr neq, AnalysedExpr child, NullValue zero, int i |
+ expr = neq and neq.getChild(i) = child and
+ nullCheckExpr(child, v) and neq.getChild(1-i) = zero)
+ or
+ exists(LogicalAndExpr op, AnalysedExpr child |
+ expr = op and op.getRightOperand() = child and
+ nullCheckExpr(child, v))
+ or
+ exists(AssignExpr assign, AnalysedExpr child |
+ expr = assign and assign.getRValue() = child and
+ nullCheckExpr(child, v) and not expr.isDef(v))
+ or
+ exists(FunctionCall fc, AnalysedExpr child |
+ expr = fc and
+ fc.getTarget().hasQualifiedName("__builtin_expect") and
+ fc.getArgument(0) = child and nullCheckExpr(child, v))
+ )
+}
+
+/**
+ * Holds if `var` is non-null when `checkExpr` evaluates to a true value.
+ */
+cached
+predicate validCheckExpr(Expr checkExpr, Variable var)
+{
+ exists(AnalysedExpr expr, LocalScopeVariable v |
+ v = var and
+ expr = checkExpr
+ |
+ expr.isUse(v)
+ or
+ expr.isDef(v)
+ or
+ exists(NotExpr notexpr, AnalysedExpr child |
+ expr = notexpr and notexpr.getOperand() = child and nullCheckExpr(child, v))
+ or
+ exists(EQExpr eq, AnalysedExpr child, NullValue zero, int i |
+ expr = eq and eq.getChild(i) = child and
+ nullCheckExpr(child, v) and eq.getChild(1-i) = zero)
+ or
+ exists(NEExpr neq, AnalysedExpr child, NullValue zero, int i |
+ expr = neq and neq.getChild(i) = child and
+ validCheckExpr(child, v) and neq.getChild(1-i) = zero)
+ or
+ exists(LogicalAndExpr op, AnalysedExpr child |
+ expr = op and op.getRightOperand() = child and
+ validCheckExpr(child, v))
+ or
+ exists(AssignExpr assign, AnalysedExpr child |
+ expr = assign and assign.getRValue() = child and
+ validCheckExpr(child, v) and not expr.isDef(v))
+ or
+ exists(FunctionCall fc, AnalysedExpr child |
+ expr = fc and
+ fc.getTarget().hasQualifiedName("__builtin_expect") and
+ fc.getArgument(0) = child and validCheckExpr(child, v))
+ )
+}
+
+/**
+ * An expression that has been extended with member predicates that provide
+ * information about the role of this expression in nullness checks.
+ */
+class AnalysedExpr extends Expr {
+
+ /**
+ * Holds if `v` is null when this expression evaluates to a true value.
+ */
+ predicate isNullCheck(LocalScopeVariable v) {
+ nullCheckExpr(this, v)
+ }
+
+ /**
+ * Holds if `v` is non-null when this expression evaluates to a true value.
+ */
+ predicate isValidCheck(LocalScopeVariable v) {
+ validCheckExpr(this, v)
+ }
+
+ /**
+ * Gets a successor of `this` in the control flow graph, where that successor
+ * is among the nodes to which control may flow when `this` tests `v` to be
+ * _null_.
+ */
+ ControlFlowNode getNullSuccessor(LocalScopeVariable v)
+ {
+ (this.isNullCheck(v) and result = this.getATrueSuccessor())
+ or
+ (this.isValidCheck(v) and result = this.getAFalseSuccessor())
+ }
+
+ /**
+ * Gets a successor of `this` in the control flow graph, where that successor
+ * is among the nodes to which control may flow when `this` tests `v` to be
+ * _not null_.
+ */
+ ControlFlowNode getNonNullSuccessor(LocalScopeVariable v)
+ {
+ (this.isNullCheck(v) and result = this.getAFalseSuccessor())
+ or
+ (this.isValidCheck(v) and result = this.getATrueSuccessor())
+ }
+
+ /**
+ * DEPRECATED: Use `getNonNullSuccessor` instead, which does the same.
+ */
+ deprecated
+ ControlFlowNode getValidSuccessor(LocalScopeVariable v)
+ {
+ (this.isValidCheck(v) and result = this.getATrueSuccessor())
+ or
+ (this.isNullCheck(v) and result = this.getAFalseSuccessor())
+ }
+
+ /**
+ * Holds if this is a `VariableAccess` of `v` nested inside a condition.
+ */
+ predicate isUse(LocalScopeVariable v)
+ {
+ this.inCondition() and
+ this = v.getAnAccess()
+ }
+
+ /**
+ * Holds if this is an `Assignment` to `v` nested inside a condition.
+ */
+ predicate isDef(LocalScopeVariable v)
+ {
+ this.inCondition() and
+ this.(Assignment).getLValue() = v.getAnAccess()
+ }
+
+ /**
+ * Holds if `this` occurs at or below the controlling expression of an `if`,
+ * `while`, `?:`, or similar.
+ */
+ predicate inCondition()
+ {
+ this.isCondition() or
+ this.getParent().(AnalysedExpr).inCondition()
+ }
+}
+
+/**
+ * Holds if `var` is likely to be null at `node`.
+ */
+cached
+predicate checkedNull(Variable var, ControlFlowNode node)
+{
+ exists(LocalScopeVariable v | v = var |
+ exists(AnalysedExpr e |
+ e.getNullSuccessor(v) = node
+ )
+ or
+ exists(ControlFlowNode pred |
+ pred = node.getAPredecessor() and
+ not pred.(AnalysedExpr).isDef(v) and
+ checkedNull(v, pred)
+ )
+ )
+}
+
+/**
+ * Holds if `var` is likely to be non-null at `node`.
+ */
+cached
+predicate checkedValid(Variable var, ControlFlowNode node)
+{
+ exists(LocalScopeVariable v | v = var |
+ exists(AnalysedExpr e |
+ e.getNonNullSuccessor(v) = node
+ )
+ or
+ exists(ControlFlowNode pred |
+ pred = node.getAPredecessor() and
+ not pred.(AnalysedExpr).isDef(v) and
+ checkedValid(v, pred)
+ )
+ )
+}
+
+/**
+ * Holds if `val` is a null literal or a call to a function that may return a
+ * null literal.
+ */
+predicate nullValue(Expr val)
+{
+ val instanceof NullValue
+ or
+ callMayReturnNull(val)
+ or
+ nullValue(val.(Assignment).getRValue())
+}
+
+/**
+ * Holds if the evaluation of `n` may have the effect of, directly or
+ * indirectly, assigning a null literal to `var`.
+ */
+predicate nullInit(Variable v, ControlFlowNode n)
+{
+ exists(Initializer init |
+ init = n and nullValue(init.getExpr()) and
+ v.getInitializer() = init)
+ or
+ exists(AssignExpr assign |
+ assign = n and nullValue(assign.getRValue()) and
+ assign.getLValue() = v.getAnAccess())
+}
+
+/**
+ * Holds if `call` may, directly or indirectly, evaluate to a null literal.
+ */
+predicate callMayReturnNull(Call call)
+{
+ exists(Options opts |
+ if opts.overrideReturnsNull(call) then
+ opts.returnsNull(call)
+ else
+ mayReturnNull(call.(FunctionCall).getTarget())
+ )
+}
+
+/**
+ * Holds if `f` may, directly or indirectly, return a null literal.
+ */
+predicate mayReturnNull(Function f)
+{
+ f.getQualifiedName() = "malloc"
+ or
+ f.getQualifiedName() = "calloc"
+ or
+// f.getQualifiedName() = "strchr"
+// or
+// f.getQualifiedName() = "strstr"
+// or
+ exists(ReturnStmt ret |
+ nullValue(ret.getExpr()) and
+ ret.getEnclosingFunction() = f)
+ or
+ exists(ReturnStmt ret, Expr returned, ControlFlowNode init, LocalScopeVariable v |
+ ret.getExpr() = returned and
+ nullInit(v, init) and
+ definitionUsePair(v, init, returned) and
+ not(checkedValid(v, returned)) and
+ ret.getEnclosingFunction() = f)
+}
diff --git a/cpp/ql/src/semmle/code/cpp/controlflow/SSA.qll b/cpp/ql/src/semmle/code/cpp/controlflow/SSA.qll
new file mode 100644
index 000000000000..725f2b057e25
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/controlflow/SSA.qll
@@ -0,0 +1,170 @@
+import cpp
+import semmle.code.cpp.controlflow.Dominance
+import SSAUtils
+
+library class StandardSSA extends SSAHelper {
+ StandardSSA() { this = 0 }
+}
+
+/**
+ * A definition of one or more SSA variables, including phi node definitions.
+ * An _SSA variable_, as defined in the literature, is effectively the pair of
+ * an `SsaDefinition d` and a `LocalScopeVariable v`, written `(d, v)` in this
+ * documentation. Note that definitions and uses can be coincident due to the
+ * presence of parameter definitions and phi nodes.
+ *
+ * Not all `LocalScopeVariable`s of a function have SSA definitions. If the variable
+ * has its address taken, either explicitly or implicitly, then it is excluded
+ * from analysis. `SsaDefinition`s are not generated in locations that are
+ * statically seen to be unreachable.
+ */
+class SsaDefinition extends @cfgnode {
+
+ SsaDefinition() {
+ exists(StandardSSA x | x.ssa_defn(_, (ControlFlowNode)this, _, _))
+ }
+
+ /**
+ * Gets a variable corresponding to an SSA LocalScopeVariable defined by
+ * this definition.
+ */
+ LocalScopeVariable getAVariable() {
+ exists(StandardSSA x | x.ssa_defn(result, (ControlFlowNode)this, _, _))
+ }
+
+ /** Gets a textual representation of this element. */
+ string toString() {
+ result = "SSA definition"
+ }
+
+ /**
+ * Gets a string representation of the SSA variable represented by the pair
+ * (this, v).
+ */
+ string toString(LocalScopeVariable v) {
+ exists(StandardSSA x | result = x.toString((ControlFlowNode)this, v))
+ }
+
+ /** Gets a use of the SSA variable represented by the pair (this, v). */
+ VariableAccess getAUse(LocalScopeVariable v) {
+ exists(StandardSSA x | result = x.getAUse((ControlFlowNode)this, v))
+ }
+
+ /**
+ * Gets the control-flow node for this definition. This will usually be the
+ * control-flow node that assigns to this variable as a side effect, but
+ * there are some exceptions. If `this` is defined by initialization, the
+ * result is the value of `Initializer.getExpr()` for that initialization.
+ * If `this` is a function parameter (see `definedByParameter`), the result
+ * will be the function entry point. If `this` variable is defined by being
+ * passed as a reference in a function call, including overloaded
+ * operators, the result will be the `VariableAccess` expression for this
+ * parameter. If `this` is a phi node (see `isPhiNode`), the result will be
+ * the node where control flow is joined from multiple paths.
+ */
+ ControlFlowNode getDefinition() {
+ result = this
+ }
+
+ BasicBlock getBasicBlock() {
+ result.contains(getDefinition())
+ }
+
+ /** Holds if this definition is a phi node for variable `v`. */
+ predicate isPhiNode(LocalScopeVariable v) {
+ exists(StandardSSA x | x.phi_node(v, (BasicBlock)this))
+ }
+
+ Location getLocation() {
+ result = this.(ControlFlowNode).getLocation()
+ }
+
+ /** Holds if the SSA variable `(this, p)` is defined by parameter `p`. */
+ predicate definedByParameter(Parameter p) {
+ this = p.getFunction().getEntryPoint()
+ }
+
+ /**
+ * Holds if the SSA variable `(result, v)` is an input to the phi definition
+ * `(this, v)`.
+ */
+ SsaDefinition getAPhiInput(LocalScopeVariable v) {
+ this.isPhiNode(v)
+ and
+ result.reachesEndOfBB(v, this.(BasicBlock).getAPredecessor())
+ }
+
+ /**
+ * Gets the expression assigned to the SSA variable `(this, v)`, if any,
+ * when it is not a phi definition. The following is an exhaustive list of
+ * expressions that may be the result of this predicate.
+ *
+ * - The contained expression of an `Initializer`.
+ * - The right-hand side of an `AssignExpr`.
+ * - An `AssignOperation`.
+ * - A `CrementOperation`.
+ *
+ * In all cases except `PostfixCrementOperation`, the variable `v` will be
+ * equal to the result of this predicate after evaluation of
+ * `this.getDefinition()`.
+ *
+ * If the SSA variable is defined in other ways than those four (such as
+ * function parameters or `f(&x)`) there is no result. These cases are
+ * instead covered via `definedByParameter` and `getDefinition`,
+ * respectively.
+ */
+ Expr getDefiningValue(LocalScopeVariable v) {
+ exists(ControlFlowNode def | def = this.getDefinition() |
+ def = v.getInitializer().getExpr() and def = result
+ or
+ exists(AssignExpr assign | def = assign and
+ assign.getLValue() = v.getAnAccess() and result = assign.getRValue()
+ )
+ or
+ exists(AssignOperation assign | def = assign and
+ assign.getLValue() = v.getAnAccess() and result = assign
+ )
+ or
+ exists(CrementOperation crement | def = crement and
+ crement.getOperand() = v.getAnAccess() and result = crement
+ )
+ )
+ }
+
+ /** Holds if `(this, v)` reaches the end of basic block `b`. */
+ predicate reachesEndOfBB(LocalScopeVariable v, BasicBlock b) {
+ exists(StandardSSA x | x.ssaDefinitionReachesEndOfBB(v, (ControlFlowNode)this, b))
+ }
+
+ /**
+ * Gets a definition that ultimately defines this variable and is not
+ * itself a phi node.
+ */
+ SsaDefinition getAnUltimateSsaDefinition(LocalScopeVariable v) {
+ result = this.getAPhiInput(v).getAnUltimateSsaDefinition(v)
+ or
+ v = this.getAVariable() and
+ not this.isPhiNode(v) and
+ result = this
+ }
+
+ /**
+ * Gets a possible defining expression for `v` at this SSA definition,
+ * recursing backwards through phi definitions. Not all definitions have a
+ * defining expression---see the documentation for `getDefiningValue`.
+ */
+ Expr getAnUltimateDefiningValue(LocalScopeVariable v) {
+ result = this.getAnUltimateSsaDefinition(v).getDefiningValue(v)
+ }
+
+ /**
+ * DEPRECATED: this is the old name for `getAnUltimateDefiningValue`. The
+ * name was confusing as it seemed analogous to `getDefinition` rather than
+ * `getDefiningValue`. The SSA libraries for other languages use the name
+ * `getAnUltimateSsaDefinition` to refer to a predicate named
+ * `getAnUltimateSsaDefinition` in this class.
+ */
+ deprecated Expr getAnUltimateDefinition(LocalScopeVariable v) {
+ result = this.getAnUltimateDefiningValue(v)
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/controlflow/SSAUtils.qll b/cpp/ql/src/semmle/code/cpp/controlflow/SSAUtils.qll
new file mode 100644
index 000000000000..62ec85562476
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/controlflow/SSAUtils.qll
@@ -0,0 +1,269 @@
+import cpp
+import semmle.code.cpp.controlflow.Dominance
+import semmle.code.cpp.controlflow.SSA // must be imported for proper caching of SSAHelper
+import semmle.code.cpp.rangeanalysis.RangeSSA // must be imported for proper caching of SSAHelper
+
+/* The dominance frontier of a block `x` is the set of all blocks `w` such that
+ * `x` dominates a predecessor of `w` but does not strictly dominate `w`. */
+pragma[noinline]
+private predicate dominanceFrontier(BasicBlock x, BasicBlock w) {
+ bbDominates(x, w.getAPredecessor()) and not bbStrictlyDominates(x, w)
+}
+
+/**
+ * Extended version of `definition` that also includes parameters but excludes
+ * static variables.
+ */
+predicate var_definition(LocalScopeVariable v, ControlFlowNode node) {
+ not v.isStatic()
+ and
+ not addressTakenVariable(v)
+ and
+ not unreachable(node)
+ and
+ (if isReferenceVar(v)
+ then // Assignments to reference variables modify the referenced
+ // value, not the reference itself. So reference variables only
+ // have two kinds of definition: initializers and parameters.
+ node = v.getInitializer().getExpr()
+ else definition(v, node))
+ or
+ v instanceof Parameter and exists(BasicBlock b | b.getStart() = node and not exists(b.getAPredecessor()) and
+ b = v.(Parameter).getFunction().getEntryPoint())
+}
+
+/**
+ * Stack variables that have their address taken are excluded from the
+ * analysis because the pointer could be used to change the value at
+ * any moment.
+ */
+private predicate addressTakenVariable(LocalScopeVariable var) {
+ // If the type of the variable is a reference type, then it is safe (as
+ // far as SSA is concerned) to take its address, because this does not
+ // enable the variable to be modified indirectly. Obviously the
+ // referenced value can change, but that is not the same thing as
+ // changing which value the reference points to. SSA tracks the latter,
+ // but the target of a reference is immutable so reference variables
+ // always have exactly one definition.
+ not isReferenceVar(var)
+ and
+
+ // Find a VariableAccess that takes the address of `var`.
+ exists (VariableAccess va
+ | va = var.getAnAccess() and
+ va.isAddressOfAccessNonConst() and
+ // If the address is passed to a function then we will trust that it
+ // is only used to modify the variable for the duration of the
+ // function call.
+ not exists(Call call | call.passesByReferenceNonConst(_, va))
+ )
+}
+
+private predicate isReferenceVar(LocalScopeVariable v) {
+ v.getType().getUnspecifiedType() instanceof ReferenceType
+}
+
+/**
+ * This predicate is the same as `var_definition`, but annotated with
+ * the basic block and index of the control flow node.
+ */
+private predicate variableUpdate(LocalScopeVariable v, ControlFlowNode n, BasicBlock b, int i) {
+ var_definition(v, n) and n = b.getNode(i)
+}
+
+private predicate ssa_use(LocalScopeVariable v, VariableAccess node, BasicBlock b, int index) {
+ useOfVar(v, node) and b.getNode(index) = node
+}
+
+private predicate live_at_start_of_bb(LocalScopeVariable v, BasicBlock b) {
+ exists (int i | ssa_use(v, _, b, i) |
+ not exists (int j | variableUpdate(v, _, b, j) | j < i))
+ or
+ (live_at_exit_of_bb(v, b) and not variableUpdate(v, _, b, _))
+}
+
+pragma[noinline]
+private predicate live_at_exit_of_bb(LocalScopeVariable v, BasicBlock b) {
+ live_at_start_of_bb(v, b.getASuccessor())
+}
+
+/** Common SSA logic for standard SSA and range-analysis SSA. */
+cached library class SSAHelper extends int {
+ /* 0 = StandardSSA, 1 = RangeSSA */
+ cached SSAHelper() { this in [0 .. 1] }
+
+ /**
+ * Override to insert a custom phi node for variable `v` at the start of
+ * basic block `b`.
+ */
+ cached predicate custom_phi_node(LocalScopeVariable v, BasicBlock b) { none() }
+
+ /**
+ * Remove any custom phi nodes that are invalid.
+ */
+ private predicate sanitized_custom_phi_node(LocalScopeVariable v, BasicBlock b) {
+ custom_phi_node(v,b) and
+ not addressTakenVariable(v) and
+ not isReferenceVar(v) and
+ b.isReachable()
+ }
+
+ /**
+ * Holds if there is a phi node for variable `v` at the start of basic block
+ * `b`.
+ */
+ cached predicate phi_node(LocalScopeVariable v, BasicBlock b) {
+ frontier_phi_node(v,b) or sanitized_custom_phi_node(v,b)
+ }
+
+ /**
+ * A phi node is required for variable `v` at the start of basic block `b`
+ * if there exists a basic block `x` such that `b` is in the dominance
+ * frontier of `x` and `v` is defined in `x` (including phi-nodes as
+ * definitions). This is known as the iterated dominance frontier. See
+ * Modern Compiler Implementation by Andrew Appel.
+ */
+ private predicate frontier_phi_node(LocalScopeVariable v, BasicBlock b) {
+ exists(BasicBlock x | dominanceFrontier(x, b) and ssa_defn(v, _, x, _))
+ /* We can also eliminate those nodes where the variable is not live on any incoming edge */
+ and live_at_start_of_bb(v, b)
+ }
+
+ /**
+ * Holds if `v` is defined, for the purpose of SSA, at `node`, which is at
+ * position `index` in block `b`. This includes definitions from phi nodes.
+ */
+ cached predicate ssa_defn(LocalScopeVariable v, ControlFlowNode node, BasicBlock b, int index) {
+ phi_node(v, b) and b.getStart() = node and index = -1
+ or
+ variableUpdate(v, node, b, index)
+ }
+
+ /*
+ * The construction of SSA form ensures that each use of a variable is
+ * dominated by its definition. A definition of an SSA variable therefore
+ * reaches a `ControlFlowNode` if it is the _closest_ SSA variable definition
+ * that dominates the node. If two definitions dominate a node then one must
+ * dominate the other, so therefore the definition of _closest_ is given by the
+ * dominator tree. Thus, reaching definitions can be calculated in terms of
+ * dominance.
+ */
+
+ /**
+ * A ranking of the indices `i` at which there is an SSA definition or use of
+ * `v` in the basic block `b`.
+ *
+ * Basic block indices are translated to rank indices in order to skip
+ * irrelevant indices at which there is no definition or use when traversing
+ * basic blocks.
+ */
+ private predicate defUseRank(LocalScopeVariable v, BasicBlock b, int rankix, int i) {
+ i = rank[rankix](int j | ssa_defn(v, _, b, j) or ssa_use(v, _, b, j))
+ }
+
+ /**
+ * Gets the maximum rank index for the given variable `v` and basic block
+ * `b`. This will be the number of defs/uses of `v` in `b` plus one, where
+ * the extra rank at the end represents a position past the last node in
+ * the block.
+ */
+ private int lastRank(LocalScopeVariable v, BasicBlock b) {
+ result = max(int rankix | defUseRank(v, b, rankix, _)) + 1
+ }
+
+ /**
+ * Holds if SSA variable `(v, def)` is defined at rank index `rankix` in
+ * basic block `b`.
+ */
+ private predicate ssaDefRank(LocalScopeVariable v, ControlFlowNode def, BasicBlock b, int rankix) {
+ exists(int i
+ | ssa_defn(v, def, b, i) and
+ defUseRank(v, b, rankix, i))
+ }
+
+ /**
+ * Holds if SSA variable `(v, def)` reaches the rank index `rankix` in its
+ * own basic block `b` before being overwritten by another definition of
+ * `v` that comes _at or after_ the reached node. Reaching a node means
+ * that the definition is visible to any _use_ at that node.
+ */
+ private predicate ssaDefReachesRank(LocalScopeVariable v, ControlFlowNode def, BasicBlock b, int rankix) {
+ // A definition should not reach its own node unless a loop allows it.
+ // When nodes are both definitions and uses for the same variable, the
+ // use is understood to happen _before_ the definition. Phi nodes are
+ // at rankidx -1 and will therefore always reach the first node in the
+ // basic block.
+ ssaDefRank(v, def, b, rankix-1)
+ or
+ (ssaDefReachesRank(v, def, b, rankix-1) and
+ rankix <= lastRank(v, b) and // Without this, the predicate would be infinite.
+ not ssaDefRank(v, _, b, rankix-1)) // Range is inclusive of but not past next def.
+ }
+
+ /** Holds if SSA variable `(v, def)` reaches the end of block `b`. */
+ cached predicate ssaDefinitionReachesEndOfBB(LocalScopeVariable v, ControlFlowNode def, BasicBlock b) {
+ (live_at_exit_of_bb(v, b) and ssaDefReachesRank(v, def, b, lastRank(v, b)))
+ or
+ exists (BasicBlock idom |
+ ssaDefinitionReachesEndOfBB(v, def, idom) and
+ noDefinitionsSinceIDominator(v, idom, b)
+ )
+ }
+
+ /**
+ * Helper predicate for ssaDefinitionReachesEndOfBB. If there is no
+ * definition of `v` in basic block `b`, then any definition of `v`
+ * that reaches the end of `idom` (the immediate dominator of `b`) also
+ * reaches the end of `b`.
+ */
+ pragma[noinline]
+ private predicate noDefinitionsSinceIDominator(LocalScopeVariable v, BasicBlock idom, BasicBlock b) {
+ bbIDominates(idom, b) and // It is sufficient to traverse the dominator graph, cf. discussion above.
+ live_at_exit_of_bb(v, b) and
+ not ssa_defn(v, _, b, _)
+ }
+
+ /**
+ * Holds if SSA variable `(v, def)` reaches `use` within the same basic
+ * block, where `use` is a `VariableAccess` of `v`.
+ */
+ private predicate ssaDefinitionReachesUseWithinBB(LocalScopeVariable v, ControlFlowNode def, Expr use) {
+ exists (BasicBlock b, int rankix, int i
+ | ssaDefReachesRank(v, def, b, rankix) and
+ defUseRank(v, b, rankix, i) and
+ ssa_use(v, use, b, i))
+ }
+
+ /**
+ * Holds if SSA variable `(v, def)` reaches the control-flow node `use`.
+ */
+ private
+ predicate ssaDefinitionReaches(LocalScopeVariable v, ControlFlowNode def, Expr use) {
+ ssaDefinitionReachesUseWithinBB(v, def, use) or
+ exists (BasicBlock b
+ | ssa_use(v, use, b, _) and
+ ssaDefinitionReachesEndOfBB(v, def, b.getAPredecessor()) and
+ not ssaDefinitionReachesUseWithinBB(v, _, use))
+ }
+
+ /**
+ * Gets a string representation of the SSA variable represented by the pair
+ * `(node, v)`.
+ */
+ cached string toString(ControlFlowNode node, LocalScopeVariable v) {
+ if phi_node(v, (BasicBlock)node) then
+ result = "SSA phi(" + v.getName() + ")"
+ else
+ (ssa_defn(v, node, _, _) and result = "SSA def(" + v.getName() + ")")
+ }
+
+ /**
+ * Holds if SSA variable `(v, def)` reaches `result`, where `result` is an
+ * access of `v`.
+ */
+ cached VariableAccess getAUse(ControlFlowNode def, LocalScopeVariable v) {
+ ssaDefinitionReaches(v, def, result)
+ and
+ ssa_use(v, result, _, _)
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/controlflow/StackVariableReachability.qll b/cpp/ql/src/semmle/code/cpp/controlflow/StackVariableReachability.qll
new file mode 100644
index 000000000000..8ebf850cd5bc
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/controlflow/StackVariableReachability.qll
@@ -0,0 +1,329 @@
+import cpp
+
+/**
+ * DEPRECATED: use `LocalScopeVariableReachability` instead.
+ *
+ * A reachability analysis for control-flow nodes involving stack variables.
+ */
+deprecated abstract class StackVariableReachability extends string {
+ bindingset[this]
+ StackVariableReachability() { length() >= 0 }
+
+ /** Holds if `node` is a source for the reachability analysis using variable `v`. */
+ abstract predicate isSource(ControlFlowNode node, StackVariable v);
+
+ /** Holds if `sink` is a (potential) sink for the reachability analysis using variable `v`. */
+ abstract predicate isSink(ControlFlowNode node, StackVariable v);
+
+ /** Holds if `node` is a barrier for the reachability analysis using variable `v`. */
+ abstract predicate isBarrier(ControlFlowNode node, StackVariable v);
+
+ /**
+ * Holds if the source node `source` can reach the sink `sink` without crossing
+ * a barrier. This is (almost) equivalent to the following QL predicate but
+ * uses basic blocks internally for better performance:
+ *
+ * ```
+ * predicate reaches(ControlFlowNode source, StackVariable v, ControlFlowNode sink) {
+ * reachesImpl(source, v, sink)
+ * and
+ * isSink(sink, v)
+ * }
+ *
+ * predicate reachesImpl(ControlFlowNode source, StackVariable v, ControlFlowNode sink) {
+ * sink = source.getASuccessor() and isSource(source, v)
+ * or
+ * exists(ControlFlowNode mid | reachesImpl(source, v, mid) |
+ * not isBarrier(mid, v)
+ * and
+ * sink = mid.getASuccessor()
+ * )
+ * }
+ * ```
+ *
+ * In addition to using a better performing implementation, this analysis
+ * accounts for loops where the condition is provably true upon entry.
+ */
+ predicate reaches(ControlFlowNode source, StackVariable v, ControlFlowNode sink) {
+ /* Implementation detail: the predicates in this class are a generalization of
+ * those in DefinitionsAndUses.qll, and should be kept in sync.
+ *
+ * Unfortunately, caching of abstract predicates does not work well, so the
+ * predicates in DefinitionsAndUses.qll cannot use this library.
+ */
+ exists(BasicBlock bb, int i |
+ isSource(source, v) and
+ bb.getNode(i) = source and
+ not bb.isUnreachable() |
+ exists(int j |
+ j > i
+ and
+ sink = bb.getNode(j)
+ and
+ isSink(sink, v)
+ and
+ not exists(int k | isBarrier(bb.getNode(k), v) | k in [i + 1 .. j - 1])
+ )
+ or
+ not exists(int k | isBarrier(bb.getNode(k), v) | k > i) and
+ bbSuccessorEntryReaches(bb, v, sink, _)
+ )
+ }
+
+ private predicate bbSuccessorEntryReaches(BasicBlock bb, StackVariable v, ControlFlowNode node, boolean skipsFirstLoopAlwaysTrueUponEntry) {
+ exists(BasicBlock succ, boolean succSkipsFirstLoopAlwaysTrueUponEntry |
+ bbSuccessorEntryReachesLoopInvariant(bb, succ, skipsFirstLoopAlwaysTrueUponEntry, succSkipsFirstLoopAlwaysTrueUponEntry) |
+ bbEntryReachesLocally(succ, v, node) and
+ succSkipsFirstLoopAlwaysTrueUponEntry = false
+ or
+ not isBarrier(succ.getNode(_), v) and
+ bbSuccessorEntryReaches(succ, v, node, succSkipsFirstLoopAlwaysTrueUponEntry)
+ )
+ }
+
+ private predicate bbEntryReachesLocally(BasicBlock bb, StackVariable v, ControlFlowNode node) {
+ exists(int n |
+ node = bb.getNode(n) and isSink(node, v) |
+ not exists(int m | m < n | isBarrier(bb.getNode(m), v))
+ )
+ }
+}
+
+/**
+ * Holds if `bb` contains the entry point `loop` for a loop at position `i`.
+ * The condition of that loop is provably true upon entry but not provably
+ * true in general (if it were, the false-successor had already been removed
+ * from the CFG).
+ *
+ * Examples:
+ * ```
+ * for (int i = 0; i < 2; i++) { } // always true upon entry
+ * for (int i = 0; true; i++) { } // always true
+ * ```
+ */
+private predicate bbLoopEntryConditionAlwaysTrueAt(BasicBlock bb, int i, ControlFlowNode loop) {
+ exists(Expr condition |
+ loopConditionAlwaysTrueUponEntry(loop, condition) and
+ not conditionAlwaysTrue(condition) and
+ bb.getNode(i) = loop
+ )
+}
+
+/**
+ * Basic block `pred` ends with a condition belonging to a loop, and that
+ * condition is provably true upon entry. Basic block `succ` is a successor
+ * of `pred`, and `skipsLoop` indicates whether `succ` is the false-successor
+ * of `pred`.
+ */
+private predicate bbLoopConditionAlwaysTrueUponEntrySuccessor(BasicBlock pred, BasicBlock succ, boolean skipsLoop) {
+ succ = pred.getASuccessor() and
+ exists(ControlFlowNode last |
+ last = pred.getEnd() and
+ loopConditionAlwaysTrueUponEntry(_, last) and
+ if succ = pred.getAFalseSuccessor() then
+ skipsLoop = true
+ else
+ skipsLoop = false
+ )
+}
+
+/**
+ * DEPRECATED: use the corresponding predicate in
+ * `LocalScopeVariableReachability` instead.
+ *
+ * Loop invariant for `bbSuccessorEntryReaches`:
+ *
+ * - `succ` is a successor of `pred`.
+ * - `predSkipsFirstLoopAlwaysTrueUponEntry`: whether the path from
+ * `pred` (via `succ`) skips the first loop where the condition is
+ * provably true upon entry.
+ * - `succSkipsFirstLoopAlwaysTrueUponEntry`: whether the path from
+ * `succ` skips the first loop where the condition is provably true
+ * upon entry.
+ * - If `pred` contains the entry point of a loop where the condition
+ * is provably true upon entry, then `succ` is not allowed to skip
+ * that loop (`succSkipsFirstLoopAlwaysTrueUponEntry = false`).
+ */
+deprecated
+predicate bbSuccessorEntryReachesLoopInvariant(BasicBlock pred, BasicBlock succ, boolean predSkipsFirstLoopAlwaysTrueUponEntry, boolean succSkipsFirstLoopAlwaysTrueUponEntry) {
+ succ = pred.getASuccessor() and
+ (succSkipsFirstLoopAlwaysTrueUponEntry = true or succSkipsFirstLoopAlwaysTrueUponEntry = false) and
+ (
+ // The edge from `pred` to `succ` is from a loop condition provably
+ // true upon entry, so the value of `predSkipsFirstLoopAlwaysTrueUponEntry`
+ // is determined by whether the true edge or the false edge is chosen,
+ // regardless of the value of `succSkipsFirstLoopAlwaysTrueUponEntry`.
+ bbLoopConditionAlwaysTrueUponEntrySuccessor(pred, succ, predSkipsFirstLoopAlwaysTrueUponEntry)
+ or
+ (
+ // The edge from `pred` to `succ` is _not_ from a loop condition provably
+ // true upon entry, so the values of `predSkipsFirstLoopAlwaysTrueUponEntry`
+ // and `succSkipsFirstLoopAlwaysTrueUponEntry` must be the same.
+ not bbLoopConditionAlwaysTrueUponEntrySuccessor(pred, _, _) and
+ succSkipsFirstLoopAlwaysTrueUponEntry = predSkipsFirstLoopAlwaysTrueUponEntry and
+ // Moreover, if `pred` contains the entry point of a loop where the
+ // condition is provably true upon entry, then `succ` is not allowed
+ // to skip that loop, and hence `succSkipsFirstLoopAlwaysTrueUponEntry = false`.
+ (bbLoopEntryConditionAlwaysTrueAt(pred, _, _) implies succSkipsFirstLoopAlwaysTrueUponEntry = false)
+ )
+ )
+}
+
+/**
+ * DEPRECATED: use `LocalScopeVariableReachabilityWithReassignment` instead.
+ *
+ * Reachability analysis for control-flow nodes involving stack variables.
+ * Unlike `StackVariableReachability`, this analysis takes variable
+ * reassignments into account.
+ */
+deprecated abstract class StackVariableReachabilityWithReassignment extends StackVariableReachability {
+ bindingset[this]
+ StackVariableReachabilityWithReassignment() { length() >= 0 }
+
+ /** Override this predicate rather than `isSource` (`isSource` is used internally). */
+ abstract predicate isSourceActual(ControlFlowNode node, StackVariable v);
+
+ /** Override this predicate rather than `isSink` (`isSink` is used internally). */
+ abstract predicate isSinkActual(ControlFlowNode node, StackVariable v);
+
+ /**
+ * Holds if the source node `source` can reach the sink `sink` without crossing
+ * a barrier, taking reassignments into account. This is (almost) equivalent
+ * to the following QL predicate, but uses basic blocks internally for better
+ * performance:
+ *
+ * ```
+ * predicate reaches(ControlFlowNode source, StackVariable v, ControlFlowNode sink) {
+ * reachesImpl(source, v, sink)
+ * and
+ * isSinkActual(sink, v)
+ * }
+ *
+ * predicate reachesImpl(ControlFlowNode source, StackVariable v, ControlFlowNode sink) {
+ * isSourceActual(source, v)
+ * and
+ * (
+ * sink = source.getASuccessor()
+ * or
+ * exists(ControlFlowNode mid, StackVariable v0 | reachesImpl(source, v0, mid) |
+ * // ordinary successor
+ * not isBarrier(mid, v) and
+ * sink = mid.getASuccessor() and
+ * v = v0
+ * or
+ * // reassigned from v0 to v
+ * exprDefinition(v, mid, v0.getAnAccess()) and
+ * sink = mid.getASuccessor()
+ * )
+ * )
+ * }
+ * ```
+ *
+ * In addition to using a better performing implementation, this analysis
+ * accounts for loops where the condition is provably true upon entry.
+ */
+ override predicate reaches(ControlFlowNode source, StackVariable v, ControlFlowNode sink) {
+ reachesTo(source, v, sink, _)
+ }
+
+ /**
+ * As `reaches`, but also specifies the last variable it was reassigned to (`v0`).
+ */
+ predicate reachesTo(ControlFlowNode source, StackVariable v, ControlFlowNode sink, StackVariable v0) {
+ exists(ControlFlowNode def |
+ actualSourceReaches(source, v, def, v0) and
+ StackVariableReachability.super.reaches(def, v0, sink) and
+ isSinkActual(sink, v0)
+ )
+ }
+
+ private predicate actualSourceReaches(ControlFlowNode source, StackVariable v, ControlFlowNode def, StackVariable v0) {
+ isSourceActual(source, v) and def = source and v0 = v
+ or
+ exists(ControlFlowNode source1, StackVariable v1 |
+ actualSourceReaches(source, v, source1, v1) |
+ reassignment(source1, v1, def, v0)
+ )
+ }
+
+ private predicate reassignment(ControlFlowNode source, StackVariable v, ControlFlowNode def, StackVariable v0) {
+ StackVariableReachability.super.reaches(source, v, def) and
+ exprDefinition(v0, def, v.getAnAccess())
+ }
+
+ final override predicate isSource(ControlFlowNode node, StackVariable v) {
+ isSourceActual(node, v)
+ or
+ // Reassignment generates a new (non-actual) source
+ reassignment(_, _, node, v)
+ }
+
+ final override predicate isSink(ControlFlowNode node, StackVariable v) {
+ isSinkActual(node, v)
+ or
+ // Reassignment generates a new (non-actual) sink
+ exprDefinition(_, node, v.getAnAccess())
+ }
+}
+
+/**
+ * DEPRECATED: use `LocalScopeVariableReachabilityExt` instead.
+ *
+ * Same as `StackVariableReachability`, but `isBarrier` works on control-flow
+ * edges rather than nodes and is therefore parameterized by the original
+ * source node as well.
+ */
+deprecated abstract class StackVariableReachabilityExt extends string {
+ bindingset[this]
+ StackVariableReachabilityExt() { length() >= 0 }
+
+ /** `node` is a source for the reachability analysis using variable `v`. */
+ abstract predicate isSource(ControlFlowNode node, StackVariable v);
+
+ /** `sink` is a (potential) sink for the reachability analysis using variable `v`. */
+ abstract predicate isSink(ControlFlowNode node, StackVariable v);
+
+ /** `node` is a barrier for the reachability analysis using variable `v` and starting from `source`. */
+ abstract predicate isBarrier(ControlFlowNode source, ControlFlowNode node, ControlFlowNode next, StackVariable v);
+
+ /** See `StackVariableReachability.reaches`. */
+ predicate reaches(ControlFlowNode source, StackVariable v, ControlFlowNode sink) {
+ exists(BasicBlock bb, int i |
+ isSource(source, v) and
+ bb.getNode(i) = source and
+ not bb.isUnreachable() |
+ exists(int j |
+ j > i
+ and
+ sink = bb.getNode(j)
+ and
+ isSink(sink, v)
+ and
+ not exists(int k | isBarrier(source, bb.getNode(k), bb.getNode(k + 1), v) | k in [i .. j - 1])
+ )
+ or
+ not exists(int k | isBarrier(source, bb.getNode(k), bb.getNode(k + 1), v) | k >= i) and
+ bbSuccessorEntryReaches(source, bb, v, sink, _)
+ )
+ }
+
+ private predicate bbSuccessorEntryReaches(ControlFlowNode source, BasicBlock bb, StackVariable v, ControlFlowNode node, boolean skipsFirstLoopAlwaysTrueUponEntry) {
+ exists(BasicBlock succ, boolean succSkipsFirstLoopAlwaysTrueUponEntry |
+ bbSuccessorEntryReachesLoopInvariant(bb, succ, skipsFirstLoopAlwaysTrueUponEntry, succSkipsFirstLoopAlwaysTrueUponEntry) and
+ not isBarrier(source, bb.getEnd(), succ.getStart(), v) |
+ bbEntryReachesLocally(source, succ, v, node) and
+ succSkipsFirstLoopAlwaysTrueUponEntry = false
+ or
+ not exists(int k | isBarrier(source, succ.getNode(k), succ.getNode(k + 1), v)) and
+ bbSuccessorEntryReaches(source, succ, v, node, succSkipsFirstLoopAlwaysTrueUponEntry)
+ )
+ }
+
+ private predicate bbEntryReachesLocally(ControlFlowNode source, BasicBlock bb, StackVariable v, ControlFlowNode node) {
+ isSource(source, v) and
+ exists(int n |
+ node = bb.getNode(n) and isSink(node, v) |
+ not exists(int m | m < n | isBarrier(source, bb.getNode(m), bb.getNode(m + 1), v))
+ )
+ }
+}
\ No newline at end of file
diff --git a/cpp/ql/src/semmle/code/cpp/controlflow/SubBasicBlocks.qll b/cpp/ql/src/semmle/code/cpp/controlflow/SubBasicBlocks.qll
new file mode 100644
index 000000000000..63eca58688cf
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/controlflow/SubBasicBlocks.qll
@@ -0,0 +1,183 @@
+//
+// NOTE: Maintain this file in synchrony with
+// semmlecode-cpp-queries/semmle/code/cpp/dataflow/internal/SubBasicBlocks.qll
+//
+
+/**
+ * Provides the `SubBasicBlock` class, used for partitioning basic blocks in
+ * smaller pieces.
+ */
+import cpp
+
+/**
+ * An abstract class that directs where in the control-flow graph a new
+ * `SubBasicBlock` must start. If a `ControlFlowNode` is an instance of this
+ * class, that node is guaranteed to be the first node in a `SubBasicBlock`.
+ * If multiple libraries use the `SubBasicBlock` library, basic blocks may be
+ * split in more places than either library expects, but nothing should break
+ * as a direct result of that.
+ */
+abstract class SubBasicBlockCutNode extends @cfgnode {
+ SubBasicBlockCutNode() {
+ // Some control-flow nodes are not in any basic block. This includes
+ // `Conversion`s, expressions that are evaluated at compile time, default
+ // arguments, and `Function`s without implementation.
+ exists(this.(ControlFlowNode).getBasicBlock())
+ }
+ string toString() { result = "SubBasicBlockCutNode" }
+}
+
+/**
+ * A block that can be smaller than or equal to a `BasicBlock`. Use this class
+ * when `ControlFlowNode` is too fine-grained and `BasicBlock` too
+ * coarse-grained. Their successor graph is like that of basic blocks, except
+ * that the blocks are split up with an extra edge right before any instance of
+ * the abstract class `SubBasicBlockCutNode`. Users of this library must
+ * therefore extend `SubBasicBlockCutNode` to direct where basic blocks will be
+ * split up.
+ */
+class SubBasicBlock extends @cfgnode {
+ SubBasicBlock() {
+ this instanceof BasicBlock
+ or
+ this instanceof SubBasicBlockCutNode
+ }
+
+ /** Gets the basic block in which this `SubBasicBlock` is contained. */
+ BasicBlock getBasicBlock() {
+ result = this.(ControlFlowNode).getBasicBlock()
+ }
+
+ /**
+ * Holds if this `SubBasicBlock` comes first in its basic block. This is the
+ * only condition under which a `SubBasicBlock` may have multiple
+ * predecessors.
+ */
+ predicate firstInBB() {
+ exists(BasicBlock bb | this.getPosInBasicBlock(bb) = 0)
+ }
+
+ /**
+ * Holds if this `SubBasicBlock` comes last in its basic block. This is the
+ * only condition under which a `SubBasicBlock` may have multiple successors.
+ */
+ predicate lastInBB() {
+ exists(BasicBlock bb |
+ this.getPosInBasicBlock(bb) = countSubBasicBlocksInBasicBlock(bb) - 1
+ )
+ }
+
+ /**
+ * Gets the position of this `SubBasicBlock` in its containing basic block
+ * `bb`, where `bb` is equal to `getBasicBlock()`.
+ */
+ int getPosInBasicBlock(BasicBlock bb) {
+ exists(int nodePos, int rnk |
+ bb = this.(ControlFlowNode).getBasicBlock() and
+ this = bb.getNode(nodePos) and
+ nodePos = rank[rnk](int i | exists(SubBasicBlock n | n = bb.getNode(i))) and
+ result = rnk - 1
+ )
+ }
+
+ /** Gets a successor in the control-flow graph of `SubBasicBlock`s. */
+ SubBasicBlock getASuccessor() {
+ this.lastInBB() and
+ result = this.getBasicBlock().getASuccessor()
+ or
+ exists(BasicBlock bb |
+ result.getPosInBasicBlock(bb) = this.getPosInBasicBlock(bb) + 1
+ )
+ }
+
+ /**
+ * Gets the `pos`th control-flow node in this `SubBasicBlock`. Positions
+ * start from 0, and the node at position 0 always exists and compares equal
+ * to `this`.
+ */
+ ControlFlowNode getNode(int pos) {
+ exists(BasicBlock bb | bb = this.getBasicBlock() |
+ exists(int thisPos | this = bb.getNode(thisPos) |
+ result = bb.getNode(thisPos + pos) and
+ pos >= 0 and
+ pos < this.getNumberOfNodes()
+ )
+ )
+ }
+
+ /** Gets a control-flow node in this `SubBasicBlock`. */
+ ControlFlowNode getANode() {
+ result = this.getNode(_)
+ }
+
+ /** Holds if `this` contains `node`. */
+ predicate contains(ControlFlowNode node) {
+ node = this.getANode()
+ }
+
+ /** Gets a predecessor in the control-flow graph of `SubBasicBlock`s. */
+ SubBasicBlock getAPredecessor() {
+ result.getASuccessor() = this
+ }
+
+ string toString() { result = "SubBasicBlock" }
+
+ /**
+ * Gets a node such that the control-flow edge `(this, result)` may be taken
+ * when the final node of this `SubBasicBlock` is a conditional expression
+ * and evaluates to true.
+ */
+ SubBasicBlock getATrueSuccessor() {
+ this.lastInBB() and
+ result = this.getBasicBlock().getATrueSuccessor()
+ }
+
+ /**
+ * Gets a node such that the control-flow edge `(this, result)` may be taken
+ * when the final node of this `SubBasicBlock` is a conditional expression
+ * and evaluates to false.
+ */
+ SubBasicBlock getAFalseSuccessor() {
+ this.lastInBB() and
+ result = this.getBasicBlock().getAFalseSuccessor()
+ }
+
+ /**
+ * Gets the number of control-flow nodes in this `SubBasicBlock`. There is
+ * always at least one.
+ */
+ int getNumberOfNodes() {
+ exists(BasicBlock bb | bb = this.getBasicBlock() |
+ exists(int thisPos | this = bb.getNode(thisPos) |
+ this.lastInBB() and
+ result = bb.length() - thisPos
+ or
+ exists(SubBasicBlock succ, int succPos |
+ succ.getPosInBasicBlock(bb) = this.getPosInBasicBlock(bb) + 1 and
+ bb.getNode(succPos) = succ and
+ result = succPos - thisPos
+ )
+ )
+ )
+ }
+
+ /** Gets the last control-flow node in this `SubBasicBlock`. */
+ ControlFlowNode getEnd() {
+ result = this.getNode(this.getNumberOfNodes() - 1)
+ }
+
+ /** Gets the first control-flow node in this `SubBasicBlock`. */
+ ControlFlowNode getStart() {
+ result = this
+ }
+
+ pragma[noinline]
+ Function getEnclosingFunction() {
+ result = this.getStart().getControlFlowScope()
+ }
+}
+
+/** Gets the number of `SubBasicBlock`s in the given basic block. */
+private int countSubBasicBlocksInBasicBlock(BasicBlock bb) {
+ result = strictcount(SubBasicBlock sbb | sbb.getBasicBlock() = bb)
+}
diff --git a/cpp/ql/src/semmle/code/cpp/controlflow/internal/ConstantExprs.qll b/cpp/ql/src/semmle/code/cpp/controlflow/internal/ConstantExprs.qll
new file mode 100644
index 000000000000..1aab24acfa35
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/controlflow/internal/ConstantExprs.qll
@@ -0,0 +1,1010 @@
+import cpp
+private import PrimitiveBasicBlocks
+
+/** A call to a function known not to return. */
+predicate aborting(FunctionCall c) {
+ not potentiallyReturningFunctionCall(c)
+}
+
+/**
+ * Functions that are known not to return. This is normally because the function
+ * exits the program or longjmps to another location.
+ */
+predicate abortingFunction(Function f) {
+ not potentiallyReturningFunction(f)
+}
+
+/** A function call that *may* return; if in doubt, we assume it may. */
+private predicate potentiallyReturningFunctionCall(FunctionCall fc) {
+ potentiallyReturningFunction(fc.getTarget()) or fc.isVirtual()
+}
+
+/** A function that *may* return; if in doubt, we assume it may. */
+private predicate potentiallyReturningFunction(Function f) {
+ not getOptions().exits(f)
+ and
+ (
+ nonAnalyzableFunction(f)
+ or
+ // otherwise the exit-point of `f` must be reachable
+ reachable(f)
+ )
+}
+
+/**
+ * A non-analyzable function is one for which there is no
+ * path from the entry point to the exit point using the bare
+ * `successors_extended` relation. This can happen if either the
+ * function has no entry point (an external/library function),
+ * or if the CFG for that function is incomplete.
+ */
+private predicate nonAnalyzableFunction(Function f) {
+ /*
+ * Identical to
+ * ```
+ * not successors_extended*(f.getEntryPoint(), f)
+ * ```
+ * but uses primitive basic blocks instead for better performance
+ * (transitive closure of `PrimitiveBasicBlock.getASuccessor()` is
+ * faster than transitive closure of the much larger `successors_extended`
+ * relation).
+ */
+ not exists(PrimitiveBasicBlock bb1, int pos1, PrimitiveBasicBlock bb2, int pos2 |
+ f.getEntryPoint() = bb1.getNode(pos1) and
+ f = bb2.getNode(pos2) |
+ (bb1 = bb2 and pos2 > pos1)
+ or
+ bb1.getASuccessor+() = bb2
+ )
+}
+
+/**
+ * If a condition is provably true, then control-flow edges to its false successors are impossible.
+ */
+private predicate impossibleFalseEdge(Expr condition, @cfgnode succ) {
+ conditionAlwaysTrue(condition)
+ and falsecond(condition,succ)
+ and not truecond(condition,succ)
+}
+
+/**
+ * If a condition is provably false, then control-flow edges to its true successors are impossible.
+ */
+private predicate impossibleTrueEdge(Expr condition, @cfgnode succ) {
+ conditionAlwaysFalse(condition)
+ and truecond(condition,succ)
+ and not falsecond(condition,succ)
+}
+
+/**
+ * Normally a switch case is for a single value, but it might cover a range
+ * of values. Either way, this tells us the upper bound.
+ */
+private int switchCaseRangeEnd(SwitchCase sc) {
+ if exists(sc.getEndExpr())
+ then result = sc.getEndExpr().(CompileTimeConstantInt).getIntValue()
+ else result = sc.getExpr().(CompileTimeConstantInt).getIntValue()
+}
+
+/**
+ * Gets a switch expression for switch statement `switch` with
+ * body `switchBlock`. There may be several such expressions: for example, if
+ * the condition is `(x ? y : z)` then the result is {`y`, `z`}.
+ */
+private @cfgnode getASwitchExpr(SwitchStmt switch, Block switchBlock) {
+ switch.getStmt() = switchBlock and
+ successors_extended(result, switchBlock)
+}
+
+/**
+ * If a switch provably never chooses `sc`, then the control-flow edge
+ * from `switchBlock` to `sc` is impossible. This considers only non-`default`
+ * switch cases.
+ */
+private predicate impossibleSwitchEdge(Block switchBlock, SwitchCase sc) {
+ not sc instanceof DefaultCase and
+ exists(SwitchStmt switch |
+ switch = sc.getSwitchStmt()
+ and switch.getStmt() = switchBlock
+ // If all of the successors have known values, and none of those
+ // values are in our range, then this edge is impossible.
+ and forall(@cfgnode n |
+ n = getASwitchExpr(switch, switchBlock) |
+ exists(int switchValue |
+ switchValue = getSwitchValue(n)
+ and (switchValue < sc.getExpr().(CompileTimeConstantInt).getIntValue() or
+ switchValue > switchCaseRangeEnd(sc)))))
+}
+
+/**
+ * If a switch provably always chooses a non-default case, then the edge to
+ * the default case is impossible.
+ */
+private predicate impossibleDefaultSwitchEdge(Block switchBlock, DefaultCase dc) {
+ exists(SwitchStmt switch |
+ switch = dc.getSwitchStmt()
+ and switch.getStmt() = switchBlock
+ // If all of the successors lead to other switch cases
+ // then this edge is impossible.
+ and forall(@cfgnode n |
+ n = getASwitchExpr(switch, switchBlock) |
+ exists(SwitchCase sc, int val |
+ sc.getSwitchStmt() = switch and
+ val = getSwitchValue(n) and
+ val >= sc.getExpr().(CompileTimeConstantInt).getIntValue() and
+ val <= switchCaseRangeEnd(sc))))
+}
+
+/**
+ * If `pred` is a function call with (at least) one function target,
+ * (at least) one such target must be potentially returning.
+ */
+private predicate possiblePredecessor(@cfgnode pred) {
+ not exists(pred.(FunctionCall).getTarget())
+ or
+ potentiallyReturningFunctionCall(pred)
+}
+
+/**
+ * An adapted version of the `successors_extended` relation that excludes
+ * impossible control-flow edges - flow will never occur along these
+ * edges, so it is safe (and indeed sensible) to remove them.
+ */
+cached predicate successors_adapted(@cfgnode pred, @cfgnode succ) {
+ successors_extended(pred, succ)
+ and possiblePredecessor(pred)
+ and not impossibleFalseEdge(pred, succ)
+ and not impossibleTrueEdge(pred, succ)
+ and not impossibleSwitchEdge(pred, succ)
+ and not impossibleDefaultSwitchEdge(pred, succ)
+ and not getOptions().exprExits(pred)
+}
+
+private predicate compileTimeConstantInt(Expr e, int val) {
+ val = e.getFullyConverted().getValue().toInt() and
+ not e instanceof StringLiteral and
+ not exists(Expr e1 | e1.getConversion() = e) // only values for fully converted expressions
+}
+
+library class CompileTimeConstantInt extends Expr {
+ CompileTimeConstantInt() {
+ compileTimeConstantInt(this, _)
+ }
+
+ int getIntValue() {
+ compileTimeConstantInt(this, result)
+ }
+}
+
+library class CompileTimeVariableExpr extends Expr {
+ CompileTimeVariableExpr() {
+ not compileTimeConstantInt(this, _)
+ }
+}
+
+/** A helper class for evaluation of expressions. */
+library class ExprEvaluator extends int {
+ /*
+ * 0 = ConditionEvaluator,
+ * 1 = SwitchEvaluator,
+ * 2 = WhileLoopEntryConditionEvaluator,
+ * 3 = ForLoopEntryConditionEvaluator
+ */
+ ExprEvaluator() { this in [0 .. 3] }
+
+ /** `e` is an expression for which we want to calculate a value. */
+ abstract predicate interesting(Expr e);
+
+ /** Gets the value of (interesting) expression `e`, if any. */
+ int getValue(Expr e) { result = getValueInternal(e, e) }
+
+ /**
+ * When evaluating a syntactic subexpression of `e`, we may
+ * ignore the non-analyzable variable definition `def` for
+ * variable `v`.
+ *
+ * Subclasses may implement this predicate when needed.
+ */
+ predicate ignoreNonAnalyzableVariableDefinition(Expr e, Variable v, StmtParent def) { none() }
+
+ /**
+ * When evaluating a syntactic subexpression of `e`, we may
+ * ignore the expression `value` assigned to variable `v`.
+ *
+ * Subclasses may implement this predicate when needed.
+ */
+ predicate ignoreVariableAssignment(Expr e, Variable v, Expr value) { none() }
+
+ /**
+ * When evaluating a syntactic subexpression of `e`, we may
+ * consider variable `v` even though it lacks an initializer.
+ * Normally, this is not sound, as uninitialized variables
+ * can contain arbitrary data (in fact, a query
+ * UninitialisedLocal.ql exists for finding that).
+ *
+ * Subclasses may implement this predicate when needed.
+ */
+ predicate allowVariableWithoutInitializer(Expr e, Variable v) { none() }
+
+ /* Internal implementation predicates below */
+
+ /**
+ * `req` is an expression for which a value is required to be evaluated in
+ * order to calculate a value for interesting expression `e`. `sub`
+ * indicates whether `req` is a syntactic subexpression of `e`.
+ *
+ * This predicate enumerates the nodes top-down; `getValueInternal()`
+ * calculates the values bottom-up.
+ */
+ predicate interestingInternal(Expr e, Expr req, boolean sub) {
+ interesting(e) and req = e and sub = true
+ or
+ exists(Expr mid |
+ interestingInternal(e, mid, sub) |
+ req = mid.(NotExpr).getOperand() or
+ req = mid.(BinaryLogicalOperation).getAnOperand() or
+ req = mid.(RelationalOperation).getAnOperand() or
+ req = mid.(EQExpr).getAnOperand() or
+ req = mid.(NEExpr).getAnOperand() or
+ req = mid.(AddExpr).getAnOperand() or
+ req = mid.(SubExpr).getAnOperand() or
+ req = mid.(MulExpr).getAnOperand() or
+ req = mid.(RemExpr).getAnOperand() or
+ req = mid.(DivExpr).getAnOperand() or
+ req = mid.(AssignExpr).getRValue()
+ )
+ or
+ exists(VariableAccess va, Variable v, boolean sub1 |
+ interestingVariableAccess(e, va, v, sub1) and
+ req = v.getAnAssignedValue() and
+ (sub1 = true implies not ignoreVariableAssignment(e, v, req)) and
+ sub = false
+ )
+ or
+ exists(Function f |
+ interestingFunction(e, f) and
+ returnStmt(f, req) and
+ sub = false
+ )
+ }
+
+ private predicate interestingVariableAccess(Expr e, VariableAccess va, Variable v, boolean sub) {
+ interestingInternal(e, va, sub) and
+ v = getVariableTarget(va) and
+ (v.hasInitializer() or sub = true and allowVariableWithoutInitializer(e, v)) and
+ tractableVariable(v) and
+ forall(StmtParent def |
+ nonAnalyzableVariableDefinition(v, def) |
+ sub = true and
+ ignoreNonAnalyzableVariableDefinition(e, v, def)
+ )
+ }
+
+ private predicate interestingFunction(Expr e, Function f) {
+ exists(FunctionCall fc |
+ interestingInternal(e, fc, _) |
+ f = fc.getTarget()
+ and not obviouslyNonConstant(f)
+ and not f.getType().getUnspecifiedType() instanceof VoidType
+ )
+ }
+
+ /** Gets the value of subexpressions `req` for expression `e`, if any. */
+ private int getValueInternal(Expr e, Expr req) {
+ (
+ interestingInternal(e, req, true)
+ and
+ (
+ result = req.(CompileTimeConstantInt).getIntValue() or
+ result = getCompoundValue(e, (CompileTimeVariableExpr)req)
+ )
+ and
+ (
+ req.getUnderlyingType().(IntegralType).isSigned() or
+ result >= 0
+ )
+ )
+ }
+
+ /** Gets the value of compound subexpressions `val` for expression `e`, if any. */
+ private int getCompoundValue(Expr e, CompileTimeVariableExpr val) {
+ interestingInternal(e, val, true)
+ and
+ (
+ exists(NotExpr req |
+ req = val |
+ result = 1 and getValueInternal(e, req.getOperand()) = 0 or
+ result = 0 and getValueInternal(e, req.getOperand()) != 0
+ )
+ or
+ exists(LogicalAndExpr req |
+ req = val |
+ result = 1 and getValueInternal(e, req.getLeftOperand()) != 0 and getValueInternal(e, req.getRightOperand()) != 0 or
+ result = 0 and getValueInternal(e, req.getAnOperand()) = 0
+ )
+ or
+ exists(LogicalOrExpr req |
+ req = val |
+ result = 1 and getValueInternal(e, req.getAnOperand()) != 0 or
+ result = 0 and getValueInternal(e, req.getLeftOperand()) = 0 and getValueInternal(e, req.getRightOperand()) = 0
+ )
+ or
+ exists(LTExpr req |
+ req = val |
+ result = 1 and getValueInternal(e, req.getLeftOperand()) < getValueInternal(e, req.getRightOperand()) or
+ result = 0 and getValueInternal(e, req.getLeftOperand()) >= getValueInternal(e, req.getRightOperand())
+ )
+ or
+ exists(GTExpr req |
+ req = val |
+ result = 1 and getValueInternal(e, req.getLeftOperand()) > getValueInternal(e, req.getRightOperand()) or
+ result = 0 and getValueInternal(e, req.getLeftOperand()) <= getValueInternal(e, req.getRightOperand())
+ )
+ or
+ exists(LEExpr req |
+ req = val |
+ result = 1 and getValueInternal(e, req.getLeftOperand()) <= getValueInternal(e, req.getRightOperand()) or
+ result = 0 and getValueInternal(e, req.getLeftOperand()) > getValueInternal(e, req.getRightOperand())
+ )
+ or
+ exists(GEExpr req |
+ req = val |
+ result = 1 and getValueInternal(e, req.getLeftOperand()) >= getValueInternal(e, req.getRightOperand()) or
+ result = 0 and getValueInternal(e, req.getLeftOperand()) < getValueInternal(e, req.getRightOperand())
+ )
+ or
+ exists(EQExpr req |
+ req = val |
+ result = 1 and getValueInternal(e, req.getLeftOperand()) = getValueInternal(e, req.getRightOperand()) or
+ result = 0 and getValueInternal(e, req.getLeftOperand()) != getValueInternal(e, req.getRightOperand())
+ )
+ or
+ exists(NEExpr req |
+ req = val |
+ result = 0 and getValueInternal(e, req.getLeftOperand()) = getValueInternal(e, req.getRightOperand()) or
+ result = 1 and getValueInternal(e, req.getLeftOperand()) != getValueInternal(e, req.getRightOperand())
+ )
+ or
+ exists(AddExpr req |
+ req = val |
+ result = getValueInternal(e, req.getLeftOperand()) + getValueInternal(e, req.getRightOperand())
+ )
+ or
+ exists(SubExpr req |
+ req = val |
+ result = getValueInternal(e, req.getLeftOperand()) - getValueInternal(e, req.getRightOperand())
+ )
+ or
+ exists(MulExpr req |
+ req = val |
+ result = getValueInternal(e, req.getLeftOperand()) * getValueInternal(e, req.getRightOperand())
+ )
+ or
+ exists(RemExpr req |
+ req = val |
+ result = getValueInternal(e, req.getLeftOperand()) % getValueInternal(e, req.getRightOperand())
+ )
+ or
+ exists(DivExpr req |
+ req = val |
+ result = getValueInternal(e, req.getLeftOperand()) / getValueInternal(e, req.getRightOperand())
+ )
+ or
+ exists(AssignExpr req |
+ req = val |
+ result = getValueInternal(e, req.getRValue())
+ )
+ or
+ result = getVariableValue(e, (VariableAccess)val)
+ or
+ exists(FunctionCall call |
+ call = val and not callWithMultipleTargets(call) |
+ result = getFunctionValue(call.getTarget()))
+ )
+ }
+
+ language[monotonicAggregates]
+ private int getVariableValue(Expr e, VariableAccess va) {
+ exists(Variable v |
+ interestingVariableAccess(e, va, v, true)
+ and
+ // All assignments must have the same int value
+ result = min(Expr value | value = v.getAnAssignedValue() and not ignoreVariableAssignment(e, v, value) |
+ getValueInternalNonSubExpr(value)
+ ) and
+ result = max(Expr value | value = v.getAnAssignedValue() and not ignoreVariableAssignment(e, v, value) |
+ getValueInternalNonSubExpr(value)
+ )
+ )
+ }
+
+ private int getFunctionValue(Function f) {
+ interestingFunction(_, f)
+ and
+ // All returns must have the same int value
+ // And it must have at least one return
+ forex(Expr ret | returnStmt(f, ret) | result = getValueInternalNonSubExpr(ret))
+ }
+
+ /**
+ * Same as `getValueInternal` but where `req` is not a syntactic subexpression
+ * of an interesting expression, and hence `nonAnalyzableVariableDefinition` and
+ * `ignoreNonAnalyzableVariableDefinition` are not relevant. That is, `req` is
+ * either a value assigned to an interesting variable or the return expression of
+ * an interesting function.
+ *
+ * This predicate, `getCompoundValueNonSubExpr`, and `getVariableValueNonSubExpr`
+ * need to be duplicated for performance reasons (the extra argument `e` can be
+ * omitted).
+ */
+ private int getValueInternalNonSubExpr(Expr req) {
+ interestingInternal(_, req, false)
+ and
+ (
+ result = req.(CompileTimeConstantInt).getIntValue() or
+ result = getCompoundValueNonSubExpr((CompileTimeVariableExpr)req)
+ )
+ and
+ (
+ req.getUnderlyingType().(IntegralType).isSigned() or
+ result >= 0
+ )
+ }
+
+ private int getCompoundValueNonSubExpr(CompileTimeVariableExpr val) {
+ (
+ exists(NotExpr req |
+ req = val |
+ result = 1 and getValueInternalNonSubExpr(req.getOperand()) = 0 or
+ result = 0 and getValueInternalNonSubExpr(req.getOperand()) != 0
+ )
+ or
+ exists(LogicalAndExpr req |
+ req = val |
+ result = 1 and getValueInternalNonSubExpr(req.getLeftOperand()) != 0 and getValueInternalNonSubExpr(req.getRightOperand()) != 0 or
+ result = 0 and getValueInternalNonSubExpr(req.getAnOperand()) = 0
+ )
+ or
+ exists(LogicalOrExpr req |
+ req = val |
+ result = 1 and getValueInternalNonSubExpr(req.getAnOperand()) != 0 or
+ result = 0 and getValueInternalNonSubExpr(req.getLeftOperand()) = 0 and getValueInternalNonSubExpr(req.getRightOperand()) = 0
+ )
+ or
+ exists(LTExpr req |
+ req = val |
+ result = 1 and getValueInternalNonSubExpr(req.getLeftOperand()) < getValueInternalNonSubExpr(req.getRightOperand()) or
+ result = 0 and getValueInternalNonSubExpr(req.getLeftOperand()) >= getValueInternalNonSubExpr(req.getRightOperand())
+ )
+ or
+ exists(GTExpr req |
+ req = val |
+ result = 1 and getValueInternalNonSubExpr(req.getLeftOperand()) > getValueInternalNonSubExpr(req.getRightOperand()) or
+ result = 0 and getValueInternalNonSubExpr(req.getLeftOperand()) <= getValueInternalNonSubExpr(req.getRightOperand())
+ )
+ or
+ exists(LEExpr req |
+ req = val |
+ result = 1 and getValueInternalNonSubExpr(req.getLeftOperand()) <= getValueInternalNonSubExpr(req.getRightOperand()) or
+ result = 0 and getValueInternalNonSubExpr(req.getLeftOperand()) > getValueInternalNonSubExpr(req.getRightOperand())
+ )
+ or
+ exists(GEExpr req |
+ req = val |
+ result = 1 and getValueInternalNonSubExpr(req.getLeftOperand()) >= getValueInternalNonSubExpr(req.getRightOperand()) or
+ result = 0 and getValueInternalNonSubExpr(req.getLeftOperand()) < getValueInternalNonSubExpr(req.getRightOperand())
+ )
+ or
+ exists(EQExpr req |
+ req = val |
+ result = 1 and getValueInternalNonSubExpr(req.getLeftOperand()) = getValueInternalNonSubExpr(req.getRightOperand()) or
+ result = 0 and getValueInternalNonSubExpr(req.getLeftOperand()) != getValueInternalNonSubExpr(req.getRightOperand())
+ )
+ or
+ exists(NEExpr req |
+ req = val |
+ result = 0 and getValueInternalNonSubExpr(req.getLeftOperand()) = getValueInternalNonSubExpr(req.getRightOperand()) or
+ result = 1 and getValueInternalNonSubExpr(req.getLeftOperand()) != getValueInternalNonSubExpr(req.getRightOperand())
+ )
+ or
+ exists(AddExpr req |
+ req = val |
+ result = getValueInternalNonSubExpr(req.getLeftOperand()) + getValueInternalNonSubExpr(req.getRightOperand())
+ )
+ or
+ exists(SubExpr req |
+ req = val |
+ result = getValueInternalNonSubExpr(req.getLeftOperand()) - getValueInternalNonSubExpr(req.getRightOperand())
+ )
+ or
+ exists(MulExpr req |
+ req = val |
+ result = getValueInternalNonSubExpr(req.getLeftOperand()) * getValueInternalNonSubExpr(req.getRightOperand())
+ )
+ or
+ exists(RemExpr req |
+ req = val |
+ result = getValueInternalNonSubExpr(req.getLeftOperand()) % getValueInternalNonSubExpr(req.getRightOperand())
+ )
+ or
+ exists(DivExpr req |
+ req = val |
+ result = getValueInternalNonSubExpr(req.getLeftOperand()) / getValueInternalNonSubExpr(req.getRightOperand())
+ )
+ or
+ exists(AssignExpr req |
+ req = val |
+ result = getValueInternalNonSubExpr(req.getRValue())
+ )
+ or
+ result = getVariableValueNonSubExpr(val.(VariableAccess))
+ or
+ exists(FunctionCall call |
+ call = val and not callWithMultipleTargets(call) |
+ result = getFunctionValue(call.getTarget()))
+ )
+ }
+
+ private int getVariableValueNonSubExpr(VariableAccess va) {
+ // All assignments must have the same int value
+ result = getMinVariableValueNonSubExpr(va) and
+ result = getMaxVariableValueNonSubExpr(va)
+ }
+
+ /**
+ * Helper predicate for `getVariableValueNonSubExpr`: computes the minimum value considered by this library
+ * that is assigned to the variable accessed by `va`.
+ */
+ language[monotonicAggregates]
+ pragma[noopt]
+ private int getMinVariableValueNonSubExpr(VariableAccess va) {
+ exists(Variable v |
+ interestingVariableAccess(_, va, v, false)
+ and
+ result = min(Expr value | value = v.getAnAssignedValue() | getValueInternalNonSubExpr(value))
+ )
+ }
+
+ /**
+ * Helper predicate for `getVariableValueNonSubExpr`: computes the maximum value considered by this library
+ * that is assigned to the variable accessed by `va`.
+ */
+ language[monotonicAggregates]
+ pragma[noopt]
+ private int getMaxVariableValueNonSubExpr(VariableAccess va) {
+ exists(Variable v |
+ interestingVariableAccess(_, va, v, false) and
+ result = max(Expr value | value = v.getAnAssignedValue() | getValueInternalNonSubExpr(value))
+ )
+ }
+}
+
+/**
+ * Holds if the dynamic target of `call` cannot be determined statically even
+ * though there is a `call.getTarget()`. This can happen due to virtual
+ * dispatch or due to insufficient information about which object files should
+ * be linked together.
+ */
+private predicate callWithMultipleTargets(FunctionCall call) {
+ // Some function calls have more than one possible target. Such call need to
+ // be excluded from the analysis, because they could lead to ambiguous
+ // results.
+ call.getTarget() != call.getTarget()
+ or
+ call.isVirtual()
+}
+
+// Folded predicate for proper join-order
+private Variable getVariableTarget(VariableAccess va) {
+ result = va.getTarget()
+ and
+ (result instanceof LocalVariable or result instanceof GlobalOrNamespaceVariable)
+}
+
+/**
+ * Holds if `def` is a (potential) definition of variable `v` that makes it
+ * impossible to analyze the value of `v` by only looking at direct assignments
+ * to `v`.
+ */
+private predicate nonAnalyzableVariableDefinition(Variable v, StmtParent def) {
+ def.(AddressOfExpr).getAddressable() = v
+ or
+ exists(VariableAccess va |
+ va.getTarget() = v |
+ definitionByReference(va, def)
+ or
+ def.(CrementOperation).getAnOperand() = va
+ or
+ def.(Assignment).getLValue() = va and not def instanceof AssignExpr
+ )
+ or
+ asmStmtMayDefineVariable(def, v)
+}
+
+/**
+ * For performance reasons, we want to restrict some of the computation to only
+ * variables that are tractable. The threshold chosen here has been tested
+ * empirically to have effect only on a few rare and pathological examples.
+ */
+private predicate tractableVariable(Variable v) {
+ not exists(StmtParent def | nonAnalyzableVariableDefinition(v, def)) or
+ strictcount(StmtParent def | nonAnalyzableVariableDefinition(v, def)) < 1000
+}
+
+/**
+ * Helper predicate: Gets an expression which is obviously just an access to
+ * the parameter `p`, including ternary expressions.
+ */
+private Expr parameterAccess(Parameter p) {
+ result = p.getAnAccess() or
+ result.(ConditionalExpr).getThen() = parameterAccess(p) or
+ result.(ConditionalExpr).getElse() = parameterAccess(p)
+}
+
+/**
+ * Holds if the function `f` is obviously not tractable for this library's
+ * analysis techniques:
+ * - it may obviously return multiple distinct constant values,
+ * - it may return one of its parameters without reassigning it, or
+ * - it may return an expression for which this analysis cannot infer a constant value.
+ *
+ * For example, `int f(int x) { if (x) return 0; else return 1; }` may
+ * obviously return two constant values, and so will never be considered to
+ * have a compile-time constant value by this library, and
+ * `int min(int x, int y) { return x < y ? x : y; }` returns a parameter and
+ * so won't have a locally constant value.
+ */
+private predicate obviouslyNonConstant(Function f) {
+ // May return multiple distinct constant values
+ 1 < strictcount(Expr e, string value | returnStmt(f, e) and value = e.getValue()) or
+ // May return a parameter without reassignment
+ exists(Parameter p, Expr ret |
+ returnStmt(f, ret) and
+ p = f.getAParameter() and
+ not exists(p.getAnAssignedValue()) |
+ ret = parameterAccess(p)
+ ) or
+ // May return a value for which this analysis cannot infer a constant value
+ exists(Expr ret | returnStmt(f, ret) | nonComputableConstant(ret))
+ or
+ // Returns many non-constant values
+ strictcount(Expr e | returnStmt(f, e) and not exists(e.getValue())) > 100
+}
+
+/**
+ * Helper predicate: holds if the analysis cannot compute a
+ * constant value for the expression `e`.
+ */
+private predicate nonComputableConstant(Expr e) {
+ // Variable targets that are ignored
+ e instanceof VariableAccess and not exists(getVariableTarget(e))
+ or
+ // Recursive cases
+ nonComputableConstant(e.(BinaryArithmeticOperation).getAnOperand())
+ or
+ nonComputableConstant(e.(ComparisonOperation).getAnOperand())
+}
+
+/** Holds if assembler statement `asm` may define variable `v`. */
+private predicate asmStmtMayDefineVariable(AsmStmt asm, Variable v) {
+ // We don't actually have access to the assembler code, so assume
+ // that any variable declared in the same function may be defined
+ exists(DeclStmt decl, Function f |
+ decl.getADeclaration() = v and
+ f = decl.getEnclosingFunction() and
+ f = asm.getEnclosingFunction()
+ )
+}
+
+private predicate returnStmt(Function f, Expr value) {
+ exists(ReturnStmt ret |
+ ret.getEnclosingFunction() = f
+ and value = ret.getExpr()
+ )
+}
+
+/** A helper class for evaluation of conditions. */
+library class ConditionEvaluator extends ExprEvaluator {
+ ConditionEvaluator() { this = 0 }
+
+ override predicate interesting(Expr e) {
+ falsecond(e, _)
+ or
+ truecond(e, _)
+ }
+}
+
+/** A helper class for evaluation of switch expressions. */
+library class SwitchEvaluator extends ExprEvaluator {
+ SwitchEvaluator() { this = 1 }
+
+ override predicate interesting(Expr e) {
+ e = getASwitchExpr(_, _)
+ }
+}
+
+private int getSwitchValue(Expr e) {
+ exists(SwitchEvaluator x | result = x.getValue(e))
+}
+
+/** A helper class for evaluation of loop entry conditions. */
+library class LoopEntryConditionEvaluator extends ExprEvaluator {
+ LoopEntryConditionEvaluator() { this in [2 .. 3] }
+
+ abstract override predicate interesting(Expr e);
+
+ /** Holds if `cfn` is the entry point of the loop for which `e` is the condition. */
+ abstract predicate isLoopEntry(Expr e, ControlFlowNode cfn);
+
+ /** Holds if `s` is the loop body guarded by the condition `e`. */
+ abstract predicate isLoopBody(Expr e, StmtParent s);
+
+ private predicate isLoopBodyDescendant(Expr e, StmtParent s) {
+ isLoopBody(e, s)
+ or
+ exists(StmtParent mid |
+ isLoopBodyDescendant(e, mid) |
+ s = mid.(Stmt).getAChild() or
+ s = mid.(Expr).getAChild()
+ )
+ }
+
+ // Same as `interestingInternal(e, sub, true)` but avoids negative recursion
+ private predicate interestingSubExpr(Expr e, Expr sub) {
+ interesting(e) and e = sub
+ or
+ exists(Expr mid | interestingSubExpr(e, mid) and sub = mid.getAChild())
+ }
+
+ private predicate maybeInterestingVariable(Expr e, Variable v) {
+ exists(VariableAccess va |
+ interestingSubExpr(e, va) |
+ va.getTarget() = v
+ )
+ }
+
+ /**
+ * Holds if the expression `valueOrDef` in the body of the loop belonging to
+ * `e` can reach the entry point of the loop without crossing an assignment
+ * to `v`.
+ *
+ * `valueOrDef` is either a value assigned to variable `v` or a non-analyzable
+ * definition of `v`.
+ */
+ private predicate reachesLoopEntryFromLoopBody(Expr e, Variable v, StmtParent valueOrDef) {
+ maybeInterestingVariable(e, v) and
+ (valueOrDef = v.getAnAssignedValue() or nonAnalyzableVariableDefinition(v, valueOrDef)) and
+ isLoopBodyDescendant(e, valueOrDef) and
+ /* Use primitive basic blocks in reachability analysis for better performance.
+ * This is similar to the pattern used in e.g. `DefinitionsAndUses` and
+ * `LocalScopeVariableReachability`.
+ */
+ exists(PrimitiveBasicBlock bb1, int pos1 |
+ bb1.getNode(pos1) = valueOrDef |
+ // Reaches in same basic block
+ exists(int pos2 |
+ loopEntryAt(bb1, pos2, e) and
+ pos2 > pos1 and
+ not exists(int k | assignmentAt(bb1, k, v) | k in [pos1 + 1 .. pos2 - 1])
+ )
+ or
+ // Reaches in a successor block
+ exists(PrimitiveBasicBlock bb2 |
+ bb2 = bb1.getASuccessor() and
+ not exists(int pos3 | assignmentAt(bb1, pos3, v) and pos3 > pos1) and
+ bbReachesLoopEntry(bb2, e, v)
+ )
+ )
+ }
+
+ private predicate loopEntryAt(PrimitiveBasicBlock bb, int pos, Expr e) {
+ exists(ControlFlowNode cfn |
+ bb.getNode(pos) = cfn and
+ isLoopEntry(e, cfn)
+ )
+ }
+
+ private predicate assignmentAt(PrimitiveBasicBlock bb, int pos, Variable v) {
+ maybeInterestingVariable(_, v) and
+ bb.getNode(pos) = v.getAnAssignedValue()
+ }
+
+ /**
+ * Holds if the entry point of basic block `bb` can reach the entry point of
+ * the loop belonging to `e` without crossing an assignment to `v`.
+ */
+ private predicate bbReachesLoopEntry(PrimitiveBasicBlock bb, Expr e, Variable v) {
+ bbReachesLoopEntryLocally(bb, e, v)
+ or
+ exists(PrimitiveBasicBlock succ |
+ succ = bb.getASuccessor() |
+ bbReachesLoopEntry(succ, e, v) and
+ not assignmentAt(bb, _, v)
+ )
+ }
+
+ private predicate bbReachesLoopEntryLocally(PrimitiveBasicBlock bb, Expr e, Variable v) {
+ exists(int pos |
+ loopEntryAt(bb, pos, e) and
+ maybeInterestingVariable(e, v) and
+ not exists(int pos1 | assignmentAt(bb, pos1, v) | pos1 < pos)
+ )
+ }
+
+ /**
+ * When evaluating a syntactic subexpression of loop condition `e`,
+ * we may ignore non-analyzable variable definition `def` for
+ * variable `v`, provided that `def` is in the body of the loop and
+ * cannot reach the loop entry point.
+ *
+ * Example:
+ *
+ * ```
+ * done = false;
+ * while (!done) {
+ * f(&done); // can be ignored
+ * }
+ *
+ * while (...) {
+ * done = false;
+ * while (!done) {
+ * f(&done); // can be ignored
+ * }
+ * }
+ *
+ * done = false;
+ * while (...) {
+ * while (!done) {
+ * f(&done); // cannot be ignored
+ * }
+ * }
+ * ```
+ */
+ override predicate ignoreNonAnalyzableVariableDefinition(Expr e, Variable v, StmtParent def) {
+ maybeInterestingVariable(e, v) and
+ nonAnalyzableVariableDefinition(v, def) and
+ isLoopBodyDescendant(e, def) and
+ not reachesLoopEntryFromLoopBody(e, v, def)
+ }
+
+ /**
+ * When evaluating a syntactic subexpression of loop condition `e`,
+ * we may ignore the expression `value` assigned to variable `v`,
+ * provided that `value` is in the body of the loop and cannot reach
+ * the loop entry point.
+ *
+ * Example:
+ *
+ * ```
+ * done = false;
+ * while (!done) {
+ * done = true; // can be ignored
+ * }
+ *
+ * while (...) {
+ * done = false;
+ * while (!done) {
+ * done = true; // can be ignored
+ * }
+ * }
+ *
+ * done = false;
+ * while (...) {
+ * while (!done) {
+ * done = true; // cannot be ignored
+ * }
+ * }
+ * ```
+ */
+ override predicate ignoreVariableAssignment(Expr e, Variable v, Expr value) {
+ maybeInterestingVariable(e, v) and
+ value = v.getAnAssignedValue() and
+ isLoopBodyDescendant(e, value) and
+ not reachesLoopEntryFromLoopBody(e, v, value)
+ }
+}
+
+/** A helper class for evaluation of while-loop entry conditions. */
+library class WhileLoopEntryConditionEvaluator extends LoopEntryConditionEvaluator {
+ WhileLoopEntryConditionEvaluator() { this = 2 }
+
+ override predicate interesting(Expr e) {
+ exists(WhileStmt while | e = while.getCondition())
+ }
+
+ override predicate isLoopEntry(Expr e, ControlFlowNode cfn) {
+ cfn.(WhileStmt).getCondition() = e
+ }
+
+ override predicate isLoopBody(Expr e, StmtParent s) {
+ exists(WhileStmt while |
+ e = while.getCondition() |
+ s = while.getStmt()
+ )
+ }
+}
+
+/** A helper class for evaluation of for-loop entry conditions. */
+library class ForLoopEntryConditionEvaluator extends LoopEntryConditionEvaluator {
+ ForLoopEntryConditionEvaluator() { this = 3 }
+
+ override predicate interesting(Expr e) {
+ exists(ForStmt for | e = for.getCondition())
+ }
+
+ override predicate isLoopEntry(Expr e, ControlFlowNode cfn) {
+ cfn.(ForStmt).getCondition() = e
+ }
+
+ override predicate isLoopBody(Expr e, StmtParent s) {
+ exists(ForStmt for |
+ e = for.getCondition() |
+ s = for.getUpdate() or
+ s = for.getStmt()
+ )
+ }
+
+ override predicate ignoreNonAnalyzableVariableDefinition(Expr e, Variable v, StmtParent def) {
+ LoopEntryConditionEvaluator.super.ignoreNonAnalyzableVariableDefinition(e, v, def)
+ or
+ // If the for loop initializes variable `v` we know its exact value so all
+ // non-analyzable definitions can be ignored
+ exists(ForStmt for |
+ forLoopInitializesVariable(for, v, _) and
+ e = for.getCondition() and
+ nonAnalyzableVariableDefinition(v, def)
+ )
+ }
+
+ override predicate ignoreVariableAssignment(Expr e, Variable v, Expr value) {
+ LoopEntryConditionEvaluator.super.ignoreVariableAssignment(e, v, value)
+ or
+ // If the for loop initializes variable `v` we know its exact value so all
+ // other assignments can be ignored
+ exists(ForStmt for |
+ forLoopInitializesVariable(for, v, _) and
+ e = for.getCondition() and
+ value = v.getAnAssignedValue() and
+ not forLoopInitializesVariable(for, v, value)
+ )
+ }
+
+ override predicate allowVariableWithoutInitializer(Expr e, Variable v) {
+ // If the for loop initializes variable `v` we know its exact value
+ // regardless of a lacking initializer
+ exists(ForStmt for |
+ forLoopInitializesVariable(for, v, _) and
+ e = for.getCondition() and
+ not v.hasInitializer()
+ )
+ }
+}
+
+/** Holds if for-loop `for` initializes variable `v` to expression `e`. */
+private predicate forLoopInitializesVariable(ForStmt for, Variable v, Expr e) {
+ exists(AssignExpr ae |
+ ae = for.getInitialization().(ExprStmt).getExpr() and
+ assignsValue(ae, v, e)
+ )
+ or
+ exists(DeclStmt decl, Expr init, Variable v1 |
+ decl = for.getInitialization() and
+ v1 = decl.getADeclaration() and
+ init = v1.getInitializer().getExpr() |
+ e = init and v = v1
+ or
+ assignsValue(init, v, e)
+ )
+}
+
+/**
+ * Holds if assignment `ae` assigns expression `e` to variable `v`.
+ *
+ * Nested assignments are included, e.g. `i = j = 0;` assigns the
+ * expression `j = 0` to `i` and the expression `0` to `j`.
+ */
+private predicate assignsValue(AssignExpr ae, Variable v, Expr e) {
+ v.getAnAccess() = ae.getLValue() and e = ae.getRValue()
+ or
+ assignsValue(ae.getRValue(), v, e)
+}
diff --git a/cpp/ql/src/semmle/code/cpp/controlflow/internal/PrimitiveBasicBlocks.qll b/cpp/ql/src/semmle/code/cpp/controlflow/internal/PrimitiveBasicBlocks.qll
new file mode 100644
index 000000000000..bb3cf562c6e2
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/controlflow/internal/PrimitiveBasicBlocks.qll
@@ -0,0 +1,110 @@
+/**
+ * INTERNAL: use the `BasicBlocks` library instead.
+ * This library defines `PrimitiveBasicBlock`s, an intermediate stage in the
+ * computation of `BasicBlock`s.
+ */
+/*
+ * Unlike `BasicBlock`s, `PrimitiveBasicBlock`s are constructed using
+ * the primitive `successors_extended` relation only. That is, impossible
+ * edges removed in `successors_adapted` are still taken into account.
+ *
+ * `PrimitiveBasicBlock`s are used as helper entities for actually
+ * constructing `successors_adapted`, hence the need for two "layers"
+ * of basic blocks. In addition to being used to construct
+ * `successors_adapted`, the relations for `BasicBlocks` (e.g.,
+ * `basic_block_entry_node`) can reuse the relations computed here
+ * (e.g, `primitive_basic_block_entry_node`), as most `BasicBlock`s
+ * will coincide with `PrimitiveBasicBlock`s.
+ */
+import cpp
+
+import Cached
+private cached module Cached {
+ /** Holds if `node` is the entry node of a primitive basic block. */
+ cached
+ predicate primitive_basic_block_entry_node(ControlFlowNode node) {
+ // The entry point of the CFG is the start of a BB.
+ exists (Function f | f.getEntryPoint() = node)
+
+ // If the node has more than one predecessor,
+ // or the node's predecessor has more than one successor,
+ // then the node is the start of a new primitive basic block.
+ or
+ strictcount (ControlFlowNode pred, ControlFlowNode other
+ | successors_extended(pred,node) and successors_extended(pred,other)) > 1
+
+ // If the node has zero predecessors then it is the start of
+ // a BB. However, the C++ AST contains many nodes with zero
+ // predecessors and zero successors, which are not members of
+ // the CFG. So we exclude all of those trivial BBs by requiring
+ // that the node have at least one successor.
+ or
+ (not successors_extended(_, node) and successors_extended(node, _))
+ }
+
+ /** Holds if `node` is the `pos`th control-flow node in primitive basic block `bb`. */
+ cached
+ predicate primitive_basic_block_member(ControlFlowNode node, PrimitiveBasicBlock bb, int pos) {
+ (node = bb and pos = 0)
+ or
+ (not (node instanceof PrimitiveBasicBlock) and
+ exists (ControlFlowNode pred
+ | successors_extended(pred,node)
+ | primitive_basic_block_member(pred, bb, pos - 1)))
+ }
+
+ /** Gets the number of control-flow nodes in the primitive basic block `bb`. */
+ cached
+ int primitive_bb_length(PrimitiveBasicBlock bb) {
+ result = strictcount(ControlFlowNode node | primitive_basic_block_member(node, bb, _))
+ }
+
+ /** Successor relation for primitive basic blocks. */
+ cached
+ predicate primitive_bb_successor(PrimitiveBasicBlock pred, PrimitiveBasicBlock succ) {
+ exists(ControlFlowNode last |
+ primitive_basic_block_member(last, pred, primitive_bb_length(pred)-1) and
+ successors_extended(last, succ)
+ )
+ }
+}
+
+/**
+ * A primitive basic block in the C/C++ control-flow graph constructed using
+ * the primitive `successors_extended` relation only.
+ */
+class PrimitiveBasicBlock extends @cfgnode {
+
+ PrimitiveBasicBlock() {
+ primitive_basic_block_entry_node(this)
+ }
+
+ /** Gets a textual representation of this element. */
+ string toString() {
+ result = "PrimitiveBasicBlock"
+ }
+
+ predicate contains(ControlFlowNode node) {
+ primitive_basic_block_member(node, this, _)
+ }
+
+ ControlFlowNode getNode(int pos) {
+ primitive_basic_block_member(result, this, pos)
+ }
+
+ ControlFlowNode getANode() {
+ primitive_basic_block_member(result, this, _)
+ }
+
+ PrimitiveBasicBlock getASuccessor() {
+ primitive_bb_successor(this, result)
+ }
+
+ PrimitiveBasicBlock getAPredecessor() {
+ primitive_bb_successor(result, this)
+ }
+
+ int length() {
+ result = primitive_bb_length(this)
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/DataFlow.qll b/cpp/ql/src/semmle/code/cpp/dataflow/DataFlow.qll
new file mode 100644
index 000000000000..bfb93f77bfa7
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/DataFlow.qll
@@ -0,0 +1,21 @@
+/**
+ * Provides a library for local (intra-procedural) and global (inter-procedural)
+ * data flow analysis: deciding whether data can flow from a _source_ to a
+ * _sink_.
+ *
+ * Unless configured otherwise, _flow_ means that the exact value of
+ * the source may reach the sink. We do not track flow across pointer
+ * dereferences or array indexing. To track these types of flow, where the
+ * exact value may not be preserved, import
+ * `semmle.code.cpp.dataflow.TaintTracking`.
+ *
+ * To use global (interprocedural) data flow, extend the class
+ * `DataFlow::Configuration` as documented on that class. To use local
+ * (intraprocedural) data flow, invoke `DataFlow::localFlow` or
+ * `DataFlow::LocalFlowStep` with arguments of type `DataFlow::Node`.
+ */
+import cpp
+
+module DataFlow {
+ import semmle.code.cpp.dataflow.internal.DataFlowImpl
+}
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/DataFlow2.qll b/cpp/ql/src/semmle/code/cpp/dataflow/DataFlow2.qll
new file mode 100644
index 000000000000..6f6c41ee16c0
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/DataFlow2.qll
@@ -0,0 +1,38 @@
+/**
+ * Provides a `DataFlow2` module, which is a copy of the `DataFlow` module. Use
+ * this class when data-flow configurations must depend on each other. Two
+ * classes extending `DataFlow::Configuration` should never depend on each
+ * other, but one of them should instead depend on a
+ * `DataFlow2::Configuration`, a `DataFlow3::Configuration`, or a
+ * `DataFlow4::Configuration`.
+ *
+ * See `semmle.code.cpp.dataflow.DataFlow` for the full documentation.
+ */
+import cpp
+
+module DataFlow2 {
+ import semmle.code.cpp.dataflow.internal.DataFlowImpl2
+
+ /**
+ * This class exists to prevent mutual recursion between the user-overridden
+ * member predicates of `Configuration` and the rest of the data-flow library.
+ * Good performance cannot be guaranteed in the presence of such recursion, so
+ * it should be replaced by using more than one copy of the data flow library.
+ * Four copies are available: `DataFlow` through `DataFlow4`.
+ */
+ private abstract
+ class ConfigurationRecursionPrevention extends Configuration {
+ bindingset[this]
+ ConfigurationRecursionPrevention() { any() }
+
+ override predicate hasFlow(Node source, Node sink) {
+ strictcount(Node n | this.isSource(n)) < 0
+ or
+ strictcount(Node n | this.isSink(n)) < 0
+ or
+ strictcount(Node n1, Node n2 | this.isAdditionalFlowStep(n1, n2)) < 0
+ or
+ super.hasFlow(source, sink)
+ }
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/DataFlow3.qll b/cpp/ql/src/semmle/code/cpp/dataflow/DataFlow3.qll
new file mode 100644
index 000000000000..77385b2dbe5c
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/DataFlow3.qll
@@ -0,0 +1,38 @@
+/**
+ * Provides a `DataFlow3` module, which is a copy of the `DataFlow` module. Use
+ * this class when data-flow configurations must depend on each other. Two
+ * classes extending `DataFlow::Configuration` should never depend on each
+ * other, but one of them should instead depend on a
+ * `DataFlow2::Configuration`, a `DataFlow3::Configuration`, or a
+ * `DataFlow4::Configuration`.
+ *
+ * See `semmle.code.cpp.dataflow.DataFlow` for the full documentation.
+ */
+import cpp
+
+module DataFlow3 {
+ import semmle.code.cpp.dataflow.internal.DataFlowImpl3
+
+ /**
+ * This class exists to prevent mutual recursion between the user-overridden
+ * member predicates of `Configuration` and the rest of the data-flow library.
+ * Good performance cannot be guaranteed in the presence of such recursion, so
+ * it should be replaced by using more than one copy of the data flow library.
+ * Four copies are available: `DataFlow` through `DataFlow4`.
+ */
+ private abstract
+ class ConfigurationRecursionPrevention extends Configuration {
+ bindingset[this]
+ ConfigurationRecursionPrevention() { any() }
+
+ override predicate hasFlow(Node source, Node sink) {
+ strictcount(Node n | this.isSource(n)) < 0
+ or
+ strictcount(Node n | this.isSink(n)) < 0
+ or
+ strictcount(Node n1, Node n2 | this.isAdditionalFlowStep(n1, n2)) < 0
+ or
+ super.hasFlow(source, sink)
+ }
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/DataFlow4.qll b/cpp/ql/src/semmle/code/cpp/dataflow/DataFlow4.qll
new file mode 100644
index 000000000000..30b7273f4513
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/DataFlow4.qll
@@ -0,0 +1,38 @@
+/**
+ * Provides a `DataFlow4` module, which is a copy of the `DataFlow` module. Use
+ * this class when data-flow configurations must depend on each other. Two
+ * classes extending `DataFlow::Configuration` should never depend on each
+ * other, but one of them should instead depend on a
+ * `DataFlow2::Configuration`, a `DataFlow3::Configuration`, or a
+ * `DataFlow4::Configuration`.
+ *
+ * See `semmle.code.cpp.dataflow.DataFlow` for the full documentation.
+ */
+import cpp
+
+module DataFlow4 {
+ import semmle.code.cpp.dataflow.internal.DataFlowImpl4
+
+ /**
+ * This class exists to prevent mutual recursion between the user-overridden
+ * member predicates of `Configuration` and the rest of the data-flow library.
+ * Good performance cannot be guaranteed in the presence of such recursion, so
+ * it should be replaced by using more than one copy of the data flow library.
+ * Four copies are available: `DataFlow` through `DataFlow4`.
+ */
+ private abstract
+ class ConfigurationRecursionPrevention extends Configuration {
+ bindingset[this]
+ ConfigurationRecursionPrevention() { any() }
+
+ override predicate hasFlow(Node source, Node sink) {
+ strictcount(Node n | this.isSource(n)) < 0
+ or
+ strictcount(Node n | this.isSink(n)) < 0
+ or
+ strictcount(Node n1, Node n2 | this.isAdditionalFlowStep(n1, n2)) < 0
+ or
+ super.hasFlow(source, sink)
+ }
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/EscapesTree.qll b/cpp/ql/src/semmle/code/cpp/dataflow/EscapesTree.qll
new file mode 100644
index 000000000000..4f9474e2efc6
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/EscapesTree.qll
@@ -0,0 +1,302 @@
+/**
+ * Provides a local analysis for identifying where a variable address or value
+ * may escape an _expression tree_, meaning that it is assigned to a variable,
+ * passed to a function, or similar.
+ */
+private import cpp
+
+/**
+ * Holds if `f` is an instantiation of the `std::move` or `std::forward`
+ * template functions, these functions are essentially casts, so we treat them
+ * as such.
+ */
+private predicate stdIdentityFunction(Function f) {
+ f.getNamespace().getParentNamespace() instanceof GlobalNamespace and
+ f.getNamespace().getName() = "std" and
+ ( f.getName() = "move"
+ or
+ f.getName() = "forward" )
+}
+
+private predicate lvalueToLvalueStepPure(Expr lvalueIn, Expr lvalueOut) {
+ lvalueIn = lvalueOut.(DotFieldAccess).getQualifier().getFullyConverted()
+ or
+ lvalueIn.getConversion() = lvalueOut.(ParenthesisExpr)
+ or
+ // When an object is implicitly converted to a reference to one of its base
+ // classes, it gets two `Conversion`s: there is first an implicit
+ // `CStyleCast` to its base class followed by a `ReferenceToExpr` to a
+ // reference to its base class. Whereas an explicit cast to the base class
+ // would produce an rvalue, which would not be convertible to an lvalue
+ // reference, this implicit cast instead produces an lvalue. The following
+ // case ensures that we propagate the property of being an lvalue through
+ // such casts.
+ lvalueIn.getConversion() = lvalueOut and
+ lvalueOut.(CStyleCast).isImplicit()
+}
+
+private predicate lvalueToLvalueStep(Expr lvalueIn, Expr lvalueOut) {
+ lvalueToLvalueStepPure(lvalueIn, lvalueOut)
+ or
+ // C++ only
+ lvalueIn = lvalueOut.(PrefixCrementOperation).getOperand()
+ .getFullyConverted()
+ or
+ // C++ only
+ lvalueIn = lvalueOut.(Assignment).getLValue().getFullyConverted()
+}
+
+private predicate pointerToLvalueStep(Expr pointerIn, Expr lvalueOut) {
+ pointerIn = lvalueOut.(ArrayExpr).getArrayBase().getFullyConverted()
+ or
+ pointerIn = lvalueOut.(PointerDereferenceExpr)
+ .getOperand().getFullyConverted()
+ or
+ pointerIn = lvalueOut.(PointerFieldAccess).getQualifier().getFullyConverted()
+}
+
+private predicate lvalueToPointerStep(Expr lvalueIn, Expr pointerOut) {
+ lvalueIn.getConversion() = pointerOut.(ArrayToPointerConversion)
+ or
+ lvalueIn = pointerOut.(AddressOfExpr).getOperand().getFullyConverted()
+}
+
+private predicate pointerToPointerStep(Expr pointerIn, Expr pointerOut) {
+ (
+ pointerOut instanceof PointerAddExpr
+ or
+ pointerOut instanceof PointerSubExpr
+ ) and
+ pointerIn = pointerOut.getAChild().getFullyConverted() and
+ pointerIn.getType().getUnspecifiedType() instanceof PointerType
+ or
+ pointerIn = pointerOut.(UnaryPlusExpr).getOperand().getFullyConverted()
+ or
+ pointerIn.getConversion() = pointerOut.(Cast)
+ or
+ pointerIn.getConversion() = pointerOut.(ParenthesisExpr)
+ or
+ pointerIn = pointerOut.(ConditionalExpr).getThen().getFullyConverted()
+ or
+ pointerIn = pointerOut.(ConditionalExpr).getElse().getFullyConverted()
+ or
+ pointerIn = pointerOut.(CommaExpr).getRightOperand().getFullyConverted()
+ or
+ pointerIn = pointerOut.(StmtExpr).getResultExpr().getFullyConverted()
+}
+
+private predicate lvalueToReferenceStep(Expr lvalueIn, Expr referenceOut) {
+ lvalueIn.getConversion() = referenceOut.(ReferenceToExpr)
+}
+
+private predicate referenceToLvalueStep(Expr referenceIn, Expr lvalueOut) {
+ // This probably cannot happen. It would require an expression to be
+ // converted to a reference and back again without an intermediate variable
+ // assignment.
+ referenceIn.getConversion() = lvalueOut.(ReferenceDereferenceExpr)
+}
+
+private predicate referenceToReferenceStep(Expr referenceIn, Expr referenceOut) {
+ referenceOut = any(FunctionCall call |
+ stdIdentityFunction(call.getTarget()) and
+ referenceIn = call.getArgument(0).getFullyConverted()
+ )
+ or
+ referenceIn.getConversion() = referenceOut.(Cast)
+ or
+ referenceIn.getConversion() = referenceOut.(ParenthesisExpr)
+}
+
+private predicate lvalueFromVariableAccess(VariableAccess va, Expr lvalue) {
+ // Base case for non-reference types.
+ lvalue = va and
+ not va.getConversion() instanceof ReferenceDereferenceExpr
+ or
+ // Base case for reference types where we pretend that they are
+ // non-reference types. The type of the target of `va` can be `ReferenceType`
+ // or `FunctionReferenceType`.
+ lvalue = va.getConversion().(ReferenceDereferenceExpr)
+ or
+ // lvalue -> lvalue
+ exists(Expr prev |
+ lvalueFromVariableAccess(va, prev) and
+ lvalueToLvalueStep(prev, lvalue)
+ )
+ or
+ // pointer -> lvalue
+ exists(Expr prev |
+ pointerFromVariableAccess(va, prev) and
+ pointerToLvalueStep(prev, lvalue)
+ )
+ or
+ // reference -> lvalue
+ exists(Expr prev |
+ referenceFromVariableAccess(va, prev) and
+ referenceToLvalueStep(prev, lvalue)
+ )
+}
+
+private predicate pointerFromVariableAccess(VariableAccess va, Expr pointer) {
+ // pointer -> pointer
+ exists(Expr prev |
+ pointerFromVariableAccess(va, prev) and
+ pointerToPointerStep(prev, pointer)
+ )
+ or
+ // lvalue -> pointer
+ exists(Expr prev |
+ lvalueFromVariableAccess(va, prev) and
+ lvalueToPointerStep(prev, pointer)
+ )
+}
+
+private predicate referenceFromVariableAccess(VariableAccess va, Expr reference) {
+ // reference -> reference
+ exists(Expr prev |
+ referenceFromVariableAccess(va, prev) and
+ referenceToReferenceStep(prev, reference)
+ )
+ or
+ // lvalue -> reference
+ exists(Expr prev |
+ lvalueFromVariableAccess(va, prev) and
+ lvalueToReferenceStep(prev, reference)
+ )
+}
+
+private predicate valueMayEscapeAt(Expr e) {
+ exists(Call call |
+ e = call.getAnArgument().getFullyConverted() and
+ not stdIdentityFunction(call.getTarget())
+ )
+ or
+ exists(AssignExpr assign | e = assign.getRValue().getFullyConverted())
+ or
+ exists(Initializer init | e = init.getExpr().getFullyConverted())
+ or
+ exists(ConstructorFieldInit init | e = init.getExpr().getFullyConverted())
+ or
+ exists(ReturnStmt ret | e = ret.getExpr().getFullyConverted())
+ or
+ exists(ThrowExpr throw | e = throw.getExpr().getFullyConverted())
+ or
+ exists(AggregateLiteral agg | e = agg.getAChild().getFullyConverted())
+ or
+ exists(AsmStmt asm | e = asm.getAChild().(Expr).getFullyConverted())
+}
+
+private predicate valueMayEscapeMutablyAt(Expr e) {
+ valueMayEscapeAt(e) and
+ exists(Type t | t = e.getType().getUnderlyingType() |
+ exists(PointerType pt |
+ pt = t
+ or
+ pt = t.(SpecifiedType).getBaseType()
+ |
+ not pt.getBaseType().isConst()
+ )
+ or
+ t instanceof ReferenceType and
+ not t.(ReferenceType).getBaseType().isConst()
+ )
+}
+
+private
+predicate addressFromVariableAccess(VariableAccess va, Expr e) {
+ pointerFromVariableAccess(va, e)
+ or
+ referenceFromVariableAccess(va, e)
+ or
+ // `e` could be a pointer that is converted to a reference as the final step,
+ // meaning that we pass a value that is two dereferences away from referring
+ // to `va`. This happens, for example, with `void std::vector::push_back(T&&
+ // value);` when called as `v.push_back(&x)`, for a static variable `x`. It
+ // can also happen when taking a reference to a const pointer to a
+ // (potentially non-const) value.
+ exists(Expr pointerValue |
+ pointerFromVariableAccess(va, pointerValue) and
+ e = pointerValue.getConversion().(ReferenceToExpr)
+ )
+}
+
+import EscapesTree_Cached
+private cached module EscapesTree_Cached {
+ /**
+ * Holds if `e` is a fully-converted expression that evaluates to an address
+ * derived from the address of `va` and is stored in a variable or passed
+ * across functions. This means `e` is the `Expr.getFullyConverted`-form of:
+ *
+ * - The right-hand side of an assignment or initialization;
+ * - A function argument or return value;
+ * - The argument to `throw`.
+ * - An entry in an `AggregateLiteral`, including the compiler-generated
+ * `ClassAggregateLiteral` that initializes a `LambdaExpression`; or
+ * - An expression in an inline assembly statement.
+ *
+ * This predicate includes pointers or reference to `const` types. See
+ * `variableAddressEscapesTreeNonConst` for a version of this predicate that
+ * does not.
+ *
+ * If `va` has reference type, the escape analysis concerns the value pointed
+ * to by the reference rather than the reference itself. The C++ language does
+ * not allow taking the address of a reference in any way, so this predicate
+ * would never produce any results for the reference itself. Callers that are
+ * not interested in the value referred to by references should exclude
+ * variable accesses to reference-typed values.
+ */
+ cached predicate variableAddressEscapesTree(VariableAccess va, Expr e) {
+ valueMayEscapeAt(e) and
+ addressFromVariableAccess(va, e)
+ }
+
+ /**
+ * Holds if `e` is a fully-converted expression that evaluates to a non-const
+ * address derived from the address of `va` and is stored in a variable or
+ * passed across functions. This means `e` is the `Expr.getFullyConverted`-form
+ * of:
+ *
+ * - The right-hand side of an assignment or initialization;
+ * - A function argument or return value;
+ * - The argument to `throw`.
+ * - An entry in an `AggregateLiteral`, including the compiler-generated
+ * `ClassAggregateLiteral` that initializes a `LambdaExpression`; or
+ * - An expression in an inline assembly statement.
+ *
+ * This predicate omits pointers or reference to `const` types. See
+ * `variableAddressEscapesTree` for a version of this predicate that includes
+ * those.
+ *
+ * If `va` has reference type, the escape analysis concerns the value pointed
+ * to by the reference rather than the reference itself. The C++ language
+ * offers no way to take the address of a reference, so this predicate will
+ * never produce any results for the reference itself. Callers that are not
+ * interested in the value referred to by references should exclude variable
+ * accesses to reference-typed values.
+ */
+ cached predicate variableAddressEscapesTreeNonConst(VariableAccess va, Expr e) {
+ valueMayEscapeMutablyAt(e) and
+ addressFromVariableAccess(va, e)
+ }
+
+ /**
+ * Holds if `e` is a fully-converted expression that evaluates to an lvalue
+ * derived from `va` and is used for reading from or assigning to. This is in
+ * contrast with a variable access that is used for taking an address (`&x`)
+ * or simply discarding its value (`x;`).
+ *
+ * This analysis does not propagate across assignments or calls. The analysis
+ * is also not concerned with whether the lvalue `e` is converted to an rvalue
+ * -- to examine that, use the relevant member predicates on `Expr`.
+ *
+ * If `va` has reference type, the analysis concerns the value pointed to by
+ * the reference rather than the reference itself. The expression `e` may be a
+ * `Conversion`.
+ */
+ cached predicate variableAccessedAsValue(VariableAccess va, Expr e) {
+ lvalueFromVariableAccess(va, e) and
+ not lvalueToLvalueStepPure(e, _) and
+ not lvalueToPointerStep(e, _) and
+ not lvalueToReferenceStep(e, _) and
+ not e = any(ExprInVoidContext eivc | e = eivc.getConversion*())
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/RecursionPrevention.qll b/cpp/ql/src/semmle/code/cpp/dataflow/RecursionPrevention.qll
new file mode 100644
index 000000000000..75f22a077fd5
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/RecursionPrevention.qll
@@ -0,0 +1,34 @@
+/**
+ * When this module is imported, recursive use of `DataFlow::Configuration` is
+ * disallowed. Importing this module will guarantee the absence of such
+ * recursion, which is unsupported and will be unconditionally disallowed in a
+ * future release.
+ *
+ * Recursive use of `DataFlow{2..4}::Configuration` is always disallowed, so no
+ * import is needed for those.
+ */
+import cpp
+private import semmle.code.cpp.dataflow.DataFlow
+
+/**
+ * This class exists to prevent mutual recursion between the user-overridden
+ * member predicates of `Configuration` and the rest of the data-flow library.
+ * Good performance cannot be guaranteed in the presence of such recursion, so
+ * it should be replaced by using more than one copy of the data flow library.
+ * Four copies are available: `DataFlow` through `DataFlow4`.
+ */
+private abstract
+class ConfigurationRecursionPrevention extends DataFlow::Configuration {
+ bindingset[this]
+ ConfigurationRecursionPrevention() { any() }
+
+ override predicate hasFlow(DataFlow::Node source, DataFlow::Node sink) {
+ strictcount(DataFlow::Node n | this.isSource(n)) < 0
+ or
+ strictcount(DataFlow::Node n | this.isSink(n)) < 0
+ or
+ strictcount(DataFlow::Node n1, DataFlow::Node n2 | this.isAdditionalFlowStep(n1, n2)) < 0
+ or
+ super.hasFlow(source, sink)
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/StackAddress.qll b/cpp/ql/src/semmle/code/cpp/dataflow/StackAddress.qll
new file mode 100644
index 000000000000..d696df934770
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/StackAddress.qll
@@ -0,0 +1,304 @@
+/**
+ * Provides utilities for determining which expressions contain
+ * stack addresses.
+ */
+import cpp
+import semmle.code.cpp.controlflow.SSA
+
+/**
+ * A stack address flows to `use`.
+ * The simplest case is when `use` is the expression `&var`, but
+ * assignments are also handled. For example:
+ *
+ * x = &var;
+ * y = x;
+ * ...y... // use of &var
+ *
+ * `useType` is the type of data which we believe was allocated on the
+ * stack. It is particularly important when dealing with pointers. Consider
+ * this example:
+ *
+ * int x[10];
+ * int *y = new int[10];
+ * ... = &x[1];
+ * ... = &y[1];
+ *
+ * In this example, x and y are both stack variables. But &x[1] is a
+ * pointer to the stack and &y[1] is a pointer to the heap. The difference
+ * is that the type of x is int[10], but the type of y is int*. This
+ * information is stored in `useType`.
+ *
+ * `source` is the origin of the stack address. It is only used to improve
+ * the quality of the error messages.
+ *
+ * `isLocal` is true if the stack address came from the current
+ * function. It is false if the stack address arrived via a function
+ * parameter. This information is only used to improve the quality of the
+ * error messages.
+ */
+predicate stackPointerFlowsToUse(
+ Expr use, Type useType, Expr source, boolean isLocal) {
+ // Arrays in C are convertible to pointers. For example, if the type of x
+ // is int[10] then it is convertible to int*. The same rule applies to
+ // multidimensional arrays: if the type of y is int[2][3][4], then it is
+ // convertible to int(*)[3][4]. This conversion is what happens under the
+ // hood when we index an array. For example, x[5] is equivalent to
+ // *(x+5), so x is first converted to a pointer and then the pointer
+ // arithmetic is applied to the pointer.
+ exists (ArrayType arrayType
+ | stackReferenceFlowsToUse(use, arrayType, source, isLocal) and
+ useType = getExprPtrType(use.getConversion()).getBaseType())
+ or
+ // Address of: &x
+ stackReferenceFlowsToUse(
+ use.(AddressOfExpr).getOperand(), useType, source, isLocal)
+ or
+ // Pointer subtract: if p is a pointer to a stack address, then p-1 is
+ // too.
+ stackPointerFlowsToUse(
+ use.(PointerSubExpr).getLeftOperand(), useType, source, isLocal)
+ or
+ // Pointer add: if p is a pointer to a stack address, then p+1 is too.
+ stackPointerFlowsToUse(
+ use.(PointerAddExpr).getAnOperand(), useType, source, isLocal)
+ or
+ // Indirect use of a stack address.
+ exists (SsaDefinition def, LocalScopeVariable var
+ | stackPointerFlowsToDef(def, var, useType, source, isLocal) and
+ use = def.getAUse(var))
+ or
+ // Use of a stack address which arrived via one of the function's
+ // parameters. We do not use the original pointer source here because it
+ // could lead to an extremely large number of results if the function has
+ // many callers. Instead we set `source` to the use of the parameter.
+ exists (SsaDefinition def, Parameter param
+ | pointerParamFlowsToDef(def, param, useType) and
+ use = def.getAUse(param) and
+ source = use and
+ isLocal = false)
+ or
+ // Similar to the parameter case above. If a member function is called
+ // on an object which is allocated on the stack, then the "this" pointer
+ // contains a stack address.
+ exists (ThisExpr thisExpr
+ | use = thisExpr and
+ memberFcnMightRunOnStack(thisExpr.getEnclosingFunction(), useType) and
+ source = use and
+ isLocal = false)
+}
+
+/**
+ * Helper function for stackPointerFlowsToUse. Gets the type of a pointer
+ * expression.
+ */
+cached private PointerType getExprPtrType(Expr use) {
+ result = use.getType().getUnspecifiedType()
+}
+
+predicate stackReferenceFlowsToUse(
+ Expr use, Type useType, Expr source, boolean isLocal) {
+ // Stack variables
+ exists (LocalScopeVariable var
+ | not var.isStatic() and
+ use = source and
+ source = var.getAnAccess() and
+ isLocal = true and
+
+ // If the type of the variable is a reference type, such as int&, then
+ // we need to look at its definition to determine whether it contains a
+ // stack reference. This is handled by stackReferenceFlowsToDef, below.
+ not isReferenceVariable(var) and
+
+ // There is a subtlety relating to ArrayType which is hidden by the
+ // simplicity of the line below. Consider this example:
+ //
+ // int arraytest(int p[3][4][5]) {
+ // int x[3][4][5] = { ... };
+ // return x[1][2][3] + p[1][2][3];
+ // }
+ //
+ // The types of `x` and `p` are the same, but `x` is stack allocated
+ // and `p` is not. So we want `useType` to be an ArrayType for `x` and
+ // a PointerType for `p`. Luckily, this conversion happens
+ // automatically when the variable is used. So we get the correct type
+ // provided that we get it from `use` rather than from `var`.
+ useType = use.getType().getUnspecifiedType())
+ or
+ // Accessing the field of a class, struct, or union.
+ exists (FieldAccess access, Class classType
+ | use = access and useType = access.getType().getUnspecifiedType()
+ | // Handle both x.f and x->f:
+ stackReferenceFlowsToUse(access.getQualifier(), classType, source, isLocal) or
+ stackPointerFlowsToUse(access.getQualifier(), classType, source, isLocal))
+ or
+ // Array indexing: x[i].
+ // Note that array types are converted to pointers in
+ // stackPointerFlowsToUse.
+ stackPointerFlowsToUse(
+ use.(ArrayExpr).getArrayBase(), useType, source, isLocal)
+ or
+ // Pointer dereference: *x
+ stackPointerFlowsToUse(
+ use.(PointerDereferenceExpr).getOperand(), useType, source, isLocal)
+ or
+ // Indirect use of a stack reference, via a reference variable.
+ exists (SsaDefinition def, LocalScopeVariable var
+ | stackReferenceFlowsToDef(def, var, useType, source, isLocal) and
+ use = def.getAUse(var))
+ or
+ // Use of a stack reference which arrived via one of the function's
+ // parameters. We do not use the original reference source here because
+ // it could lead to an extremely large number of results if the function
+ // has many callers. Instead we set `source` to the use of the parameter.
+ exists (SsaDefinition def, Parameter param
+ | referenceParamFlowsToDef(def, param, useType) and
+ use = def.getAUse(param) and
+ source = use and
+ isLocal = false)
+}
+
+/**
+ * Helper predicate for stackPointerFlowsToUse. Tracks the flow of stack
+ * addresses through SSA definitions.
+ */
+predicate stackPointerFlowsToDef(
+ SsaDefinition def, LocalScopeVariable var,
+ Type useType, Expr source, boolean isLocal) {
+ stackPointerFlowsToUse(
+ def.getDefiningValue(var), useType, source, isLocal)
+ or
+ // Increment/decrement operators.
+ exists (VariableAccess access
+ | access = def.(CrementOperation).getOperand() and
+ var = access.getTarget() and
+ stackPointerFlowsToUse(access, useType, source, isLocal))
+ or
+ // Transitive closure over phi definitions.
+ stackPointerFlowsToDef(
+ def.getAPhiInput(var), var, useType, source, isLocal)
+}
+
+/**
+ * Helper predicate for stackPointerFlowsToUse. Tracks the flow of stack
+ * references through SSA definitions. This predicate is almost identical
+ * to stackPointerFlowsToDef, except it handles references types, such as
+ * int&, rather than pointers.
+ */
+predicate stackReferenceFlowsToDef(
+ SsaDefinition def, LocalScopeVariable var,
+ Type useType, Expr source, boolean isLocal) {
+ // Check that the type of the variable is a reference type and delegate
+ // the rest of the work to stackReferenceFlowsToDef_Impl.
+ isReferenceVariable(var) and
+ stackReferenceFlowsToDef_Impl(def, var, useType, source, isLocal)
+}
+
+/**
+ * stackReferenceFlowsToDef delegates most of the work to this
+ * predicate.
+ */
+predicate stackReferenceFlowsToDef_Impl(
+ SsaDefinition def, LocalScopeVariable var,
+ Type useType, Expr source, boolean isLocal) {
+ stackReferenceFlowsToUse(
+ def.getDefiningValue(var), useType, source, isLocal)
+ or
+ // Increment/decrement operators.
+ exists (VariableAccess access
+ | access = def.(CrementOperation).getOperand() and
+ var = access.getTarget() and
+ stackReferenceFlowsToUse(access, useType, source, isLocal))
+ or
+ // Transitive closure over phi definitions.
+ stackReferenceFlowsToDef(
+ def.getAPhiInput(var), var, useType, source, isLocal)
+}
+
+/** The type of the variable is a reference type, such as int&. */
+predicate isReferenceVariable(LocalScopeVariable var) {
+ var.getType().getUnspecifiedType() instanceof ReferenceType
+}
+
+/**
+ * Helper predicate for stackPointerFlowsToUse. Tracks the flow of stack
+ * addresses which arrived through one of the function's parameters. This
+ * predicate is very similar to stackPointerFlowsToDef but they cannot be
+ * merged, because we cannot identify a sensible source expression here.
+ */
+predicate pointerParamFlowsToDef(
+ SsaDefinition def, Parameter param, Type useType) {
+ // Only include a parameter definition if we can find a call site which
+ // might pass it a stack address.
+ exists (FunctionCall call
+ | call.getTarget() = param.getFunction() and
+ stackPointerFlowsToUse(
+ call.getArgument(param.getIndex()), useType, _, _) and
+ def.definedByParameter(param))
+ or
+ // Transitive closure over phi definitions.
+ pointerParamFlowsToDef(def.getAPhiInput(param), param, useType)
+}
+
+/**
+ * Helper predicate for stackPointerFlowsToUse. Tracks the flow of stack
+ * addresses which arrived through one of the function's parameters. This
+ * predicate is very similar to stackPointerFlowsToDef but they cannot be
+ * merged, because we cannot identify a sensible source expression here.
+ */
+predicate referenceParamFlowsToDef(
+ SsaDefinition def, Parameter param, Type useType) {
+ // Only include a parameter definition if we can find a call site which
+ // might pass it a stack reference.
+ exists (FunctionCall call
+ | call.getTarget() = param.getFunction() and
+ stackReferenceFlowsToUse(
+ call.getArgument(param.getIndex()), useType, _, _) and
+ def.definedByParameter(param))
+ or
+ // Transitive closure over phi definitions.
+ referenceParamFlowsToDef(def.getAPhiInput(param), param, useType)
+}
+
+/**
+ * Holds if this member function might be called on an object which
+ * is allocated on the stack.
+ */
+predicate memberFcnMightRunOnStack(MemberFunction fcn, Type useType) {
+ exists (FunctionCall call
+ | call.getTarget() = fcn
+ | // Call of the form `x.f()` where `x` is allocated on the stack.
+ stackReferenceFlowsToUse(call.getQualifier(), useType, _, _)
+
+ or
+ // Call of the form `x->f()` where `x` is allocated on the stack.
+ stackPointerFlowsToUse(call.getQualifier(), useType, _, _))
+
+ or
+ // Constructor calls need to be treated as a special case, because
+ // `call.getQualifier()` is empty.
+ (constructorMightRunOnStack(fcn) and
+ useType = fcn.getDeclaringType().getUnspecifiedType())
+}
+
+/**
+ * Helper predicate for memberFcnMightRunOnStack. Function calls
+ * to constructors need to be treated as a special case, because
+ * `call.getQualifier()` is empty. Instead, we need to check whether
+ * the constructor is called from an initializer. There are several
+ * kinds of initializers to consider.
+ */
+predicate constructorMightRunOnStack(Constructor constructor) {
+ exists (ConstructorCall call
+ | call.getTarget() = constructor
+ | // Call to a constructor from a stack variable's initializer.
+ exists (LocalScopeVariable var | var.getInitializer().getExpr() = call)
+
+ or
+ // Call to a constructor from another constructor which might
+ // also run on the stack.
+ (constructorMightRunOnStack(call.getEnclosingFunction()) and
+ (call instanceof ConstructorDirectInit or
+ call instanceof ConstructorVirtualInit or
+ call instanceof ConstructorDelegationInit or
+ exists (ConstructorFieldInit init | init.getExpr() = call))))
+}
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/TaintTracking.qll b/cpp/ql/src/semmle/code/cpp/dataflow/TaintTracking.qll
new file mode 100644
index 000000000000..2d8181be9454
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/TaintTracking.qll
@@ -0,0 +1,229 @@
+/**
+ * Provides classes for performing local (intra-procedural) and
+ * global (inter-procedural) taint-tracking analyses.
+ *
+ * We define _taint propagation_ informally to mean that a substantial part of
+ * the information from the source is preserved at the sink. For example, taint
+ * propagates from `x` to `x + 100`, but it does not propagate from `x` to `x >
+ * 100` since we consider a single bit of information to be too little.
+ */
+import semmle.code.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.DataFlow2
+
+module TaintTracking {
+
+ /**
+ * A configuration of interprocedural taint tracking analysis. This defines
+ * sources, sinks, and any other configurable aspect of the analysis. Each
+ * use of the taint tracking library must define its own unique extension of
+ * this abstract class.
+ *
+ * A taint-tracking configuration is a special data flow configuration
+ * (`DataFlow::Configuration`) that allows for flow through nodes that do not
+ * necessarily preserve values but are still relevant from a taint-tracking
+ * perspective. (For example, string concatenation, where one of the operands
+ * is tainted.)
+ *
+ * To create a configuration, extend this class with a subclass whose
+ * characteristic predicate is a unique singleton string. For example, write
+ *
+ * ```
+ * class MyAnalysisConfiguration extends TaintTracking::Configuration {
+ * MyAnalysisConfiguration() { this = "MyAnalysisConfiguration" }
+ * // Override `isSource` and `isSink`.
+ * // Optionally override `isSanitizer`.
+ * // Optionally override `isSanitizerEdge`.
+ * // Optionally override `isAdditionalTaintStep`.
+ * }
+ * ```
+ *
+ * Then, to query whether there is flow between some `source` and `sink`,
+ * write
+ *
+ * ```
+ * exists(MyAnalysisConfiguration cfg | cfg.hasFlow(source, sink))
+ * ```
+ *
+ * Multiple configurations can coexist, but it is unsupported to depend on a
+ * `TaintTracking::Configuration` or a `DataFlow::Configuration` in the
+ * overridden predicates that define sources, sinks, or additional steps.
+ * Instead, the dependency should go to a `TaintTracking::Configuration2` or
+ * a `DataFlow{2,3,4}::Configuration`.
+ */
+ abstract class Configuration extends DataFlow::Configuration {
+ bindingset[this]
+ Configuration() { any() }
+
+ /** Holds if `source` is a taint source. */
+ // overridden to provide taint-tracking specific qldoc
+ abstract override predicate isSource(DataFlow::Node source);
+
+ /** Holds if `sink` is a taint sink. */
+ // overridden to provide taint-tracking specific qldoc
+ abstract override predicate isSink(DataFlow::Node sink);
+
+ /**
+ * Holds if taint should not flow into `node`.
+ */
+ predicate isSanitizer(DataFlow::Node node) { none() }
+
+ /** Holds if data flow from `node1` to `node2` is prohibited. */
+ predicate isSanitizerEdge(DataFlow::Node node1, DataFlow::Node node2) {
+ none()
+ }
+
+ /**
+ * Holds if the additional taint propagation step
+ * from `source` to `target` must be taken into account in the analysis.
+ * This step will only be followed if `target` is not in the `isSanitizer`
+ * predicate.
+ */
+ predicate isAdditionalTaintStep(DataFlow::Node source,
+ DataFlow::Node target)
+ { none() }
+
+ final override
+ predicate isBarrier(DataFlow::Node node) { isSanitizer(node) }
+
+ /** DEPRECATED: use `isSanitizerEdge` instead. */
+ override deprecated
+ predicate isBarrierEdge(DataFlow::Node node1, DataFlow::Node node2) {
+ this.isSanitizerEdge(node1, node2)
+ }
+
+ final override
+ predicate isAdditionalFlowStep(DataFlow::Node source, DataFlow::Node target) {
+ this.isAdditionalTaintStep(source, target)
+ or
+ localTaintStep(source, target)
+ }
+ }
+
+ /**
+ * A taint-tracking configuration that is backed by the `DataFlow2` library
+ * instead of `DataFlow`. Use this class when taint-tracking configurations
+ * or data-flow configurations must depend on each other.
+ *
+ * See `TaintTracking::Configuration` for the full documentation.
+ */
+ abstract class Configuration2 extends DataFlow2::Configuration {
+ bindingset[this]
+ Configuration2() { any() }
+
+ /** Holds if `source` is a taint source. */
+ // overridden to provide taint-tracking specific qldoc
+ abstract override predicate isSource(DataFlow::Node source);
+
+ /** Holds if `sink` is a taint sink. */
+ // overridden to provide taint-tracking specific qldoc
+ abstract override predicate isSink(DataFlow::Node sink);
+
+ /**
+ * Holds if taint should not flow into `node`.
+ */
+ predicate isSanitizer(DataFlow::Node node) { none() }
+
+ /** Holds if data flow from `node1` to `node2` is prohibited. */
+ predicate isSanitizerEdge(DataFlow::Node node1, DataFlow::Node node2) {
+ none()
+ }
+
+ /**
+ * Holds if the additional taint propagation step
+ * from `source` to `target` must be taken into account in the analysis.
+ * This step will only be followed if `target` is not in the `isSanitizer`
+ * predicate.
+ */
+ predicate isAdditionalTaintStep(DataFlow::Node source,
+ DataFlow::Node target)
+ { none() }
+
+ final override
+ predicate isBarrier(DataFlow::Node node) { isSanitizer(node) }
+
+ /** DEPRECATED: use `isSanitizerEdge` instead. */
+ override deprecated
+ predicate isBarrierEdge(DataFlow::Node node1, DataFlow::Node node2) {
+ this.isSanitizerEdge(node1, node2)
+ }
+
+ final override
+ predicate isAdditionalFlowStep(DataFlow::Node source, DataFlow::Node target) {
+ this.isAdditionalTaintStep(source, target)
+ or
+ localTaintStep(source, target)
+ }
+ }
+
+ /**
+ * Holds if taint propagates from `nodeFrom` to `nodeTo` in exactly one local
+ * (intra-procedural) step.
+ */
+ predicate localTaintStep(DataFlow::Node nodeFrom, DataFlow::Node nodeTo) {
+ // Taint can flow into using ordinary data flow.
+ DataFlow::localFlowStep(nodeFrom, nodeTo)
+ or
+ // Taint can flow through expressions that alter the value but preserve
+ // more than one bit of it _or_ expressions that follow data through
+ // pointer indirections.
+ exists(Expr exprFrom, Expr exprTo |
+ exprFrom = nodeFrom.asExpr() and
+ exprTo = nodeTo.asExpr()
+ |
+ exprFrom = exprTo.getAChild() and
+ not noParentExprFlow(exprFrom, exprTo) and
+ not noFlowFromChildExpr(exprTo)
+ or
+ // Taint can flow from the `x` variable in `x++` to all subsequent
+ // accesses to the unmodified `x` variable.
+ //
+ // `DataFlow` without taint specifies flow from `++x` and `x += 1` into the
+ // variable `x` and thus into subsequent accesses because those expressions
+ // compute the same value as `x`. This is not the case for `x++`, which
+ // computes a different value, so we have to add that ourselves for taint
+ // tracking. The flow from expression `x` into `x++` etc. is handled in the
+ // case above.
+ exprTo = DataFlow::getAnAccessToAssignedVariable(
+ exprFrom.(PostfixCrementOperation)
+ )
+ )
+ }
+
+ /**
+ * Holds if taint may propagate from `source` to `sink` in zero or more local
+ * (intra-procedural) steps.
+ */
+ predicate localTaint(DataFlow::Node source, DataFlow::Node sink) {
+ localTaintStep*(source, sink)
+ }
+
+ /**
+ * Holds if we do not propagate taint from `fromExpr` to `toExpr`
+ * even though `toExpr` is the AST parent of `fromExpr`.
+ */
+ private predicate noParentExprFlow(Expr fromExpr, Expr toExpr) {
+ fromExpr = toExpr.(ConditionalExpr).getCondition()
+ or
+ fromExpr = toExpr.(CommaExpr).getLeftOperand()
+ or
+ fromExpr = toExpr.(AssignExpr).getLValue() // LHS of `=`
+ }
+
+ /**
+ * Holds if we do not propagate taint from a child of `e` to `e` itself.
+ */
+ private predicate noFlowFromChildExpr(Expr e) {
+ e instanceof ComparisonOperation
+ or
+ e instanceof LogicalAndExpr
+ or
+ e instanceof LogicalOrExpr
+ or
+ e instanceof Call
+ or
+ e instanceof SizeofOperator
+ or
+ e instanceof AlignofOperator
+ }
+
+}
\ No newline at end of file
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowDispatch.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowDispatch.qll
new file mode 100644
index 000000000000..8beb2c5d319a
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowDispatch.qll
@@ -0,0 +1,60 @@
+private import cpp
+private import DataFlowPrivate
+
+Function viableImpl(MethodAccess ma) {
+ result = ma.getTarget()
+}
+
+Function viableCallable(Call call) {
+ result = call.getTarget()
+}
+
+/**
+ * Holds if the call context `ctx` reduces the set of viable dispatch
+ * targets of `ma` in `c`.
+ */
+predicate reducedViableImplInCallContext(MethodAccess ma, Callable c, Call ctx) {
+ none()
+}
+
+/**
+ * Gets a viable dispatch target of `ma` in the context `ctx`. This is
+ * restricted to those `ma`s for which a context might make a difference.
+ */
+private Method viableImplInCallContext(MethodAccess ma, Call ctx) {
+ // stub implementation
+ result = viableImpl(ma) and
+ viableCallable(ctx) = ma.getEnclosingFunction()
+}
+
+/**
+ * Gets a viable dispatch target of `ma` in the context `ctx`. This is
+ * restricted to those `ma`s for which the context makes a difference.
+ */
+Method prunedViableImplInCallContext(MethodAccess ma, Call ctx) {
+ result = viableImplInCallContext(ma, ctx) and
+ reducedViableImplInCallContext(ma, _, ctx)
+}
+
+/**
+ * Holds if flow returning from `m` to `ma` might return further and if
+ * this path restricts the set of call sites that can be returned to.
+ */
+predicate reducedViableImplInReturn(Method m, MethodAccess ma) {
+ exists(int tgts, int ctxtgts |
+ m = viableImpl(ma) and
+ ctxtgts = count(Call ctx | m = viableImplInCallContext(ma, ctx)) and
+ tgts = strictcount(Call ctx | viableCallable(ctx) = ma.getEnclosingFunction()) and
+ ctxtgts < tgts
+ )
+}
+
+/**
+ * Gets a viable dispatch target of `ma` in the context `ctx`. This is
+ * restricted to those `ma`s and results for which the return flow from the
+ * result to `ma` restricts the possible context `ctx`.
+ */
+Method prunedViableImplInCallContextReverse(MethodAccess ma, Call ctx) {
+ result = viableImplInCallContext(ma, ctx) and
+ reducedViableImplInReturn(result, ma)
+}
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll
new file mode 100644
index 000000000000..142ea7f8a7e9
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll
@@ -0,0 +1,1536 @@
+/**
+ * Provides an implementation of global (interprocedural) data flow. This file
+ * re-exports the local (intraprocedural) data flow analysis from `DataFlowUtil`
+ * and adds a global analysis, mainly exposed through the `Configuration` class.
+ * This file exists in several identical copies, allowing queries to use
+ * multiple `Configuration` classes that depend on each other without
+ * introducing mutual recursion among those configurations.
+ */
+
+ import DataFlowUtil
+ private import DataFlowPrivate
+ private import DataFlowDispatch
+ private import DataFlowImplCommon
+
+
+ /**
+ * A configuration of interprocedural data flow analysis. This defines
+ * sources, sinks, and any other configurable aspect of the analysis. Each
+ * use of the global data flow library must define its own unique extension
+ * of this abstract class. To create a configuration, extend this class with
+ * a subclass whose characteristic predicate is a unique singleton string.
+ * For example, write
+ *
+ * ```
+ * class MyAnalysisConfiguration extends DataFlow::Configuration {
+ * MyAnalysisConfiguration() { this = "MyAnalysisConfiguration" }
+ * // Override `isSource` and `isSink`.
+ * // Optionally override `isBarrier`.
+ * // Optionally override `isAdditionalFlowStep`.
+ * }
+ * ```
+ *
+ * Then, to query whether there is flow between some `source` and `sink`,
+ * write
+ *
+ * ```
+ * exists(MyAnalysisConfiguration cfg | cfg.hasFlow(source, sink))
+ * ```
+ *
+ * Multiple configurations can coexist, but two classes extending
+ * `DataFlow::Configuration` should never depend on each other. One of them
+ * should instead depend on a `DataFlow2::Configuration`, a
+ * `DataFlow3::Configuration`, or a `DataFlow4::Configuration`.
+ */
+ abstract class Configuration extends string {
+ bindingset[this]
+ Configuration() { any() }
+
+ /**
+ * Holds if `source` is a relevant data flow source.
+ */
+ abstract predicate isSource(Node source);
+
+ /**
+ * Holds if `sink` is a relevant data flow sink.
+ */
+ abstract predicate isSink(Node sink);
+
+ /** Holds if data flow through `node` is prohibited. */
+ predicate isBarrier(Node node) { none() }
+
+ /** Holds if data flow from `node1` to `node2` is prohibited. */
+ predicate isBarrierEdge(Node node1, Node node2) { none() }
+
+ /**
+ * Holds if the additional flow step from `node1` to `node2` must be taken
+ * into account in the analysis.
+ */
+ predicate isAdditionalFlowStep(Node node1, Node node2) { none() }
+
+ /**
+ * Gets the virtual dispatch branching limit when calculating field flow.
+ * This can be overridden to a smaller value to improve performance (a
+ * value of 0 disables field flow), or a larger value to get more results.
+ */
+ int fieldFlowBranchLimit() { result = 2 }
+
+ /**
+ * Holds if data may flow from `source` to `sink` for this configuration.
+ */
+ predicate hasFlow(Node source, Node sink) {
+ flowsTo(source, sink, this)
+ }
+
+ /**
+ * Holds if data may flow from `source` to `sink` for this configuration.
+ *
+ * The corresponding paths are generated from the end-points and the graph
+ * included in the module `PathGraph`.
+ */
+ predicate hasFlowPath(PathNode source, PathNode sink) {
+ flowsTo(source, sink, _, _, this)
+ }
+
+ /**
+ * Holds if data may flow from some source to `sink` for this configuration.
+ */
+ predicate hasFlowTo(Node sink) {
+ hasFlow(_, sink)
+ }
+
+ /**
+ * Holds if data may flow from some source to `sink` for this configuration.
+ */
+ predicate hasFlowToExpr(Expr sink) {
+ hasFlowTo(exprNode(sink))
+ }
+
+ /** DEPRECATED: use `hasFlow` instead. */
+ deprecated predicate hasFlowForward(Node source, Node sink) {
+ hasFlow(source, sink)
+ }
+
+ /** DEPRECATED: use `hasFlow` instead. */
+ deprecated predicate hasFlowBackward(Node source, Node sink) {
+ hasFlow(source, sink)
+ }
+ }
+
+ /**
+ * Holds if the additional step from `node1` to `node2` jumps between callables.
+ */
+ private predicate additionalJumpStep(Node node1, Node node2, Configuration config) {
+ config.isAdditionalFlowStep(node1, node2) and
+ node1.getEnclosingCallable() != node2.getEnclosingCallable()
+ }
+
+ pragma[noinline]
+ private predicate isAdditionalFlowStep(Node node1, Node node2, Callable callable1, Callable callable2, Configuration config) {
+ config.isAdditionalFlowStep(node1, node2) and
+ callable1 = node1.getEnclosingCallable() and
+ callable2 = node2.getEnclosingCallable()
+ }
+
+ /**
+ * Holds if the additional step from `node1` to `node2` does not jump between callables.
+ */
+ private predicate additionalLocalFlowStep(Node node1, Node node2, Configuration config) {
+ exists(Callable callable |
+ isAdditionalFlowStep(node1, node2, callable, callable, config)
+ )
+ }
+
+ /**
+ * Holds if data can flow from `node1` to `node2` through a static field or
+ * variable capture.
+ */
+ private predicate jumpStep(Node node1, Node node2, boolean preservesValue, Configuration config) {
+ jumpStep(node1, node2) and preservesValue = true or
+ additionalJumpStep(node1, node2, config) and preservesValue = false
+ }
+
+ /**
+ * Holds if data can flow in one local step from `node1` to `node2` taking
+ * additional steps from the configuration into account.
+ */
+ private predicate localFlowStep(Node node1, Node node2, boolean preservesValue, Configuration config) {
+ localFlowStep(node1, node2) and not config.isBarrierEdge(node1, node2) and preservesValue = true or
+ additionalLocalFlowStep(node1, node2, config) and preservesValue = false
+ }
+
+ pragma[noinline]
+ private Method returnNodeGetEnclosingCallable(ReturnNode ret) {
+ result = ret.getEnclosingCallable()
+ }
+
+ /**
+ * Holds if field flow should be used for the given configuration.
+ */
+ private predicate useFieldFlow(Configuration config) {
+ config.fieldFlowBranchLimit() >= 1
+ }
+
+ /**
+ * Holds if `node` is reachable from a source in the given configuration
+ * ignoring call contexts.
+ */
+ private predicate nodeCandFwd1(Node node, boolean stored, Configuration config) {
+ not config.isBarrier(node) and
+ (
+ config.isSource(node) and stored = false
+ or
+ exists(Node mid, boolean preservesValue |
+ nodeCandFwd1(mid, stored, config) and
+ localFlowStep(mid, node, preservesValue, config) and
+ (stored = false or preservesValue = true)
+ )
+ or
+ exists(Node mid, boolean preservesValue |
+ nodeCandFwd1(mid, stored, config) and
+ jumpStep(mid, node, preservesValue, config) and
+ (stored = false or preservesValue = true)
+ )
+ or
+ // store
+ exists(Node mid |
+ useFieldFlow(config) and
+ nodeCandFwd1(mid, _, config) and
+ store(mid, _, node) and
+ stored = true
+ )
+ or
+ // read
+ exists(Node mid, Content f |
+ nodeCandFwd1(mid, true, config) and
+ read(mid, f, node) and
+ storeCandFwd1(f, unbind(config)) and
+ (stored = false or stored = true)
+ )
+ or
+ // flow into a callable
+ exists(Node arg |
+ nodeCandFwd1(arg, stored, config) and
+ viableParamArg(node, arg)
+ )
+ or
+ // flow out of an argument
+ exists(PostUpdateNode mid, ParameterNode p |
+ nodeCandFwd1(mid, stored, config) and
+ parameterValueFlowsToUpdate(p, mid) and
+ viableParamArg(p, node.(PostUpdateNode).getPreUpdateNode())
+ )
+ or
+ // flow out of a callable
+ exists(Method m, MethodAccess ma, ReturnNode ret |
+ nodeCandFwd1(ret, stored, config) and
+ m = returnNodeGetEnclosingCallable(ret) and
+ m = viableImpl(ma) and
+ node.asExpr() = ma
+ )
+ )
+ }
+
+ /**
+ * Holds if `f` is the target of a store in the flow covered by `nodeCandFwd1`.
+ */
+ private predicate storeCandFwd1(Content f, Configuration config) {
+ exists(Node mid, Node node |
+ not config.isBarrier(node) and
+ useFieldFlow(unbind(config)) and
+ nodeCandFwd1(mid, _, config) and
+ store(mid, f, node)
+ )
+ }
+
+ bindingset[result, b]
+ private boolean unbindBool(boolean b) { result != b.booleanNot() }
+
+ /**
+ * Holds if `node` is part of a path from a source to a sink in the given
+ * configuration ignoring call contexts.
+ */
+ pragma[nomagic]
+ private predicate nodeCand1(Node node, boolean stored, Configuration config) {
+ nodeCandFwd1(node, false, config) and
+ config.isSink(node) and stored = false
+ or
+ nodeCandFwd1(node, unbindBool(stored), unbind(config)) and
+ (
+ exists(Node mid, boolean preservesValue |
+ localFlowStep(node, mid, preservesValue, config) and
+ nodeCand1(mid, stored, config) and
+ (stored = false or preservesValue = true)
+ )
+ or
+ exists(Node mid, boolean preservesValue |
+ jumpStep(node, mid, preservesValue, config) and
+ nodeCand1(mid, stored, config) and
+ (stored = false or preservesValue = true)
+ )
+ or
+ // store
+ exists(Node mid, Content f |
+ store(node, f, mid) and
+ readCand1(f, unbind(config)) and
+ nodeCand1(mid, true, config) and
+ (stored = false or stored = true)
+ )
+ or
+ // read
+ exists(Node mid, Content f |
+ read(node, f, mid) and
+ storeCandFwd1(f, unbind(config)) and
+ nodeCand1(mid, _, config) and
+ stored = true
+ )
+ or
+ // flow into a callable
+ exists(Node param |
+ viableParamArg(param, node) and
+ nodeCand1(param, stored, config)
+ )
+ or
+ // flow out of an argument
+ exists(PostUpdateNode mid, ParameterNode p |
+ parameterValueFlowsToUpdate(p, node) and
+ viableParamArg(p, mid.getPreUpdateNode()) and
+ nodeCand1(mid, stored, config)
+ )
+ or
+ // flow out of a callable
+ exists(Method m, ExprNode ma |
+ nodeCand1(ma, stored, config) and
+ m = returnNodeGetEnclosingCallable(node) and
+ m = viableImpl(ma.getExpr())
+ )
+ )
+ }
+
+ /**
+ * Holds if `f` is the target of a read in the flow covered by `nodeCand1`.
+ */
+ private predicate readCand1(Content f, Configuration config) {
+ exists(Node mid, Node node |
+ useFieldFlow(unbind(config)) and
+ nodeCandFwd1(node, true, unbind(config)) and
+ read(node, f, mid) and
+ storeCandFwd1(f, unbind(config)) and
+ nodeCand1(mid, _, config)
+ )
+ }
+
+ /**
+ * Holds if there is a path from `p` to `node` in the same callable that is
+ * part of a path from a source to a sink taking simple call contexts into
+ * consideration. This is restricted to paths that does not necessarily
+ * preserve the value of `p` by making use of at least one additional step
+ * from the configuration.
+ */
+ pragma[nomagic]
+ private predicate simpleParameterFlow(ParameterNode p, Node node, RefType t, Configuration config) {
+ nodeCand1(node, false, config) and
+ p = node and
+ t = getErasedRepr(node.getType()) and
+ not parameterValueFlowsThrough(p)
+ or
+ nodeCand1(node, false, unbind(config)) and
+ exists(Node mid |
+ simpleParameterFlow(p, mid, t, config) and
+ localFlowStep(mid, node, true, config) and
+ compatibleTypes(t, node.getType())
+ )
+ or
+ nodeCand1(node, false, unbind(config)) and
+ exists(Node mid |
+ simpleParameterFlow(p, mid, _, config) and
+ localFlowStep(mid, node, false, config) and
+ t = getErasedRepr(node.getType())
+ )
+ or
+ nodeCand1(node, false, unbind(config)) and
+ exists(Node mid |
+ simpleParameterFlow(p, mid, t, config) and
+ localStoreReadStep(mid, node) and
+ compatibleTypes(t, node.getType())
+ )
+ or
+ // value flow through a callable
+ nodeCand1(node, false, config) and
+ exists(Node arg |
+ simpleParameterFlow(p, arg, t, config) and
+ argumentValueFlowsThrough(arg, node) and
+ compatibleTypes(t, node.getType())
+ )
+ or
+ // flow through a callable
+ nodeCand1(node, false, config) and
+ exists(Node arg |
+ simpleParameterFlow(p, arg, _, config) and
+ simpleArgumentFlowsThrough(arg, node, t, config)
+ )
+ }
+
+ /**
+ * Holds if data can flow from `arg` through the `call` taking simple call
+ * contexts into consideration and that this is part of a path from a source
+ * to a sink. This is restricted to paths through the `call` that does not
+ * necessarily preserve the value of `arg` by making use of at least one
+ * additional step from the configuration.
+ */
+ private predicate simpleArgumentFlowsThrough(ArgumentNode arg, ExprNode call, RefType t, Configuration config) {
+ exists(ParameterNode param, ReturnNode ret |
+ nodeCand1(arg, false, unbind(config)) and
+ nodeCand1(call, false, unbind(config)) and
+ viableParamArg(param, arg) and
+ simpleParameterFlow(param, ret, t, config) and
+ arg.argumentOf(call.getExpr(), _)
+ )
+ }
+
+ /**
+ * Holds if data can flow from `node1` to `node2` by a step through a method.
+ */
+ private predicate flowThroughMethod(Node node1, Node node2, boolean preservesValue, Configuration config) {
+ simpleArgumentFlowsThrough(node1, node2, _, config) and preservesValue = false or
+ argumentValueFlowsThrough(node1, node2) and preservesValue = true
+ }
+
+ /**
+ * Holds if data can flow from `node1` to `node2` in one local step or a step
+ * through a method.
+ */
+ private predicate localFlowStepOrFlowThroughMethod(Node node1, Node node2, boolean preservesValue, Configuration config) {
+ localFlowStep(node1, node2, preservesValue, config) or
+ flowThroughMethod(node1, node2, preservesValue, config)
+ }
+
+ /**
+ * Holds if data can flow out of a callable from `node1` to `node2`, either
+ * through a `ReturnNode` or through an argument that has been mutated, and
+ * that this step is part of a path from a source to a sink.
+ */
+ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config) {
+ nodeCand1(node1, _, unbind(config)) and
+ nodeCand1(node2, _, config) and
+ (
+ // flow out of an argument
+ exists(ParameterNode p |
+ parameterValueFlowsToUpdate(p, node1) and
+ viableParamArg(p, node2.(PostUpdateNode).getPreUpdateNode())
+ )
+ or
+ // flow out of a method
+ exists(Method m, MethodAccess ma, ReturnNode ret |
+ ret = node1 and
+ m = returnNodeGetEnclosingCallable(ret) and
+ m = viableImpl(ma) and
+ node2.asExpr() = ma
+ )
+ )
+ }
+
+ /**
+ * Holds if data can flow into a callable and that this step is part of a
+ * path from a source to a sink.
+ */
+ private predicate flowIntoCallable(Node node1, Node node2, Configuration config) {
+ viableParamArg(node2, node1) and
+ nodeCand1(node1, _, unbind(config)) and
+ nodeCand1(node2, _, config)
+ }
+
+ /**
+ * Gets the amount of forward branching on the origin of a cross-call path
+ * edge in the graph of paths between sources and sinks that ignores call
+ * contexts.
+ */
+ private int branch(Node n1, Configuration conf) {
+ result = strictcount(Node n | flowOutOfCallable(n1, n, conf) or flowIntoCallable(n1, n, conf))
+ }
+
+ /**
+ * Gets the amount of backward branching on the target of a cross-call path
+ * edge in the graph of paths between sources and sinks that ignores call
+ * contexts.
+ */
+ private int join(Node n2, Configuration conf) {
+ result = strictcount(Node n | flowOutOfCallable(n, n2, conf) or flowIntoCallable(n, n2, conf))
+ }
+
+ /**
+ * Holds if data can flow out of a callable from `node1` to `node2`, either
+ * through a `ReturnNode` or through an argument that has been mutated, and
+ * that this step is part of a path from a source to a sink. The
+ * `allowsFieldFlow` flag indicates whether the branching is within the limit
+ * specified by the configuration.
+ */
+ private predicate flowOutOfCallable(Node node1, Node node2, boolean allowsFieldFlow, Configuration config) {
+ flowOutOfCallable(node1, node2, config) and
+ exists(int b, int j |
+ b = branch(node1, config) and
+ j = join(node2, config) and
+ if b.minimum(j) <= config.fieldFlowBranchLimit() then allowsFieldFlow = true else allowsFieldFlow = false
+ )
+ }
+
+ /**
+ * Holds if data can flow into a callable and that this step is part of a
+ * path from a source to a sink. The `allowsFieldFlow` flag indicates whether
+ * the branching is within the limit specified by the configuration.
+ */
+ private predicate flowIntoCallable(Node node1, Node node2, boolean allowsFieldFlow, Configuration config) {
+ flowIntoCallable(node1, node2, config) and
+ exists(int b, int j |
+ b = branch(node1, config) and
+ j = join(node2, config) and
+ if b.minimum(j) <= config.fieldFlowBranchLimit() then allowsFieldFlow = true else allowsFieldFlow = false
+ )
+ }
+
+ /**
+ * Holds if `node` is part of a path from a source to a sink in the given
+ * configuration taking simple call contexts into consideration.
+ */
+ private predicate nodeCandFwd2(Node node, boolean fromArg, boolean stored, Configuration config) {
+ nodeCand1(node, false, config) and
+ config.isSource(node) and fromArg = false and stored = false
+ or
+ nodeCand1(node, unbindBool(stored), unbind(config)) and
+ (
+ exists(Node mid, boolean preservesValue |
+ nodeCandFwd2(mid, fromArg, stored, config) and
+ localFlowStepOrFlowThroughMethod(mid, node, preservesValue, config) and
+ (stored = false or preservesValue = true)
+ )
+ or
+ exists(Node mid, boolean preservesValue |
+ nodeCandFwd2(mid, _, stored, config) and
+ jumpStep(mid, node, preservesValue, config) and
+ fromArg = false and
+ (stored = false or preservesValue = true)
+ )
+ or
+ // store
+ exists(Node mid, Content f |
+ nodeCandFwd2(mid, fromArg, _, config) and
+ store(mid, f, node) and
+ readCand1(f, unbind(config)) and
+ stored = true
+ )
+ or
+ // read
+ exists(Node mid, Content f |
+ nodeCandFwd2(mid, fromArg, true, config) and
+ read(mid, f, node) and
+ storeCandFwd2(f, unbind(config)) and
+ (stored = false or stored = true)
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ nodeCandFwd2(mid, _, stored, config) and
+ flowIntoCallable(mid, node, allowsFieldFlow, config) and
+ fromArg = true and
+ (stored = false or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ nodeCandFwd2(mid, false, stored, config) and
+ flowOutOfCallable(mid, node, allowsFieldFlow, config) and
+ fromArg = false and
+ (stored = false or allowsFieldFlow = true)
+ )
+ )
+ }
+
+ /**
+ * Holds if `f` is the target of a store in the flow covered by `nodeCandFwd2`.
+ */
+ private predicate storeCandFwd2(Content f, Configuration config) {
+ exists(Node mid, Node node |
+ useFieldFlow(unbind(config)) and
+ nodeCand1(node, true, unbind(config)) and
+ nodeCandFwd2(mid, _, _, config) and
+ store(mid, f, node) and
+ readCand1(f, unbind(config))
+ )
+ }
+
+ /**
+ * Holds if `node` is part of a path from a source to a sink in the given
+ * configuration taking simple call contexts into consideration.
+ */
+ private predicate nodeCand2(Node node, boolean toReturn, boolean stored, Configuration config) {
+ nodeCandFwd2(node, _, false, config) and
+ config.isSink(node) and toReturn = false and stored = false
+ or
+ nodeCandFwd2(node, _, unbindBool(stored), unbind(config)) and
+ (
+ exists(Node mid, boolean preservesValue |
+ localFlowStepOrFlowThroughMethod(node, mid, preservesValue, config) and
+ nodeCand2(mid, toReturn, stored, config) and
+ (stored = false or preservesValue = true)
+ )
+ or
+ exists(Node mid, boolean preservesValue |
+ jumpStep(node, mid, preservesValue, config) and
+ nodeCand2(mid, _, stored, config) and
+ toReturn = false and
+ (stored = false or preservesValue = true)
+ )
+ or
+ // store
+ exists(Node mid, Content f |
+ store(node, f, mid) and
+ readCand2(f, unbind(config)) and
+ nodeCand2(mid, toReturn, true, config) and
+ (stored = false or stored = true)
+ )
+ or
+ // read
+ exists(Node mid, Content f |
+ read(node, f, mid) and
+ storeCandFwd2(f, unbind(config)) and
+ nodeCand2(mid, toReturn, _, config) and
+ stored = true
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowIntoCallable(node, mid, allowsFieldFlow, config) and
+ nodeCand2(mid, false, stored, config) and
+ toReturn = false and
+ (stored = false or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowOutOfCallable(node, mid, allowsFieldFlow, config) and
+ nodeCand2(mid, _, stored, config) and
+ toReturn = true and
+ (stored = false or allowsFieldFlow = true)
+ )
+ )
+ }
+
+ /**
+ * Holds if `f` is the target of a read in the flow covered by `nodeCand2`.
+ */
+ private predicate readCand2(Content f, Configuration config) {
+ exists(Node mid, Node node |
+ useFieldFlow(unbind(config)) and
+ nodeCandFwd2(node, _, true, unbind(config)) and
+ read(node, f, mid) and
+ storeCandFwd2(f, unbind(config)) and
+ nodeCand2(mid, _, _, config)
+ )
+ }
+
+ private predicate storeCand(Content f, Configuration conf) {
+ exists(Node n1, Node n2 |
+ store(n1, f, n2) and
+ nodeCand2(n1, _, _, conf) and
+ nodeCand2(n2, _, _, unbind(conf))
+ )
+ }
+
+ private predicate readCand(Content f, Configuration conf) {
+ readCand2(f, conf)
+ }
+
+ /**
+ * Holds if `f` is the target of both a store and a read in the path graph
+ * covered by `nodeCand2`.
+ */
+ pragma[noinline]
+ private predicate readStoreCand(Content f, Configuration conf) {
+ storeCand(f, conf) and
+ readCand(f, conf)
+ }
+
+ private predicate nodeCand(Node node, Configuration config) {
+ nodeCand2(node, _, _, config)
+ }
+
+ /**
+ * Holds if `node` can be the first node in a maximal subsequence of local
+ * flow steps in a dataflow path.
+ */
+ private predicate localFlowEntry(Node node, Configuration config) {
+ nodeCand(node, config) and
+ (
+ config.isSource(node) or
+ jumpStep(_, node, _, config) or
+ node instanceof ParameterNode or
+ node.asExpr() instanceof MethodAccess or
+ node instanceof PostUpdateNode or
+ read(_, _, node) or
+ node.asExpr() instanceof CastExpr
+ )
+ }
+
+ /**
+ * Holds if `node` can be the last node in a maximal subsequence of local
+ * flow steps in a dataflow path.
+ */
+ private predicate localFlowExit(Node node, Configuration config) {
+ exists(Node next |
+ nodeCand(next, config)
+ |
+ jumpStep(node, next, _, config) or
+ flowIntoCallable(node, next, config) or
+ flowOutOfCallable(node, next, config) or
+ flowThroughMethod(node, next, _, config) or
+ store(node, _, next) or
+ read(node, _, next)
+ ) or
+ node.asExpr() instanceof CastExpr or
+ config.isSink(node)
+ }
+
+ /**
+ * Holds if the local path from `node1` to `node2` is a prefix of a maximal
+ * subsequence of local flow steps in a dataflow path.
+ *
+ * This is the transitive closure of `localFlowStep` beginning at `localFlowEntry`.
+ */
+ private predicate localFlowStepPlus(Node node1, Node node2, boolean preservesValue, Configuration config) {
+ localFlowEntry(node1, config) and
+ localFlowStep(node1, node2, preservesValue, config) and
+ node1 != node2 and
+ nodeCand(node2, unbind(config))
+ or
+ exists(Node mid, boolean pv1, boolean pv2 |
+ localFlowStepPlus(node1, mid, pv1, config) and
+ localFlowStep(mid, node2, pv2, config) and
+ not mid.asExpr() instanceof CastExpr and
+ preservesValue = pv1.booleanAnd(pv2) and
+ nodeCand(node2, unbind(config))
+ )
+ }
+
+ /**
+ * Holds if `node1` can step to `node2` in one or more local steps and this
+ * path can occur as a maximal subsequence of local steps in a dataflow path.
+ */
+ pragma[noinline]
+ private predicate localFlowBigStep(Node node1, Node node2, boolean preservesValue, Configuration config) {
+ localFlowStepPlus(node1, node2, preservesValue, config) and
+ localFlowExit(node2, config)
+ }
+
+ /**
+ * Holds if `f` may contain an object of the same type, `t`, as the one
+ * that contains `f`, and if this fact should be used to compress
+ * access paths.
+ *
+ * Examples include the tail pointer in a linked list or the left and right
+ * pointers in a binary tree.
+ */
+ private predicate selfRef(Content f, RefType t) {
+ t = f.getDeclaringType() and
+ f.isSelfRef()
+ }
+
+ private newtype TFlowContainer =
+ TRegularContent(Content f) { not selfRef(f, _) } or
+ TSelfRefContent(RefType t) { selfRef(_, t) }
+
+ /**
+ * A `Content` or a `Content` abstracted as its declaring type.
+ *
+ * Sequences of one or more `Content`s in the same declaring type for which
+ * `isSelfRef()` holds are represented as a single `FlowContainer` in an
+ * `AccessPath`.
+ */
+ private class FlowContainer extends TFlowContainer {
+ string toString() {
+ exists(Content f | this = TRegularContent(f) and result = f.toString()) or
+ exists(RefType t | this = TSelfRefContent(t) and result = t.toString())
+ }
+ predicate usesContent(Content f) {
+ this = TRegularContent(f) or
+ exists(RefType t | this = TSelfRefContent(t) and selfRef(f, t))
+ }
+ RefType getContainerType() {
+ exists(Content f | this = TRegularContent(f) and result = f.getDeclaringType()) or
+ this = TSelfRefContent(result)
+ }
+ }
+
+ private newtype TAccessPathFront = TFrontNil(Type t) or TFrontHead(FlowContainer f)
+
+ /**
+ * The front of an `AccessPath`. This is either a head or a nil.
+ */
+ private class AccessPathFront extends TAccessPathFront {
+ string toString() {
+ exists(Type t | this = TFrontNil(t) | result = t.toString()) or
+ exists(FlowContainer f | this = TFrontHead(f) | result = f.toString())
+ }
+ Type getType() {
+ this = TFrontNil(result) or
+ exists(FlowContainer head | this = TFrontHead(head) | result = head.getContainerType())
+ }
+ predicate headUsesContent(Content f) {
+ exists(FlowContainer fc |
+ fc.usesContent(f) and
+ this = TFrontHead(fc)
+ )
+ }
+ }
+
+ private class AccessPathFrontNil extends AccessPathFront, TFrontNil {
+ }
+
+ /**
+ * A `Node` at which a cast can occur such that the type should be checked.
+ */
+ private class CastingNode extends Node {
+ CastingNode() {
+ this instanceof ParameterNode or
+ this.asExpr() instanceof CastExpr or
+ this.asExpr() instanceof MethodAccess or
+ this.(PostUpdateNode).getPreUpdateNode() instanceof ArgumentNode
+ }
+ }
+
+ /**
+ * Holds if data can flow from a source to `node` with the given `apf`.
+ */
+ private predicate flowCandFwd(Node node, boolean fromArg, AccessPathFront apf, Configuration config) {
+ flowCandFwd0(node, fromArg, apf, config) and
+ if node instanceof CastingNode then
+ compatibleTypes(node.getType(), apf.getType())
+ else
+ any()
+ }
+ private predicate flowCandFwd0(Node node, boolean fromArg, AccessPathFront apf, Configuration config) {
+ nodeCand2(node, _, false, config) and
+ config.isSource(node) and fromArg = false and apf = TFrontNil(getErasedRepr(node.getType()))
+ or
+ nodeCand(node, unbind(config)) and
+ (
+ exists(Node mid |
+ flowCandFwd(mid, fromArg, apf, config) and
+ localFlowBigStep(mid, node, true, config)
+ )
+ or
+ exists(Node mid, AccessPathFront apf0 |
+ flowCandFwd(mid, fromArg, apf0, config) and
+ localFlowBigStep(mid, node, false, config) and
+ apf0 instanceof AccessPathFrontNil and
+ apf = TFrontNil(getErasedRepr(node.getType()))
+ )
+ or
+ exists(Node mid |
+ flowCandFwd(mid, _, apf, config) and
+ jumpStep(mid, node, true, config) and
+ fromArg = false
+ )
+ or
+ exists(Node mid, AccessPathFront apf0 |
+ flowCandFwd(mid, _, apf0, config) and
+ jumpStep(mid, node, false, config) and
+ fromArg = false and
+ apf0 instanceof AccessPathFrontNil and
+ apf = TFrontNil(getErasedRepr(node.getType()))
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowCandFwd(mid, _, apf, config) and
+ flowIntoCallable(mid, node, allowsFieldFlow, config) and
+ fromArg = true and
+ (apf instanceof AccessPathFrontNil or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowCandFwd(mid, false, apf, config) and
+ flowOutOfCallable(mid, node, allowsFieldFlow, config) and
+ fromArg = false and
+ (apf instanceof AccessPathFrontNil or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean preservesValue, AccessPathFront apf0 |
+ flowCandFwd(mid, fromArg, apf0, config) and
+ flowThroughMethod(mid, node, preservesValue, config) and
+ (preservesValue = true and apf = apf0 or preservesValue = false and apf0 instanceof AccessPathFrontNil and apf = TFrontNil(getErasedRepr(node.getType())))
+ )
+ )
+ or
+ exists(Node mid, Content f |
+ flowCandFwd(mid, fromArg, _, config) and
+ store(mid, f, node) and
+ nodeCand(node, unbind(config)) and
+ apf.headUsesContent(f)
+ )
+ or
+ exists(Node mid, Content f, AccessPathFront apf0 |
+ flowCandFwd(mid, fromArg, apf0, config) and
+ read(mid, f, node) and
+ nodeCand(node, config) and
+ apf0.headUsesContent(f) and
+ consCandFwd(f, apf, unbind(config))
+ )
+ }
+ private predicate consCandFwd(Content f, AccessPathFront apf, Configuration config) {
+ exists(Node mid, Node n |
+ flowCandFwd(mid, _, apf, config) and
+ store(mid, f, n) and
+ nodeCand(n, unbind(config)) and
+ readStoreCand(f, unbind(config)) and
+ compatibleTypes(apf.getType(), f.getType())
+ )
+ }
+
+ /**
+ * Holds if data can flow from a source to `node` with the given `apf` and
+ * from there flow to a sink.
+ */
+ private predicate flowCand(Node node, boolean toReturn, AccessPathFront apf, Configuration config) {
+ flowCand0(node, toReturn, apf, config) and
+ flowCandFwd(node, _, apf, config)
+ }
+ private predicate flowCand0(Node node, boolean toReturn, AccessPathFront apf, Configuration config) {
+ flowCandFwd(node, _, apf, config) and
+ config.isSink(node) and toReturn = false and apf instanceof AccessPathFrontNil
+ or
+ (
+ exists(Node mid |
+ localFlowBigStep(node, mid, true, config) and
+ flowCand(mid, toReturn, apf, config)
+ )
+ or
+ exists(Node mid, AccessPathFront apf0 |
+ flowCandFwd(node, _, apf, config) and
+ localFlowBigStep(node, mid, false, config) and
+ flowCand(mid, toReturn, apf0, config) and
+ apf0 instanceof AccessPathFrontNil and
+ apf instanceof AccessPathFrontNil
+ )
+ or
+ exists(Node mid |
+ jumpStep(node, mid, true, config) and
+ flowCand(mid, _, apf, config) and
+ toReturn = false
+ )
+ or
+ exists(Node mid, AccessPathFront apf0 |
+ flowCandFwd(node, _, apf, config) and
+ jumpStep(node, mid, false, config) and
+ flowCand(mid, _, apf0, config) and
+ toReturn = false and
+ apf0 instanceof AccessPathFrontNil and
+ apf instanceof AccessPathFrontNil
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowIntoCallable(node, mid, allowsFieldFlow, config) and
+ flowCand(mid, false, apf, config) and
+ toReturn = false and
+ (apf instanceof AccessPathFrontNil or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowOutOfCallable(node, mid, allowsFieldFlow, config) and
+ flowCand(mid, _, apf, config) and
+ toReturn = true and
+ (apf instanceof AccessPathFrontNil or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean preservesValue, AccessPathFront apf0 |
+ flowThroughMethod(node, mid, preservesValue, config) and
+ flowCand(mid, toReturn, apf0, config) and
+ (preservesValue = true and apf = apf0 or preservesValue = false and apf0 instanceof AccessPathFrontNil and apf instanceof AccessPathFrontNil and flowCandFwd(node, _, apf, config))
+ )
+ or
+ exists(Node mid, Content f, AccessPathFront apf0 |
+ store(node, f, mid) and
+ flowCand(mid, toReturn, apf0, config) and
+ apf0.headUsesContent(f) and
+ consCand(f, apf, unbind(config))
+ )
+ or
+ exists(Node mid, Content f, AccessPathFront apf0 |
+ read(node, f, mid) and
+ flowCand(mid, toReturn, apf0, config) and
+ consCandFwd(f, apf0, unbind(config)) and
+ apf.headUsesContent(f)
+ )
+ )
+ }
+ private predicate consCand(Content f, AccessPathFront apf, Configuration config) {
+ consCandFwd(f, apf, config) and
+ exists(Node mid, Node n, AccessPathFront apf0 |
+ flowCandFwd(n, _, apf0, config) and
+ apf0.headUsesContent(f) and
+ read(n, f, mid) and
+ flowCand(mid, _, apf, config)
+ )
+ }
+
+ private newtype TAccessPath = TNil(Type t) or TCons(FlowContainer f, int len) { len in [1..5] }
+
+ /**
+ * Conceptually a list of `Content`s followed by a `Type`, but only the first
+ * element of the list and its length are tracked. If data flows from a source to
+ * a given node with a given `AccessPath`, this indicates the sequence of
+ * dereference operations needed to get from the value in the node to the
+ * tracked object. The final type indicates the type of the tracked object.
+ */
+ private class AccessPath extends TAccessPath {
+ abstract string toString();
+ FlowContainer getHead() { this = TCons(result, _) }
+ int len() {
+ this = TNil(_) and result = 0
+ or
+ this = TCons(_, result)
+ }
+ Type getType() {
+ this = TNil(result) or
+ exists(FlowContainer head | this = TCons(head, _) | result = head.getContainerType())
+ }
+ abstract AccessPathFront getFront();
+ }
+
+ private class AccessPathNil extends AccessPath, TNil {
+ override string toString() { exists(Type t | this = TNil(t) | result = t.toString()) }
+ override AccessPathFront getFront() { exists(Type t | this = TNil(t) | result = TFrontNil(t)) }
+ }
+
+ private class AccessPathCons extends AccessPath, TCons {
+ override string toString() {
+ exists(FlowContainer f, int len | this = TCons(f, len) | result = f.toString() + ", ... (" + len.toString() + ")")
+ }
+ override AccessPathFront getFront() { exists(FlowContainer f | this = TCons(f, _) | result = TFrontHead(f)) }
+ }
+
+ /** Holds if `ap0` corresponds to the cons of `f` and `ap`. */
+ private predicate pop(AccessPath ap0, Content f, AccessPath ap) {
+ ap0.getFront().headUsesContent(f) and
+ consCand(f, ap.getFront(), _) and
+ ap0.len() = 1 + ap.len()
+ }
+
+ /** Holds if `ap0` corresponds to the cons of `f` and `ap` and `apf` is the front of `ap`. */
+ pragma[noinline]
+ private predicate popWithFront(AccessPath ap0, Content f, AccessPathFront apf, AccessPath ap) {
+ pop(ap0, f, ap) and apf = ap.getFront()
+ }
+
+ /** Holds if `ap` corresponds to the cons of `f` and `ap0`. */
+ private predicate push(AccessPath ap0, Content f, AccessPath ap) { pop(ap, f, ap0) }
+
+ /**
+ * Holds if data can flow from a source to `node` with the given `ap`.
+ */
+ private predicate flowFwd(Node node, boolean fromArg, AccessPathFront apf, AccessPath ap, Configuration config) {
+ flowFwd0(node, fromArg, apf, ap, config) and
+ flowCand(node, _, apf, config)
+ }
+ private predicate flowFwd0(Node node, boolean fromArg, AccessPathFront apf, AccessPath ap, Configuration config) {
+ flowCand(node, _, _, config) and
+ config.isSource(node) and fromArg = false and ap = TNil(getErasedRepr(node.getType())) and apf = ap.(AccessPathNil).getFront()
+ or
+ flowCand(node, _, _, unbind(config)) and
+ (
+ exists(Node mid |
+ flowFwd(mid, fromArg, apf, ap, config) and
+ localFlowBigStep(mid, node, true, config)
+ )
+ or
+ exists(Node mid, AccessPath ap0 |
+ flowFwd(mid, fromArg, _, ap0, config) and
+ localFlowBigStep(mid, node, false, config) and
+ ap0 instanceof AccessPathNil and
+ ap = TNil(getErasedRepr(node.getType())) and
+ apf = ap.(AccessPathNil).getFront()
+ )
+ or
+ exists(Node mid |
+ flowFwd(mid, _, apf, ap, config) and
+ jumpStep(mid, node, true, config) and
+ fromArg = false
+ )
+ or
+ exists(Node mid, AccessPath ap0 |
+ flowFwd(mid, _, _, ap0, config) and
+ jumpStep(mid, node, false, config) and
+ fromArg = false and
+ ap0 instanceof AccessPathNil and
+ ap = TNil(getErasedRepr(node.getType())) and
+ apf = ap.(AccessPathNil).getFront()
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowFwd(mid, _, apf, ap, config) and
+ flowIntoCallable(mid, node, allowsFieldFlow, config) and
+ fromArg = true and
+ (ap instanceof AccessPathNil or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowFwd(mid, false, apf, ap, config) and
+ flowOutOfCallable(mid, node, allowsFieldFlow, config) and
+ fromArg = false and
+ (ap instanceof AccessPathNil or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean preservesValue, AccessPathFront apf0, AccessPath ap0 |
+ flowFwd(mid, fromArg, apf0, ap0, config) and
+ flowThroughMethod(mid, node, preservesValue, config) and
+ (preservesValue = true and ap = ap0 and apf = apf0 or preservesValue = false and ap0 instanceof AccessPathNil and ap = TNil(getErasedRepr(node.getType())) and apf = ap.(AccessPathNil).getFront())
+ )
+ )
+ or
+ exists(Content f, AccessPath ap0 |
+ flowFwdStore(node, f, ap0, apf, fromArg, config) and
+ push(ap0, f, ap)
+ )
+ or
+ exists(Content f, AccessPath ap0 |
+ flowFwdRead(node, f, ap0, fromArg, config) and
+ popWithFront(ap0, f, apf, ap)
+ )
+ }
+ pragma[nomagic]
+ private predicate flowFwdStore(Node node, Content f, AccessPath ap0, AccessPathFront apf, boolean fromArg, Configuration config) {
+ exists(Node mid, AccessPathFront apf0 |
+ flowFwd(mid, fromArg, apf0, ap0, config) and
+ flowFwdStoreAux(mid, f, node, apf0, apf, config)
+ )
+ }
+ private predicate flowFwdStoreAux(Node mid, Content f, Node node, AccessPathFront apf0, AccessPathFront apf, Configuration config) {
+ store(mid, f, node) and
+ consCand(f, apf0, config) and
+ apf.headUsesContent(f) and
+ flowCand(node, _, apf, unbind(config))
+ }
+ pragma[nomagic]
+ private predicate flowFwdRead(Node node, Content f, AccessPath ap0, boolean fromArg, Configuration config) {
+ exists(Node mid, AccessPathFront apf0 |
+ flowFwd(mid, fromArg, apf0, ap0, config) and
+ read(mid, f, node) and
+ apf0.headUsesContent(f) and
+ flowCand(node, _, _, unbind(config))
+ )
+ }
+
+ /**
+ * Holds if data can flow from a source to `node` with the given `ap` and
+ * from there flow to a sink.
+ */
+ private predicate flow(Node node, boolean toReturn, AccessPath ap, Configuration config) {
+ flow0(node, toReturn, ap, config) and
+ flowFwd(node, _, _, ap, config)
+ }
+ private predicate flow0(Node node, boolean toReturn, AccessPath ap, Configuration config) {
+ flowFwd(node, _, _, ap, config) and
+ config.isSink(node) and toReturn = false and ap instanceof AccessPathNil
+ or
+ (
+ exists(Node mid |
+ localFlowBigStep(node, mid, true, config) and
+ flow(mid, toReturn, ap, config)
+ )
+ or
+ exists(Node mid, AccessPath ap0 |
+ flowFwd(node, _, _, ap, config) and
+ localFlowBigStep(node, mid, false, config) and
+ flow(mid, toReturn, ap0, config) and
+ ap0 instanceof AccessPathNil and
+ ap instanceof AccessPathNil
+ )
+ or
+ exists(Node mid |
+ jumpStep(node, mid, true, config) and
+ flow(mid, _, ap, config) and
+ toReturn = false
+ )
+ or
+ exists(Node mid, AccessPath ap0 |
+ flowFwd(node, _, _, ap, config) and
+ jumpStep(node, mid, false, config) and
+ flow(mid, _, ap0, config) and
+ toReturn = false and
+ ap0 instanceof AccessPathNil and
+ ap instanceof AccessPathNil
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowIntoCallable(node, mid, allowsFieldFlow, config) and
+ flow(mid, false, ap, config) and
+ toReturn = false and
+ (ap instanceof AccessPathNil or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowOutOfCallable(node, mid, allowsFieldFlow, config) and
+ flow(mid, _, ap, config) and
+ toReturn = true and
+ (ap instanceof AccessPathNil or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean preservesValue, AccessPath ap0 |
+ flowThroughMethod(node, mid, preservesValue, config) and
+ flow(mid, toReturn, ap0, config) and
+ (preservesValue = true and ap = ap0 or preservesValue = false and ap0 instanceof AccessPathNil and ap instanceof AccessPathNil and flowFwd(node, _, _, ap, config))
+ )
+ or
+ exists(Content f, AccessPath ap0 |
+ flowStore(node, f, toReturn, ap0, config) and
+ pop(ap0, f, ap)
+ )
+ or
+ exists(Content f, AccessPath ap0 |
+ flowRead(node, f, toReturn, ap0, config) and
+ push(ap0, f, ap)
+ )
+ )
+ }
+ pragma[nomagic]
+ private predicate flowStore(Node node, Content f, boolean toReturn, AccessPath ap0, Configuration config) {
+ exists(Node mid |
+ store(node, f, mid) and
+ flow(mid, toReturn, ap0, config)
+ )
+ }
+ pragma[nomagic]
+ private predicate flowRead(Node node, Content f, boolean toReturn, AccessPath ap0, Configuration config) {
+ exists(Node mid |
+ read(node, f, mid) and
+ flow(mid, toReturn, ap0, config)
+ )
+ }
+
+ private bindingset[conf, result] Configuration unbind(Configuration conf) { result >= conf and result <= conf }
+
+ private predicate flow(Node n, Configuration config) {
+ flow(n, _, _, config)
+ }
+
+ private newtype TPathNode =
+ TPathNodeMid(Node node, CallContext cc, AccessPath ap, Configuration config) {
+ // A PathNode is introduced by a source ...
+ flow(node, config) and
+ config.isSource(node) and
+ cc instanceof CallContextAny and
+ ap = TNil(getErasedRepr(node.getType()))
+ or
+ // ... or a step from an existing PathNode to another node.
+ exists(PathNodeMid mid |
+ flowStep(mid, node, cc, ap) and
+ config = mid.getConfiguration() and
+ flow(node, _, ap, unbind(config))
+ )
+ } or
+ TPathNodeSink(Node node, Configuration config) { // The AccessPath on a sink is empty.
+ config.isSink(node) and
+ flow(node, config)
+ }
+
+ /**
+ * A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
+ * Only those `PathNode`s that are reachable from a source are generated.
+ */
+ abstract class PathNode extends TPathNode {
+ /** Gets a textual representation of this element. */
+ string toString() { result = getNode().toString() + ppAp() }
+ /** Gets the source location for this element. */
+ Location getLocation() { result = getNode().getLocation() }
+ /** Gets the underlying `Node`. */
+ abstract Node getNode();
+ /** Gets the associated configuration. */
+ abstract Configuration getConfiguration();
+ /** Gets a successor. */
+ abstract PathNode getSucc();
+ private string ppAp() {
+ this instanceof PathNodeSink and result = "" or
+ result = " [" + this.(PathNodeMid).getAp().toString() + "]"
+ }
+ }
+
+ /** Holds if `n` can reach a sink. */
+ private predicate reach(PathNode n) { n instanceof PathNodeSink or reach(n.getSucc()) }
+
+ /** Holds if `n1.getSucc() = n2` and `n2` can reach a sink. */
+ private predicate pathSucc(PathNode n1, PathNode n2) { n1.getSucc() = n2 and reach(n2) }
+
+ private predicate pathSuccPlus(PathNode n1, PathNode n2) = fastTC(pathSucc/2)(n1, n2)
+
+ /**
+ * Provides the query predicates needed to include a graph in a path-problem query.
+ */
+ module PathGraph {
+ /** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */
+ query predicate edges(PathNode a, PathNode b) { pathSucc(a, b) }
+ }
+
+ /**
+ * An intermediate flow graph node. This is a triple consisting of a `Node`,
+ * a `CallContext`, and a `Configuration`.
+ */
+ private class PathNodeMid extends PathNode, TPathNodeMid {
+ Node node;
+ CallContext cc;
+ AccessPath ap;
+ Configuration config;
+ PathNodeMid() { this = TPathNodeMid(node, cc, ap, config) }
+ override Node getNode() { result = node }
+ CallContext getCallContext() { result = cc }
+ AccessPath getAp() { result = ap }
+ override Configuration getConfiguration() { result = config }
+ private PathNodeMid getSuccMid() {
+ flowStep(this, result.getNode(), result.getCallContext(), result.getAp()) and
+ result.getConfiguration() = unbind(this.getConfiguration())
+ }
+ override PathNode getSucc() {
+ // an intermediate step to another intermediate node
+ result = getSuccMid()
+ or
+ // a final step to a sink via one or more local steps
+ localFlowStepPlus(node, result.getNode(), _, config) and
+ ap instanceof AccessPathNil and
+ result instanceof PathNodeSink and
+ result.getConfiguration() = unbind(this.getConfiguration())
+ or
+ // a final step to a sink via zero steps means we merge the last two steps to prevent trivial-looking edges
+ exists(PathNodeMid mid |
+ mid = getSuccMid() and
+ mid.getNode() = result.getNode() and
+ mid.getAp() instanceof AccessPathNil and
+ result instanceof PathNodeSink and
+ result.getConfiguration() = unbind(mid.getConfiguration())
+ )
+ or
+ // a direct step from a source to a sink if a node is both
+ this instanceof PathNodeSource and
+ result instanceof PathNodeSink and
+ this.getNode() = result.getNode() and
+ result.getConfiguration() = unbind(this.getConfiguration())
+ }
+ }
+
+ /**
+ * A flow graph node corresponding to a source.
+ */
+ private class PathNodeSource extends PathNodeMid {
+ PathNodeSource() {
+ getConfiguration().isSource(getNode()) and
+ getCallContext() instanceof CallContextAny and
+ getAp() instanceof AccessPathNil
+ }
+ }
+
+ /**
+ * A flow graph node corresponding to a sink. This is disjoint from the
+ * intermediate nodes in order to uniquely correspond to a given sink by
+ * excluding the `CallContext`.
+ */
+ private class PathNodeSink extends PathNode, TPathNodeSink {
+ Node node;
+ Configuration config;
+ PathNodeSink() { this = TPathNodeSink(node, config) }
+ override Node getNode() { result = node }
+ override Configuration getConfiguration() { result = config }
+ override PathNode getSucc() { none() }
+ }
+
+ /**
+ * Holds if data may flow from `mid` to `node`. The last step in or out of
+ * a callable is recorded by `cc`.
+ */
+ private predicate flowStep(PathNodeMid mid, Node node, CallContext cc, AccessPath ap) {
+ localFlowBigStep(mid.getNode(), node, true, mid.getConfiguration()) and
+ cc = mid.getCallContext() and
+ ap = mid.getAp()
+ or
+ localFlowBigStep(mid.getNode(), node, false, mid.getConfiguration()) and
+ cc = mid.getCallContext() and
+ mid.getAp() instanceof AccessPathNil and
+ ap = TNil(getErasedRepr(node.getType()))
+ or
+ jumpStep(mid.getNode(), node, true, mid.getConfiguration()) and
+ cc instanceof CallContextAny and
+ ap = mid.getAp()
+ or
+ jumpStep(mid.getNode(), node, false, mid.getConfiguration()) and
+ cc instanceof CallContextAny and
+ mid.getAp() instanceof AccessPathNil and
+ ap = TNil(getErasedRepr(node.getType()))
+ or
+ contentReadStep(mid, node, ap) and cc = mid.getCallContext()
+ or
+ exists(Content f, AccessPath ap0 | contentStoreStep(mid, node, ap0, f, cc) and push(ap0, f, ap))
+ or
+ flowOutOfArgument(mid, node, cc) and ap = mid.getAp()
+ or
+ flowIntoCallable(mid, node, _, cc, _) and ap = mid.getAp()
+ or
+ flowOutOfMethod(mid, node.asExpr(), cc) and ap = mid.getAp()
+ or
+ flowThroughMethod(mid, node.asExpr(), cc) and ap = TNil(getErasedRepr(node.getType()))
+ or
+ valueFlowThroughMethod(mid, node.asExpr(), cc) and ap = mid.getAp()
+ }
+
+ private predicate contentReadStep(PathNodeMid mid, Node node, AccessPath ap) {
+ exists(Content f, AccessPath ap0 |
+ ap0 = mid.getAp() and
+ read(mid.getNode(), f, node) and
+ pop(ap0, f, ap)
+ )
+ }
+
+ pragma[noinline]
+ private predicate contentStoreStep(PathNodeMid mid, Node node, AccessPath ap0, Content f, CallContext cc) {
+ ap0 = mid.getAp() and
+ store(mid.getNode(), f, node) and
+ cc = mid.getCallContext()
+ }
+
+ /**
+ * Holds if data may flow from `mid` to an exit of `m` in the context
+ * `innercc`, and the path did not flow through a parameter of `m`.
+ */
+ private predicate flowOutOfMethod0(PathNodeMid mid, Method m, CallContext innercc) {
+ exists(ReturnNode ret |
+ ret = mid.getNode() and
+ innercc = mid.getCallContext() and
+ m = returnNodeGetEnclosingCallable(ret) and
+ not innercc instanceof CallContextCall
+ )
+ }
+
+ /**
+ * Holds if data may flow from `mid` to `ma`. The last step of this path
+ * is a return from a method and is recorded by `cc`, if needed.
+ */
+ pragma[noinline]
+ private predicate flowOutOfMethod(PathNodeMid mid, MethodAccess ma, CallContext cc) {
+ exists(Method m, CallContext innercc |
+ flowOutOfMethod0(mid, m, innercc) and
+ resolveReturn(innercc, m, ma)
+ |
+ if reducedViableImplInReturn(m, ma) then cc = TReturn(m, ma) else cc = TAnyCallContext()
+ )
+ }
+
+ private predicate flowOutOfArgument(PathNodeMid mid, PostUpdateNode node, CallContext cc) {
+ exists(PostUpdateNode n, ParameterNode p, Callable callable, CallContext innercc, int i, Call call, ArgumentNode arg |
+ mid.getNode() = n and
+ parameterValueFlowsToUpdate(p, n) and
+ innercc = mid.getCallContext() and
+ p.isParameterOf(callable, i) and
+ resolveReturn(innercc, callable, call) and
+ node.getPreUpdateNode() = arg and
+ arg.argumentOf(call, i) and
+ flow(node, unbind(mid.getConfiguration()))
+ |
+ if reducedViableImplInReturn(callable, call) then cc = TReturn(callable, call) else cc = TAnyCallContext()
+ )
+ }
+
+ /**
+ * Holds if data may flow from `mid` to the `i`th argument of `call` in `cc`.
+ */
+ pragma[noinline]
+ private predicate flowIntoArg(PathNodeMid mid, int i, CallContext cc, Call call, boolean emptyAp) {
+ exists(ArgumentNode arg, AccessPath ap |
+ arg = mid.getNode() and
+ cc = mid.getCallContext() and
+ arg.argumentOf(call, i) and
+ ap = mid.getAp()
+ |
+ ap instanceof AccessPathNil and emptyAp = true or
+ ap instanceof AccessPathCons and emptyAp = false
+ )
+ }
+
+ pragma[noinline]
+ private predicate parameterCand(Callable callable, int i, Configuration config) {
+ exists(ParameterNode p |
+ flow(p, config) and
+ p.isParameterOf(callable, i)
+ )
+ }
+
+ pragma[nomagic]
+ private predicate flowIntoCallable0(PathNodeMid mid, Callable callable, int i, CallContext outercc, Call call, boolean emptyAp) {
+ flowIntoArg(mid, i, outercc, call, emptyAp) and
+ callable = resolveCall(call, outercc) and
+ parameterCand(callable, any(int j | j <= i and j >= i), mid.getConfiguration())
+ }
+
+ /**
+ * Holds if data may flow from `mid` to `p` through `call`. The contexts
+ * before and after entering the callable are `outercc` and `innercc`,
+ * respectively.
+ */
+ private predicate flowIntoCallable(PathNodeMid mid, ParameterNode p, CallContext outercc, CallContextCall innercc, Call call) {
+ exists(int i, Callable callable, boolean emptyAp |
+ flowIntoCallable0(mid, callable, i, outercc, call, emptyAp) and
+ p.isParameterOf(callable, i)
+ |
+ if reducedViableImplInCallContext(_, callable, call) then innercc = TSpecificCall(call, i, emptyAp) else innercc = TSomeCall(p, emptyAp)
+ )
+ }
+
+ /** Holds if data may flow from `p` to a return statement in the callable. */
+ pragma[nomagic]
+ private predicate paramFlowsThrough(ParameterNode p, CallContextCall cc, Configuration config) {
+ exists(PathNodeMid mid, ReturnNode ret |
+ mid.getNode() = ret and
+ cc = mid.getCallContext() and
+ config = mid.getConfiguration() and
+ mid.getAp() instanceof AccessPathNil
+ |
+ cc = TSomeCall(p, true) or
+ exists(int i | cc = TSpecificCall(_, i, true) |
+ p.isParameterOf(returnNodeGetEnclosingCallable(ret), i)
+ )
+ )
+ }
+
+ /**
+ * Holds if data may flow from `mid` to an argument of `methodcall`,
+ * through a called method `m`, and back out through a return statement in
+ * `m`. The context `cc` is restored to its value prior to entering `m`.
+ */
+ pragma[noinline]
+ private predicate flowThroughMethod(PathNodeMid mid, Call methodcall, CallContext cc) {
+ exists(ParameterNode p, CallContext innercc |
+ flowIntoCallable(mid, p, cc, innercc, methodcall) and
+ paramFlowsThrough(p, innercc, unbind(mid.getConfiguration())) and
+ not parameterValueFlowsThrough(p) and
+ mid.getAp() instanceof AccessPathNil
+ )
+ }
+
+ private predicate valueFlowThroughMethod(PathNodeMid mid, Call methodcall, CallContext cc) {
+ exists(ParameterNode p |
+ flowIntoCallable(mid, p, cc, _, methodcall) and
+ parameterValueFlowsThrough(p)
+ )
+ }
+
+ /**
+ * Holds if data can flow (inter-procedurally) from `source` to `sink`.
+ *
+ * Will only have results if `configuration` has non-empty sources and
+ * sinks.
+ */
+ private predicate flowsTo(PathNodeSource flowsource, PathNodeSink flowsink, Node source, Node sink, Configuration configuration) {
+ flowsource.getConfiguration() = configuration and
+ flowsource.getNode() = source and
+ pathSuccPlus(flowsource, flowsink) and
+ flowsink.getNode() = sink
+ }
+
+ /**
+ * Holds if data can flow (inter-procedurally) from `source` to `sink`.
+ *
+ * Will only have results if `configuration` has non-empty sources and
+ * sinks.
+ */
+ predicate flowsTo(Node source, Node sink, Configuration configuration) {
+ flowsTo(_, _, source, sink, configuration)
+ }
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll
new file mode 100644
index 000000000000..142ea7f8a7e9
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll
@@ -0,0 +1,1536 @@
+/**
+ * Provides an implementation of global (interprocedural) data flow. This file
+ * re-exports the local (intraprocedural) data flow analysis from `DataFlowUtil`
+ * and adds a global analysis, mainly exposed through the `Configuration` class.
+ * This file exists in several identical copies, allowing queries to use
+ * multiple `Configuration` classes that depend on each other without
+ * introducing mutual recursion among those configurations.
+ */
+
+ import DataFlowUtil
+ private import DataFlowPrivate
+ private import DataFlowDispatch
+ private import DataFlowImplCommon
+
+
+ /**
+ * A configuration of interprocedural data flow analysis. This defines
+ * sources, sinks, and any other configurable aspect of the analysis. Each
+ * use of the global data flow library must define its own unique extension
+ * of this abstract class. To create a configuration, extend this class with
+ * a subclass whose characteristic predicate is a unique singleton string.
+ * For example, write
+ *
+ * ```
+ * class MyAnalysisConfiguration extends DataFlow::Configuration {
+ * MyAnalysisConfiguration() { this = "MyAnalysisConfiguration" }
+ * // Override `isSource` and `isSink`.
+ * // Optionally override `isBarrier`.
+ * // Optionally override `isAdditionalFlowStep`.
+ * }
+ * ```
+ *
+ * Then, to query whether there is flow between some `source` and `sink`,
+ * write
+ *
+ * ```
+ * exists(MyAnalysisConfiguration cfg | cfg.hasFlow(source, sink))
+ * ```
+ *
+ * Multiple configurations can coexist, but two classes extending
+ * `DataFlow::Configuration` should never depend on each other. One of them
+ * should instead depend on a `DataFlow2::Configuration`, a
+ * `DataFlow3::Configuration`, or a `DataFlow4::Configuration`.
+ */
+ abstract class Configuration extends string {
+ bindingset[this]
+ Configuration() { any() }
+
+ /**
+ * Holds if `source` is a relevant data flow source.
+ */
+ abstract predicate isSource(Node source);
+
+ /**
+ * Holds if `sink` is a relevant data flow sink.
+ */
+ abstract predicate isSink(Node sink);
+
+ /** Holds if data flow through `node` is prohibited. */
+ predicate isBarrier(Node node) { none() }
+
+ /** Holds if data flow from `node1` to `node2` is prohibited. */
+ predicate isBarrierEdge(Node node1, Node node2) { none() }
+
+ /**
+ * Holds if the additional flow step from `node1` to `node2` must be taken
+ * into account in the analysis.
+ */
+ predicate isAdditionalFlowStep(Node node1, Node node2) { none() }
+
+ /**
+ * Gets the virtual dispatch branching limit when calculating field flow.
+ * This can be overridden to a smaller value to improve performance (a
+ * value of 0 disables field flow), or a larger value to get more results.
+ */
+ int fieldFlowBranchLimit() { result = 2 }
+
+ /**
+ * Holds if data may flow from `source` to `sink` for this configuration.
+ */
+ predicate hasFlow(Node source, Node sink) {
+ flowsTo(source, sink, this)
+ }
+
+ /**
+ * Holds if data may flow from `source` to `sink` for this configuration.
+ *
+ * The corresponding paths are generated from the end-points and the graph
+ * included in the module `PathGraph`.
+ */
+ predicate hasFlowPath(PathNode source, PathNode sink) {
+ flowsTo(source, sink, _, _, this)
+ }
+
+ /**
+ * Holds if data may flow from some source to `sink` for this configuration.
+ */
+ predicate hasFlowTo(Node sink) {
+ hasFlow(_, sink)
+ }
+
+ /**
+ * Holds if data may flow from some source to `sink` for this configuration.
+ */
+ predicate hasFlowToExpr(Expr sink) {
+ hasFlowTo(exprNode(sink))
+ }
+
+ /** DEPRECATED: use `hasFlow` instead. */
+ deprecated predicate hasFlowForward(Node source, Node sink) {
+ hasFlow(source, sink)
+ }
+
+ /** DEPRECATED: use `hasFlow` instead. */
+ deprecated predicate hasFlowBackward(Node source, Node sink) {
+ hasFlow(source, sink)
+ }
+ }
+
+ /**
+ * Holds if the additional step from `node1` to `node2` jumps between callables.
+ */
+ private predicate additionalJumpStep(Node node1, Node node2, Configuration config) {
+ config.isAdditionalFlowStep(node1, node2) and
+ node1.getEnclosingCallable() != node2.getEnclosingCallable()
+ }
+
+ pragma[noinline]
+ private predicate isAdditionalFlowStep(Node node1, Node node2, Callable callable1, Callable callable2, Configuration config) {
+ config.isAdditionalFlowStep(node1, node2) and
+ callable1 = node1.getEnclosingCallable() and
+ callable2 = node2.getEnclosingCallable()
+ }
+
+ /**
+ * Holds if the additional step from `node1` to `node2` does not jump between callables.
+ */
+ private predicate additionalLocalFlowStep(Node node1, Node node2, Configuration config) {
+ exists(Callable callable |
+ isAdditionalFlowStep(node1, node2, callable, callable, config)
+ )
+ }
+
+ /**
+ * Holds if data can flow from `node1` to `node2` through a static field or
+ * variable capture.
+ */
+ private predicate jumpStep(Node node1, Node node2, boolean preservesValue, Configuration config) {
+ jumpStep(node1, node2) and preservesValue = true or
+ additionalJumpStep(node1, node2, config) and preservesValue = false
+ }
+
+ /**
+ * Holds if data can flow in one local step from `node1` to `node2` taking
+ * additional steps from the configuration into account.
+ */
+ private predicate localFlowStep(Node node1, Node node2, boolean preservesValue, Configuration config) {
+ localFlowStep(node1, node2) and not config.isBarrierEdge(node1, node2) and preservesValue = true or
+ additionalLocalFlowStep(node1, node2, config) and preservesValue = false
+ }
+
+ pragma[noinline]
+ private Method returnNodeGetEnclosingCallable(ReturnNode ret) {
+ result = ret.getEnclosingCallable()
+ }
+
+ /**
+ * Holds if field flow should be used for the given configuration.
+ */
+ private predicate useFieldFlow(Configuration config) {
+ config.fieldFlowBranchLimit() >= 1
+ }
+
+ /**
+ * Holds if `node` is reachable from a source in the given configuration
+ * ignoring call contexts.
+ */
+ private predicate nodeCandFwd1(Node node, boolean stored, Configuration config) {
+ not config.isBarrier(node) and
+ (
+ config.isSource(node) and stored = false
+ or
+ exists(Node mid, boolean preservesValue |
+ nodeCandFwd1(mid, stored, config) and
+ localFlowStep(mid, node, preservesValue, config) and
+ (stored = false or preservesValue = true)
+ )
+ or
+ exists(Node mid, boolean preservesValue |
+ nodeCandFwd1(mid, stored, config) and
+ jumpStep(mid, node, preservesValue, config) and
+ (stored = false or preservesValue = true)
+ )
+ or
+ // store
+ exists(Node mid |
+ useFieldFlow(config) and
+ nodeCandFwd1(mid, _, config) and
+ store(mid, _, node) and
+ stored = true
+ )
+ or
+ // read
+ exists(Node mid, Content f |
+ nodeCandFwd1(mid, true, config) and
+ read(mid, f, node) and
+ storeCandFwd1(f, unbind(config)) and
+ (stored = false or stored = true)
+ )
+ or
+ // flow into a callable
+ exists(Node arg |
+ nodeCandFwd1(arg, stored, config) and
+ viableParamArg(node, arg)
+ )
+ or
+ // flow out of an argument
+ exists(PostUpdateNode mid, ParameterNode p |
+ nodeCandFwd1(mid, stored, config) and
+ parameterValueFlowsToUpdate(p, mid) and
+ viableParamArg(p, node.(PostUpdateNode).getPreUpdateNode())
+ )
+ or
+ // flow out of a callable
+ exists(Method m, MethodAccess ma, ReturnNode ret |
+ nodeCandFwd1(ret, stored, config) and
+ m = returnNodeGetEnclosingCallable(ret) and
+ m = viableImpl(ma) and
+ node.asExpr() = ma
+ )
+ )
+ }
+
+ /**
+ * Holds if `f` is the target of a store in the flow covered by `nodeCandFwd1`.
+ */
+ private predicate storeCandFwd1(Content f, Configuration config) {
+ exists(Node mid, Node node |
+ not config.isBarrier(node) and
+ useFieldFlow(unbind(config)) and
+ nodeCandFwd1(mid, _, config) and
+ store(mid, f, node)
+ )
+ }
+
+ bindingset[result, b]
+ private boolean unbindBool(boolean b) { result != b.booleanNot() }
+
+ /**
+ * Holds if `node` is part of a path from a source to a sink in the given
+ * configuration ignoring call contexts.
+ */
+ pragma[nomagic]
+ private predicate nodeCand1(Node node, boolean stored, Configuration config) {
+ nodeCandFwd1(node, false, config) and
+ config.isSink(node) and stored = false
+ or
+ nodeCandFwd1(node, unbindBool(stored), unbind(config)) and
+ (
+ exists(Node mid, boolean preservesValue |
+ localFlowStep(node, mid, preservesValue, config) and
+ nodeCand1(mid, stored, config) and
+ (stored = false or preservesValue = true)
+ )
+ or
+ exists(Node mid, boolean preservesValue |
+ jumpStep(node, mid, preservesValue, config) and
+ nodeCand1(mid, stored, config) and
+ (stored = false or preservesValue = true)
+ )
+ or
+ // store
+ exists(Node mid, Content f |
+ store(node, f, mid) and
+ readCand1(f, unbind(config)) and
+ nodeCand1(mid, true, config) and
+ (stored = false or stored = true)
+ )
+ or
+ // read
+ exists(Node mid, Content f |
+ read(node, f, mid) and
+ storeCandFwd1(f, unbind(config)) and
+ nodeCand1(mid, _, config) and
+ stored = true
+ )
+ or
+ // flow into a callable
+ exists(Node param |
+ viableParamArg(param, node) and
+ nodeCand1(param, stored, config)
+ )
+ or
+ // flow out of an argument
+ exists(PostUpdateNode mid, ParameterNode p |
+ parameterValueFlowsToUpdate(p, node) and
+ viableParamArg(p, mid.getPreUpdateNode()) and
+ nodeCand1(mid, stored, config)
+ )
+ or
+ // flow out of a callable
+ exists(Method m, ExprNode ma |
+ nodeCand1(ma, stored, config) and
+ m = returnNodeGetEnclosingCallable(node) and
+ m = viableImpl(ma.getExpr())
+ )
+ )
+ }
+
+ /**
+ * Holds if `f` is the target of a read in the flow covered by `nodeCand1`.
+ */
+ private predicate readCand1(Content f, Configuration config) {
+ exists(Node mid, Node node |
+ useFieldFlow(unbind(config)) and
+ nodeCandFwd1(node, true, unbind(config)) and
+ read(node, f, mid) and
+ storeCandFwd1(f, unbind(config)) and
+ nodeCand1(mid, _, config)
+ )
+ }
+
+ /**
+ * Holds if there is a path from `p` to `node` in the same callable that is
+ * part of a path from a source to a sink taking simple call contexts into
+ * consideration. This is restricted to paths that does not necessarily
+ * preserve the value of `p` by making use of at least one additional step
+ * from the configuration.
+ */
+ pragma[nomagic]
+ private predicate simpleParameterFlow(ParameterNode p, Node node, RefType t, Configuration config) {
+ nodeCand1(node, false, config) and
+ p = node and
+ t = getErasedRepr(node.getType()) and
+ not parameterValueFlowsThrough(p)
+ or
+ nodeCand1(node, false, unbind(config)) and
+ exists(Node mid |
+ simpleParameterFlow(p, mid, t, config) and
+ localFlowStep(mid, node, true, config) and
+ compatibleTypes(t, node.getType())
+ )
+ or
+ nodeCand1(node, false, unbind(config)) and
+ exists(Node mid |
+ simpleParameterFlow(p, mid, _, config) and
+ localFlowStep(mid, node, false, config) and
+ t = getErasedRepr(node.getType())
+ )
+ or
+ nodeCand1(node, false, unbind(config)) and
+ exists(Node mid |
+ simpleParameterFlow(p, mid, t, config) and
+ localStoreReadStep(mid, node) and
+ compatibleTypes(t, node.getType())
+ )
+ or
+ // value flow through a callable
+ nodeCand1(node, false, config) and
+ exists(Node arg |
+ simpleParameterFlow(p, arg, t, config) and
+ argumentValueFlowsThrough(arg, node) and
+ compatibleTypes(t, node.getType())
+ )
+ or
+ // flow through a callable
+ nodeCand1(node, false, config) and
+ exists(Node arg |
+ simpleParameterFlow(p, arg, _, config) and
+ simpleArgumentFlowsThrough(arg, node, t, config)
+ )
+ }
+
+ /**
+ * Holds if data can flow from `arg` through the `call` taking simple call
+ * contexts into consideration and that this is part of a path from a source
+ * to a sink. This is restricted to paths through the `call` that does not
+ * necessarily preserve the value of `arg` by making use of at least one
+ * additional step from the configuration.
+ */
+ private predicate simpleArgumentFlowsThrough(ArgumentNode arg, ExprNode call, RefType t, Configuration config) {
+ exists(ParameterNode param, ReturnNode ret |
+ nodeCand1(arg, false, unbind(config)) and
+ nodeCand1(call, false, unbind(config)) and
+ viableParamArg(param, arg) and
+ simpleParameterFlow(param, ret, t, config) and
+ arg.argumentOf(call.getExpr(), _)
+ )
+ }
+
+ /**
+ * Holds if data can flow from `node1` to `node2` by a step through a method.
+ */
+ private predicate flowThroughMethod(Node node1, Node node2, boolean preservesValue, Configuration config) {
+ simpleArgumentFlowsThrough(node1, node2, _, config) and preservesValue = false or
+ argumentValueFlowsThrough(node1, node2) and preservesValue = true
+ }
+
+ /**
+ * Holds if data can flow from `node1` to `node2` in one local step or a step
+ * through a method.
+ */
+ private predicate localFlowStepOrFlowThroughMethod(Node node1, Node node2, boolean preservesValue, Configuration config) {
+ localFlowStep(node1, node2, preservesValue, config) or
+ flowThroughMethod(node1, node2, preservesValue, config)
+ }
+
+ /**
+ * Holds if data can flow out of a callable from `node1` to `node2`, either
+ * through a `ReturnNode` or through an argument that has been mutated, and
+ * that this step is part of a path from a source to a sink.
+ */
+ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config) {
+ nodeCand1(node1, _, unbind(config)) and
+ nodeCand1(node2, _, config) and
+ (
+ // flow out of an argument
+ exists(ParameterNode p |
+ parameterValueFlowsToUpdate(p, node1) and
+ viableParamArg(p, node2.(PostUpdateNode).getPreUpdateNode())
+ )
+ or
+ // flow out of a method
+ exists(Method m, MethodAccess ma, ReturnNode ret |
+ ret = node1 and
+ m = returnNodeGetEnclosingCallable(ret) and
+ m = viableImpl(ma) and
+ node2.asExpr() = ma
+ )
+ )
+ }
+
+ /**
+ * Holds if data can flow into a callable and that this step is part of a
+ * path from a source to a sink.
+ */
+ private predicate flowIntoCallable(Node node1, Node node2, Configuration config) {
+ viableParamArg(node2, node1) and
+ nodeCand1(node1, _, unbind(config)) and
+ nodeCand1(node2, _, config)
+ }
+
+ /**
+ * Gets the amount of forward branching on the origin of a cross-call path
+ * edge in the graph of paths between sources and sinks that ignores call
+ * contexts.
+ */
+ private int branch(Node n1, Configuration conf) {
+ result = strictcount(Node n | flowOutOfCallable(n1, n, conf) or flowIntoCallable(n1, n, conf))
+ }
+
+ /**
+ * Gets the amount of backward branching on the target of a cross-call path
+ * edge in the graph of paths between sources and sinks that ignores call
+ * contexts.
+ */
+ private int join(Node n2, Configuration conf) {
+ result = strictcount(Node n | flowOutOfCallable(n, n2, conf) or flowIntoCallable(n, n2, conf))
+ }
+
+ /**
+ * Holds if data can flow out of a callable from `node1` to `node2`, either
+ * through a `ReturnNode` or through an argument that has been mutated, and
+ * that this step is part of a path from a source to a sink. The
+ * `allowsFieldFlow` flag indicates whether the branching is within the limit
+ * specified by the configuration.
+ */
+ private predicate flowOutOfCallable(Node node1, Node node2, boolean allowsFieldFlow, Configuration config) {
+ flowOutOfCallable(node1, node2, config) and
+ exists(int b, int j |
+ b = branch(node1, config) and
+ j = join(node2, config) and
+ if b.minimum(j) <= config.fieldFlowBranchLimit() then allowsFieldFlow = true else allowsFieldFlow = false
+ )
+ }
+
+ /**
+ * Holds if data can flow into a callable and that this step is part of a
+ * path from a source to a sink. The `allowsFieldFlow` flag indicates whether
+ * the branching is within the limit specified by the configuration.
+ */
+ private predicate flowIntoCallable(Node node1, Node node2, boolean allowsFieldFlow, Configuration config) {
+ flowIntoCallable(node1, node2, config) and
+ exists(int b, int j |
+ b = branch(node1, config) and
+ j = join(node2, config) and
+ if b.minimum(j) <= config.fieldFlowBranchLimit() then allowsFieldFlow = true else allowsFieldFlow = false
+ )
+ }
+
+ /**
+ * Holds if `node` is part of a path from a source to a sink in the given
+ * configuration taking simple call contexts into consideration.
+ */
+ private predicate nodeCandFwd2(Node node, boolean fromArg, boolean stored, Configuration config) {
+ nodeCand1(node, false, config) and
+ config.isSource(node) and fromArg = false and stored = false
+ or
+ nodeCand1(node, unbindBool(stored), unbind(config)) and
+ (
+ exists(Node mid, boolean preservesValue |
+ nodeCandFwd2(mid, fromArg, stored, config) and
+ localFlowStepOrFlowThroughMethod(mid, node, preservesValue, config) and
+ (stored = false or preservesValue = true)
+ )
+ or
+ exists(Node mid, boolean preservesValue |
+ nodeCandFwd2(mid, _, stored, config) and
+ jumpStep(mid, node, preservesValue, config) and
+ fromArg = false and
+ (stored = false or preservesValue = true)
+ )
+ or
+ // store
+ exists(Node mid, Content f |
+ nodeCandFwd2(mid, fromArg, _, config) and
+ store(mid, f, node) and
+ readCand1(f, unbind(config)) and
+ stored = true
+ )
+ or
+ // read
+ exists(Node mid, Content f |
+ nodeCandFwd2(mid, fromArg, true, config) and
+ read(mid, f, node) and
+ storeCandFwd2(f, unbind(config)) and
+ (stored = false or stored = true)
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ nodeCandFwd2(mid, _, stored, config) and
+ flowIntoCallable(mid, node, allowsFieldFlow, config) and
+ fromArg = true and
+ (stored = false or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ nodeCandFwd2(mid, false, stored, config) and
+ flowOutOfCallable(mid, node, allowsFieldFlow, config) and
+ fromArg = false and
+ (stored = false or allowsFieldFlow = true)
+ )
+ )
+ }
+
+ /**
+ * Holds if `f` is the target of a store in the flow covered by `nodeCandFwd2`.
+ */
+ private predicate storeCandFwd2(Content f, Configuration config) {
+ exists(Node mid, Node node |
+ useFieldFlow(unbind(config)) and
+ nodeCand1(node, true, unbind(config)) and
+ nodeCandFwd2(mid, _, _, config) and
+ store(mid, f, node) and
+ readCand1(f, unbind(config))
+ )
+ }
+
+ /**
+ * Holds if `node` is part of a path from a source to a sink in the given
+ * configuration taking simple call contexts into consideration.
+ */
+ private predicate nodeCand2(Node node, boolean toReturn, boolean stored, Configuration config) {
+ nodeCandFwd2(node, _, false, config) and
+ config.isSink(node) and toReturn = false and stored = false
+ or
+ nodeCandFwd2(node, _, unbindBool(stored), unbind(config)) and
+ (
+ exists(Node mid, boolean preservesValue |
+ localFlowStepOrFlowThroughMethod(node, mid, preservesValue, config) and
+ nodeCand2(mid, toReturn, stored, config) and
+ (stored = false or preservesValue = true)
+ )
+ or
+ exists(Node mid, boolean preservesValue |
+ jumpStep(node, mid, preservesValue, config) and
+ nodeCand2(mid, _, stored, config) and
+ toReturn = false and
+ (stored = false or preservesValue = true)
+ )
+ or
+ // store
+ exists(Node mid, Content f |
+ store(node, f, mid) and
+ readCand2(f, unbind(config)) and
+ nodeCand2(mid, toReturn, true, config) and
+ (stored = false or stored = true)
+ )
+ or
+ // read
+ exists(Node mid, Content f |
+ read(node, f, mid) and
+ storeCandFwd2(f, unbind(config)) and
+ nodeCand2(mid, toReturn, _, config) and
+ stored = true
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowIntoCallable(node, mid, allowsFieldFlow, config) and
+ nodeCand2(mid, false, stored, config) and
+ toReturn = false and
+ (stored = false or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowOutOfCallable(node, mid, allowsFieldFlow, config) and
+ nodeCand2(mid, _, stored, config) and
+ toReturn = true and
+ (stored = false or allowsFieldFlow = true)
+ )
+ )
+ }
+
+ /**
+ * Holds if `f` is the target of a read in the flow covered by `nodeCand2`.
+ */
+ private predicate readCand2(Content f, Configuration config) {
+ exists(Node mid, Node node |
+ useFieldFlow(unbind(config)) and
+ nodeCandFwd2(node, _, true, unbind(config)) and
+ read(node, f, mid) and
+ storeCandFwd2(f, unbind(config)) and
+ nodeCand2(mid, _, _, config)
+ )
+ }
+
+ private predicate storeCand(Content f, Configuration conf) {
+ exists(Node n1, Node n2 |
+ store(n1, f, n2) and
+ nodeCand2(n1, _, _, conf) and
+ nodeCand2(n2, _, _, unbind(conf))
+ )
+ }
+
+ private predicate readCand(Content f, Configuration conf) {
+ readCand2(f, conf)
+ }
+
+ /**
+ * Holds if `f` is the target of both a store and a read in the path graph
+ * covered by `nodeCand2`.
+ */
+ pragma[noinline]
+ private predicate readStoreCand(Content f, Configuration conf) {
+ storeCand(f, conf) and
+ readCand(f, conf)
+ }
+
+ private predicate nodeCand(Node node, Configuration config) {
+ nodeCand2(node, _, _, config)
+ }
+
+ /**
+ * Holds if `node` can be the first node in a maximal subsequence of local
+ * flow steps in a dataflow path.
+ */
+ private predicate localFlowEntry(Node node, Configuration config) {
+ nodeCand(node, config) and
+ (
+ config.isSource(node) or
+ jumpStep(_, node, _, config) or
+ node instanceof ParameterNode or
+ node.asExpr() instanceof MethodAccess or
+ node instanceof PostUpdateNode or
+ read(_, _, node) or
+ node.asExpr() instanceof CastExpr
+ )
+ }
+
+ /**
+ * Holds if `node` can be the last node in a maximal subsequence of local
+ * flow steps in a dataflow path.
+ */
+ private predicate localFlowExit(Node node, Configuration config) {
+ exists(Node next |
+ nodeCand(next, config)
+ |
+ jumpStep(node, next, _, config) or
+ flowIntoCallable(node, next, config) or
+ flowOutOfCallable(node, next, config) or
+ flowThroughMethod(node, next, _, config) or
+ store(node, _, next) or
+ read(node, _, next)
+ ) or
+ node.asExpr() instanceof CastExpr or
+ config.isSink(node)
+ }
+
+ /**
+ * Holds if the local path from `node1` to `node2` is a prefix of a maximal
+ * subsequence of local flow steps in a dataflow path.
+ *
+ * This is the transitive closure of `localFlowStep` beginning at `localFlowEntry`.
+ */
+ private predicate localFlowStepPlus(Node node1, Node node2, boolean preservesValue, Configuration config) {
+ localFlowEntry(node1, config) and
+ localFlowStep(node1, node2, preservesValue, config) and
+ node1 != node2 and
+ nodeCand(node2, unbind(config))
+ or
+ exists(Node mid, boolean pv1, boolean pv2 |
+ localFlowStepPlus(node1, mid, pv1, config) and
+ localFlowStep(mid, node2, pv2, config) and
+ not mid.asExpr() instanceof CastExpr and
+ preservesValue = pv1.booleanAnd(pv2) and
+ nodeCand(node2, unbind(config))
+ )
+ }
+
+ /**
+ * Holds if `node1` can step to `node2` in one or more local steps and this
+ * path can occur as a maximal subsequence of local steps in a dataflow path.
+ */
+ pragma[noinline]
+ private predicate localFlowBigStep(Node node1, Node node2, boolean preservesValue, Configuration config) {
+ localFlowStepPlus(node1, node2, preservesValue, config) and
+ localFlowExit(node2, config)
+ }
+
+ /**
+ * Holds if `f` may contain an object of the same type, `t`, as the one
+ * that contains `f`, and if this fact should be used to compress
+ * access paths.
+ *
+ * Examples include the tail pointer in a linked list or the left and right
+ * pointers in a binary tree.
+ */
+ private predicate selfRef(Content f, RefType t) {
+ t = f.getDeclaringType() and
+ f.isSelfRef()
+ }
+
+ private newtype TFlowContainer =
+ TRegularContent(Content f) { not selfRef(f, _) } or
+ TSelfRefContent(RefType t) { selfRef(_, t) }
+
+ /**
+ * A `Content` or a `Content` abstracted as its declaring type.
+ *
+ * Sequences of one or more `Content`s in the same declaring type for which
+ * `isSelfRef()` holds are represented as a single `FlowContainer` in an
+ * `AccessPath`.
+ */
+ private class FlowContainer extends TFlowContainer {
+ string toString() {
+ exists(Content f | this = TRegularContent(f) and result = f.toString()) or
+ exists(RefType t | this = TSelfRefContent(t) and result = t.toString())
+ }
+ predicate usesContent(Content f) {
+ this = TRegularContent(f) or
+ exists(RefType t | this = TSelfRefContent(t) and selfRef(f, t))
+ }
+ RefType getContainerType() {
+ exists(Content f | this = TRegularContent(f) and result = f.getDeclaringType()) or
+ this = TSelfRefContent(result)
+ }
+ }
+
+ private newtype TAccessPathFront = TFrontNil(Type t) or TFrontHead(FlowContainer f)
+
+ /**
+ * The front of an `AccessPath`. This is either a head or a nil.
+ */
+ private class AccessPathFront extends TAccessPathFront {
+ string toString() {
+ exists(Type t | this = TFrontNil(t) | result = t.toString()) or
+ exists(FlowContainer f | this = TFrontHead(f) | result = f.toString())
+ }
+ Type getType() {
+ this = TFrontNil(result) or
+ exists(FlowContainer head | this = TFrontHead(head) | result = head.getContainerType())
+ }
+ predicate headUsesContent(Content f) {
+ exists(FlowContainer fc |
+ fc.usesContent(f) and
+ this = TFrontHead(fc)
+ )
+ }
+ }
+
+ private class AccessPathFrontNil extends AccessPathFront, TFrontNil {
+ }
+
+ /**
+ * A `Node` at which a cast can occur such that the type should be checked.
+ */
+ private class CastingNode extends Node {
+ CastingNode() {
+ this instanceof ParameterNode or
+ this.asExpr() instanceof CastExpr or
+ this.asExpr() instanceof MethodAccess or
+ this.(PostUpdateNode).getPreUpdateNode() instanceof ArgumentNode
+ }
+ }
+
+ /**
+ * Holds if data can flow from a source to `node` with the given `apf`.
+ */
+ private predicate flowCandFwd(Node node, boolean fromArg, AccessPathFront apf, Configuration config) {
+ flowCandFwd0(node, fromArg, apf, config) and
+ if node instanceof CastingNode then
+ compatibleTypes(node.getType(), apf.getType())
+ else
+ any()
+ }
+ private predicate flowCandFwd0(Node node, boolean fromArg, AccessPathFront apf, Configuration config) {
+ nodeCand2(node, _, false, config) and
+ config.isSource(node) and fromArg = false and apf = TFrontNil(getErasedRepr(node.getType()))
+ or
+ nodeCand(node, unbind(config)) and
+ (
+ exists(Node mid |
+ flowCandFwd(mid, fromArg, apf, config) and
+ localFlowBigStep(mid, node, true, config)
+ )
+ or
+ exists(Node mid, AccessPathFront apf0 |
+ flowCandFwd(mid, fromArg, apf0, config) and
+ localFlowBigStep(mid, node, false, config) and
+ apf0 instanceof AccessPathFrontNil and
+ apf = TFrontNil(getErasedRepr(node.getType()))
+ )
+ or
+ exists(Node mid |
+ flowCandFwd(mid, _, apf, config) and
+ jumpStep(mid, node, true, config) and
+ fromArg = false
+ )
+ or
+ exists(Node mid, AccessPathFront apf0 |
+ flowCandFwd(mid, _, apf0, config) and
+ jumpStep(mid, node, false, config) and
+ fromArg = false and
+ apf0 instanceof AccessPathFrontNil and
+ apf = TFrontNil(getErasedRepr(node.getType()))
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowCandFwd(mid, _, apf, config) and
+ flowIntoCallable(mid, node, allowsFieldFlow, config) and
+ fromArg = true and
+ (apf instanceof AccessPathFrontNil or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowCandFwd(mid, false, apf, config) and
+ flowOutOfCallable(mid, node, allowsFieldFlow, config) and
+ fromArg = false and
+ (apf instanceof AccessPathFrontNil or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean preservesValue, AccessPathFront apf0 |
+ flowCandFwd(mid, fromArg, apf0, config) and
+ flowThroughMethod(mid, node, preservesValue, config) and
+ (preservesValue = true and apf = apf0 or preservesValue = false and apf0 instanceof AccessPathFrontNil and apf = TFrontNil(getErasedRepr(node.getType())))
+ )
+ )
+ or
+ exists(Node mid, Content f |
+ flowCandFwd(mid, fromArg, _, config) and
+ store(mid, f, node) and
+ nodeCand(node, unbind(config)) and
+ apf.headUsesContent(f)
+ )
+ or
+ exists(Node mid, Content f, AccessPathFront apf0 |
+ flowCandFwd(mid, fromArg, apf0, config) and
+ read(mid, f, node) and
+ nodeCand(node, config) and
+ apf0.headUsesContent(f) and
+ consCandFwd(f, apf, unbind(config))
+ )
+ }
+ private predicate consCandFwd(Content f, AccessPathFront apf, Configuration config) {
+ exists(Node mid, Node n |
+ flowCandFwd(mid, _, apf, config) and
+ store(mid, f, n) and
+ nodeCand(n, unbind(config)) and
+ readStoreCand(f, unbind(config)) and
+ compatibleTypes(apf.getType(), f.getType())
+ )
+ }
+
+ /**
+ * Holds if data can flow from a source to `node` with the given `apf` and
+ * from there flow to a sink.
+ */
+ private predicate flowCand(Node node, boolean toReturn, AccessPathFront apf, Configuration config) {
+ flowCand0(node, toReturn, apf, config) and
+ flowCandFwd(node, _, apf, config)
+ }
+ private predicate flowCand0(Node node, boolean toReturn, AccessPathFront apf, Configuration config) {
+ flowCandFwd(node, _, apf, config) and
+ config.isSink(node) and toReturn = false and apf instanceof AccessPathFrontNil
+ or
+ (
+ exists(Node mid |
+ localFlowBigStep(node, mid, true, config) and
+ flowCand(mid, toReturn, apf, config)
+ )
+ or
+ exists(Node mid, AccessPathFront apf0 |
+ flowCandFwd(node, _, apf, config) and
+ localFlowBigStep(node, mid, false, config) and
+ flowCand(mid, toReturn, apf0, config) and
+ apf0 instanceof AccessPathFrontNil and
+ apf instanceof AccessPathFrontNil
+ )
+ or
+ exists(Node mid |
+ jumpStep(node, mid, true, config) and
+ flowCand(mid, _, apf, config) and
+ toReturn = false
+ )
+ or
+ exists(Node mid, AccessPathFront apf0 |
+ flowCandFwd(node, _, apf, config) and
+ jumpStep(node, mid, false, config) and
+ flowCand(mid, _, apf0, config) and
+ toReturn = false and
+ apf0 instanceof AccessPathFrontNil and
+ apf instanceof AccessPathFrontNil
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowIntoCallable(node, mid, allowsFieldFlow, config) and
+ flowCand(mid, false, apf, config) and
+ toReturn = false and
+ (apf instanceof AccessPathFrontNil or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowOutOfCallable(node, mid, allowsFieldFlow, config) and
+ flowCand(mid, _, apf, config) and
+ toReturn = true and
+ (apf instanceof AccessPathFrontNil or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean preservesValue, AccessPathFront apf0 |
+ flowThroughMethod(node, mid, preservesValue, config) and
+ flowCand(mid, toReturn, apf0, config) and
+ (preservesValue = true and apf = apf0 or preservesValue = false and apf0 instanceof AccessPathFrontNil and apf instanceof AccessPathFrontNil and flowCandFwd(node, _, apf, config))
+ )
+ or
+ exists(Node mid, Content f, AccessPathFront apf0 |
+ store(node, f, mid) and
+ flowCand(mid, toReturn, apf0, config) and
+ apf0.headUsesContent(f) and
+ consCand(f, apf, unbind(config))
+ )
+ or
+ exists(Node mid, Content f, AccessPathFront apf0 |
+ read(node, f, mid) and
+ flowCand(mid, toReturn, apf0, config) and
+ consCandFwd(f, apf0, unbind(config)) and
+ apf.headUsesContent(f)
+ )
+ )
+ }
+ private predicate consCand(Content f, AccessPathFront apf, Configuration config) {
+ consCandFwd(f, apf, config) and
+ exists(Node mid, Node n, AccessPathFront apf0 |
+ flowCandFwd(n, _, apf0, config) and
+ apf0.headUsesContent(f) and
+ read(n, f, mid) and
+ flowCand(mid, _, apf, config)
+ )
+ }
+
+ private newtype TAccessPath = TNil(Type t) or TCons(FlowContainer f, int len) { len in [1..5] }
+
+ /**
+ * Conceptually a list of `Content`s followed by a `Type`, but only the first
+ * element of the list and its length are tracked. If data flows from a source to
+ * a given node with a given `AccessPath`, this indicates the sequence of
+ * dereference operations needed to get from the value in the node to the
+ * tracked object. The final type indicates the type of the tracked object.
+ */
+ private class AccessPath extends TAccessPath {
+ abstract string toString();
+ FlowContainer getHead() { this = TCons(result, _) }
+ int len() {
+ this = TNil(_) and result = 0
+ or
+ this = TCons(_, result)
+ }
+ Type getType() {
+ this = TNil(result) or
+ exists(FlowContainer head | this = TCons(head, _) | result = head.getContainerType())
+ }
+ abstract AccessPathFront getFront();
+ }
+
+ private class AccessPathNil extends AccessPath, TNil {
+ override string toString() { exists(Type t | this = TNil(t) | result = t.toString()) }
+ override AccessPathFront getFront() { exists(Type t | this = TNil(t) | result = TFrontNil(t)) }
+ }
+
+ private class AccessPathCons extends AccessPath, TCons {
+ override string toString() {
+ exists(FlowContainer f, int len | this = TCons(f, len) | result = f.toString() + ", ... (" + len.toString() + ")")
+ }
+ override AccessPathFront getFront() { exists(FlowContainer f | this = TCons(f, _) | result = TFrontHead(f)) }
+ }
+
+ /** Holds if `ap0` corresponds to the cons of `f` and `ap`. */
+ private predicate pop(AccessPath ap0, Content f, AccessPath ap) {
+ ap0.getFront().headUsesContent(f) and
+ consCand(f, ap.getFront(), _) and
+ ap0.len() = 1 + ap.len()
+ }
+
+ /** Holds if `ap0` corresponds to the cons of `f` and `ap` and `apf` is the front of `ap`. */
+ pragma[noinline]
+ private predicate popWithFront(AccessPath ap0, Content f, AccessPathFront apf, AccessPath ap) {
+ pop(ap0, f, ap) and apf = ap.getFront()
+ }
+
+ /** Holds if `ap` corresponds to the cons of `f` and `ap0`. */
+ private predicate push(AccessPath ap0, Content f, AccessPath ap) { pop(ap, f, ap0) }
+
+ /**
+ * Holds if data can flow from a source to `node` with the given `ap`.
+ */
+ private predicate flowFwd(Node node, boolean fromArg, AccessPathFront apf, AccessPath ap, Configuration config) {
+ flowFwd0(node, fromArg, apf, ap, config) and
+ flowCand(node, _, apf, config)
+ }
+ private predicate flowFwd0(Node node, boolean fromArg, AccessPathFront apf, AccessPath ap, Configuration config) {
+ flowCand(node, _, _, config) and
+ config.isSource(node) and fromArg = false and ap = TNil(getErasedRepr(node.getType())) and apf = ap.(AccessPathNil).getFront()
+ or
+ flowCand(node, _, _, unbind(config)) and
+ (
+ exists(Node mid |
+ flowFwd(mid, fromArg, apf, ap, config) and
+ localFlowBigStep(mid, node, true, config)
+ )
+ or
+ exists(Node mid, AccessPath ap0 |
+ flowFwd(mid, fromArg, _, ap0, config) and
+ localFlowBigStep(mid, node, false, config) and
+ ap0 instanceof AccessPathNil and
+ ap = TNil(getErasedRepr(node.getType())) and
+ apf = ap.(AccessPathNil).getFront()
+ )
+ or
+ exists(Node mid |
+ flowFwd(mid, _, apf, ap, config) and
+ jumpStep(mid, node, true, config) and
+ fromArg = false
+ )
+ or
+ exists(Node mid, AccessPath ap0 |
+ flowFwd(mid, _, _, ap0, config) and
+ jumpStep(mid, node, false, config) and
+ fromArg = false and
+ ap0 instanceof AccessPathNil and
+ ap = TNil(getErasedRepr(node.getType())) and
+ apf = ap.(AccessPathNil).getFront()
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowFwd(mid, _, apf, ap, config) and
+ flowIntoCallable(mid, node, allowsFieldFlow, config) and
+ fromArg = true and
+ (ap instanceof AccessPathNil or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowFwd(mid, false, apf, ap, config) and
+ flowOutOfCallable(mid, node, allowsFieldFlow, config) and
+ fromArg = false and
+ (ap instanceof AccessPathNil or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean preservesValue, AccessPathFront apf0, AccessPath ap0 |
+ flowFwd(mid, fromArg, apf0, ap0, config) and
+ flowThroughMethod(mid, node, preservesValue, config) and
+ (preservesValue = true and ap = ap0 and apf = apf0 or preservesValue = false and ap0 instanceof AccessPathNil and ap = TNil(getErasedRepr(node.getType())) and apf = ap.(AccessPathNil).getFront())
+ )
+ )
+ or
+ exists(Content f, AccessPath ap0 |
+ flowFwdStore(node, f, ap0, apf, fromArg, config) and
+ push(ap0, f, ap)
+ )
+ or
+ exists(Content f, AccessPath ap0 |
+ flowFwdRead(node, f, ap0, fromArg, config) and
+ popWithFront(ap0, f, apf, ap)
+ )
+ }
+ pragma[nomagic]
+ private predicate flowFwdStore(Node node, Content f, AccessPath ap0, AccessPathFront apf, boolean fromArg, Configuration config) {
+ exists(Node mid, AccessPathFront apf0 |
+ flowFwd(mid, fromArg, apf0, ap0, config) and
+ flowFwdStoreAux(mid, f, node, apf0, apf, config)
+ )
+ }
+ private predicate flowFwdStoreAux(Node mid, Content f, Node node, AccessPathFront apf0, AccessPathFront apf, Configuration config) {
+ store(mid, f, node) and
+ consCand(f, apf0, config) and
+ apf.headUsesContent(f) and
+ flowCand(node, _, apf, unbind(config))
+ }
+ pragma[nomagic]
+ private predicate flowFwdRead(Node node, Content f, AccessPath ap0, boolean fromArg, Configuration config) {
+ exists(Node mid, AccessPathFront apf0 |
+ flowFwd(mid, fromArg, apf0, ap0, config) and
+ read(mid, f, node) and
+ apf0.headUsesContent(f) and
+ flowCand(node, _, _, unbind(config))
+ )
+ }
+
+ /**
+ * Holds if data can flow from a source to `node` with the given `ap` and
+ * from there flow to a sink.
+ */
+ private predicate flow(Node node, boolean toReturn, AccessPath ap, Configuration config) {
+ flow0(node, toReturn, ap, config) and
+ flowFwd(node, _, _, ap, config)
+ }
+ private predicate flow0(Node node, boolean toReturn, AccessPath ap, Configuration config) {
+ flowFwd(node, _, _, ap, config) and
+ config.isSink(node) and toReturn = false and ap instanceof AccessPathNil
+ or
+ (
+ exists(Node mid |
+ localFlowBigStep(node, mid, true, config) and
+ flow(mid, toReturn, ap, config)
+ )
+ or
+ exists(Node mid, AccessPath ap0 |
+ flowFwd(node, _, _, ap, config) and
+ localFlowBigStep(node, mid, false, config) and
+ flow(mid, toReturn, ap0, config) and
+ ap0 instanceof AccessPathNil and
+ ap instanceof AccessPathNil
+ )
+ or
+ exists(Node mid |
+ jumpStep(node, mid, true, config) and
+ flow(mid, _, ap, config) and
+ toReturn = false
+ )
+ or
+ exists(Node mid, AccessPath ap0 |
+ flowFwd(node, _, _, ap, config) and
+ jumpStep(node, mid, false, config) and
+ flow(mid, _, ap0, config) and
+ toReturn = false and
+ ap0 instanceof AccessPathNil and
+ ap instanceof AccessPathNil
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowIntoCallable(node, mid, allowsFieldFlow, config) and
+ flow(mid, false, ap, config) and
+ toReturn = false and
+ (ap instanceof AccessPathNil or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowOutOfCallable(node, mid, allowsFieldFlow, config) and
+ flow(mid, _, ap, config) and
+ toReturn = true and
+ (ap instanceof AccessPathNil or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean preservesValue, AccessPath ap0 |
+ flowThroughMethod(node, mid, preservesValue, config) and
+ flow(mid, toReturn, ap0, config) and
+ (preservesValue = true and ap = ap0 or preservesValue = false and ap0 instanceof AccessPathNil and ap instanceof AccessPathNil and flowFwd(node, _, _, ap, config))
+ )
+ or
+ exists(Content f, AccessPath ap0 |
+ flowStore(node, f, toReturn, ap0, config) and
+ pop(ap0, f, ap)
+ )
+ or
+ exists(Content f, AccessPath ap0 |
+ flowRead(node, f, toReturn, ap0, config) and
+ push(ap0, f, ap)
+ )
+ )
+ }
+ pragma[nomagic]
+ private predicate flowStore(Node node, Content f, boolean toReturn, AccessPath ap0, Configuration config) {
+ exists(Node mid |
+ store(node, f, mid) and
+ flow(mid, toReturn, ap0, config)
+ )
+ }
+ pragma[nomagic]
+ private predicate flowRead(Node node, Content f, boolean toReturn, AccessPath ap0, Configuration config) {
+ exists(Node mid |
+ read(node, f, mid) and
+ flow(mid, toReturn, ap0, config)
+ )
+ }
+
+ private bindingset[conf, result] Configuration unbind(Configuration conf) { result >= conf and result <= conf }
+
+ private predicate flow(Node n, Configuration config) {
+ flow(n, _, _, config)
+ }
+
+ private newtype TPathNode =
+ TPathNodeMid(Node node, CallContext cc, AccessPath ap, Configuration config) {
+ // A PathNode is introduced by a source ...
+ flow(node, config) and
+ config.isSource(node) and
+ cc instanceof CallContextAny and
+ ap = TNil(getErasedRepr(node.getType()))
+ or
+ // ... or a step from an existing PathNode to another node.
+ exists(PathNodeMid mid |
+ flowStep(mid, node, cc, ap) and
+ config = mid.getConfiguration() and
+ flow(node, _, ap, unbind(config))
+ )
+ } or
+ TPathNodeSink(Node node, Configuration config) { // The AccessPath on a sink is empty.
+ config.isSink(node) and
+ flow(node, config)
+ }
+
+ /**
+ * A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
+ * Only those `PathNode`s that are reachable from a source are generated.
+ */
+ abstract class PathNode extends TPathNode {
+ /** Gets a textual representation of this element. */
+ string toString() { result = getNode().toString() + ppAp() }
+ /** Gets the source location for this element. */
+ Location getLocation() { result = getNode().getLocation() }
+ /** Gets the underlying `Node`. */
+ abstract Node getNode();
+ /** Gets the associated configuration. */
+ abstract Configuration getConfiguration();
+ /** Gets a successor. */
+ abstract PathNode getSucc();
+ private string ppAp() {
+ this instanceof PathNodeSink and result = "" or
+ result = " [" + this.(PathNodeMid).getAp().toString() + "]"
+ }
+ }
+
+ /** Holds if `n` can reach a sink. */
+ private predicate reach(PathNode n) { n instanceof PathNodeSink or reach(n.getSucc()) }
+
+ /** Holds if `n1.getSucc() = n2` and `n2` can reach a sink. */
+ private predicate pathSucc(PathNode n1, PathNode n2) { n1.getSucc() = n2 and reach(n2) }
+
+ private predicate pathSuccPlus(PathNode n1, PathNode n2) = fastTC(pathSucc/2)(n1, n2)
+
+ /**
+ * Provides the query predicates needed to include a graph in a path-problem query.
+ */
+ module PathGraph {
+ /** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */
+ query predicate edges(PathNode a, PathNode b) { pathSucc(a, b) }
+ }
+
+ /**
+ * An intermediate flow graph node. This is a triple consisting of a `Node`,
+ * a `CallContext`, and a `Configuration`.
+ */
+ private class PathNodeMid extends PathNode, TPathNodeMid {
+ Node node;
+ CallContext cc;
+ AccessPath ap;
+ Configuration config;
+ PathNodeMid() { this = TPathNodeMid(node, cc, ap, config) }
+ override Node getNode() { result = node }
+ CallContext getCallContext() { result = cc }
+ AccessPath getAp() { result = ap }
+ override Configuration getConfiguration() { result = config }
+ private PathNodeMid getSuccMid() {
+ flowStep(this, result.getNode(), result.getCallContext(), result.getAp()) and
+ result.getConfiguration() = unbind(this.getConfiguration())
+ }
+ override PathNode getSucc() {
+ // an intermediate step to another intermediate node
+ result = getSuccMid()
+ or
+ // a final step to a sink via one or more local steps
+ localFlowStepPlus(node, result.getNode(), _, config) and
+ ap instanceof AccessPathNil and
+ result instanceof PathNodeSink and
+ result.getConfiguration() = unbind(this.getConfiguration())
+ or
+ // a final step to a sink via zero steps means we merge the last two steps to prevent trivial-looking edges
+ exists(PathNodeMid mid |
+ mid = getSuccMid() and
+ mid.getNode() = result.getNode() and
+ mid.getAp() instanceof AccessPathNil and
+ result instanceof PathNodeSink and
+ result.getConfiguration() = unbind(mid.getConfiguration())
+ )
+ or
+ // a direct step from a source to a sink if a node is both
+ this instanceof PathNodeSource and
+ result instanceof PathNodeSink and
+ this.getNode() = result.getNode() and
+ result.getConfiguration() = unbind(this.getConfiguration())
+ }
+ }
+
+ /**
+ * A flow graph node corresponding to a source.
+ */
+ private class PathNodeSource extends PathNodeMid {
+ PathNodeSource() {
+ getConfiguration().isSource(getNode()) and
+ getCallContext() instanceof CallContextAny and
+ getAp() instanceof AccessPathNil
+ }
+ }
+
+ /**
+ * A flow graph node corresponding to a sink. This is disjoint from the
+ * intermediate nodes in order to uniquely correspond to a given sink by
+ * excluding the `CallContext`.
+ */
+ private class PathNodeSink extends PathNode, TPathNodeSink {
+ Node node;
+ Configuration config;
+ PathNodeSink() { this = TPathNodeSink(node, config) }
+ override Node getNode() { result = node }
+ override Configuration getConfiguration() { result = config }
+ override PathNode getSucc() { none() }
+ }
+
+ /**
+ * Holds if data may flow from `mid` to `node`. The last step in or out of
+ * a callable is recorded by `cc`.
+ */
+ private predicate flowStep(PathNodeMid mid, Node node, CallContext cc, AccessPath ap) {
+ localFlowBigStep(mid.getNode(), node, true, mid.getConfiguration()) and
+ cc = mid.getCallContext() and
+ ap = mid.getAp()
+ or
+ localFlowBigStep(mid.getNode(), node, false, mid.getConfiguration()) and
+ cc = mid.getCallContext() and
+ mid.getAp() instanceof AccessPathNil and
+ ap = TNil(getErasedRepr(node.getType()))
+ or
+ jumpStep(mid.getNode(), node, true, mid.getConfiguration()) and
+ cc instanceof CallContextAny and
+ ap = mid.getAp()
+ or
+ jumpStep(mid.getNode(), node, false, mid.getConfiguration()) and
+ cc instanceof CallContextAny and
+ mid.getAp() instanceof AccessPathNil and
+ ap = TNil(getErasedRepr(node.getType()))
+ or
+ contentReadStep(mid, node, ap) and cc = mid.getCallContext()
+ or
+ exists(Content f, AccessPath ap0 | contentStoreStep(mid, node, ap0, f, cc) and push(ap0, f, ap))
+ or
+ flowOutOfArgument(mid, node, cc) and ap = mid.getAp()
+ or
+ flowIntoCallable(mid, node, _, cc, _) and ap = mid.getAp()
+ or
+ flowOutOfMethod(mid, node.asExpr(), cc) and ap = mid.getAp()
+ or
+ flowThroughMethod(mid, node.asExpr(), cc) and ap = TNil(getErasedRepr(node.getType()))
+ or
+ valueFlowThroughMethod(mid, node.asExpr(), cc) and ap = mid.getAp()
+ }
+
+ private predicate contentReadStep(PathNodeMid mid, Node node, AccessPath ap) {
+ exists(Content f, AccessPath ap0 |
+ ap0 = mid.getAp() and
+ read(mid.getNode(), f, node) and
+ pop(ap0, f, ap)
+ )
+ }
+
+ pragma[noinline]
+ private predicate contentStoreStep(PathNodeMid mid, Node node, AccessPath ap0, Content f, CallContext cc) {
+ ap0 = mid.getAp() and
+ store(mid.getNode(), f, node) and
+ cc = mid.getCallContext()
+ }
+
+ /**
+ * Holds if data may flow from `mid` to an exit of `m` in the context
+ * `innercc`, and the path did not flow through a parameter of `m`.
+ */
+ private predicate flowOutOfMethod0(PathNodeMid mid, Method m, CallContext innercc) {
+ exists(ReturnNode ret |
+ ret = mid.getNode() and
+ innercc = mid.getCallContext() and
+ m = returnNodeGetEnclosingCallable(ret) and
+ not innercc instanceof CallContextCall
+ )
+ }
+
+ /**
+ * Holds if data may flow from `mid` to `ma`. The last step of this path
+ * is a return from a method and is recorded by `cc`, if needed.
+ */
+ pragma[noinline]
+ private predicate flowOutOfMethod(PathNodeMid mid, MethodAccess ma, CallContext cc) {
+ exists(Method m, CallContext innercc |
+ flowOutOfMethod0(mid, m, innercc) and
+ resolveReturn(innercc, m, ma)
+ |
+ if reducedViableImplInReturn(m, ma) then cc = TReturn(m, ma) else cc = TAnyCallContext()
+ )
+ }
+
+ private predicate flowOutOfArgument(PathNodeMid mid, PostUpdateNode node, CallContext cc) {
+ exists(PostUpdateNode n, ParameterNode p, Callable callable, CallContext innercc, int i, Call call, ArgumentNode arg |
+ mid.getNode() = n and
+ parameterValueFlowsToUpdate(p, n) and
+ innercc = mid.getCallContext() and
+ p.isParameterOf(callable, i) and
+ resolveReturn(innercc, callable, call) and
+ node.getPreUpdateNode() = arg and
+ arg.argumentOf(call, i) and
+ flow(node, unbind(mid.getConfiguration()))
+ |
+ if reducedViableImplInReturn(callable, call) then cc = TReturn(callable, call) else cc = TAnyCallContext()
+ )
+ }
+
+ /**
+ * Holds if data may flow from `mid` to the `i`th argument of `call` in `cc`.
+ */
+ pragma[noinline]
+ private predicate flowIntoArg(PathNodeMid mid, int i, CallContext cc, Call call, boolean emptyAp) {
+ exists(ArgumentNode arg, AccessPath ap |
+ arg = mid.getNode() and
+ cc = mid.getCallContext() and
+ arg.argumentOf(call, i) and
+ ap = mid.getAp()
+ |
+ ap instanceof AccessPathNil and emptyAp = true or
+ ap instanceof AccessPathCons and emptyAp = false
+ )
+ }
+
+ pragma[noinline]
+ private predicate parameterCand(Callable callable, int i, Configuration config) {
+ exists(ParameterNode p |
+ flow(p, config) and
+ p.isParameterOf(callable, i)
+ )
+ }
+
+ pragma[nomagic]
+ private predicate flowIntoCallable0(PathNodeMid mid, Callable callable, int i, CallContext outercc, Call call, boolean emptyAp) {
+ flowIntoArg(mid, i, outercc, call, emptyAp) and
+ callable = resolveCall(call, outercc) and
+ parameterCand(callable, any(int j | j <= i and j >= i), mid.getConfiguration())
+ }
+
+ /**
+ * Holds if data may flow from `mid` to `p` through `call`. The contexts
+ * before and after entering the callable are `outercc` and `innercc`,
+ * respectively.
+ */
+ private predicate flowIntoCallable(PathNodeMid mid, ParameterNode p, CallContext outercc, CallContextCall innercc, Call call) {
+ exists(int i, Callable callable, boolean emptyAp |
+ flowIntoCallable0(mid, callable, i, outercc, call, emptyAp) and
+ p.isParameterOf(callable, i)
+ |
+ if reducedViableImplInCallContext(_, callable, call) then innercc = TSpecificCall(call, i, emptyAp) else innercc = TSomeCall(p, emptyAp)
+ )
+ }
+
+ /** Holds if data may flow from `p` to a return statement in the callable. */
+ pragma[nomagic]
+ private predicate paramFlowsThrough(ParameterNode p, CallContextCall cc, Configuration config) {
+ exists(PathNodeMid mid, ReturnNode ret |
+ mid.getNode() = ret and
+ cc = mid.getCallContext() and
+ config = mid.getConfiguration() and
+ mid.getAp() instanceof AccessPathNil
+ |
+ cc = TSomeCall(p, true) or
+ exists(int i | cc = TSpecificCall(_, i, true) |
+ p.isParameterOf(returnNodeGetEnclosingCallable(ret), i)
+ )
+ )
+ }
+
+ /**
+ * Holds if data may flow from `mid` to an argument of `methodcall`,
+ * through a called method `m`, and back out through a return statement in
+ * `m`. The context `cc` is restored to its value prior to entering `m`.
+ */
+ pragma[noinline]
+ private predicate flowThroughMethod(PathNodeMid mid, Call methodcall, CallContext cc) {
+ exists(ParameterNode p, CallContext innercc |
+ flowIntoCallable(mid, p, cc, innercc, methodcall) and
+ paramFlowsThrough(p, innercc, unbind(mid.getConfiguration())) and
+ not parameterValueFlowsThrough(p) and
+ mid.getAp() instanceof AccessPathNil
+ )
+ }
+
+ private predicate valueFlowThroughMethod(PathNodeMid mid, Call methodcall, CallContext cc) {
+ exists(ParameterNode p |
+ flowIntoCallable(mid, p, cc, _, methodcall) and
+ parameterValueFlowsThrough(p)
+ )
+ }
+
+ /**
+ * Holds if data can flow (inter-procedurally) from `source` to `sink`.
+ *
+ * Will only have results if `configuration` has non-empty sources and
+ * sinks.
+ */
+ private predicate flowsTo(PathNodeSource flowsource, PathNodeSink flowsink, Node source, Node sink, Configuration configuration) {
+ flowsource.getConfiguration() = configuration and
+ flowsource.getNode() = source and
+ pathSuccPlus(flowsource, flowsink) and
+ flowsink.getNode() = sink
+ }
+
+ /**
+ * Holds if data can flow (inter-procedurally) from `source` to `sink`.
+ *
+ * Will only have results if `configuration` has non-empty sources and
+ * sinks.
+ */
+ predicate flowsTo(Node source, Node sink, Configuration configuration) {
+ flowsTo(_, _, source, sink, configuration)
+ }
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll
new file mode 100644
index 000000000000..142ea7f8a7e9
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll
@@ -0,0 +1,1536 @@
+/**
+ * Provides an implementation of global (interprocedural) data flow. This file
+ * re-exports the local (intraprocedural) data flow analysis from `DataFlowUtil`
+ * and adds a global analysis, mainly exposed through the `Configuration` class.
+ * This file exists in several identical copies, allowing queries to use
+ * multiple `Configuration` classes that depend on each other without
+ * introducing mutual recursion among those configurations.
+ */
+
+ import DataFlowUtil
+ private import DataFlowPrivate
+ private import DataFlowDispatch
+ private import DataFlowImplCommon
+
+
+ /**
+ * A configuration of interprocedural data flow analysis. This defines
+ * sources, sinks, and any other configurable aspect of the analysis. Each
+ * use of the global data flow library must define its own unique extension
+ * of this abstract class. To create a configuration, extend this class with
+ * a subclass whose characteristic predicate is a unique singleton string.
+ * For example, write
+ *
+ * ```
+ * class MyAnalysisConfiguration extends DataFlow::Configuration {
+ * MyAnalysisConfiguration() { this = "MyAnalysisConfiguration" }
+ * // Override `isSource` and `isSink`.
+ * // Optionally override `isBarrier`.
+ * // Optionally override `isAdditionalFlowStep`.
+ * }
+ * ```
+ *
+ * Then, to query whether there is flow between some `source` and `sink`,
+ * write
+ *
+ * ```
+ * exists(MyAnalysisConfiguration cfg | cfg.hasFlow(source, sink))
+ * ```
+ *
+ * Multiple configurations can coexist, but two classes extending
+ * `DataFlow::Configuration` should never depend on each other. One of them
+ * should instead depend on a `DataFlow2::Configuration`, a
+ * `DataFlow3::Configuration`, or a `DataFlow4::Configuration`.
+ */
+ abstract class Configuration extends string {
+ bindingset[this]
+ Configuration() { any() }
+
+ /**
+ * Holds if `source` is a relevant data flow source.
+ */
+ abstract predicate isSource(Node source);
+
+ /**
+ * Holds if `sink` is a relevant data flow sink.
+ */
+ abstract predicate isSink(Node sink);
+
+ /** Holds if data flow through `node` is prohibited. */
+ predicate isBarrier(Node node) { none() }
+
+ /** Holds if data flow from `node1` to `node2` is prohibited. */
+ predicate isBarrierEdge(Node node1, Node node2) { none() }
+
+ /**
+ * Holds if the additional flow step from `node1` to `node2` must be taken
+ * into account in the analysis.
+ */
+ predicate isAdditionalFlowStep(Node node1, Node node2) { none() }
+
+ /**
+ * Gets the virtual dispatch branching limit when calculating field flow.
+ * This can be overridden to a smaller value to improve performance (a
+ * value of 0 disables field flow), or a larger value to get more results.
+ */
+ int fieldFlowBranchLimit() { result = 2 }
+
+ /**
+ * Holds if data may flow from `source` to `sink` for this configuration.
+ */
+ predicate hasFlow(Node source, Node sink) {
+ flowsTo(source, sink, this)
+ }
+
+ /**
+ * Holds if data may flow from `source` to `sink` for this configuration.
+ *
+ * The corresponding paths are generated from the end-points and the graph
+ * included in the module `PathGraph`.
+ */
+ predicate hasFlowPath(PathNode source, PathNode sink) {
+ flowsTo(source, sink, _, _, this)
+ }
+
+ /**
+ * Holds if data may flow from some source to `sink` for this configuration.
+ */
+ predicate hasFlowTo(Node sink) {
+ hasFlow(_, sink)
+ }
+
+ /**
+ * Holds if data may flow from some source to `sink` for this configuration.
+ */
+ predicate hasFlowToExpr(Expr sink) {
+ hasFlowTo(exprNode(sink))
+ }
+
+ /** DEPRECATED: use `hasFlow` instead. */
+ deprecated predicate hasFlowForward(Node source, Node sink) {
+ hasFlow(source, sink)
+ }
+
+ /** DEPRECATED: use `hasFlow` instead. */
+ deprecated predicate hasFlowBackward(Node source, Node sink) {
+ hasFlow(source, sink)
+ }
+ }
+
+ /**
+ * Holds if the additional step from `node1` to `node2` jumps between callables.
+ */
+ private predicate additionalJumpStep(Node node1, Node node2, Configuration config) {
+ config.isAdditionalFlowStep(node1, node2) and
+ node1.getEnclosingCallable() != node2.getEnclosingCallable()
+ }
+
+ pragma[noinline]
+ private predicate isAdditionalFlowStep(Node node1, Node node2, Callable callable1, Callable callable2, Configuration config) {
+ config.isAdditionalFlowStep(node1, node2) and
+ callable1 = node1.getEnclosingCallable() and
+ callable2 = node2.getEnclosingCallable()
+ }
+
+ /**
+ * Holds if the additional step from `node1` to `node2` does not jump between callables.
+ */
+ private predicate additionalLocalFlowStep(Node node1, Node node2, Configuration config) {
+ exists(Callable callable |
+ isAdditionalFlowStep(node1, node2, callable, callable, config)
+ )
+ }
+
+ /**
+ * Holds if data can flow from `node1` to `node2` through a static field or
+ * variable capture.
+ */
+ private predicate jumpStep(Node node1, Node node2, boolean preservesValue, Configuration config) {
+ jumpStep(node1, node2) and preservesValue = true or
+ additionalJumpStep(node1, node2, config) and preservesValue = false
+ }
+
+ /**
+ * Holds if data can flow in one local step from `node1` to `node2` taking
+ * additional steps from the configuration into account.
+ */
+ private predicate localFlowStep(Node node1, Node node2, boolean preservesValue, Configuration config) {
+ localFlowStep(node1, node2) and not config.isBarrierEdge(node1, node2) and preservesValue = true or
+ additionalLocalFlowStep(node1, node2, config) and preservesValue = false
+ }
+
+ pragma[noinline]
+ private Method returnNodeGetEnclosingCallable(ReturnNode ret) {
+ result = ret.getEnclosingCallable()
+ }
+
+ /**
+ * Holds if field flow should be used for the given configuration.
+ */
+ private predicate useFieldFlow(Configuration config) {
+ config.fieldFlowBranchLimit() >= 1
+ }
+
+ /**
+ * Holds if `node` is reachable from a source in the given configuration
+ * ignoring call contexts.
+ */
+ private predicate nodeCandFwd1(Node node, boolean stored, Configuration config) {
+ not config.isBarrier(node) and
+ (
+ config.isSource(node) and stored = false
+ or
+ exists(Node mid, boolean preservesValue |
+ nodeCandFwd1(mid, stored, config) and
+ localFlowStep(mid, node, preservesValue, config) and
+ (stored = false or preservesValue = true)
+ )
+ or
+ exists(Node mid, boolean preservesValue |
+ nodeCandFwd1(mid, stored, config) and
+ jumpStep(mid, node, preservesValue, config) and
+ (stored = false or preservesValue = true)
+ )
+ or
+ // store
+ exists(Node mid |
+ useFieldFlow(config) and
+ nodeCandFwd1(mid, _, config) and
+ store(mid, _, node) and
+ stored = true
+ )
+ or
+ // read
+ exists(Node mid, Content f |
+ nodeCandFwd1(mid, true, config) and
+ read(mid, f, node) and
+ storeCandFwd1(f, unbind(config)) and
+ (stored = false or stored = true)
+ )
+ or
+ // flow into a callable
+ exists(Node arg |
+ nodeCandFwd1(arg, stored, config) and
+ viableParamArg(node, arg)
+ )
+ or
+ // flow out of an argument
+ exists(PostUpdateNode mid, ParameterNode p |
+ nodeCandFwd1(mid, stored, config) and
+ parameterValueFlowsToUpdate(p, mid) and
+ viableParamArg(p, node.(PostUpdateNode).getPreUpdateNode())
+ )
+ or
+ // flow out of a callable
+ exists(Method m, MethodAccess ma, ReturnNode ret |
+ nodeCandFwd1(ret, stored, config) and
+ m = returnNodeGetEnclosingCallable(ret) and
+ m = viableImpl(ma) and
+ node.asExpr() = ma
+ )
+ )
+ }
+
+ /**
+ * Holds if `f` is the target of a store in the flow covered by `nodeCandFwd1`.
+ */
+ private predicate storeCandFwd1(Content f, Configuration config) {
+ exists(Node mid, Node node |
+ not config.isBarrier(node) and
+ useFieldFlow(unbind(config)) and
+ nodeCandFwd1(mid, _, config) and
+ store(mid, f, node)
+ )
+ }
+
+ bindingset[result, b]
+ private boolean unbindBool(boolean b) { result != b.booleanNot() }
+
+ /**
+ * Holds if `node` is part of a path from a source to a sink in the given
+ * configuration ignoring call contexts.
+ */
+ pragma[nomagic]
+ private predicate nodeCand1(Node node, boolean stored, Configuration config) {
+ nodeCandFwd1(node, false, config) and
+ config.isSink(node) and stored = false
+ or
+ nodeCandFwd1(node, unbindBool(stored), unbind(config)) and
+ (
+ exists(Node mid, boolean preservesValue |
+ localFlowStep(node, mid, preservesValue, config) and
+ nodeCand1(mid, stored, config) and
+ (stored = false or preservesValue = true)
+ )
+ or
+ exists(Node mid, boolean preservesValue |
+ jumpStep(node, mid, preservesValue, config) and
+ nodeCand1(mid, stored, config) and
+ (stored = false or preservesValue = true)
+ )
+ or
+ // store
+ exists(Node mid, Content f |
+ store(node, f, mid) and
+ readCand1(f, unbind(config)) and
+ nodeCand1(mid, true, config) and
+ (stored = false or stored = true)
+ )
+ or
+ // read
+ exists(Node mid, Content f |
+ read(node, f, mid) and
+ storeCandFwd1(f, unbind(config)) and
+ nodeCand1(mid, _, config) and
+ stored = true
+ )
+ or
+ // flow into a callable
+ exists(Node param |
+ viableParamArg(param, node) and
+ nodeCand1(param, stored, config)
+ )
+ or
+ // flow out of an argument
+ exists(PostUpdateNode mid, ParameterNode p |
+ parameterValueFlowsToUpdate(p, node) and
+ viableParamArg(p, mid.getPreUpdateNode()) and
+ nodeCand1(mid, stored, config)
+ )
+ or
+ // flow out of a callable
+ exists(Method m, ExprNode ma |
+ nodeCand1(ma, stored, config) and
+ m = returnNodeGetEnclosingCallable(node) and
+ m = viableImpl(ma.getExpr())
+ )
+ )
+ }
+
+ /**
+ * Holds if `f` is the target of a read in the flow covered by `nodeCand1`.
+ */
+ private predicate readCand1(Content f, Configuration config) {
+ exists(Node mid, Node node |
+ useFieldFlow(unbind(config)) and
+ nodeCandFwd1(node, true, unbind(config)) and
+ read(node, f, mid) and
+ storeCandFwd1(f, unbind(config)) and
+ nodeCand1(mid, _, config)
+ )
+ }
+
+ /**
+ * Holds if there is a path from `p` to `node` in the same callable that is
+ * part of a path from a source to a sink taking simple call contexts into
+ * consideration. This is restricted to paths that does not necessarily
+ * preserve the value of `p` by making use of at least one additional step
+ * from the configuration.
+ */
+ pragma[nomagic]
+ private predicate simpleParameterFlow(ParameterNode p, Node node, RefType t, Configuration config) {
+ nodeCand1(node, false, config) and
+ p = node and
+ t = getErasedRepr(node.getType()) and
+ not parameterValueFlowsThrough(p)
+ or
+ nodeCand1(node, false, unbind(config)) and
+ exists(Node mid |
+ simpleParameterFlow(p, mid, t, config) and
+ localFlowStep(mid, node, true, config) and
+ compatibleTypes(t, node.getType())
+ )
+ or
+ nodeCand1(node, false, unbind(config)) and
+ exists(Node mid |
+ simpleParameterFlow(p, mid, _, config) and
+ localFlowStep(mid, node, false, config) and
+ t = getErasedRepr(node.getType())
+ )
+ or
+ nodeCand1(node, false, unbind(config)) and
+ exists(Node mid |
+ simpleParameterFlow(p, mid, t, config) and
+ localStoreReadStep(mid, node) and
+ compatibleTypes(t, node.getType())
+ )
+ or
+ // value flow through a callable
+ nodeCand1(node, false, config) and
+ exists(Node arg |
+ simpleParameterFlow(p, arg, t, config) and
+ argumentValueFlowsThrough(arg, node) and
+ compatibleTypes(t, node.getType())
+ )
+ or
+ // flow through a callable
+ nodeCand1(node, false, config) and
+ exists(Node arg |
+ simpleParameterFlow(p, arg, _, config) and
+ simpleArgumentFlowsThrough(arg, node, t, config)
+ )
+ }
+
+ /**
+ * Holds if data can flow from `arg` through the `call` taking simple call
+ * contexts into consideration and that this is part of a path from a source
+ * to a sink. This is restricted to paths through the `call` that does not
+ * necessarily preserve the value of `arg` by making use of at least one
+ * additional step from the configuration.
+ */
+ private predicate simpleArgumentFlowsThrough(ArgumentNode arg, ExprNode call, RefType t, Configuration config) {
+ exists(ParameterNode param, ReturnNode ret |
+ nodeCand1(arg, false, unbind(config)) and
+ nodeCand1(call, false, unbind(config)) and
+ viableParamArg(param, arg) and
+ simpleParameterFlow(param, ret, t, config) and
+ arg.argumentOf(call.getExpr(), _)
+ )
+ }
+
+ /**
+ * Holds if data can flow from `node1` to `node2` by a step through a method.
+ */
+ private predicate flowThroughMethod(Node node1, Node node2, boolean preservesValue, Configuration config) {
+ simpleArgumentFlowsThrough(node1, node2, _, config) and preservesValue = false or
+ argumentValueFlowsThrough(node1, node2) and preservesValue = true
+ }
+
+ /**
+ * Holds if data can flow from `node1` to `node2` in one local step or a step
+ * through a method.
+ */
+ private predicate localFlowStepOrFlowThroughMethod(Node node1, Node node2, boolean preservesValue, Configuration config) {
+ localFlowStep(node1, node2, preservesValue, config) or
+ flowThroughMethod(node1, node2, preservesValue, config)
+ }
+
+ /**
+ * Holds if data can flow out of a callable from `node1` to `node2`, either
+ * through a `ReturnNode` or through an argument that has been mutated, and
+ * that this step is part of a path from a source to a sink.
+ */
+ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config) {
+ nodeCand1(node1, _, unbind(config)) and
+ nodeCand1(node2, _, config) and
+ (
+ // flow out of an argument
+ exists(ParameterNode p |
+ parameterValueFlowsToUpdate(p, node1) and
+ viableParamArg(p, node2.(PostUpdateNode).getPreUpdateNode())
+ )
+ or
+ // flow out of a method
+ exists(Method m, MethodAccess ma, ReturnNode ret |
+ ret = node1 and
+ m = returnNodeGetEnclosingCallable(ret) and
+ m = viableImpl(ma) and
+ node2.asExpr() = ma
+ )
+ )
+ }
+
+ /**
+ * Holds if data can flow into a callable and that this step is part of a
+ * path from a source to a sink.
+ */
+ private predicate flowIntoCallable(Node node1, Node node2, Configuration config) {
+ viableParamArg(node2, node1) and
+ nodeCand1(node1, _, unbind(config)) and
+ nodeCand1(node2, _, config)
+ }
+
+ /**
+ * Gets the amount of forward branching on the origin of a cross-call path
+ * edge in the graph of paths between sources and sinks that ignores call
+ * contexts.
+ */
+ private int branch(Node n1, Configuration conf) {
+ result = strictcount(Node n | flowOutOfCallable(n1, n, conf) or flowIntoCallable(n1, n, conf))
+ }
+
+ /**
+ * Gets the amount of backward branching on the target of a cross-call path
+ * edge in the graph of paths between sources and sinks that ignores call
+ * contexts.
+ */
+ private int join(Node n2, Configuration conf) {
+ result = strictcount(Node n | flowOutOfCallable(n, n2, conf) or flowIntoCallable(n, n2, conf))
+ }
+
+ /**
+ * Holds if data can flow out of a callable from `node1` to `node2`, either
+ * through a `ReturnNode` or through an argument that has been mutated, and
+ * that this step is part of a path from a source to a sink. The
+ * `allowsFieldFlow` flag indicates whether the branching is within the limit
+ * specified by the configuration.
+ */
+ private predicate flowOutOfCallable(Node node1, Node node2, boolean allowsFieldFlow, Configuration config) {
+ flowOutOfCallable(node1, node2, config) and
+ exists(int b, int j |
+ b = branch(node1, config) and
+ j = join(node2, config) and
+ if b.minimum(j) <= config.fieldFlowBranchLimit() then allowsFieldFlow = true else allowsFieldFlow = false
+ )
+ }
+
+ /**
+ * Holds if data can flow into a callable and that this step is part of a
+ * path from a source to a sink. The `allowsFieldFlow` flag indicates whether
+ * the branching is within the limit specified by the configuration.
+ */
+ private predicate flowIntoCallable(Node node1, Node node2, boolean allowsFieldFlow, Configuration config) {
+ flowIntoCallable(node1, node2, config) and
+ exists(int b, int j |
+ b = branch(node1, config) and
+ j = join(node2, config) and
+ if b.minimum(j) <= config.fieldFlowBranchLimit() then allowsFieldFlow = true else allowsFieldFlow = false
+ )
+ }
+
+ /**
+ * Holds if `node` is part of a path from a source to a sink in the given
+ * configuration taking simple call contexts into consideration.
+ */
+ private predicate nodeCandFwd2(Node node, boolean fromArg, boolean stored, Configuration config) {
+ nodeCand1(node, false, config) and
+ config.isSource(node) and fromArg = false and stored = false
+ or
+ nodeCand1(node, unbindBool(stored), unbind(config)) and
+ (
+ exists(Node mid, boolean preservesValue |
+ nodeCandFwd2(mid, fromArg, stored, config) and
+ localFlowStepOrFlowThroughMethod(mid, node, preservesValue, config) and
+ (stored = false or preservesValue = true)
+ )
+ or
+ exists(Node mid, boolean preservesValue |
+ nodeCandFwd2(mid, _, stored, config) and
+ jumpStep(mid, node, preservesValue, config) and
+ fromArg = false and
+ (stored = false or preservesValue = true)
+ )
+ or
+ // store
+ exists(Node mid, Content f |
+ nodeCandFwd2(mid, fromArg, _, config) and
+ store(mid, f, node) and
+ readCand1(f, unbind(config)) and
+ stored = true
+ )
+ or
+ // read
+ exists(Node mid, Content f |
+ nodeCandFwd2(mid, fromArg, true, config) and
+ read(mid, f, node) and
+ storeCandFwd2(f, unbind(config)) and
+ (stored = false or stored = true)
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ nodeCandFwd2(mid, _, stored, config) and
+ flowIntoCallable(mid, node, allowsFieldFlow, config) and
+ fromArg = true and
+ (stored = false or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ nodeCandFwd2(mid, false, stored, config) and
+ flowOutOfCallable(mid, node, allowsFieldFlow, config) and
+ fromArg = false and
+ (stored = false or allowsFieldFlow = true)
+ )
+ )
+ }
+
+ /**
+ * Holds if `f` is the target of a store in the flow covered by `nodeCandFwd2`.
+ */
+ private predicate storeCandFwd2(Content f, Configuration config) {
+ exists(Node mid, Node node |
+ useFieldFlow(unbind(config)) and
+ nodeCand1(node, true, unbind(config)) and
+ nodeCandFwd2(mid, _, _, config) and
+ store(mid, f, node) and
+ readCand1(f, unbind(config))
+ )
+ }
+
+ /**
+ * Holds if `node` is part of a path from a source to a sink in the given
+ * configuration taking simple call contexts into consideration.
+ */
+ private predicate nodeCand2(Node node, boolean toReturn, boolean stored, Configuration config) {
+ nodeCandFwd2(node, _, false, config) and
+ config.isSink(node) and toReturn = false and stored = false
+ or
+ nodeCandFwd2(node, _, unbindBool(stored), unbind(config)) and
+ (
+ exists(Node mid, boolean preservesValue |
+ localFlowStepOrFlowThroughMethod(node, mid, preservesValue, config) and
+ nodeCand2(mid, toReturn, stored, config) and
+ (stored = false or preservesValue = true)
+ )
+ or
+ exists(Node mid, boolean preservesValue |
+ jumpStep(node, mid, preservesValue, config) and
+ nodeCand2(mid, _, stored, config) and
+ toReturn = false and
+ (stored = false or preservesValue = true)
+ )
+ or
+ // store
+ exists(Node mid, Content f |
+ store(node, f, mid) and
+ readCand2(f, unbind(config)) and
+ nodeCand2(mid, toReturn, true, config) and
+ (stored = false or stored = true)
+ )
+ or
+ // read
+ exists(Node mid, Content f |
+ read(node, f, mid) and
+ storeCandFwd2(f, unbind(config)) and
+ nodeCand2(mid, toReturn, _, config) and
+ stored = true
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowIntoCallable(node, mid, allowsFieldFlow, config) and
+ nodeCand2(mid, false, stored, config) and
+ toReturn = false and
+ (stored = false or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowOutOfCallable(node, mid, allowsFieldFlow, config) and
+ nodeCand2(mid, _, stored, config) and
+ toReturn = true and
+ (stored = false or allowsFieldFlow = true)
+ )
+ )
+ }
+
+ /**
+ * Holds if `f` is the target of a read in the flow covered by `nodeCand2`.
+ */
+ private predicate readCand2(Content f, Configuration config) {
+ exists(Node mid, Node node |
+ useFieldFlow(unbind(config)) and
+ nodeCandFwd2(node, _, true, unbind(config)) and
+ read(node, f, mid) and
+ storeCandFwd2(f, unbind(config)) and
+ nodeCand2(mid, _, _, config)
+ )
+ }
+
+ private predicate storeCand(Content f, Configuration conf) {
+ exists(Node n1, Node n2 |
+ store(n1, f, n2) and
+ nodeCand2(n1, _, _, conf) and
+ nodeCand2(n2, _, _, unbind(conf))
+ )
+ }
+
+ private predicate readCand(Content f, Configuration conf) {
+ readCand2(f, conf)
+ }
+
+ /**
+ * Holds if `f` is the target of both a store and a read in the path graph
+ * covered by `nodeCand2`.
+ */
+ pragma[noinline]
+ private predicate readStoreCand(Content f, Configuration conf) {
+ storeCand(f, conf) and
+ readCand(f, conf)
+ }
+
+ private predicate nodeCand(Node node, Configuration config) {
+ nodeCand2(node, _, _, config)
+ }
+
+ /**
+ * Holds if `node` can be the first node in a maximal subsequence of local
+ * flow steps in a dataflow path.
+ */
+ private predicate localFlowEntry(Node node, Configuration config) {
+ nodeCand(node, config) and
+ (
+ config.isSource(node) or
+ jumpStep(_, node, _, config) or
+ node instanceof ParameterNode or
+ node.asExpr() instanceof MethodAccess or
+ node instanceof PostUpdateNode or
+ read(_, _, node) or
+ node.asExpr() instanceof CastExpr
+ )
+ }
+
+ /**
+ * Holds if `node` can be the last node in a maximal subsequence of local
+ * flow steps in a dataflow path.
+ */
+ private predicate localFlowExit(Node node, Configuration config) {
+ exists(Node next |
+ nodeCand(next, config)
+ |
+ jumpStep(node, next, _, config) or
+ flowIntoCallable(node, next, config) or
+ flowOutOfCallable(node, next, config) or
+ flowThroughMethod(node, next, _, config) or
+ store(node, _, next) or
+ read(node, _, next)
+ ) or
+ node.asExpr() instanceof CastExpr or
+ config.isSink(node)
+ }
+
+ /**
+ * Holds if the local path from `node1` to `node2` is a prefix of a maximal
+ * subsequence of local flow steps in a dataflow path.
+ *
+ * This is the transitive closure of `localFlowStep` beginning at `localFlowEntry`.
+ */
+ private predicate localFlowStepPlus(Node node1, Node node2, boolean preservesValue, Configuration config) {
+ localFlowEntry(node1, config) and
+ localFlowStep(node1, node2, preservesValue, config) and
+ node1 != node2 and
+ nodeCand(node2, unbind(config))
+ or
+ exists(Node mid, boolean pv1, boolean pv2 |
+ localFlowStepPlus(node1, mid, pv1, config) and
+ localFlowStep(mid, node2, pv2, config) and
+ not mid.asExpr() instanceof CastExpr and
+ preservesValue = pv1.booleanAnd(pv2) and
+ nodeCand(node2, unbind(config))
+ )
+ }
+
+ /**
+ * Holds if `node1` can step to `node2` in one or more local steps and this
+ * path can occur as a maximal subsequence of local steps in a dataflow path.
+ */
+ pragma[noinline]
+ private predicate localFlowBigStep(Node node1, Node node2, boolean preservesValue, Configuration config) {
+ localFlowStepPlus(node1, node2, preservesValue, config) and
+ localFlowExit(node2, config)
+ }
+
+ /**
+ * Holds if `f` may contain an object of the same type, `t`, as the one
+ * that contains `f`, and if this fact should be used to compress
+ * access paths.
+ *
+ * Examples include the tail pointer in a linked list or the left and right
+ * pointers in a binary tree.
+ */
+ private predicate selfRef(Content f, RefType t) {
+ t = f.getDeclaringType() and
+ f.isSelfRef()
+ }
+
+ private newtype TFlowContainer =
+ TRegularContent(Content f) { not selfRef(f, _) } or
+ TSelfRefContent(RefType t) { selfRef(_, t) }
+
+ /**
+ * A `Content` or a `Content` abstracted as its declaring type.
+ *
+ * Sequences of one or more `Content`s in the same declaring type for which
+ * `isSelfRef()` holds are represented as a single `FlowContainer` in an
+ * `AccessPath`.
+ */
+ private class FlowContainer extends TFlowContainer {
+ string toString() {
+ exists(Content f | this = TRegularContent(f) and result = f.toString()) or
+ exists(RefType t | this = TSelfRefContent(t) and result = t.toString())
+ }
+ predicate usesContent(Content f) {
+ this = TRegularContent(f) or
+ exists(RefType t | this = TSelfRefContent(t) and selfRef(f, t))
+ }
+ RefType getContainerType() {
+ exists(Content f | this = TRegularContent(f) and result = f.getDeclaringType()) or
+ this = TSelfRefContent(result)
+ }
+ }
+
+ private newtype TAccessPathFront = TFrontNil(Type t) or TFrontHead(FlowContainer f)
+
+ /**
+ * The front of an `AccessPath`. This is either a head or a nil.
+ */
+ private class AccessPathFront extends TAccessPathFront {
+ string toString() {
+ exists(Type t | this = TFrontNil(t) | result = t.toString()) or
+ exists(FlowContainer f | this = TFrontHead(f) | result = f.toString())
+ }
+ Type getType() {
+ this = TFrontNil(result) or
+ exists(FlowContainer head | this = TFrontHead(head) | result = head.getContainerType())
+ }
+ predicate headUsesContent(Content f) {
+ exists(FlowContainer fc |
+ fc.usesContent(f) and
+ this = TFrontHead(fc)
+ )
+ }
+ }
+
+ private class AccessPathFrontNil extends AccessPathFront, TFrontNil {
+ }
+
+ /**
+ * A `Node` at which a cast can occur such that the type should be checked.
+ */
+ private class CastingNode extends Node {
+ CastingNode() {
+ this instanceof ParameterNode or
+ this.asExpr() instanceof CastExpr or
+ this.asExpr() instanceof MethodAccess or
+ this.(PostUpdateNode).getPreUpdateNode() instanceof ArgumentNode
+ }
+ }
+
+ /**
+ * Holds if data can flow from a source to `node` with the given `apf`.
+ */
+ private predicate flowCandFwd(Node node, boolean fromArg, AccessPathFront apf, Configuration config) {
+ flowCandFwd0(node, fromArg, apf, config) and
+ if node instanceof CastingNode then
+ compatibleTypes(node.getType(), apf.getType())
+ else
+ any()
+ }
+ private predicate flowCandFwd0(Node node, boolean fromArg, AccessPathFront apf, Configuration config) {
+ nodeCand2(node, _, false, config) and
+ config.isSource(node) and fromArg = false and apf = TFrontNil(getErasedRepr(node.getType()))
+ or
+ nodeCand(node, unbind(config)) and
+ (
+ exists(Node mid |
+ flowCandFwd(mid, fromArg, apf, config) and
+ localFlowBigStep(mid, node, true, config)
+ )
+ or
+ exists(Node mid, AccessPathFront apf0 |
+ flowCandFwd(mid, fromArg, apf0, config) and
+ localFlowBigStep(mid, node, false, config) and
+ apf0 instanceof AccessPathFrontNil and
+ apf = TFrontNil(getErasedRepr(node.getType()))
+ )
+ or
+ exists(Node mid |
+ flowCandFwd(mid, _, apf, config) and
+ jumpStep(mid, node, true, config) and
+ fromArg = false
+ )
+ or
+ exists(Node mid, AccessPathFront apf0 |
+ flowCandFwd(mid, _, apf0, config) and
+ jumpStep(mid, node, false, config) and
+ fromArg = false and
+ apf0 instanceof AccessPathFrontNil and
+ apf = TFrontNil(getErasedRepr(node.getType()))
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowCandFwd(mid, _, apf, config) and
+ flowIntoCallable(mid, node, allowsFieldFlow, config) and
+ fromArg = true and
+ (apf instanceof AccessPathFrontNil or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowCandFwd(mid, false, apf, config) and
+ flowOutOfCallable(mid, node, allowsFieldFlow, config) and
+ fromArg = false and
+ (apf instanceof AccessPathFrontNil or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean preservesValue, AccessPathFront apf0 |
+ flowCandFwd(mid, fromArg, apf0, config) and
+ flowThroughMethod(mid, node, preservesValue, config) and
+ (preservesValue = true and apf = apf0 or preservesValue = false and apf0 instanceof AccessPathFrontNil and apf = TFrontNil(getErasedRepr(node.getType())))
+ )
+ )
+ or
+ exists(Node mid, Content f |
+ flowCandFwd(mid, fromArg, _, config) and
+ store(mid, f, node) and
+ nodeCand(node, unbind(config)) and
+ apf.headUsesContent(f)
+ )
+ or
+ exists(Node mid, Content f, AccessPathFront apf0 |
+ flowCandFwd(mid, fromArg, apf0, config) and
+ read(mid, f, node) and
+ nodeCand(node, config) and
+ apf0.headUsesContent(f) and
+ consCandFwd(f, apf, unbind(config))
+ )
+ }
+ private predicate consCandFwd(Content f, AccessPathFront apf, Configuration config) {
+ exists(Node mid, Node n |
+ flowCandFwd(mid, _, apf, config) and
+ store(mid, f, n) and
+ nodeCand(n, unbind(config)) and
+ readStoreCand(f, unbind(config)) and
+ compatibleTypes(apf.getType(), f.getType())
+ )
+ }
+
+ /**
+ * Holds if data can flow from a source to `node` with the given `apf` and
+ * from there flow to a sink.
+ */
+ private predicate flowCand(Node node, boolean toReturn, AccessPathFront apf, Configuration config) {
+ flowCand0(node, toReturn, apf, config) and
+ flowCandFwd(node, _, apf, config)
+ }
+ private predicate flowCand0(Node node, boolean toReturn, AccessPathFront apf, Configuration config) {
+ flowCandFwd(node, _, apf, config) and
+ config.isSink(node) and toReturn = false and apf instanceof AccessPathFrontNil
+ or
+ (
+ exists(Node mid |
+ localFlowBigStep(node, mid, true, config) and
+ flowCand(mid, toReturn, apf, config)
+ )
+ or
+ exists(Node mid, AccessPathFront apf0 |
+ flowCandFwd(node, _, apf, config) and
+ localFlowBigStep(node, mid, false, config) and
+ flowCand(mid, toReturn, apf0, config) and
+ apf0 instanceof AccessPathFrontNil and
+ apf instanceof AccessPathFrontNil
+ )
+ or
+ exists(Node mid |
+ jumpStep(node, mid, true, config) and
+ flowCand(mid, _, apf, config) and
+ toReturn = false
+ )
+ or
+ exists(Node mid, AccessPathFront apf0 |
+ flowCandFwd(node, _, apf, config) and
+ jumpStep(node, mid, false, config) and
+ flowCand(mid, _, apf0, config) and
+ toReturn = false and
+ apf0 instanceof AccessPathFrontNil and
+ apf instanceof AccessPathFrontNil
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowIntoCallable(node, mid, allowsFieldFlow, config) and
+ flowCand(mid, false, apf, config) and
+ toReturn = false and
+ (apf instanceof AccessPathFrontNil or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowOutOfCallable(node, mid, allowsFieldFlow, config) and
+ flowCand(mid, _, apf, config) and
+ toReturn = true and
+ (apf instanceof AccessPathFrontNil or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean preservesValue, AccessPathFront apf0 |
+ flowThroughMethod(node, mid, preservesValue, config) and
+ flowCand(mid, toReturn, apf0, config) and
+ (preservesValue = true and apf = apf0 or preservesValue = false and apf0 instanceof AccessPathFrontNil and apf instanceof AccessPathFrontNil and flowCandFwd(node, _, apf, config))
+ )
+ or
+ exists(Node mid, Content f, AccessPathFront apf0 |
+ store(node, f, mid) and
+ flowCand(mid, toReturn, apf0, config) and
+ apf0.headUsesContent(f) and
+ consCand(f, apf, unbind(config))
+ )
+ or
+ exists(Node mid, Content f, AccessPathFront apf0 |
+ read(node, f, mid) and
+ flowCand(mid, toReturn, apf0, config) and
+ consCandFwd(f, apf0, unbind(config)) and
+ apf.headUsesContent(f)
+ )
+ )
+ }
+ private predicate consCand(Content f, AccessPathFront apf, Configuration config) {
+ consCandFwd(f, apf, config) and
+ exists(Node mid, Node n, AccessPathFront apf0 |
+ flowCandFwd(n, _, apf0, config) and
+ apf0.headUsesContent(f) and
+ read(n, f, mid) and
+ flowCand(mid, _, apf, config)
+ )
+ }
+
+ private newtype TAccessPath = TNil(Type t) or TCons(FlowContainer f, int len) { len in [1..5] }
+
+ /**
+ * Conceptually a list of `Content`s followed by a `Type`, but only the first
+ * element of the list and its length are tracked. If data flows from a source to
+ * a given node with a given `AccessPath`, this indicates the sequence of
+ * dereference operations needed to get from the value in the node to the
+ * tracked object. The final type indicates the type of the tracked object.
+ */
+ private class AccessPath extends TAccessPath {
+ abstract string toString();
+ FlowContainer getHead() { this = TCons(result, _) }
+ int len() {
+ this = TNil(_) and result = 0
+ or
+ this = TCons(_, result)
+ }
+ Type getType() {
+ this = TNil(result) or
+ exists(FlowContainer head | this = TCons(head, _) | result = head.getContainerType())
+ }
+ abstract AccessPathFront getFront();
+ }
+
+ private class AccessPathNil extends AccessPath, TNil {
+ override string toString() { exists(Type t | this = TNil(t) | result = t.toString()) }
+ override AccessPathFront getFront() { exists(Type t | this = TNil(t) | result = TFrontNil(t)) }
+ }
+
+ private class AccessPathCons extends AccessPath, TCons {
+ override string toString() {
+ exists(FlowContainer f, int len | this = TCons(f, len) | result = f.toString() + ", ... (" + len.toString() + ")")
+ }
+ override AccessPathFront getFront() { exists(FlowContainer f | this = TCons(f, _) | result = TFrontHead(f)) }
+ }
+
+ /** Holds if `ap0` corresponds to the cons of `f` and `ap`. */
+ private predicate pop(AccessPath ap0, Content f, AccessPath ap) {
+ ap0.getFront().headUsesContent(f) and
+ consCand(f, ap.getFront(), _) and
+ ap0.len() = 1 + ap.len()
+ }
+
+ /** Holds if `ap0` corresponds to the cons of `f` and `ap` and `apf` is the front of `ap`. */
+ pragma[noinline]
+ private predicate popWithFront(AccessPath ap0, Content f, AccessPathFront apf, AccessPath ap) {
+ pop(ap0, f, ap) and apf = ap.getFront()
+ }
+
+ /** Holds if `ap` corresponds to the cons of `f` and `ap0`. */
+ private predicate push(AccessPath ap0, Content f, AccessPath ap) { pop(ap, f, ap0) }
+
+ /**
+ * Holds if data can flow from a source to `node` with the given `ap`.
+ */
+ private predicate flowFwd(Node node, boolean fromArg, AccessPathFront apf, AccessPath ap, Configuration config) {
+ flowFwd0(node, fromArg, apf, ap, config) and
+ flowCand(node, _, apf, config)
+ }
+ private predicate flowFwd0(Node node, boolean fromArg, AccessPathFront apf, AccessPath ap, Configuration config) {
+ flowCand(node, _, _, config) and
+ config.isSource(node) and fromArg = false and ap = TNil(getErasedRepr(node.getType())) and apf = ap.(AccessPathNil).getFront()
+ or
+ flowCand(node, _, _, unbind(config)) and
+ (
+ exists(Node mid |
+ flowFwd(mid, fromArg, apf, ap, config) and
+ localFlowBigStep(mid, node, true, config)
+ )
+ or
+ exists(Node mid, AccessPath ap0 |
+ flowFwd(mid, fromArg, _, ap0, config) and
+ localFlowBigStep(mid, node, false, config) and
+ ap0 instanceof AccessPathNil and
+ ap = TNil(getErasedRepr(node.getType())) and
+ apf = ap.(AccessPathNil).getFront()
+ )
+ or
+ exists(Node mid |
+ flowFwd(mid, _, apf, ap, config) and
+ jumpStep(mid, node, true, config) and
+ fromArg = false
+ )
+ or
+ exists(Node mid, AccessPath ap0 |
+ flowFwd(mid, _, _, ap0, config) and
+ jumpStep(mid, node, false, config) and
+ fromArg = false and
+ ap0 instanceof AccessPathNil and
+ ap = TNil(getErasedRepr(node.getType())) and
+ apf = ap.(AccessPathNil).getFront()
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowFwd(mid, _, apf, ap, config) and
+ flowIntoCallable(mid, node, allowsFieldFlow, config) and
+ fromArg = true and
+ (ap instanceof AccessPathNil or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowFwd(mid, false, apf, ap, config) and
+ flowOutOfCallable(mid, node, allowsFieldFlow, config) and
+ fromArg = false and
+ (ap instanceof AccessPathNil or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean preservesValue, AccessPathFront apf0, AccessPath ap0 |
+ flowFwd(mid, fromArg, apf0, ap0, config) and
+ flowThroughMethod(mid, node, preservesValue, config) and
+ (preservesValue = true and ap = ap0 and apf = apf0 or preservesValue = false and ap0 instanceof AccessPathNil and ap = TNil(getErasedRepr(node.getType())) and apf = ap.(AccessPathNil).getFront())
+ )
+ )
+ or
+ exists(Content f, AccessPath ap0 |
+ flowFwdStore(node, f, ap0, apf, fromArg, config) and
+ push(ap0, f, ap)
+ )
+ or
+ exists(Content f, AccessPath ap0 |
+ flowFwdRead(node, f, ap0, fromArg, config) and
+ popWithFront(ap0, f, apf, ap)
+ )
+ }
+ pragma[nomagic]
+ private predicate flowFwdStore(Node node, Content f, AccessPath ap0, AccessPathFront apf, boolean fromArg, Configuration config) {
+ exists(Node mid, AccessPathFront apf0 |
+ flowFwd(mid, fromArg, apf0, ap0, config) and
+ flowFwdStoreAux(mid, f, node, apf0, apf, config)
+ )
+ }
+ private predicate flowFwdStoreAux(Node mid, Content f, Node node, AccessPathFront apf0, AccessPathFront apf, Configuration config) {
+ store(mid, f, node) and
+ consCand(f, apf0, config) and
+ apf.headUsesContent(f) and
+ flowCand(node, _, apf, unbind(config))
+ }
+ pragma[nomagic]
+ private predicate flowFwdRead(Node node, Content f, AccessPath ap0, boolean fromArg, Configuration config) {
+ exists(Node mid, AccessPathFront apf0 |
+ flowFwd(mid, fromArg, apf0, ap0, config) and
+ read(mid, f, node) and
+ apf0.headUsesContent(f) and
+ flowCand(node, _, _, unbind(config))
+ )
+ }
+
+ /**
+ * Holds if data can flow from a source to `node` with the given `ap` and
+ * from there flow to a sink.
+ */
+ private predicate flow(Node node, boolean toReturn, AccessPath ap, Configuration config) {
+ flow0(node, toReturn, ap, config) and
+ flowFwd(node, _, _, ap, config)
+ }
+ private predicate flow0(Node node, boolean toReturn, AccessPath ap, Configuration config) {
+ flowFwd(node, _, _, ap, config) and
+ config.isSink(node) and toReturn = false and ap instanceof AccessPathNil
+ or
+ (
+ exists(Node mid |
+ localFlowBigStep(node, mid, true, config) and
+ flow(mid, toReturn, ap, config)
+ )
+ or
+ exists(Node mid, AccessPath ap0 |
+ flowFwd(node, _, _, ap, config) and
+ localFlowBigStep(node, mid, false, config) and
+ flow(mid, toReturn, ap0, config) and
+ ap0 instanceof AccessPathNil and
+ ap instanceof AccessPathNil
+ )
+ or
+ exists(Node mid |
+ jumpStep(node, mid, true, config) and
+ flow(mid, _, ap, config) and
+ toReturn = false
+ )
+ or
+ exists(Node mid, AccessPath ap0 |
+ flowFwd(node, _, _, ap, config) and
+ jumpStep(node, mid, false, config) and
+ flow(mid, _, ap0, config) and
+ toReturn = false and
+ ap0 instanceof AccessPathNil and
+ ap instanceof AccessPathNil
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowIntoCallable(node, mid, allowsFieldFlow, config) and
+ flow(mid, false, ap, config) and
+ toReturn = false and
+ (ap instanceof AccessPathNil or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowOutOfCallable(node, mid, allowsFieldFlow, config) and
+ flow(mid, _, ap, config) and
+ toReturn = true and
+ (ap instanceof AccessPathNil or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean preservesValue, AccessPath ap0 |
+ flowThroughMethod(node, mid, preservesValue, config) and
+ flow(mid, toReturn, ap0, config) and
+ (preservesValue = true and ap = ap0 or preservesValue = false and ap0 instanceof AccessPathNil and ap instanceof AccessPathNil and flowFwd(node, _, _, ap, config))
+ )
+ or
+ exists(Content f, AccessPath ap0 |
+ flowStore(node, f, toReturn, ap0, config) and
+ pop(ap0, f, ap)
+ )
+ or
+ exists(Content f, AccessPath ap0 |
+ flowRead(node, f, toReturn, ap0, config) and
+ push(ap0, f, ap)
+ )
+ )
+ }
+ pragma[nomagic]
+ private predicate flowStore(Node node, Content f, boolean toReturn, AccessPath ap0, Configuration config) {
+ exists(Node mid |
+ store(node, f, mid) and
+ flow(mid, toReturn, ap0, config)
+ )
+ }
+ pragma[nomagic]
+ private predicate flowRead(Node node, Content f, boolean toReturn, AccessPath ap0, Configuration config) {
+ exists(Node mid |
+ read(node, f, mid) and
+ flow(mid, toReturn, ap0, config)
+ )
+ }
+
+ private bindingset[conf, result] Configuration unbind(Configuration conf) { result >= conf and result <= conf }
+
+ private predicate flow(Node n, Configuration config) {
+ flow(n, _, _, config)
+ }
+
+ private newtype TPathNode =
+ TPathNodeMid(Node node, CallContext cc, AccessPath ap, Configuration config) {
+ // A PathNode is introduced by a source ...
+ flow(node, config) and
+ config.isSource(node) and
+ cc instanceof CallContextAny and
+ ap = TNil(getErasedRepr(node.getType()))
+ or
+ // ... or a step from an existing PathNode to another node.
+ exists(PathNodeMid mid |
+ flowStep(mid, node, cc, ap) and
+ config = mid.getConfiguration() and
+ flow(node, _, ap, unbind(config))
+ )
+ } or
+ TPathNodeSink(Node node, Configuration config) { // The AccessPath on a sink is empty.
+ config.isSink(node) and
+ flow(node, config)
+ }
+
+ /**
+ * A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
+ * Only those `PathNode`s that are reachable from a source are generated.
+ */
+ abstract class PathNode extends TPathNode {
+ /** Gets a textual representation of this element. */
+ string toString() { result = getNode().toString() + ppAp() }
+ /** Gets the source location for this element. */
+ Location getLocation() { result = getNode().getLocation() }
+ /** Gets the underlying `Node`. */
+ abstract Node getNode();
+ /** Gets the associated configuration. */
+ abstract Configuration getConfiguration();
+ /** Gets a successor. */
+ abstract PathNode getSucc();
+ private string ppAp() {
+ this instanceof PathNodeSink and result = "" or
+ result = " [" + this.(PathNodeMid).getAp().toString() + "]"
+ }
+ }
+
+ /** Holds if `n` can reach a sink. */
+ private predicate reach(PathNode n) { n instanceof PathNodeSink or reach(n.getSucc()) }
+
+ /** Holds if `n1.getSucc() = n2` and `n2` can reach a sink. */
+ private predicate pathSucc(PathNode n1, PathNode n2) { n1.getSucc() = n2 and reach(n2) }
+
+ private predicate pathSuccPlus(PathNode n1, PathNode n2) = fastTC(pathSucc/2)(n1, n2)
+
+ /**
+ * Provides the query predicates needed to include a graph in a path-problem query.
+ */
+ module PathGraph {
+ /** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */
+ query predicate edges(PathNode a, PathNode b) { pathSucc(a, b) }
+ }
+
+ /**
+ * An intermediate flow graph node. This is a triple consisting of a `Node`,
+ * a `CallContext`, and a `Configuration`.
+ */
+ private class PathNodeMid extends PathNode, TPathNodeMid {
+ Node node;
+ CallContext cc;
+ AccessPath ap;
+ Configuration config;
+ PathNodeMid() { this = TPathNodeMid(node, cc, ap, config) }
+ override Node getNode() { result = node }
+ CallContext getCallContext() { result = cc }
+ AccessPath getAp() { result = ap }
+ override Configuration getConfiguration() { result = config }
+ private PathNodeMid getSuccMid() {
+ flowStep(this, result.getNode(), result.getCallContext(), result.getAp()) and
+ result.getConfiguration() = unbind(this.getConfiguration())
+ }
+ override PathNode getSucc() {
+ // an intermediate step to another intermediate node
+ result = getSuccMid()
+ or
+ // a final step to a sink via one or more local steps
+ localFlowStepPlus(node, result.getNode(), _, config) and
+ ap instanceof AccessPathNil and
+ result instanceof PathNodeSink and
+ result.getConfiguration() = unbind(this.getConfiguration())
+ or
+ // a final step to a sink via zero steps means we merge the last two steps to prevent trivial-looking edges
+ exists(PathNodeMid mid |
+ mid = getSuccMid() and
+ mid.getNode() = result.getNode() and
+ mid.getAp() instanceof AccessPathNil and
+ result instanceof PathNodeSink and
+ result.getConfiguration() = unbind(mid.getConfiguration())
+ )
+ or
+ // a direct step from a source to a sink if a node is both
+ this instanceof PathNodeSource and
+ result instanceof PathNodeSink and
+ this.getNode() = result.getNode() and
+ result.getConfiguration() = unbind(this.getConfiguration())
+ }
+ }
+
+ /**
+ * A flow graph node corresponding to a source.
+ */
+ private class PathNodeSource extends PathNodeMid {
+ PathNodeSource() {
+ getConfiguration().isSource(getNode()) and
+ getCallContext() instanceof CallContextAny and
+ getAp() instanceof AccessPathNil
+ }
+ }
+
+ /**
+ * A flow graph node corresponding to a sink. This is disjoint from the
+ * intermediate nodes in order to uniquely correspond to a given sink by
+ * excluding the `CallContext`.
+ */
+ private class PathNodeSink extends PathNode, TPathNodeSink {
+ Node node;
+ Configuration config;
+ PathNodeSink() { this = TPathNodeSink(node, config) }
+ override Node getNode() { result = node }
+ override Configuration getConfiguration() { result = config }
+ override PathNode getSucc() { none() }
+ }
+
+ /**
+ * Holds if data may flow from `mid` to `node`. The last step in or out of
+ * a callable is recorded by `cc`.
+ */
+ private predicate flowStep(PathNodeMid mid, Node node, CallContext cc, AccessPath ap) {
+ localFlowBigStep(mid.getNode(), node, true, mid.getConfiguration()) and
+ cc = mid.getCallContext() and
+ ap = mid.getAp()
+ or
+ localFlowBigStep(mid.getNode(), node, false, mid.getConfiguration()) and
+ cc = mid.getCallContext() and
+ mid.getAp() instanceof AccessPathNil and
+ ap = TNil(getErasedRepr(node.getType()))
+ or
+ jumpStep(mid.getNode(), node, true, mid.getConfiguration()) and
+ cc instanceof CallContextAny and
+ ap = mid.getAp()
+ or
+ jumpStep(mid.getNode(), node, false, mid.getConfiguration()) and
+ cc instanceof CallContextAny and
+ mid.getAp() instanceof AccessPathNil and
+ ap = TNil(getErasedRepr(node.getType()))
+ or
+ contentReadStep(mid, node, ap) and cc = mid.getCallContext()
+ or
+ exists(Content f, AccessPath ap0 | contentStoreStep(mid, node, ap0, f, cc) and push(ap0, f, ap))
+ or
+ flowOutOfArgument(mid, node, cc) and ap = mid.getAp()
+ or
+ flowIntoCallable(mid, node, _, cc, _) and ap = mid.getAp()
+ or
+ flowOutOfMethod(mid, node.asExpr(), cc) and ap = mid.getAp()
+ or
+ flowThroughMethod(mid, node.asExpr(), cc) and ap = TNil(getErasedRepr(node.getType()))
+ or
+ valueFlowThroughMethod(mid, node.asExpr(), cc) and ap = mid.getAp()
+ }
+
+ private predicate contentReadStep(PathNodeMid mid, Node node, AccessPath ap) {
+ exists(Content f, AccessPath ap0 |
+ ap0 = mid.getAp() and
+ read(mid.getNode(), f, node) and
+ pop(ap0, f, ap)
+ )
+ }
+
+ pragma[noinline]
+ private predicate contentStoreStep(PathNodeMid mid, Node node, AccessPath ap0, Content f, CallContext cc) {
+ ap0 = mid.getAp() and
+ store(mid.getNode(), f, node) and
+ cc = mid.getCallContext()
+ }
+
+ /**
+ * Holds if data may flow from `mid` to an exit of `m` in the context
+ * `innercc`, and the path did not flow through a parameter of `m`.
+ */
+ private predicate flowOutOfMethod0(PathNodeMid mid, Method m, CallContext innercc) {
+ exists(ReturnNode ret |
+ ret = mid.getNode() and
+ innercc = mid.getCallContext() and
+ m = returnNodeGetEnclosingCallable(ret) and
+ not innercc instanceof CallContextCall
+ )
+ }
+
+ /**
+ * Holds if data may flow from `mid` to `ma`. The last step of this path
+ * is a return from a method and is recorded by `cc`, if needed.
+ */
+ pragma[noinline]
+ private predicate flowOutOfMethod(PathNodeMid mid, MethodAccess ma, CallContext cc) {
+ exists(Method m, CallContext innercc |
+ flowOutOfMethod0(mid, m, innercc) and
+ resolveReturn(innercc, m, ma)
+ |
+ if reducedViableImplInReturn(m, ma) then cc = TReturn(m, ma) else cc = TAnyCallContext()
+ )
+ }
+
+ private predicate flowOutOfArgument(PathNodeMid mid, PostUpdateNode node, CallContext cc) {
+ exists(PostUpdateNode n, ParameterNode p, Callable callable, CallContext innercc, int i, Call call, ArgumentNode arg |
+ mid.getNode() = n and
+ parameterValueFlowsToUpdate(p, n) and
+ innercc = mid.getCallContext() and
+ p.isParameterOf(callable, i) and
+ resolveReturn(innercc, callable, call) and
+ node.getPreUpdateNode() = arg and
+ arg.argumentOf(call, i) and
+ flow(node, unbind(mid.getConfiguration()))
+ |
+ if reducedViableImplInReturn(callable, call) then cc = TReturn(callable, call) else cc = TAnyCallContext()
+ )
+ }
+
+ /**
+ * Holds if data may flow from `mid` to the `i`th argument of `call` in `cc`.
+ */
+ pragma[noinline]
+ private predicate flowIntoArg(PathNodeMid mid, int i, CallContext cc, Call call, boolean emptyAp) {
+ exists(ArgumentNode arg, AccessPath ap |
+ arg = mid.getNode() and
+ cc = mid.getCallContext() and
+ arg.argumentOf(call, i) and
+ ap = mid.getAp()
+ |
+ ap instanceof AccessPathNil and emptyAp = true or
+ ap instanceof AccessPathCons and emptyAp = false
+ )
+ }
+
+ pragma[noinline]
+ private predicate parameterCand(Callable callable, int i, Configuration config) {
+ exists(ParameterNode p |
+ flow(p, config) and
+ p.isParameterOf(callable, i)
+ )
+ }
+
+ pragma[nomagic]
+ private predicate flowIntoCallable0(PathNodeMid mid, Callable callable, int i, CallContext outercc, Call call, boolean emptyAp) {
+ flowIntoArg(mid, i, outercc, call, emptyAp) and
+ callable = resolveCall(call, outercc) and
+ parameterCand(callable, any(int j | j <= i and j >= i), mid.getConfiguration())
+ }
+
+ /**
+ * Holds if data may flow from `mid` to `p` through `call`. The contexts
+ * before and after entering the callable are `outercc` and `innercc`,
+ * respectively.
+ */
+ private predicate flowIntoCallable(PathNodeMid mid, ParameterNode p, CallContext outercc, CallContextCall innercc, Call call) {
+ exists(int i, Callable callable, boolean emptyAp |
+ flowIntoCallable0(mid, callable, i, outercc, call, emptyAp) and
+ p.isParameterOf(callable, i)
+ |
+ if reducedViableImplInCallContext(_, callable, call) then innercc = TSpecificCall(call, i, emptyAp) else innercc = TSomeCall(p, emptyAp)
+ )
+ }
+
+ /** Holds if data may flow from `p` to a return statement in the callable. */
+ pragma[nomagic]
+ private predicate paramFlowsThrough(ParameterNode p, CallContextCall cc, Configuration config) {
+ exists(PathNodeMid mid, ReturnNode ret |
+ mid.getNode() = ret and
+ cc = mid.getCallContext() and
+ config = mid.getConfiguration() and
+ mid.getAp() instanceof AccessPathNil
+ |
+ cc = TSomeCall(p, true) or
+ exists(int i | cc = TSpecificCall(_, i, true) |
+ p.isParameterOf(returnNodeGetEnclosingCallable(ret), i)
+ )
+ )
+ }
+
+ /**
+ * Holds if data may flow from `mid` to an argument of `methodcall`,
+ * through a called method `m`, and back out through a return statement in
+ * `m`. The context `cc` is restored to its value prior to entering `m`.
+ */
+ pragma[noinline]
+ private predicate flowThroughMethod(PathNodeMid mid, Call methodcall, CallContext cc) {
+ exists(ParameterNode p, CallContext innercc |
+ flowIntoCallable(mid, p, cc, innercc, methodcall) and
+ paramFlowsThrough(p, innercc, unbind(mid.getConfiguration())) and
+ not parameterValueFlowsThrough(p) and
+ mid.getAp() instanceof AccessPathNil
+ )
+ }
+
+ private predicate valueFlowThroughMethod(PathNodeMid mid, Call methodcall, CallContext cc) {
+ exists(ParameterNode p |
+ flowIntoCallable(mid, p, cc, _, methodcall) and
+ parameterValueFlowsThrough(p)
+ )
+ }
+
+ /**
+ * Holds if data can flow (inter-procedurally) from `source` to `sink`.
+ *
+ * Will only have results if `configuration` has non-empty sources and
+ * sinks.
+ */
+ private predicate flowsTo(PathNodeSource flowsource, PathNodeSink flowsink, Node source, Node sink, Configuration configuration) {
+ flowsource.getConfiguration() = configuration and
+ flowsource.getNode() = source and
+ pathSuccPlus(flowsource, flowsink) and
+ flowsink.getNode() = sink
+ }
+
+ /**
+ * Holds if data can flow (inter-procedurally) from `source` to `sink`.
+ *
+ * Will only have results if `configuration` has non-empty sources and
+ * sinks.
+ */
+ predicate flowsTo(Node source, Node sink, Configuration configuration) {
+ flowsTo(_, _, source, sink, configuration)
+ }
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll
new file mode 100644
index 000000000000..142ea7f8a7e9
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll
@@ -0,0 +1,1536 @@
+/**
+ * Provides an implementation of global (interprocedural) data flow. This file
+ * re-exports the local (intraprocedural) data flow analysis from `DataFlowUtil`
+ * and adds a global analysis, mainly exposed through the `Configuration` class.
+ * This file exists in several identical copies, allowing queries to use
+ * multiple `Configuration` classes that depend on each other without
+ * introducing mutual recursion among those configurations.
+ */
+
+ import DataFlowUtil
+ private import DataFlowPrivate
+ private import DataFlowDispatch
+ private import DataFlowImplCommon
+
+
+ /**
+ * A configuration of interprocedural data flow analysis. This defines
+ * sources, sinks, and any other configurable aspect of the analysis. Each
+ * use of the global data flow library must define its own unique extension
+ * of this abstract class. To create a configuration, extend this class with
+ * a subclass whose characteristic predicate is a unique singleton string.
+ * For example, write
+ *
+ * ```
+ * class MyAnalysisConfiguration extends DataFlow::Configuration {
+ * MyAnalysisConfiguration() { this = "MyAnalysisConfiguration" }
+ * // Override `isSource` and `isSink`.
+ * // Optionally override `isBarrier`.
+ * // Optionally override `isAdditionalFlowStep`.
+ * }
+ * ```
+ *
+ * Then, to query whether there is flow between some `source` and `sink`,
+ * write
+ *
+ * ```
+ * exists(MyAnalysisConfiguration cfg | cfg.hasFlow(source, sink))
+ * ```
+ *
+ * Multiple configurations can coexist, but two classes extending
+ * `DataFlow::Configuration` should never depend on each other. One of them
+ * should instead depend on a `DataFlow2::Configuration`, a
+ * `DataFlow3::Configuration`, or a `DataFlow4::Configuration`.
+ */
+ abstract class Configuration extends string {
+ bindingset[this]
+ Configuration() { any() }
+
+ /**
+ * Holds if `source` is a relevant data flow source.
+ */
+ abstract predicate isSource(Node source);
+
+ /**
+ * Holds if `sink` is a relevant data flow sink.
+ */
+ abstract predicate isSink(Node sink);
+
+ /** Holds if data flow through `node` is prohibited. */
+ predicate isBarrier(Node node) { none() }
+
+ /** Holds if data flow from `node1` to `node2` is prohibited. */
+ predicate isBarrierEdge(Node node1, Node node2) { none() }
+
+ /**
+ * Holds if the additional flow step from `node1` to `node2` must be taken
+ * into account in the analysis.
+ */
+ predicate isAdditionalFlowStep(Node node1, Node node2) { none() }
+
+ /**
+ * Gets the virtual dispatch branching limit when calculating field flow.
+ * This can be overridden to a smaller value to improve performance (a
+ * value of 0 disables field flow), or a larger value to get more results.
+ */
+ int fieldFlowBranchLimit() { result = 2 }
+
+ /**
+ * Holds if data may flow from `source` to `sink` for this configuration.
+ */
+ predicate hasFlow(Node source, Node sink) {
+ flowsTo(source, sink, this)
+ }
+
+ /**
+ * Holds if data may flow from `source` to `sink` for this configuration.
+ *
+ * The corresponding paths are generated from the end-points and the graph
+ * included in the module `PathGraph`.
+ */
+ predicate hasFlowPath(PathNode source, PathNode sink) {
+ flowsTo(source, sink, _, _, this)
+ }
+
+ /**
+ * Holds if data may flow from some source to `sink` for this configuration.
+ */
+ predicate hasFlowTo(Node sink) {
+ hasFlow(_, sink)
+ }
+
+ /**
+ * Holds if data may flow from some source to `sink` for this configuration.
+ */
+ predicate hasFlowToExpr(Expr sink) {
+ hasFlowTo(exprNode(sink))
+ }
+
+ /** DEPRECATED: use `hasFlow` instead. */
+ deprecated predicate hasFlowForward(Node source, Node sink) {
+ hasFlow(source, sink)
+ }
+
+ /** DEPRECATED: use `hasFlow` instead. */
+ deprecated predicate hasFlowBackward(Node source, Node sink) {
+ hasFlow(source, sink)
+ }
+ }
+
+ /**
+ * Holds if the additional step from `node1` to `node2` jumps between callables.
+ */
+ private predicate additionalJumpStep(Node node1, Node node2, Configuration config) {
+ config.isAdditionalFlowStep(node1, node2) and
+ node1.getEnclosingCallable() != node2.getEnclosingCallable()
+ }
+
+ pragma[noinline]
+ private predicate isAdditionalFlowStep(Node node1, Node node2, Callable callable1, Callable callable2, Configuration config) {
+ config.isAdditionalFlowStep(node1, node2) and
+ callable1 = node1.getEnclosingCallable() and
+ callable2 = node2.getEnclosingCallable()
+ }
+
+ /**
+ * Holds if the additional step from `node1` to `node2` does not jump between callables.
+ */
+ private predicate additionalLocalFlowStep(Node node1, Node node2, Configuration config) {
+ exists(Callable callable |
+ isAdditionalFlowStep(node1, node2, callable, callable, config)
+ )
+ }
+
+ /**
+ * Holds if data can flow from `node1` to `node2` through a static field or
+ * variable capture.
+ */
+ private predicate jumpStep(Node node1, Node node2, boolean preservesValue, Configuration config) {
+ jumpStep(node1, node2) and preservesValue = true or
+ additionalJumpStep(node1, node2, config) and preservesValue = false
+ }
+
+ /**
+ * Holds if data can flow in one local step from `node1` to `node2` taking
+ * additional steps from the configuration into account.
+ */
+ private predicate localFlowStep(Node node1, Node node2, boolean preservesValue, Configuration config) {
+ localFlowStep(node1, node2) and not config.isBarrierEdge(node1, node2) and preservesValue = true or
+ additionalLocalFlowStep(node1, node2, config) and preservesValue = false
+ }
+
+ pragma[noinline]
+ private Method returnNodeGetEnclosingCallable(ReturnNode ret) {
+ result = ret.getEnclosingCallable()
+ }
+
+ /**
+ * Holds if field flow should be used for the given configuration.
+ */
+ private predicate useFieldFlow(Configuration config) {
+ config.fieldFlowBranchLimit() >= 1
+ }
+
+ /**
+ * Holds if `node` is reachable from a source in the given configuration
+ * ignoring call contexts.
+ */
+ private predicate nodeCandFwd1(Node node, boolean stored, Configuration config) {
+ not config.isBarrier(node) and
+ (
+ config.isSource(node) and stored = false
+ or
+ exists(Node mid, boolean preservesValue |
+ nodeCandFwd1(mid, stored, config) and
+ localFlowStep(mid, node, preservesValue, config) and
+ (stored = false or preservesValue = true)
+ )
+ or
+ exists(Node mid, boolean preservesValue |
+ nodeCandFwd1(mid, stored, config) and
+ jumpStep(mid, node, preservesValue, config) and
+ (stored = false or preservesValue = true)
+ )
+ or
+ // store
+ exists(Node mid |
+ useFieldFlow(config) and
+ nodeCandFwd1(mid, _, config) and
+ store(mid, _, node) and
+ stored = true
+ )
+ or
+ // read
+ exists(Node mid, Content f |
+ nodeCandFwd1(mid, true, config) and
+ read(mid, f, node) and
+ storeCandFwd1(f, unbind(config)) and
+ (stored = false or stored = true)
+ )
+ or
+ // flow into a callable
+ exists(Node arg |
+ nodeCandFwd1(arg, stored, config) and
+ viableParamArg(node, arg)
+ )
+ or
+ // flow out of an argument
+ exists(PostUpdateNode mid, ParameterNode p |
+ nodeCandFwd1(mid, stored, config) and
+ parameterValueFlowsToUpdate(p, mid) and
+ viableParamArg(p, node.(PostUpdateNode).getPreUpdateNode())
+ )
+ or
+ // flow out of a callable
+ exists(Method m, MethodAccess ma, ReturnNode ret |
+ nodeCandFwd1(ret, stored, config) and
+ m = returnNodeGetEnclosingCallable(ret) and
+ m = viableImpl(ma) and
+ node.asExpr() = ma
+ )
+ )
+ }
+
+ /**
+ * Holds if `f` is the target of a store in the flow covered by `nodeCandFwd1`.
+ */
+ private predicate storeCandFwd1(Content f, Configuration config) {
+ exists(Node mid, Node node |
+ not config.isBarrier(node) and
+ useFieldFlow(unbind(config)) and
+ nodeCandFwd1(mid, _, config) and
+ store(mid, f, node)
+ )
+ }
+
+ bindingset[result, b]
+ private boolean unbindBool(boolean b) { result != b.booleanNot() }
+
+ /**
+ * Holds if `node` is part of a path from a source to a sink in the given
+ * configuration ignoring call contexts.
+ */
+ pragma[nomagic]
+ private predicate nodeCand1(Node node, boolean stored, Configuration config) {
+ nodeCandFwd1(node, false, config) and
+ config.isSink(node) and stored = false
+ or
+ nodeCandFwd1(node, unbindBool(stored), unbind(config)) and
+ (
+ exists(Node mid, boolean preservesValue |
+ localFlowStep(node, mid, preservesValue, config) and
+ nodeCand1(mid, stored, config) and
+ (stored = false or preservesValue = true)
+ )
+ or
+ exists(Node mid, boolean preservesValue |
+ jumpStep(node, mid, preservesValue, config) and
+ nodeCand1(mid, stored, config) and
+ (stored = false or preservesValue = true)
+ )
+ or
+ // store
+ exists(Node mid, Content f |
+ store(node, f, mid) and
+ readCand1(f, unbind(config)) and
+ nodeCand1(mid, true, config) and
+ (stored = false or stored = true)
+ )
+ or
+ // read
+ exists(Node mid, Content f |
+ read(node, f, mid) and
+ storeCandFwd1(f, unbind(config)) and
+ nodeCand1(mid, _, config) and
+ stored = true
+ )
+ or
+ // flow into a callable
+ exists(Node param |
+ viableParamArg(param, node) and
+ nodeCand1(param, stored, config)
+ )
+ or
+ // flow out of an argument
+ exists(PostUpdateNode mid, ParameterNode p |
+ parameterValueFlowsToUpdate(p, node) and
+ viableParamArg(p, mid.getPreUpdateNode()) and
+ nodeCand1(mid, stored, config)
+ )
+ or
+ // flow out of a callable
+ exists(Method m, ExprNode ma |
+ nodeCand1(ma, stored, config) and
+ m = returnNodeGetEnclosingCallable(node) and
+ m = viableImpl(ma.getExpr())
+ )
+ )
+ }
+
+ /**
+ * Holds if `f` is the target of a read in the flow covered by `nodeCand1`.
+ */
+ private predicate readCand1(Content f, Configuration config) {
+ exists(Node mid, Node node |
+ useFieldFlow(unbind(config)) and
+ nodeCandFwd1(node, true, unbind(config)) and
+ read(node, f, mid) and
+ storeCandFwd1(f, unbind(config)) and
+ nodeCand1(mid, _, config)
+ )
+ }
+
+ /**
+ * Holds if there is a path from `p` to `node` in the same callable that is
+ * part of a path from a source to a sink taking simple call contexts into
+ * consideration. This is restricted to paths that does not necessarily
+ * preserve the value of `p` by making use of at least one additional step
+ * from the configuration.
+ */
+ pragma[nomagic]
+ private predicate simpleParameterFlow(ParameterNode p, Node node, RefType t, Configuration config) {
+ nodeCand1(node, false, config) and
+ p = node and
+ t = getErasedRepr(node.getType()) and
+ not parameterValueFlowsThrough(p)
+ or
+ nodeCand1(node, false, unbind(config)) and
+ exists(Node mid |
+ simpleParameterFlow(p, mid, t, config) and
+ localFlowStep(mid, node, true, config) and
+ compatibleTypes(t, node.getType())
+ )
+ or
+ nodeCand1(node, false, unbind(config)) and
+ exists(Node mid |
+ simpleParameterFlow(p, mid, _, config) and
+ localFlowStep(mid, node, false, config) and
+ t = getErasedRepr(node.getType())
+ )
+ or
+ nodeCand1(node, false, unbind(config)) and
+ exists(Node mid |
+ simpleParameterFlow(p, mid, t, config) and
+ localStoreReadStep(mid, node) and
+ compatibleTypes(t, node.getType())
+ )
+ or
+ // value flow through a callable
+ nodeCand1(node, false, config) and
+ exists(Node arg |
+ simpleParameterFlow(p, arg, t, config) and
+ argumentValueFlowsThrough(arg, node) and
+ compatibleTypes(t, node.getType())
+ )
+ or
+ // flow through a callable
+ nodeCand1(node, false, config) and
+ exists(Node arg |
+ simpleParameterFlow(p, arg, _, config) and
+ simpleArgumentFlowsThrough(arg, node, t, config)
+ )
+ }
+
+ /**
+ * Holds if data can flow from `arg` through the `call` taking simple call
+ * contexts into consideration and that this is part of a path from a source
+ * to a sink. This is restricted to paths through the `call` that does not
+ * necessarily preserve the value of `arg` by making use of at least one
+ * additional step from the configuration.
+ */
+ private predicate simpleArgumentFlowsThrough(ArgumentNode arg, ExprNode call, RefType t, Configuration config) {
+ exists(ParameterNode param, ReturnNode ret |
+ nodeCand1(arg, false, unbind(config)) and
+ nodeCand1(call, false, unbind(config)) and
+ viableParamArg(param, arg) and
+ simpleParameterFlow(param, ret, t, config) and
+ arg.argumentOf(call.getExpr(), _)
+ )
+ }
+
+ /**
+ * Holds if data can flow from `node1` to `node2` by a step through a method.
+ */
+ private predicate flowThroughMethod(Node node1, Node node2, boolean preservesValue, Configuration config) {
+ simpleArgumentFlowsThrough(node1, node2, _, config) and preservesValue = false or
+ argumentValueFlowsThrough(node1, node2) and preservesValue = true
+ }
+
+ /**
+ * Holds if data can flow from `node1` to `node2` in one local step or a step
+ * through a method.
+ */
+ private predicate localFlowStepOrFlowThroughMethod(Node node1, Node node2, boolean preservesValue, Configuration config) {
+ localFlowStep(node1, node2, preservesValue, config) or
+ flowThroughMethod(node1, node2, preservesValue, config)
+ }
+
+ /**
+ * Holds if data can flow out of a callable from `node1` to `node2`, either
+ * through a `ReturnNode` or through an argument that has been mutated, and
+ * that this step is part of a path from a source to a sink.
+ */
+ private predicate flowOutOfCallable(Node node1, Node node2, Configuration config) {
+ nodeCand1(node1, _, unbind(config)) and
+ nodeCand1(node2, _, config) and
+ (
+ // flow out of an argument
+ exists(ParameterNode p |
+ parameterValueFlowsToUpdate(p, node1) and
+ viableParamArg(p, node2.(PostUpdateNode).getPreUpdateNode())
+ )
+ or
+ // flow out of a method
+ exists(Method m, MethodAccess ma, ReturnNode ret |
+ ret = node1 and
+ m = returnNodeGetEnclosingCallable(ret) and
+ m = viableImpl(ma) and
+ node2.asExpr() = ma
+ )
+ )
+ }
+
+ /**
+ * Holds if data can flow into a callable and that this step is part of a
+ * path from a source to a sink.
+ */
+ private predicate flowIntoCallable(Node node1, Node node2, Configuration config) {
+ viableParamArg(node2, node1) and
+ nodeCand1(node1, _, unbind(config)) and
+ nodeCand1(node2, _, config)
+ }
+
+ /**
+ * Gets the amount of forward branching on the origin of a cross-call path
+ * edge in the graph of paths between sources and sinks that ignores call
+ * contexts.
+ */
+ private int branch(Node n1, Configuration conf) {
+ result = strictcount(Node n | flowOutOfCallable(n1, n, conf) or flowIntoCallable(n1, n, conf))
+ }
+
+ /**
+ * Gets the amount of backward branching on the target of a cross-call path
+ * edge in the graph of paths between sources and sinks that ignores call
+ * contexts.
+ */
+ private int join(Node n2, Configuration conf) {
+ result = strictcount(Node n | flowOutOfCallable(n, n2, conf) or flowIntoCallable(n, n2, conf))
+ }
+
+ /**
+ * Holds if data can flow out of a callable from `node1` to `node2`, either
+ * through a `ReturnNode` or through an argument that has been mutated, and
+ * that this step is part of a path from a source to a sink. The
+ * `allowsFieldFlow` flag indicates whether the branching is within the limit
+ * specified by the configuration.
+ */
+ private predicate flowOutOfCallable(Node node1, Node node2, boolean allowsFieldFlow, Configuration config) {
+ flowOutOfCallable(node1, node2, config) and
+ exists(int b, int j |
+ b = branch(node1, config) and
+ j = join(node2, config) and
+ if b.minimum(j) <= config.fieldFlowBranchLimit() then allowsFieldFlow = true else allowsFieldFlow = false
+ )
+ }
+
+ /**
+ * Holds if data can flow into a callable and that this step is part of a
+ * path from a source to a sink. The `allowsFieldFlow` flag indicates whether
+ * the branching is within the limit specified by the configuration.
+ */
+ private predicate flowIntoCallable(Node node1, Node node2, boolean allowsFieldFlow, Configuration config) {
+ flowIntoCallable(node1, node2, config) and
+ exists(int b, int j |
+ b = branch(node1, config) and
+ j = join(node2, config) and
+ if b.minimum(j) <= config.fieldFlowBranchLimit() then allowsFieldFlow = true else allowsFieldFlow = false
+ )
+ }
+
+ /**
+ * Holds if `node` is part of a path from a source to a sink in the given
+ * configuration taking simple call contexts into consideration.
+ */
+ private predicate nodeCandFwd2(Node node, boolean fromArg, boolean stored, Configuration config) {
+ nodeCand1(node, false, config) and
+ config.isSource(node) and fromArg = false and stored = false
+ or
+ nodeCand1(node, unbindBool(stored), unbind(config)) and
+ (
+ exists(Node mid, boolean preservesValue |
+ nodeCandFwd2(mid, fromArg, stored, config) and
+ localFlowStepOrFlowThroughMethod(mid, node, preservesValue, config) and
+ (stored = false or preservesValue = true)
+ )
+ or
+ exists(Node mid, boolean preservesValue |
+ nodeCandFwd2(mid, _, stored, config) and
+ jumpStep(mid, node, preservesValue, config) and
+ fromArg = false and
+ (stored = false or preservesValue = true)
+ )
+ or
+ // store
+ exists(Node mid, Content f |
+ nodeCandFwd2(mid, fromArg, _, config) and
+ store(mid, f, node) and
+ readCand1(f, unbind(config)) and
+ stored = true
+ )
+ or
+ // read
+ exists(Node mid, Content f |
+ nodeCandFwd2(mid, fromArg, true, config) and
+ read(mid, f, node) and
+ storeCandFwd2(f, unbind(config)) and
+ (stored = false or stored = true)
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ nodeCandFwd2(mid, _, stored, config) and
+ flowIntoCallable(mid, node, allowsFieldFlow, config) and
+ fromArg = true and
+ (stored = false or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ nodeCandFwd2(mid, false, stored, config) and
+ flowOutOfCallable(mid, node, allowsFieldFlow, config) and
+ fromArg = false and
+ (stored = false or allowsFieldFlow = true)
+ )
+ )
+ }
+
+ /**
+ * Holds if `f` is the target of a store in the flow covered by `nodeCandFwd2`.
+ */
+ private predicate storeCandFwd2(Content f, Configuration config) {
+ exists(Node mid, Node node |
+ useFieldFlow(unbind(config)) and
+ nodeCand1(node, true, unbind(config)) and
+ nodeCandFwd2(mid, _, _, config) and
+ store(mid, f, node) and
+ readCand1(f, unbind(config))
+ )
+ }
+
+ /**
+ * Holds if `node` is part of a path from a source to a sink in the given
+ * configuration taking simple call contexts into consideration.
+ */
+ private predicate nodeCand2(Node node, boolean toReturn, boolean stored, Configuration config) {
+ nodeCandFwd2(node, _, false, config) and
+ config.isSink(node) and toReturn = false and stored = false
+ or
+ nodeCandFwd2(node, _, unbindBool(stored), unbind(config)) and
+ (
+ exists(Node mid, boolean preservesValue |
+ localFlowStepOrFlowThroughMethod(node, mid, preservesValue, config) and
+ nodeCand2(mid, toReturn, stored, config) and
+ (stored = false or preservesValue = true)
+ )
+ or
+ exists(Node mid, boolean preservesValue |
+ jumpStep(node, mid, preservesValue, config) and
+ nodeCand2(mid, _, stored, config) and
+ toReturn = false and
+ (stored = false or preservesValue = true)
+ )
+ or
+ // store
+ exists(Node mid, Content f |
+ store(node, f, mid) and
+ readCand2(f, unbind(config)) and
+ nodeCand2(mid, toReturn, true, config) and
+ (stored = false or stored = true)
+ )
+ or
+ // read
+ exists(Node mid, Content f |
+ read(node, f, mid) and
+ storeCandFwd2(f, unbind(config)) and
+ nodeCand2(mid, toReturn, _, config) and
+ stored = true
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowIntoCallable(node, mid, allowsFieldFlow, config) and
+ nodeCand2(mid, false, stored, config) and
+ toReturn = false and
+ (stored = false or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowOutOfCallable(node, mid, allowsFieldFlow, config) and
+ nodeCand2(mid, _, stored, config) and
+ toReturn = true and
+ (stored = false or allowsFieldFlow = true)
+ )
+ )
+ }
+
+ /**
+ * Holds if `f` is the target of a read in the flow covered by `nodeCand2`.
+ */
+ private predicate readCand2(Content f, Configuration config) {
+ exists(Node mid, Node node |
+ useFieldFlow(unbind(config)) and
+ nodeCandFwd2(node, _, true, unbind(config)) and
+ read(node, f, mid) and
+ storeCandFwd2(f, unbind(config)) and
+ nodeCand2(mid, _, _, config)
+ )
+ }
+
+ private predicate storeCand(Content f, Configuration conf) {
+ exists(Node n1, Node n2 |
+ store(n1, f, n2) and
+ nodeCand2(n1, _, _, conf) and
+ nodeCand2(n2, _, _, unbind(conf))
+ )
+ }
+
+ private predicate readCand(Content f, Configuration conf) {
+ readCand2(f, conf)
+ }
+
+ /**
+ * Holds if `f` is the target of both a store and a read in the path graph
+ * covered by `nodeCand2`.
+ */
+ pragma[noinline]
+ private predicate readStoreCand(Content f, Configuration conf) {
+ storeCand(f, conf) and
+ readCand(f, conf)
+ }
+
+ private predicate nodeCand(Node node, Configuration config) {
+ nodeCand2(node, _, _, config)
+ }
+
+ /**
+ * Holds if `node` can be the first node in a maximal subsequence of local
+ * flow steps in a dataflow path.
+ */
+ private predicate localFlowEntry(Node node, Configuration config) {
+ nodeCand(node, config) and
+ (
+ config.isSource(node) or
+ jumpStep(_, node, _, config) or
+ node instanceof ParameterNode or
+ node.asExpr() instanceof MethodAccess or
+ node instanceof PostUpdateNode or
+ read(_, _, node) or
+ node.asExpr() instanceof CastExpr
+ )
+ }
+
+ /**
+ * Holds if `node` can be the last node in a maximal subsequence of local
+ * flow steps in a dataflow path.
+ */
+ private predicate localFlowExit(Node node, Configuration config) {
+ exists(Node next |
+ nodeCand(next, config)
+ |
+ jumpStep(node, next, _, config) or
+ flowIntoCallable(node, next, config) or
+ flowOutOfCallable(node, next, config) or
+ flowThroughMethod(node, next, _, config) or
+ store(node, _, next) or
+ read(node, _, next)
+ ) or
+ node.asExpr() instanceof CastExpr or
+ config.isSink(node)
+ }
+
+ /**
+ * Holds if the local path from `node1` to `node2` is a prefix of a maximal
+ * subsequence of local flow steps in a dataflow path.
+ *
+ * This is the transitive closure of `localFlowStep` beginning at `localFlowEntry`.
+ */
+ private predicate localFlowStepPlus(Node node1, Node node2, boolean preservesValue, Configuration config) {
+ localFlowEntry(node1, config) and
+ localFlowStep(node1, node2, preservesValue, config) and
+ node1 != node2 and
+ nodeCand(node2, unbind(config))
+ or
+ exists(Node mid, boolean pv1, boolean pv2 |
+ localFlowStepPlus(node1, mid, pv1, config) and
+ localFlowStep(mid, node2, pv2, config) and
+ not mid.asExpr() instanceof CastExpr and
+ preservesValue = pv1.booleanAnd(pv2) and
+ nodeCand(node2, unbind(config))
+ )
+ }
+
+ /**
+ * Holds if `node1` can step to `node2` in one or more local steps and this
+ * path can occur as a maximal subsequence of local steps in a dataflow path.
+ */
+ pragma[noinline]
+ private predicate localFlowBigStep(Node node1, Node node2, boolean preservesValue, Configuration config) {
+ localFlowStepPlus(node1, node2, preservesValue, config) and
+ localFlowExit(node2, config)
+ }
+
+ /**
+ * Holds if `f` may contain an object of the same type, `t`, as the one
+ * that contains `f`, and if this fact should be used to compress
+ * access paths.
+ *
+ * Examples include the tail pointer in a linked list or the left and right
+ * pointers in a binary tree.
+ */
+ private predicate selfRef(Content f, RefType t) {
+ t = f.getDeclaringType() and
+ f.isSelfRef()
+ }
+
+ private newtype TFlowContainer =
+ TRegularContent(Content f) { not selfRef(f, _) } or
+ TSelfRefContent(RefType t) { selfRef(_, t) }
+
+ /**
+ * A `Content` or a `Content` abstracted as its declaring type.
+ *
+ * Sequences of one or more `Content`s in the same declaring type for which
+ * `isSelfRef()` holds are represented as a single `FlowContainer` in an
+ * `AccessPath`.
+ */
+ private class FlowContainer extends TFlowContainer {
+ string toString() {
+ exists(Content f | this = TRegularContent(f) and result = f.toString()) or
+ exists(RefType t | this = TSelfRefContent(t) and result = t.toString())
+ }
+ predicate usesContent(Content f) {
+ this = TRegularContent(f) or
+ exists(RefType t | this = TSelfRefContent(t) and selfRef(f, t))
+ }
+ RefType getContainerType() {
+ exists(Content f | this = TRegularContent(f) and result = f.getDeclaringType()) or
+ this = TSelfRefContent(result)
+ }
+ }
+
+ private newtype TAccessPathFront = TFrontNil(Type t) or TFrontHead(FlowContainer f)
+
+ /**
+ * The front of an `AccessPath`. This is either a head or a nil.
+ */
+ private class AccessPathFront extends TAccessPathFront {
+ string toString() {
+ exists(Type t | this = TFrontNil(t) | result = t.toString()) or
+ exists(FlowContainer f | this = TFrontHead(f) | result = f.toString())
+ }
+ Type getType() {
+ this = TFrontNil(result) or
+ exists(FlowContainer head | this = TFrontHead(head) | result = head.getContainerType())
+ }
+ predicate headUsesContent(Content f) {
+ exists(FlowContainer fc |
+ fc.usesContent(f) and
+ this = TFrontHead(fc)
+ )
+ }
+ }
+
+ private class AccessPathFrontNil extends AccessPathFront, TFrontNil {
+ }
+
+ /**
+ * A `Node` at which a cast can occur such that the type should be checked.
+ */
+ private class CastingNode extends Node {
+ CastingNode() {
+ this instanceof ParameterNode or
+ this.asExpr() instanceof CastExpr or
+ this.asExpr() instanceof MethodAccess or
+ this.(PostUpdateNode).getPreUpdateNode() instanceof ArgumentNode
+ }
+ }
+
+ /**
+ * Holds if data can flow from a source to `node` with the given `apf`.
+ */
+ private predicate flowCandFwd(Node node, boolean fromArg, AccessPathFront apf, Configuration config) {
+ flowCandFwd0(node, fromArg, apf, config) and
+ if node instanceof CastingNode then
+ compatibleTypes(node.getType(), apf.getType())
+ else
+ any()
+ }
+ private predicate flowCandFwd0(Node node, boolean fromArg, AccessPathFront apf, Configuration config) {
+ nodeCand2(node, _, false, config) and
+ config.isSource(node) and fromArg = false and apf = TFrontNil(getErasedRepr(node.getType()))
+ or
+ nodeCand(node, unbind(config)) and
+ (
+ exists(Node mid |
+ flowCandFwd(mid, fromArg, apf, config) and
+ localFlowBigStep(mid, node, true, config)
+ )
+ or
+ exists(Node mid, AccessPathFront apf0 |
+ flowCandFwd(mid, fromArg, apf0, config) and
+ localFlowBigStep(mid, node, false, config) and
+ apf0 instanceof AccessPathFrontNil and
+ apf = TFrontNil(getErasedRepr(node.getType()))
+ )
+ or
+ exists(Node mid |
+ flowCandFwd(mid, _, apf, config) and
+ jumpStep(mid, node, true, config) and
+ fromArg = false
+ )
+ or
+ exists(Node mid, AccessPathFront apf0 |
+ flowCandFwd(mid, _, apf0, config) and
+ jumpStep(mid, node, false, config) and
+ fromArg = false and
+ apf0 instanceof AccessPathFrontNil and
+ apf = TFrontNil(getErasedRepr(node.getType()))
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowCandFwd(mid, _, apf, config) and
+ flowIntoCallable(mid, node, allowsFieldFlow, config) and
+ fromArg = true and
+ (apf instanceof AccessPathFrontNil or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowCandFwd(mid, false, apf, config) and
+ flowOutOfCallable(mid, node, allowsFieldFlow, config) and
+ fromArg = false and
+ (apf instanceof AccessPathFrontNil or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean preservesValue, AccessPathFront apf0 |
+ flowCandFwd(mid, fromArg, apf0, config) and
+ flowThroughMethod(mid, node, preservesValue, config) and
+ (preservesValue = true and apf = apf0 or preservesValue = false and apf0 instanceof AccessPathFrontNil and apf = TFrontNil(getErasedRepr(node.getType())))
+ )
+ )
+ or
+ exists(Node mid, Content f |
+ flowCandFwd(mid, fromArg, _, config) and
+ store(mid, f, node) and
+ nodeCand(node, unbind(config)) and
+ apf.headUsesContent(f)
+ )
+ or
+ exists(Node mid, Content f, AccessPathFront apf0 |
+ flowCandFwd(mid, fromArg, apf0, config) and
+ read(mid, f, node) and
+ nodeCand(node, config) and
+ apf0.headUsesContent(f) and
+ consCandFwd(f, apf, unbind(config))
+ )
+ }
+ private predicate consCandFwd(Content f, AccessPathFront apf, Configuration config) {
+ exists(Node mid, Node n |
+ flowCandFwd(mid, _, apf, config) and
+ store(mid, f, n) and
+ nodeCand(n, unbind(config)) and
+ readStoreCand(f, unbind(config)) and
+ compatibleTypes(apf.getType(), f.getType())
+ )
+ }
+
+ /**
+ * Holds if data can flow from a source to `node` with the given `apf` and
+ * from there flow to a sink.
+ */
+ private predicate flowCand(Node node, boolean toReturn, AccessPathFront apf, Configuration config) {
+ flowCand0(node, toReturn, apf, config) and
+ flowCandFwd(node, _, apf, config)
+ }
+ private predicate flowCand0(Node node, boolean toReturn, AccessPathFront apf, Configuration config) {
+ flowCandFwd(node, _, apf, config) and
+ config.isSink(node) and toReturn = false and apf instanceof AccessPathFrontNil
+ or
+ (
+ exists(Node mid |
+ localFlowBigStep(node, mid, true, config) and
+ flowCand(mid, toReturn, apf, config)
+ )
+ or
+ exists(Node mid, AccessPathFront apf0 |
+ flowCandFwd(node, _, apf, config) and
+ localFlowBigStep(node, mid, false, config) and
+ flowCand(mid, toReturn, apf0, config) and
+ apf0 instanceof AccessPathFrontNil and
+ apf instanceof AccessPathFrontNil
+ )
+ or
+ exists(Node mid |
+ jumpStep(node, mid, true, config) and
+ flowCand(mid, _, apf, config) and
+ toReturn = false
+ )
+ or
+ exists(Node mid, AccessPathFront apf0 |
+ flowCandFwd(node, _, apf, config) and
+ jumpStep(node, mid, false, config) and
+ flowCand(mid, _, apf0, config) and
+ toReturn = false and
+ apf0 instanceof AccessPathFrontNil and
+ apf instanceof AccessPathFrontNil
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowIntoCallable(node, mid, allowsFieldFlow, config) and
+ flowCand(mid, false, apf, config) and
+ toReturn = false and
+ (apf instanceof AccessPathFrontNil or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowOutOfCallable(node, mid, allowsFieldFlow, config) and
+ flowCand(mid, _, apf, config) and
+ toReturn = true and
+ (apf instanceof AccessPathFrontNil or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean preservesValue, AccessPathFront apf0 |
+ flowThroughMethod(node, mid, preservesValue, config) and
+ flowCand(mid, toReturn, apf0, config) and
+ (preservesValue = true and apf = apf0 or preservesValue = false and apf0 instanceof AccessPathFrontNil and apf instanceof AccessPathFrontNil and flowCandFwd(node, _, apf, config))
+ )
+ or
+ exists(Node mid, Content f, AccessPathFront apf0 |
+ store(node, f, mid) and
+ flowCand(mid, toReturn, apf0, config) and
+ apf0.headUsesContent(f) and
+ consCand(f, apf, unbind(config))
+ )
+ or
+ exists(Node mid, Content f, AccessPathFront apf0 |
+ read(node, f, mid) and
+ flowCand(mid, toReturn, apf0, config) and
+ consCandFwd(f, apf0, unbind(config)) and
+ apf.headUsesContent(f)
+ )
+ )
+ }
+ private predicate consCand(Content f, AccessPathFront apf, Configuration config) {
+ consCandFwd(f, apf, config) and
+ exists(Node mid, Node n, AccessPathFront apf0 |
+ flowCandFwd(n, _, apf0, config) and
+ apf0.headUsesContent(f) and
+ read(n, f, mid) and
+ flowCand(mid, _, apf, config)
+ )
+ }
+
+ private newtype TAccessPath = TNil(Type t) or TCons(FlowContainer f, int len) { len in [1..5] }
+
+ /**
+ * Conceptually a list of `Content`s followed by a `Type`, but only the first
+ * element of the list and its length are tracked. If data flows from a source to
+ * a given node with a given `AccessPath`, this indicates the sequence of
+ * dereference operations needed to get from the value in the node to the
+ * tracked object. The final type indicates the type of the tracked object.
+ */
+ private class AccessPath extends TAccessPath {
+ abstract string toString();
+ FlowContainer getHead() { this = TCons(result, _) }
+ int len() {
+ this = TNil(_) and result = 0
+ or
+ this = TCons(_, result)
+ }
+ Type getType() {
+ this = TNil(result) or
+ exists(FlowContainer head | this = TCons(head, _) | result = head.getContainerType())
+ }
+ abstract AccessPathFront getFront();
+ }
+
+ private class AccessPathNil extends AccessPath, TNil {
+ override string toString() { exists(Type t | this = TNil(t) | result = t.toString()) }
+ override AccessPathFront getFront() { exists(Type t | this = TNil(t) | result = TFrontNil(t)) }
+ }
+
+ private class AccessPathCons extends AccessPath, TCons {
+ override string toString() {
+ exists(FlowContainer f, int len | this = TCons(f, len) | result = f.toString() + ", ... (" + len.toString() + ")")
+ }
+ override AccessPathFront getFront() { exists(FlowContainer f | this = TCons(f, _) | result = TFrontHead(f)) }
+ }
+
+ /** Holds if `ap0` corresponds to the cons of `f` and `ap`. */
+ private predicate pop(AccessPath ap0, Content f, AccessPath ap) {
+ ap0.getFront().headUsesContent(f) and
+ consCand(f, ap.getFront(), _) and
+ ap0.len() = 1 + ap.len()
+ }
+
+ /** Holds if `ap0` corresponds to the cons of `f` and `ap` and `apf` is the front of `ap`. */
+ pragma[noinline]
+ private predicate popWithFront(AccessPath ap0, Content f, AccessPathFront apf, AccessPath ap) {
+ pop(ap0, f, ap) and apf = ap.getFront()
+ }
+
+ /** Holds if `ap` corresponds to the cons of `f` and `ap0`. */
+ private predicate push(AccessPath ap0, Content f, AccessPath ap) { pop(ap, f, ap0) }
+
+ /**
+ * Holds if data can flow from a source to `node` with the given `ap`.
+ */
+ private predicate flowFwd(Node node, boolean fromArg, AccessPathFront apf, AccessPath ap, Configuration config) {
+ flowFwd0(node, fromArg, apf, ap, config) and
+ flowCand(node, _, apf, config)
+ }
+ private predicate flowFwd0(Node node, boolean fromArg, AccessPathFront apf, AccessPath ap, Configuration config) {
+ flowCand(node, _, _, config) and
+ config.isSource(node) and fromArg = false and ap = TNil(getErasedRepr(node.getType())) and apf = ap.(AccessPathNil).getFront()
+ or
+ flowCand(node, _, _, unbind(config)) and
+ (
+ exists(Node mid |
+ flowFwd(mid, fromArg, apf, ap, config) and
+ localFlowBigStep(mid, node, true, config)
+ )
+ or
+ exists(Node mid, AccessPath ap0 |
+ flowFwd(mid, fromArg, _, ap0, config) and
+ localFlowBigStep(mid, node, false, config) and
+ ap0 instanceof AccessPathNil and
+ ap = TNil(getErasedRepr(node.getType())) and
+ apf = ap.(AccessPathNil).getFront()
+ )
+ or
+ exists(Node mid |
+ flowFwd(mid, _, apf, ap, config) and
+ jumpStep(mid, node, true, config) and
+ fromArg = false
+ )
+ or
+ exists(Node mid, AccessPath ap0 |
+ flowFwd(mid, _, _, ap0, config) and
+ jumpStep(mid, node, false, config) and
+ fromArg = false and
+ ap0 instanceof AccessPathNil and
+ ap = TNil(getErasedRepr(node.getType())) and
+ apf = ap.(AccessPathNil).getFront()
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowFwd(mid, _, apf, ap, config) and
+ flowIntoCallable(mid, node, allowsFieldFlow, config) and
+ fromArg = true and
+ (ap instanceof AccessPathNil or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowFwd(mid, false, apf, ap, config) and
+ flowOutOfCallable(mid, node, allowsFieldFlow, config) and
+ fromArg = false and
+ (ap instanceof AccessPathNil or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean preservesValue, AccessPathFront apf0, AccessPath ap0 |
+ flowFwd(mid, fromArg, apf0, ap0, config) and
+ flowThroughMethod(mid, node, preservesValue, config) and
+ (preservesValue = true and ap = ap0 and apf = apf0 or preservesValue = false and ap0 instanceof AccessPathNil and ap = TNil(getErasedRepr(node.getType())) and apf = ap.(AccessPathNil).getFront())
+ )
+ )
+ or
+ exists(Content f, AccessPath ap0 |
+ flowFwdStore(node, f, ap0, apf, fromArg, config) and
+ push(ap0, f, ap)
+ )
+ or
+ exists(Content f, AccessPath ap0 |
+ flowFwdRead(node, f, ap0, fromArg, config) and
+ popWithFront(ap0, f, apf, ap)
+ )
+ }
+ pragma[nomagic]
+ private predicate flowFwdStore(Node node, Content f, AccessPath ap0, AccessPathFront apf, boolean fromArg, Configuration config) {
+ exists(Node mid, AccessPathFront apf0 |
+ flowFwd(mid, fromArg, apf0, ap0, config) and
+ flowFwdStoreAux(mid, f, node, apf0, apf, config)
+ )
+ }
+ private predicate flowFwdStoreAux(Node mid, Content f, Node node, AccessPathFront apf0, AccessPathFront apf, Configuration config) {
+ store(mid, f, node) and
+ consCand(f, apf0, config) and
+ apf.headUsesContent(f) and
+ flowCand(node, _, apf, unbind(config))
+ }
+ pragma[nomagic]
+ private predicate flowFwdRead(Node node, Content f, AccessPath ap0, boolean fromArg, Configuration config) {
+ exists(Node mid, AccessPathFront apf0 |
+ flowFwd(mid, fromArg, apf0, ap0, config) and
+ read(mid, f, node) and
+ apf0.headUsesContent(f) and
+ flowCand(node, _, _, unbind(config))
+ )
+ }
+
+ /**
+ * Holds if data can flow from a source to `node` with the given `ap` and
+ * from there flow to a sink.
+ */
+ private predicate flow(Node node, boolean toReturn, AccessPath ap, Configuration config) {
+ flow0(node, toReturn, ap, config) and
+ flowFwd(node, _, _, ap, config)
+ }
+ private predicate flow0(Node node, boolean toReturn, AccessPath ap, Configuration config) {
+ flowFwd(node, _, _, ap, config) and
+ config.isSink(node) and toReturn = false and ap instanceof AccessPathNil
+ or
+ (
+ exists(Node mid |
+ localFlowBigStep(node, mid, true, config) and
+ flow(mid, toReturn, ap, config)
+ )
+ or
+ exists(Node mid, AccessPath ap0 |
+ flowFwd(node, _, _, ap, config) and
+ localFlowBigStep(node, mid, false, config) and
+ flow(mid, toReturn, ap0, config) and
+ ap0 instanceof AccessPathNil and
+ ap instanceof AccessPathNil
+ )
+ or
+ exists(Node mid |
+ jumpStep(node, mid, true, config) and
+ flow(mid, _, ap, config) and
+ toReturn = false
+ )
+ or
+ exists(Node mid, AccessPath ap0 |
+ flowFwd(node, _, _, ap, config) and
+ jumpStep(node, mid, false, config) and
+ flow(mid, _, ap0, config) and
+ toReturn = false and
+ ap0 instanceof AccessPathNil and
+ ap instanceof AccessPathNil
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowIntoCallable(node, mid, allowsFieldFlow, config) and
+ flow(mid, false, ap, config) and
+ toReturn = false and
+ (ap instanceof AccessPathNil or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean allowsFieldFlow |
+ flowOutOfCallable(node, mid, allowsFieldFlow, config) and
+ flow(mid, _, ap, config) and
+ toReturn = true and
+ (ap instanceof AccessPathNil or allowsFieldFlow = true)
+ )
+ or
+ exists(Node mid, boolean preservesValue, AccessPath ap0 |
+ flowThroughMethod(node, mid, preservesValue, config) and
+ flow(mid, toReturn, ap0, config) and
+ (preservesValue = true and ap = ap0 or preservesValue = false and ap0 instanceof AccessPathNil and ap instanceof AccessPathNil and flowFwd(node, _, _, ap, config))
+ )
+ or
+ exists(Content f, AccessPath ap0 |
+ flowStore(node, f, toReturn, ap0, config) and
+ pop(ap0, f, ap)
+ )
+ or
+ exists(Content f, AccessPath ap0 |
+ flowRead(node, f, toReturn, ap0, config) and
+ push(ap0, f, ap)
+ )
+ )
+ }
+ pragma[nomagic]
+ private predicate flowStore(Node node, Content f, boolean toReturn, AccessPath ap0, Configuration config) {
+ exists(Node mid |
+ store(node, f, mid) and
+ flow(mid, toReturn, ap0, config)
+ )
+ }
+ pragma[nomagic]
+ private predicate flowRead(Node node, Content f, boolean toReturn, AccessPath ap0, Configuration config) {
+ exists(Node mid |
+ read(node, f, mid) and
+ flow(mid, toReturn, ap0, config)
+ )
+ }
+
+ private bindingset[conf, result] Configuration unbind(Configuration conf) { result >= conf and result <= conf }
+
+ private predicate flow(Node n, Configuration config) {
+ flow(n, _, _, config)
+ }
+
+ private newtype TPathNode =
+ TPathNodeMid(Node node, CallContext cc, AccessPath ap, Configuration config) {
+ // A PathNode is introduced by a source ...
+ flow(node, config) and
+ config.isSource(node) and
+ cc instanceof CallContextAny and
+ ap = TNil(getErasedRepr(node.getType()))
+ or
+ // ... or a step from an existing PathNode to another node.
+ exists(PathNodeMid mid |
+ flowStep(mid, node, cc, ap) and
+ config = mid.getConfiguration() and
+ flow(node, _, ap, unbind(config))
+ )
+ } or
+ TPathNodeSink(Node node, Configuration config) { // The AccessPath on a sink is empty.
+ config.isSink(node) and
+ flow(node, config)
+ }
+
+ /**
+ * A `Node` augmented with a call context (except for sinks), an access path, and a configuration.
+ * Only those `PathNode`s that are reachable from a source are generated.
+ */
+ abstract class PathNode extends TPathNode {
+ /** Gets a textual representation of this element. */
+ string toString() { result = getNode().toString() + ppAp() }
+ /** Gets the source location for this element. */
+ Location getLocation() { result = getNode().getLocation() }
+ /** Gets the underlying `Node`. */
+ abstract Node getNode();
+ /** Gets the associated configuration. */
+ abstract Configuration getConfiguration();
+ /** Gets a successor. */
+ abstract PathNode getSucc();
+ private string ppAp() {
+ this instanceof PathNodeSink and result = "" or
+ result = " [" + this.(PathNodeMid).getAp().toString() + "]"
+ }
+ }
+
+ /** Holds if `n` can reach a sink. */
+ private predicate reach(PathNode n) { n instanceof PathNodeSink or reach(n.getSucc()) }
+
+ /** Holds if `n1.getSucc() = n2` and `n2` can reach a sink. */
+ private predicate pathSucc(PathNode n1, PathNode n2) { n1.getSucc() = n2 and reach(n2) }
+
+ private predicate pathSuccPlus(PathNode n1, PathNode n2) = fastTC(pathSucc/2)(n1, n2)
+
+ /**
+ * Provides the query predicates needed to include a graph in a path-problem query.
+ */
+ module PathGraph {
+ /** Holds if `(a,b)` is an edge in the graph of data flow path explanations. */
+ query predicate edges(PathNode a, PathNode b) { pathSucc(a, b) }
+ }
+
+ /**
+ * An intermediate flow graph node. This is a triple consisting of a `Node`,
+ * a `CallContext`, and a `Configuration`.
+ */
+ private class PathNodeMid extends PathNode, TPathNodeMid {
+ Node node;
+ CallContext cc;
+ AccessPath ap;
+ Configuration config;
+ PathNodeMid() { this = TPathNodeMid(node, cc, ap, config) }
+ override Node getNode() { result = node }
+ CallContext getCallContext() { result = cc }
+ AccessPath getAp() { result = ap }
+ override Configuration getConfiguration() { result = config }
+ private PathNodeMid getSuccMid() {
+ flowStep(this, result.getNode(), result.getCallContext(), result.getAp()) and
+ result.getConfiguration() = unbind(this.getConfiguration())
+ }
+ override PathNode getSucc() {
+ // an intermediate step to another intermediate node
+ result = getSuccMid()
+ or
+ // a final step to a sink via one or more local steps
+ localFlowStepPlus(node, result.getNode(), _, config) and
+ ap instanceof AccessPathNil and
+ result instanceof PathNodeSink and
+ result.getConfiguration() = unbind(this.getConfiguration())
+ or
+ // a final step to a sink via zero steps means we merge the last two steps to prevent trivial-looking edges
+ exists(PathNodeMid mid |
+ mid = getSuccMid() and
+ mid.getNode() = result.getNode() and
+ mid.getAp() instanceof AccessPathNil and
+ result instanceof PathNodeSink and
+ result.getConfiguration() = unbind(mid.getConfiguration())
+ )
+ or
+ // a direct step from a source to a sink if a node is both
+ this instanceof PathNodeSource and
+ result instanceof PathNodeSink and
+ this.getNode() = result.getNode() and
+ result.getConfiguration() = unbind(this.getConfiguration())
+ }
+ }
+
+ /**
+ * A flow graph node corresponding to a source.
+ */
+ private class PathNodeSource extends PathNodeMid {
+ PathNodeSource() {
+ getConfiguration().isSource(getNode()) and
+ getCallContext() instanceof CallContextAny and
+ getAp() instanceof AccessPathNil
+ }
+ }
+
+ /**
+ * A flow graph node corresponding to a sink. This is disjoint from the
+ * intermediate nodes in order to uniquely correspond to a given sink by
+ * excluding the `CallContext`.
+ */
+ private class PathNodeSink extends PathNode, TPathNodeSink {
+ Node node;
+ Configuration config;
+ PathNodeSink() { this = TPathNodeSink(node, config) }
+ override Node getNode() { result = node }
+ override Configuration getConfiguration() { result = config }
+ override PathNode getSucc() { none() }
+ }
+
+ /**
+ * Holds if data may flow from `mid` to `node`. The last step in or out of
+ * a callable is recorded by `cc`.
+ */
+ private predicate flowStep(PathNodeMid mid, Node node, CallContext cc, AccessPath ap) {
+ localFlowBigStep(mid.getNode(), node, true, mid.getConfiguration()) and
+ cc = mid.getCallContext() and
+ ap = mid.getAp()
+ or
+ localFlowBigStep(mid.getNode(), node, false, mid.getConfiguration()) and
+ cc = mid.getCallContext() and
+ mid.getAp() instanceof AccessPathNil and
+ ap = TNil(getErasedRepr(node.getType()))
+ or
+ jumpStep(mid.getNode(), node, true, mid.getConfiguration()) and
+ cc instanceof CallContextAny and
+ ap = mid.getAp()
+ or
+ jumpStep(mid.getNode(), node, false, mid.getConfiguration()) and
+ cc instanceof CallContextAny and
+ mid.getAp() instanceof AccessPathNil and
+ ap = TNil(getErasedRepr(node.getType()))
+ or
+ contentReadStep(mid, node, ap) and cc = mid.getCallContext()
+ or
+ exists(Content f, AccessPath ap0 | contentStoreStep(mid, node, ap0, f, cc) and push(ap0, f, ap))
+ or
+ flowOutOfArgument(mid, node, cc) and ap = mid.getAp()
+ or
+ flowIntoCallable(mid, node, _, cc, _) and ap = mid.getAp()
+ or
+ flowOutOfMethod(mid, node.asExpr(), cc) and ap = mid.getAp()
+ or
+ flowThroughMethod(mid, node.asExpr(), cc) and ap = TNil(getErasedRepr(node.getType()))
+ or
+ valueFlowThroughMethod(mid, node.asExpr(), cc) and ap = mid.getAp()
+ }
+
+ private predicate contentReadStep(PathNodeMid mid, Node node, AccessPath ap) {
+ exists(Content f, AccessPath ap0 |
+ ap0 = mid.getAp() and
+ read(mid.getNode(), f, node) and
+ pop(ap0, f, ap)
+ )
+ }
+
+ pragma[noinline]
+ private predicate contentStoreStep(PathNodeMid mid, Node node, AccessPath ap0, Content f, CallContext cc) {
+ ap0 = mid.getAp() and
+ store(mid.getNode(), f, node) and
+ cc = mid.getCallContext()
+ }
+
+ /**
+ * Holds if data may flow from `mid` to an exit of `m` in the context
+ * `innercc`, and the path did not flow through a parameter of `m`.
+ */
+ private predicate flowOutOfMethod0(PathNodeMid mid, Method m, CallContext innercc) {
+ exists(ReturnNode ret |
+ ret = mid.getNode() and
+ innercc = mid.getCallContext() and
+ m = returnNodeGetEnclosingCallable(ret) and
+ not innercc instanceof CallContextCall
+ )
+ }
+
+ /**
+ * Holds if data may flow from `mid` to `ma`. The last step of this path
+ * is a return from a method and is recorded by `cc`, if needed.
+ */
+ pragma[noinline]
+ private predicate flowOutOfMethod(PathNodeMid mid, MethodAccess ma, CallContext cc) {
+ exists(Method m, CallContext innercc |
+ flowOutOfMethod0(mid, m, innercc) and
+ resolveReturn(innercc, m, ma)
+ |
+ if reducedViableImplInReturn(m, ma) then cc = TReturn(m, ma) else cc = TAnyCallContext()
+ )
+ }
+
+ private predicate flowOutOfArgument(PathNodeMid mid, PostUpdateNode node, CallContext cc) {
+ exists(PostUpdateNode n, ParameterNode p, Callable callable, CallContext innercc, int i, Call call, ArgumentNode arg |
+ mid.getNode() = n and
+ parameterValueFlowsToUpdate(p, n) and
+ innercc = mid.getCallContext() and
+ p.isParameterOf(callable, i) and
+ resolveReturn(innercc, callable, call) and
+ node.getPreUpdateNode() = arg and
+ arg.argumentOf(call, i) and
+ flow(node, unbind(mid.getConfiguration()))
+ |
+ if reducedViableImplInReturn(callable, call) then cc = TReturn(callable, call) else cc = TAnyCallContext()
+ )
+ }
+
+ /**
+ * Holds if data may flow from `mid` to the `i`th argument of `call` in `cc`.
+ */
+ pragma[noinline]
+ private predicate flowIntoArg(PathNodeMid mid, int i, CallContext cc, Call call, boolean emptyAp) {
+ exists(ArgumentNode arg, AccessPath ap |
+ arg = mid.getNode() and
+ cc = mid.getCallContext() and
+ arg.argumentOf(call, i) and
+ ap = mid.getAp()
+ |
+ ap instanceof AccessPathNil and emptyAp = true or
+ ap instanceof AccessPathCons and emptyAp = false
+ )
+ }
+
+ pragma[noinline]
+ private predicate parameterCand(Callable callable, int i, Configuration config) {
+ exists(ParameterNode p |
+ flow(p, config) and
+ p.isParameterOf(callable, i)
+ )
+ }
+
+ pragma[nomagic]
+ private predicate flowIntoCallable0(PathNodeMid mid, Callable callable, int i, CallContext outercc, Call call, boolean emptyAp) {
+ flowIntoArg(mid, i, outercc, call, emptyAp) and
+ callable = resolveCall(call, outercc) and
+ parameterCand(callable, any(int j | j <= i and j >= i), mid.getConfiguration())
+ }
+
+ /**
+ * Holds if data may flow from `mid` to `p` through `call`. The contexts
+ * before and after entering the callable are `outercc` and `innercc`,
+ * respectively.
+ */
+ private predicate flowIntoCallable(PathNodeMid mid, ParameterNode p, CallContext outercc, CallContextCall innercc, Call call) {
+ exists(int i, Callable callable, boolean emptyAp |
+ flowIntoCallable0(mid, callable, i, outercc, call, emptyAp) and
+ p.isParameterOf(callable, i)
+ |
+ if reducedViableImplInCallContext(_, callable, call) then innercc = TSpecificCall(call, i, emptyAp) else innercc = TSomeCall(p, emptyAp)
+ )
+ }
+
+ /** Holds if data may flow from `p` to a return statement in the callable. */
+ pragma[nomagic]
+ private predicate paramFlowsThrough(ParameterNode p, CallContextCall cc, Configuration config) {
+ exists(PathNodeMid mid, ReturnNode ret |
+ mid.getNode() = ret and
+ cc = mid.getCallContext() and
+ config = mid.getConfiguration() and
+ mid.getAp() instanceof AccessPathNil
+ |
+ cc = TSomeCall(p, true) or
+ exists(int i | cc = TSpecificCall(_, i, true) |
+ p.isParameterOf(returnNodeGetEnclosingCallable(ret), i)
+ )
+ )
+ }
+
+ /**
+ * Holds if data may flow from `mid` to an argument of `methodcall`,
+ * through a called method `m`, and back out through a return statement in
+ * `m`. The context `cc` is restored to its value prior to entering `m`.
+ */
+ pragma[noinline]
+ private predicate flowThroughMethod(PathNodeMid mid, Call methodcall, CallContext cc) {
+ exists(ParameterNode p, CallContext innercc |
+ flowIntoCallable(mid, p, cc, innercc, methodcall) and
+ paramFlowsThrough(p, innercc, unbind(mid.getConfiguration())) and
+ not parameterValueFlowsThrough(p) and
+ mid.getAp() instanceof AccessPathNil
+ )
+ }
+
+ private predicate valueFlowThroughMethod(PathNodeMid mid, Call methodcall, CallContext cc) {
+ exists(ParameterNode p |
+ flowIntoCallable(mid, p, cc, _, methodcall) and
+ parameterValueFlowsThrough(p)
+ )
+ }
+
+ /**
+ * Holds if data can flow (inter-procedurally) from `source` to `sink`.
+ *
+ * Will only have results if `configuration` has non-empty sources and
+ * sinks.
+ */
+ private predicate flowsTo(PathNodeSource flowsource, PathNodeSink flowsink, Node source, Node sink, Configuration configuration) {
+ flowsource.getConfiguration() = configuration and
+ flowsource.getNode() = source and
+ pathSuccPlus(flowsource, flowsink) and
+ flowsink.getNode() = sink
+ }
+
+ /**
+ * Holds if data can flow (inter-procedurally) from `source` to `sink`.
+ *
+ * Will only have results if `configuration` has non-empty sources and
+ * sinks.
+ */
+ predicate flowsTo(Node source, Node sink, Configuration configuration) {
+ flowsTo(_, _, source, sink, configuration)
+ }
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll
new file mode 100644
index 000000000000..94d81815dcb0
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll
@@ -0,0 +1,274 @@
+
+import DataFlowUtil
+private import DataFlowPrivate
+private import DataFlowDispatch
+
+cached
+private module ImplCommon {
+ /**
+ * Holds if `p` is the `i`th parameter of a viable dispatch target of `call`.
+ * The instance parameter is considered to have index `-1`.
+ */
+ pragma[nomagic]
+ private predicate viableParam(Call call, int i, ParameterNode p) {
+ exists(Callable callable |
+ callable = viableCallable(call) and
+ p.isParameterOf(callable, i)
+ )
+ }
+
+ /**
+ * Holds if `arg` is a possible argument to `p` taking virtual dispatch into account.
+ */
+ cached
+ predicate viableParamArg(ParameterNode p, ArgumentNode arg) {
+ exists(int i, Call call |
+ viableParam(call, i, p) and
+ arg.argumentOf(call, i)
+ )
+ }
+
+ /**
+ * Holds if `p` can flow to `node` in the same callable using only
+ * value-preserving steps.
+ */
+ private predicate parameterValueFlow(ParameterNode p, Node node) {
+ p = node
+ or
+ exists(Node mid |
+ parameterValueFlow(p, mid) and
+ localFlowStep(mid, node) and
+ compatibleTypes(p.getType(), node.getType())
+ )
+ or
+ // flow through a callable
+ exists(Node arg |
+ parameterValueFlow(p, arg) and
+ argumentValueFlowsThrough(arg, node) and
+ compatibleTypes(p.getType(), node.getType())
+ )
+ }
+
+ /**
+ * Holds if `p` can flow to a `ReturnNode` in the same callable using only
+ * value-preserving steps.
+ */
+ cached
+ predicate parameterValueFlowsThrough(ParameterNode p) {
+ exists(ReturnNode ret |
+ parameterValueFlow(p, ret)
+ )
+ }
+
+ /**
+ * Holds if `arg` flows through `call` using only value-preserving steps.
+ */
+ cached
+ predicate argumentValueFlowsThrough(ArgumentNode arg, ExprNode call) {
+ exists(ParameterNode param |
+ viableParamArg(param, arg) and
+ parameterValueFlowsThrough(param) and
+ arg.argumentOf(call.getExpr(), _) and
+ compatibleTypes(arg.getType(), call.getType())
+ )
+ }
+
+ /**
+ * Holds if `p` can flow to the pre-update node of `n` in the same callable
+ * using only value-preserving steps.
+ */
+ cached
+ predicate parameterValueFlowsToUpdate(ParameterNode p, PostUpdateNode n) {
+ parameterValueFlow(p, n.getPreUpdateNode())
+ }
+
+ /**
+ * Holds if data can flow from `node1` to `node2` in one local step or a step
+ * through a value-preserving method.
+ */
+ private predicate localValueStep(Node node1, Node node2) {
+ localFlowStep(node1, node2) or
+ argumentValueFlowsThrough(node1, node2)
+ }
+
+ /*
+ * Calculation of `predicate store(Node node1, Content f, Node node2)`:
+ * There are three cases:
+ * - The base case: A direct local assignment given by `storeStep`.
+ * - A call to a method or constructor with two arguments, `arg1` and `arg2`,
+ * such the call has the side-effect `arg2.f = arg1`.
+ * - A call to a method that returns an object in which an argument has been
+ * stored.
+ * `storeViaSideEffect` covers the first two cases, and `storeReturn` covers
+ * the third case.
+ */
+
+ /**
+ * Holds if data can flow from `node1` to `node2` via a direct assignment to
+ * `f` or via a call that acts as a setter.
+ */
+ cached
+ predicate store(Node node1, Content f, Node node2) {
+ storeViaSideEffect(node1, f, node2) or
+ storeReturn(node1, f, node2)
+ }
+ private predicate storeViaSideEffect(Node node1, Content f, PostUpdateNode node2) {
+ storeStep(node1, f, node2) and readStep(_, f, _) or
+ exists(Call call, int i1, int i2 |
+ setterCall(call, i1, i2, f) and
+ node1.(ArgumentNode).argumentOf(call, i1) and
+ node2.getPreUpdateNode().(ArgumentNode).argumentOf(call, i2) and
+ compatibleTypes(node1.getTypeBound(), f.getType()) and
+ compatibleTypes(node2.getTypeBound(), f.getDeclaringType())
+ )
+ }
+ pragma[nomagic]
+ private predicate setterInParam(ParameterNode p1, Content f, ParameterNode p2) {
+ exists(Node n1, PostUpdateNode n2 |
+ parameterValueFlow(p1, n1) and
+ storeViaSideEffect(n1, f, n2) and
+ parameterValueFlow(p2, n2.getPreUpdateNode()) and
+ p1 != p2
+ )
+ }
+ pragma[nomagic]
+ private predicate setterCall(Call call, int i1, int i2, Content f) {
+ exists(Callable callable, ParameterNode p1, ParameterNode p2 |
+ setterInParam(p1, f, p2) and
+ callable = viableCallable(call) and
+ p1.isParameterOf(callable, i1) and
+ p2.isParameterOf(callable, i2)
+ )
+ }
+ private predicate storeReturn(Node node1, Content f, Node node2) {
+ exists(ParameterNode p, ArgumentNode arg |
+ arg = node1 and
+ viableParamArg(p, arg) and
+ setterReturn(p, f) and
+ arg.argumentOf(node2.asExpr(), _) and
+ compatibleTypes(node1.getTypeBound(), f.getType()) and
+ compatibleTypes(node2.getTypeBound(), f.getDeclaringType())
+ )
+ }
+ private predicate setterReturn(ParameterNode p, Content f) {
+ exists(Node n1, Node n2, ReturnNode ret |
+ parameterValueFlow(p, n1) and
+ store(n1, f, n2) and
+ localValueStep*(n2, ret)
+ )
+ }
+
+ /**
+ * Holds if data can flow from `node1` to `node2` via a direct read of `f` or
+ * via a getter.
+ */
+ cached
+ predicate read(Node node1, Content f, Node node2) {
+ readStep(node1, f, node2) and storeStep(_, f, _) or
+ exists(ParameterNode p, ArgumentNode arg |
+ arg = node1 and
+ viableParamArg(p, arg) and
+ getter(p, f) and
+ arg.argumentOf(node2.asExpr(), _) and
+ compatibleTypes(node1.getTypeBound(), f.getDeclaringType()) and
+ compatibleTypes(node2.getTypeBound(), f.getType())
+ )
+ }
+ private predicate getter(ParameterNode p, Content f) {
+ exists(Node n1, Node n2, ReturnNode ret |
+ parameterValueFlow(p, n1) and
+ read(n1, f, n2) and
+ localValueStep*(n2, ret)
+ )
+ }
+
+ cached
+ predicate localStoreReadStep(Node node1, Node node2) {
+ exists(Node mid1, Node mid2, Content f |
+ store(node1, f, mid1) and
+ localValueStep*(mid1, mid2) and
+ read(mid2, f, node2)
+ )
+ }
+
+ /**
+ * Holds if `call` passes an implicit or explicit instance argument, i.e., an
+ * expression that reaches a `this` parameter.
+ */
+ private predicate callHasInstanceArgument(Call call) {
+ exists(ArgumentNode arg |
+ arg.argumentOf(call, -1)
+ )
+ }
+
+ cached
+ newtype TCallContext =
+ TAnyCallContext() or
+ TSpecificCall(Call call, int i, boolean emptyAp) {
+ reducedViableImplInCallContext(_, _, call) and
+ (emptyAp = true or emptyAp = false) and
+ (exists(call.getArgument(i))
+ or
+ i = -1 and callHasInstanceArgument(call))
+ } or
+ TSomeCall(ParameterNode p, boolean emptyAp) { emptyAp = true or emptyAp = false } or
+ TReturn(Method m, MethodAccess ma) { reducedViableImplInReturn(m, ma) }
+}
+import ImplCommon
+
+/**
+ * A call context to restrict the targets of virtual dispatch and match the
+ * call sites of flow into a method with flow out of a method.
+ *
+ * There are four cases:
+ * - `TAnyCallContext()` : No restrictions on method flow.
+ * - `TSpecificCall(Call call, int i)` : Flow entered through the `i`th
+ * parameter at the given `call`. This call improves the set of viable
+ * dispatch targets for at least one method call in the current callable.
+ * - `TSomeCall(ParameterNode p)` : Flow entered through parameter `p`. The
+ * originating call does not improve the set of dispatch targets for any
+ * method call in the current callable and was therefore not recorded.
+ * - `TReturn(Method m, MethodAccess ma)` : Flow reached `ma` from `m` and
+ * this dispatch target of `ma` implies a reduced set of dispatch origins
+ * to which data may flow if it should reach a `return` statement.
+ */
+abstract class CallContext extends TCallContext {
+ abstract string toString();
+}
+class CallContextAny extends CallContext, TAnyCallContext {
+ override string toString() { result = "CcAny" }
+}
+abstract class CallContextCall extends CallContext { }
+class CallContextSpecificCall extends CallContextCall, TSpecificCall {
+ override string toString() { result = "CcCall" }
+}
+class CallContextSomeCall extends CallContextCall, TSomeCall {
+ override string toString() { result = "CcSomeCall" }
+}
+class CallContextReturn extends CallContext, TReturn {
+ override string toString() { result = "CcReturn" }
+}
+
+bindingset[cc, callable]
+predicate resolveReturn(CallContext cc, Callable callable, Call call) {
+ cc instanceof CallContextAny and callable = viableCallable(call)
+ or
+ exists(Method m0, MethodAccess ma0 |
+ ma0.getEnclosingCallable() = callable and
+ cc = TReturn(m0, ma0) and
+ m0 = prunedViableImplInCallContextReverse(ma0, call)
+ )
+}
+
+bindingset[call, cc]
+Callable resolveCall(Call call, CallContext cc) {
+ exists(Call ctx | cc = TSpecificCall(ctx, _, _) |
+ if reducedViableImplInCallContext(call, _, ctx) then
+ result = prunedViableImplInCallContext(call, ctx)
+ else
+ result = viableCallable(call)
+ ) or
+ result = viableCallable(call) and cc instanceof CallContextSomeCall or
+ result = viableCallable(call) and cc instanceof CallContextAny or
+ result = viableCallable(call) and cc instanceof CallContextReturn
+}
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowPrivate.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowPrivate.qll
new file mode 100644
index 000000000000..8bc840da0c7f
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowPrivate.qll
@@ -0,0 +1,191 @@
+private import cpp
+private import DataFlowUtil
+
+/** Gets the instance argument of a non-static call. */
+private Node getInstanceArgument(Call call) {
+ result.asExpr() = call.getQualifier()
+ // This does not include the implicit `this` argument on auto-generated
+ // base class destructor calls as those do not have an AST element.
+}
+
+/**
+ * A data flow node that occurs as the argument of a call and is passed as-is
+ * to the callable. Arguments that are wrapped in an implicit varargs array
+ * creation are not included, but the implicitly created array is.
+ * Instance arguments are also included.
+ */
+class ArgumentNode extends Node {
+ ArgumentNode() {
+ exists(Argument arg | this.asExpr() = arg) or
+ this = getInstanceArgument(_)
+ }
+
+ /**
+ * Holds if this argument occurs at the given position in the given call.
+ * The instance argument is considered to have index `-1`.
+ */
+ predicate argumentOf(Call call, int pos) {
+ exists(Argument arg | this.asExpr() = arg | call = arg.getCall() and pos = arg.getPosition()) or
+ pos = -1 and this = getInstanceArgument(call)
+ }
+}
+
+/** A data flow node that occurs as the result of a `ReturnStmt`. */
+class ReturnNode extends ExprNode {
+ ReturnNode() {
+ exists(ReturnStmt ret | this.getExpr() = ret.getExpr())
+ }
+}
+
+/**
+ * Holds if data can flow from `node1` to `node2` in a way that loses the
+ * calling context. For example, this would happen with flow through a
+ * global or static variable.
+ */
+predicate jumpStep(Node n1, Node n2) {
+ none()
+}
+
+/**
+ * Holds if `call` does not pass an implicit or explicit qualifier, i.e., a
+ * `this` parameter.
+ */
+predicate callHasQualifier(Call call) {
+ call.hasQualifier()
+ or
+ call.getTarget() instanceof Destructor
+}
+
+private newtype TContent = TFieldContent(Field f) or TCollectionContent() or TArrayContent()
+
+/**
+ * A reference contained in an object. Examples include instance fields, the
+ * contents of a collection object, or the contents of an array.
+ */
+class Content extends TContent {
+ /** Gets a textual representation of this element. */
+ abstract string toString();
+ predicate hasLocationInfo(string path, int sl, int sc, int el, int ec) {
+ path = "" and sl = 0 and sc = 0 and el = 0 and ec = 0
+ }
+ /** Gets the type of the object containing this content. */
+ abstract RefType getDeclaringType();
+ /** Gets the type of this content. */
+ abstract Type getType();
+ /**
+ * Holds if this content may contain an object of the same type as the one
+ * that contains this content, and if this fact should be used to compress
+ * access paths.
+ *
+ * Examples include the tail pointer in a linked list or the left and right
+ * pointers in a binary tree.
+ */
+ predicate isSelfRef() { none() }
+}
+private class FieldContent extends Content, TFieldContent {
+ Field f;
+ FieldContent() { this = TFieldContent(f) }
+ Field getField() { result = f }
+ override string toString() { result = f.toString() }
+ override predicate hasLocationInfo(string path, int sl, int sc, int el, int ec) {
+ f.getLocation().hasLocationInfo(path, sl, sc, el, ec)
+ }
+ override RefType getDeclaringType() { result = f.getDeclaringType() }
+ override Type getType() { result = f.getType() }
+}
+private class CollectionContent extends Content, TCollectionContent {
+ override string toString() { result = "collection" }
+ override RefType getDeclaringType() { none() }
+ override Type getType() { none() }
+}
+private class ArrayContent extends Content, TArrayContent {
+ override string toString() { result = "array" }
+ override RefType getDeclaringType() { none() }
+ override Type getType() { none() }
+}
+
+/**
+ * Holds if data can flow from `node1` to `node2` via an assignment to `f`.
+ * Thus, `node2` references an object with a field `f` that contains the
+ * value of `node1`.
+ */
+predicate storeStep(Node node1, Content f, PostUpdateNode node2) {
+ none() // stub implementation
+}
+
+/**
+ * Holds if data can flow from `node1` to `node2` via a read of `f`.
+ * Thus, `node1` references an object with a field `f` whose value ends up in
+ * `node2`.
+ */
+predicate readStep(Node node1, Content f, Node node2) {
+ none() // stub implementation
+}
+
+/**
+ * Gets a representative (boxed) type for `t` for the purpose of pruning
+ * possible flow. A single type is used for all numeric types to account for
+ * numeric conversions, and otherwise the erasure is used.
+ */
+RefType getErasedRepr(Type t) {
+ result instanceof VoidType // stub implementation
+}
+
+/**
+ * Holds if `t1` and `t2` are compatible, that is, whether data can flow from
+ * a node of type `t1` to a node of type `t2`.
+ */
+pragma[inline]
+predicate compatibleTypes(Type t1, Type t2) {
+ any() // stub implementation
+}
+
+//////////////////////////////////////////////////////////////////////////////
+// Java QL library compatibility wrappers
+//////////////////////////////////////////////////////////////////////////////
+
+class RefType extends Type {
+}
+
+class CastExpr extends Expr {
+ CastExpr() { none() } // stub implementation
+}
+
+/** An argument to a call. */
+class Argument extends Expr {
+ Call call;
+ int pos;
+
+ Argument() {
+ call.getArgument(pos) = this
+ }
+
+ /** Gets the call that has this argument. */
+ Call getCall() { result = call }
+
+ /** Gets the position of this argument. */
+ int getPosition() {
+ result = pos
+ }
+}
+
+class Callable extends Function { }
+
+/**
+ * An alias for `Function` in the C++ library. In the Java library, a `Method`
+ * is any callable except a constructor.
+ */
+class Method extends Function { }
+
+/**
+ * An alias for `FunctionCall` in the C++ library. In the Java library, a
+ * `MethodAccess` is any `Call` that does not call a constructor.
+ */
+class MethodAccess extends FunctionCall {
+ /**
+ * INTERNAL: Do not use. Alternative name for `getEnclosingFunction`.
+ */
+ Callable getEnclosingCallable() {
+ result = this.getEnclosingFunction()
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll
new file mode 100644
index 000000000000..62dca33d323a
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll
@@ -0,0 +1,250 @@
+/**
+ * Provides C++-specific definitions for use in the data flow library.
+ */
+import cpp
+private import semmle.code.cpp.dataflow.internal.FlowVar
+
+private newtype TNode =
+ TExprNode(Expr e) or
+ TParameterNode(Parameter p) { exists(p.getFunction().getBlock()) } or
+ TUninitializedNode(LocalVariable v) {
+ not v.hasInitializer()
+ }
+
+/**
+ * A node in a data flow graph.
+ *
+ * A node can be either an expression, a parameter, or an uninitialized local
+ * variable. Such nodes are created with `DataFlow::exprNode`,
+ * `DataFlow::parameterNode`, and `DataFlow::uninitializedNode` respectively.
+*/
+class Node extends TNode {
+ /** Gets the function to which this node belongs. */
+ Function getFunction() {
+ result = this.asExpr().getEnclosingFunction()
+ or
+ result = this.asParameter().getFunction()
+ or
+ result = this.asUninitialized().getFunction()
+ }
+
+ /**
+ * INTERNAL: Do not use. Alternative name for `getFunction`.
+ */
+ Function getEnclosingCallable() {
+ result = this.getFunction()
+ }
+
+ /** Gets the type of this node. */
+ Type getType() {
+ result = this.asExpr().getType()
+ or
+ result = asVariable(this).getType()
+ }
+
+ /** Gets the expression corresponding to this node, if any. */
+ Expr asExpr() { result = this.(ExprNode).getExpr() }
+
+ /** Gets the parameter corresponding to this node, if any. */
+ Parameter asParameter() { result = this.(ParameterNode).getParameter() }
+
+ /**
+ * Gets the uninitialized local variable corresponding to this node, if
+ * any.
+ */
+ LocalVariable asUninitialized() {
+ result = this.(UninitializedNode).getLocalVariable()
+ }
+
+ /** Gets a textual representation of this element. */
+ string toString() { none() } // overridden by subclasses
+
+ /** Gets the location of this element. */
+ Location getLocation() { none() } // overridden by subclasses
+
+ /**
+ * Gets an upper bound on the type of this node.
+ */
+ Type getTypeBound() { result = getType() }
+}
+
+/**
+ * An expression, viewed as a node in a data flow graph.
+ */
+class ExprNode extends Node, TExprNode {
+ Expr expr;
+ ExprNode() { this = TExprNode(expr) }
+ override string toString() { result = expr.toString() }
+ override Location getLocation() { result = expr.getLocation() }
+ /** Gets the expression corresponding to this node. */
+ Expr getExpr() { result = expr }
+}
+
+/**
+ * The value of a parameter at function entry, viewed as a node in a data
+ * flow graph.
+ */
+class ParameterNode extends Node, TParameterNode {
+ Parameter param;
+ ParameterNode() { this = TParameterNode(param) }
+ override string toString() { result = param.toString() }
+ override Location getLocation() { result = param.getLocation() }
+ /** Gets the parameter corresponding to this node. */
+ Parameter getParameter() { result = param }
+ /**
+ * Holds if this node is the parameter of `c` at the specified (zero-based)
+ * position. The implicit `this` parameter is considered to have index `-1`.
+ */
+ predicate isParameterOf(Function f, int i) {
+ f.getParameter(i) = param
+ }
+}
+
+/**
+ * The value of an uninitialized local variable, viewed as a node in a data
+ * flow graph.
+ */
+class UninitializedNode extends Node, TUninitializedNode {
+ LocalVariable v;
+ UninitializedNode() { this = TUninitializedNode(v) }
+ override string toString() { result = v.toString() }
+ override Location getLocation() { result = v.getLocation() }
+ /** Gets the uninitialized local variable corresponding to this node. */
+ LocalVariable getLocalVariable() { result = v }
+}
+
+/**
+ * A node associated with an object after an operation that might have
+ * changed its state.
+ *
+ * This can be either the argument to a callable after the callable returns
+ * (which might have mutated the argument), or the qualifier of a field after
+ * an update to the field.
+ *
+ * Nodes corresponding to AST elements, for example `ExprNode`, usually refer
+ * to the value before the update with the exception of `ClassInstanceExpr`,
+ * which represents the value after the constructor has run.
+ */
+class PostUpdateNode extends Node {
+ PostUpdateNode() { none() } // stub implementation
+ /**
+ * Gets the node before the state update.
+ */
+ Node getPreUpdateNode() { none() } // stub implementation
+}
+
+/**
+ * Gets the `Node` corresponding to `e`.
+ */
+ExprNode exprNode(Expr e) { result.getExpr() = e }
+
+/**
+ * Gets the `Node` corresponding to the value of `p` at function entry.
+ */
+ParameterNode parameterNode(Parameter p) { result.getParameter() = p }
+
+/**
+ * Gets the `Node` corresponding to the value of an uninitialized local
+ * variable `v`.
+ */
+UninitializedNode uninitializedNode(LocalVariable v) {
+ result.getLocalVariable() = v
+}
+
+private Variable asVariable(Node node) {
+ result = node.asParameter()
+ or
+ result = node.asUninitialized()
+}
+
+/**
+ * Holds if data flows from `nodeFrom` to `nodeTo` in exactly one local
+ * (intra-procedural) step.
+ */
+predicate localFlowStep(Node nodeFrom, Node nodeTo) {
+ // Expr -> Expr
+ exprToExprStep_nocfg(nodeFrom.asExpr(), nodeTo.asExpr())
+ or
+ // Node -> FlowVar -> VariableAccess
+ exists(FlowVar var |
+ (
+ exprToVarStep(nodeFrom.asExpr(), var)
+ or
+ varSourceBaseCase(var, asVariable(nodeFrom))
+ ) and
+ varToExprStep(var, nodeTo.asExpr())
+ )
+}
+
+/**
+ * Holds if data flows from `source` to `sink` in zero or more local
+ * (intra-procedural) steps.
+ */
+predicate localFlow(Node source, Node sink) {
+ localFlowStep*(source, sink)
+}
+
+/**
+ * Holds if the initial value of `v`, if it is a source, flows to `var`.
+ */
+private predicate varSourceBaseCase(FlowVar var, Variable v) {
+ var.definedByInitialValue(v)
+}
+
+/**
+ * Holds if `var` is defined by an assignment-like operation that causes flow
+ * directly from `assignedExpr` to `var`, _and_ `assignedExpr` evaluates to
+ * the same value as what is assigned to `var`.
+ */
+private predicate exprToVarStep(Expr assignedExpr, FlowVar var) {
+ exists(ControlFlowNode operation |
+ var.definedByExpr(assignedExpr, operation) and
+ not operation instanceof PostfixCrementOperation
+ )
+}
+
+/**
+ * Holds if the expression `e` is an access of the variable `var`.
+ */
+private predicate varToExprStep(FlowVar var, Expr e) {
+ e = var.getAnAccess()
+}
+
+/**
+ * Holds if data flows from `fromExpr` to `toExpr` directly, in the case
+ * where `toExpr` is the immediate AST parent of `fromExpr`. For example,
+ * data flows from `x` and `y` to `b ? x : y`.
+ */
+private predicate exprToExprStep_nocfg(Expr fromExpr, Expr toExpr) {
+ toExpr = any(ConditionalExpr cond |
+ fromExpr = cond.getThen() or fromExpr = cond.getElse()
+ )
+ or
+ toExpr = any(AssignExpr assign |
+ fromExpr = assign.getRValue()
+ )
+ or
+ toExpr = any(CommaExpr comma |
+ fromExpr = comma.getRightOperand()
+ )
+ or
+ toExpr = any(PostfixCrementOperation op |
+ fromExpr = op.getOperand()
+ )
+ or
+ toExpr = any(FunctionCall moveCall |
+ moveCall.getTarget().getNamespace().getName() = "std" and
+ moveCall.getTarget().getName() = "move" and
+ fromExpr = moveCall.getArgument(0)
+ )
+}
+
+VariableAccess getAnAccessToAssignedVariable(Expr assign) {
+ (assign instanceof Assignment
+ or
+ assign instanceof CrementOperation) and
+ exists(FlowVar var |
+ var.definedByExpr(_, assign) and
+ result = var.getAnAccess()
+ )
+}
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/FlowVar.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/FlowVar.qll
new file mode 100644
index 000000000000..963b648727fb
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/FlowVar.qll
@@ -0,0 +1,534 @@
+/**
+ * Provides a class for handling variables in the data flow analysis.
+ */
+import cpp
+private import semmle.code.cpp.controlflow.SSA
+private import semmle.code.cpp.dataflow.internal.SubBasicBlocks
+
+/**
+ * A conceptual variable that is assigned only once, like an SSA variable. This
+ * class is used for tracking data flow through variables, where the desired
+ * semantics is sometimes different from what the SSA library provides. Unlike
+ * SSA, there are no _phi_ nodes; instead, each `VariableAccess` may be
+ * associated with more than one `FlowVar`.
+ *
+ * Each instance of this class corresponds to a modification or an initial
+ * value of a variable. A `FlowVar` has exactly one result for either
+ * `definedByExpr` or `definedByInitialValue`. The documentation on those two
+ * member predicates explains how a `FlowVar` relates to syntactic constructs of
+ * the language.
+ */
+cached class FlowVar extends TFlowVar {
+ /**
+ * Gets a `VariableAccess` that _may_ take its value from `this`. Consider
+ * the following snippet.
+ *
+ * ```
+ * int x = 0;
+ * if (b) { f(x); x = 1; }
+ * g(x)
+ * ```
+ *
+ * The access to `x` in `f(x)` may take its value from the `FlowVar`
+ * corresponding to `int x = 0`, while the access to `x` in `g(x)` may take
+ * its value from the `FlowVar` corresponding to `int x = 0` or the `FlowVar`
+ * corresponding to `x = 1`. The `x` in `x = 1` is not considered to be an
+ * access.
+ */
+ cached abstract VariableAccess getAnAccess();
+
+ /**
+ * Holds if this `FlowVar` corresponds to a modification occurring when `node` is
+ * evaluated, receiving a value best described by `e`. The following is an
+ * exhaustive list of cases where this may happen.
+ *
+ * - `node` is an `Initializer` and `e` is its contained expression.
+ * - `node` is an `AssignExpr`, and `e` is its right-hand side.
+ * - `node` is an `AssignOperation`, and `e` is `node`.
+ * - `node` is a `CrementOperation`, and `e` is `node`. The case where
+ * `node instanceof PostCrementOperation` is an exception to the rule that
+ * `this` contains the value of `e` after the evaluation of `node`.
+ */
+ cached abstract predicate definedByExpr(Expr e, ControlFlowNode node);
+
+ /**
+ * Holds if this `FlowVar` corresponds to the initial value of `v`. The following
+ * is an exhaustive list of cases where this may happen.
+ *
+ * - `v` is a parameter, and `this` contains the value of the parameter at
+ * the entry point of its function body.
+ * - `v` is an uninitialized local variable, and `v` contains its (arbitrary)
+ * value before it is reassigned. If it can be statically determined that a
+ * local variable is always overwritten before it is used, there is no
+ * `FlowVar` instance for the uninitialized value of that variable.
+ */
+ cached abstract predicate definedByInitialValue(LocalScopeVariable v);
+
+ /** Gets a textual representation of this element. */
+ cached abstract string toString();
+
+ /** Gets the location of this element. */
+ cached abstract Location getLocation();
+}
+
+private import FlowVar_internal
+
+/**
+ * Provides classes and predicates that ought to be private but cannot use the
+ * `private` annotation because they may be referred to by unit tests.
+ */
+module FlowVar_internal {
+ /**
+ * For various reasons, not all variables handled perfectly by the SSA library.
+ * Ideally, this predicate should become larger as the SSA library improves.
+ * Before we can remove the `BlockVar` class completely, the SSA library needs
+ * the following improvements.
+ * - Considering uninitialized local variables to be definitions.
+ * - Supporting fields, globals and statics like the Java SSA library does.
+ * - Supporting all local variables, even if their address is taken by
+ * address-of, reference assignments, or lambdas.
+ */
+ predicate fullySupportedSsaVariable(Variable v) {
+ v = any(SsaDefinition def).getAVariable() and
+ // SSA variables do not exist before their first assignment, but one
+ // feature of this data flow library is to track where uninitialized data
+ // ends up.
+ not mayBeUsedUninitialized(v, _) and
+ // If `v` may be a variable that is always overwritten in a loop that
+ // always executes at least once, we give it special treatment in
+ // `BlockVar`, somewhat analogous to unrolling the first iteration of the
+ // loop.
+ not exists(AlwaysTrueUponEntryLoop loop |
+ loop.alwaysAssignsBeforeLeavingCondition(_, _, v)
+ ) and
+ // The SSA library has a theoretically accurate treatment of reference types,
+ // treating them as immutable, but for data flow it gives better results in
+ // practice to make the variable synonymous with its contents.
+ not v.getType().getUnspecifiedType() instanceof ReferenceType
+ }
+
+ /**
+ * Holds if `sbb` is the `SubBasicBlock` where `v` receives its initial value.
+ * See the documentation for `FlowVar.definedByInitialValue`.
+ */
+ predicate blockVarDefinedByVariable(
+ SubBasicBlock sbb, LocalScopeVariable v)
+ {
+ sbb = v.(Parameter).getFunction().getEntryPoint()
+ or
+ exists(DeclStmt declStmt |
+ declStmt.getDeclaration(_) = v.(LocalVariable) and
+ sbb.contains(declStmt) and
+ mayBeUsedUninitialized(v, _)
+ )
+ }
+
+ newtype TFlowVar =
+ TSsaVar(SsaDefinition def, LocalScopeVariable v) {
+ fullySupportedSsaVariable(v) and
+ v = def.getAVariable()
+ }
+ or
+ TBlockVar(SubBasicBlock sbb, Variable v) {
+ not fullySupportedSsaVariable(v) and
+ reachable(sbb) and
+ (
+ initializer(sbb.getANode(), v, _)
+ or
+ assignmentLikeOperation(sbb, v, _)
+ or
+ blockVarDefinedByVariable(sbb, v)
+ )
+ }
+
+ /**
+ * A variable whose analysis is backed by the SSA library.
+ */
+ class SsaVar extends TSsaVar, FlowVar {
+ SsaDefinition def;
+ LocalScopeVariable v;
+
+ SsaVar() { this = TSsaVar(def, v) }
+
+ override VariableAccess getAnAccess() {
+ // There is no need to know about direct accesses to phi nodes because
+ // the data flow library will never see those, and the `FlowVar` library
+ // is only meant to be used by the data flow library.
+ this.isNonPhi() and
+ ( // This base case could be included in the transitive case by changing
+ // `+` to `*`, but that's slower because it goes through the `TSsaVar`
+ // indirection.
+ result = def.getAUse(v)
+ or
+ exists(SsaDefinition descendentDef |
+ getASuccessorSsaVar+() = TSsaVar(descendentDef, _) and
+ result = descendentDef.getAUse(v)
+ )
+ )
+ }
+
+ override predicate definedByExpr(Expr e, ControlFlowNode node) {
+ e = def.getDefiningValue(v) and
+ (if def.getDefinition() = v.getInitializer().getExpr()
+ then node = v.getInitializer()
+ else node = def.getDefinition())
+ }
+
+ override predicate definedByInitialValue(LocalScopeVariable param) {
+ def.definedByParameter(param) and
+ param = v
+ }
+
+ /**
+ * Holds if this `SsaVar` corresponds to a non-phi definition. Users of this
+ * library will never directly use an `SsaVar` that comes from a phi node,
+ * so such values are purely for implementation use.
+ */
+ private predicate isNonPhi() {
+ // This implementation is positively phrased in terms of these two helper
+ // predicates because it performs better than phrasing it negatively in
+ // terms of `def.isPhiNode`.
+ this.definedByExpr(_, _)
+ or
+ this.definedByInitialValue(_)
+ }
+
+ /**
+ * Holds if `result` might have the same value as `this` because `result` is
+ * a phi node with `this` as input.
+ */
+ private SsaVar getASuccessorSsaVar() {
+ exists(SsaDefinition succDef |
+ result = TSsaVar(succDef, v) and
+ def = succDef.getAPhiInput(v)
+ )
+ }
+
+ override string toString() { result = def.toString(v) }
+
+ override Location getLocation() { result = def.getLocation() }
+ }
+
+ /**
+ * A variable whose analysis is backed by a simple control flow analysis that
+ * does not perform as well as the SSA library but gives better results for
+ * data flow purposes in some cases.
+ */
+ class BlockVar extends TBlockVar, FlowVar {
+ SubBasicBlock sbb;
+ Variable v;
+
+ BlockVar() { this = TBlockVar(sbb, v) }
+
+ override VariableAccess getAnAccess() {
+ result.getTarget() = v and
+ result = getAReachedBlockVarSBB(this).getANode() and
+ not overwrite(result, _)
+ }
+
+ override predicate definedByInitialValue(LocalScopeVariable lsv) {
+ blockVarDefinedByVariable(sbb, lsv) and
+ lsv = v
+ }
+
+ override predicate definedByExpr(Expr e, ControlFlowNode node) {
+ assignmentLikeOperation(node, v, e) and
+ node = sbb
+ or
+ initializer(node, v, e) and
+ node = sbb.getANode()
+ }
+
+ override string toString() {
+ exists(Expr e |
+ this.definedByExpr(e, _) and
+ result = v +" := "+ e
+ )
+ or
+ this.definedByInitialValue(_) and
+ result = "initial value of "+ v
+ or
+ // impossible case
+ not this.definedByExpr(_, _) and
+ not this.definedByInitialValue(_) and
+ result = "undefined "+ v
+ }
+
+ override Location getLocation() { result = sbb.getStart().getLocation() }
+ }
+
+ /** Type-specialized version of `getEnclosingElement`. */
+ private ControlFlowNode getCFNParent(ControlFlowNode node) {
+ result = node.getEnclosingElement()
+ }
+
+ /**
+ * A for-loop or while-loop whose condition is always true upon entry but not
+ * always true after the first iteration.
+ */
+ class AlwaysTrueUponEntryLoop extends Stmt {
+ AlwaysTrueUponEntryLoop() {
+ this.(WhileStmt).conditionAlwaysTrueUponEntry() and
+ not this.(WhileStmt).conditionAlwaysTrue()
+ or
+ this.(ForStmt).conditionAlwaysTrueUponEntry() and
+ not this.(ForStmt).conditionAlwaysTrue()
+ }
+
+ /**
+ * Holds if this loop always assigns to `v` before leaving through an edge
+ * from `bbInside` in its condition to `bbOutside` outside the loop. Also,
+ * `v` must be used outside the loop.
+ */
+ predicate alwaysAssignsBeforeLeavingCondition(
+ BasicBlock bbInside, BasicBlock bbOutside, Variable v
+ ) {
+ v = this.getARelevantVariable() and
+ this.bbInLoopCondition(bbInside) and
+ not this.bbInLoop(bbOutside) and
+ bbOutside = bbInside.getASuccessor() and
+ not reachesWithoutAssignment(bbInside, v)
+ }
+
+ /**
+ * Gets a variable that is assigned in this loop and read outside the loop.
+ */
+ private Variable getARelevantVariable() {
+ exists(BasicBlock bbAssign |
+ assignmentLikeOperation(bbAssign.getANode(), result, _) and
+ this.bbInLoop(bbAssign)
+ ) and
+ exists(VariableAccess va |
+ va.getTarget() = result and
+ readAccess(va) and
+ bbNotInLoop(va.getBasicBlock())
+ )
+ }
+
+ private predicate bbInLoopCondition(BasicBlock bb) {
+ getCFNParent*(bb.getANode()) = this.(Loop).getCondition()
+ }
+
+ private predicate bbInLoop(BasicBlock bb) {
+ bbDominates(this.(Loop).getStmt(), bb)
+ or
+ bbInLoopCondition(bb)
+ }
+
+ predicate bbNotInLoop(BasicBlock bb) {
+ not this.bbInLoop(bb) and
+ bb.getEnclosingFunction() = this.getEnclosingFunction()
+ }
+
+ /**
+ * Holds if `bb` is a basic block inside this loop where `v` has not been
+ * overwritten at the end of `bb`.
+ */
+ private predicate reachesWithoutAssignment(BasicBlock bb, Variable v) {
+ (
+ // For the type of loop we are interested in, the body is always a
+ // basic block.
+ bb = this.(Loop).getStmt() and
+ v = this.getARelevantVariable()
+ or
+ reachesWithoutAssignment(bb.getAPredecessor(), v) and
+ this.bbInLoop(bb)
+ ) and
+ not assignmentLikeOperation(bb.getANode(), v, _)
+ }
+ }
+
+ /**
+ * Holds if some loop always assigns to `v` before leaving through an edge
+ * from `bbInside` in its condition to `bbOutside` outside the loop, where
+ * (`sbbDef`, `v`) is a `BlockVar` defined outside the loop. Also, `v` must
+ * be used outside the loop.
+ */
+ predicate skipLoop(
+ SubBasicBlock sbbInside, SubBasicBlock sbbOutside,
+ SubBasicBlock sbbDef, Variable v
+ ) {
+ exists(AlwaysTrueUponEntryLoop loop,
+ BasicBlock bbInside, BasicBlock bbOutside |
+ loop.alwaysAssignsBeforeLeavingCondition(bbInside, bbOutside, v) and
+ bbInside = sbbInside.getBasicBlock() and
+ bbOutside = sbbOutside.getBasicBlock() and
+ sbbInside.lastInBB() and
+ sbbOutside.firstInBB() and
+ loop.bbNotInLoop(sbbDef.getBasicBlock()) and
+ exists(TBlockVar(sbbDef, v))
+ )
+ }
+
+ pragma[nomagic]
+ private SubBasicBlock getAReachedBlockVarSBB(TBlockVar start) {
+ start = TBlockVar(result, _)
+ or
+ exists(SubBasicBlock mid, SubBasicBlock sbbDef, Variable v |
+ start = TBlockVar(sbbDef, v) and
+ mid = getAReachedBlockVarSBB(start) and
+ result = mid.getASuccessor() and
+ not skipLoop(mid, result, sbbDef, v) and
+ not assignmentLikeOperation(result, v, _)
+ )
+ }
+
+ /**
+ * A local variable that is uninitialized immediately after its declaration.
+ */
+ class UninitializedLocalVariable extends LocalVariable {
+ UninitializedLocalVariable() {
+ not this.hasInitializer() and
+ not this.isStatic()
+ }
+ }
+
+ /** Holds if `va` may be an uninitialized access to `v`. */
+ predicate mayBeUsedUninitialized(UninitializedLocalVariable v, VariableAccess va) {
+ exists(BasicBlock bb, int vaIndex |
+ va.getTarget() = v and
+ readAccess(va) and
+ va = bb.getNode(vaIndex) and
+ notAccessedAtStartOfBB(v, bb) and
+ (
+ vaIndex < indexOfFirstOverwriteInBB(v, bb)
+ or
+ not exists(indexOfFirstOverwriteInBB(v, bb))
+ )
+ )
+ }
+
+ /**
+ * Holds if `v` has not been accessed at the start of `bb`, for a variable
+ * `v` where `allReadsDominatedByOverwrite(v)` does not hold.
+ */
+ predicate notAccessedAtStartOfBB(UninitializedLocalVariable v, BasicBlock bb) {
+ // Start from a BB containing an uninitialized variable
+ bb.getANode().(DeclStmt).getDeclaration(_) = v and
+ // Only consider variables for which initialization before reading cannot
+ // be proved by simpler means. This predicate is expensive in time and
+ // space, whereas `allReadsDominatedByOverwrite` is cheap.
+ not allReadsDominatedByOverwrite(v)
+ or
+ exists(BasicBlock pred |
+ pred = bb.getAPredecessor() and
+ notAccessedAtStartOfBB(v, pred) and
+ // Stop searching when `v` is accessed.
+ not pred.getANode() = v.getAnAccess()
+ )
+ }
+
+ /**
+ * Holds if all read accesses of `v` are dominated by an overwrite of `v`.
+ */
+ predicate allReadsDominatedByOverwrite(UninitializedLocalVariable v) {
+ forall(VariableAccess va |
+ va.getTarget() = v and
+ readAccess(va)
+ | dominatedByOverwrite(v, va)
+ )
+ }
+
+ /** Holds if `va` accesses `v` and is dominated by an overwrite of `v`. */
+ predicate dominatedByOverwrite(UninitializedLocalVariable v,
+ VariableAccess va)
+ {
+ exists(BasicBlock bb, int vaIndex |
+ va = bb.getNode(vaIndex) and
+ va.getTarget() = v
+ | vaIndex > indexOfFirstOverwriteInBB(v, bb)
+ or
+ bbStrictlyDominates(getAnOverwritingBB(v), bb)
+ )
+ }
+
+ /** Gets a basic block in which `v` is overwritten. */
+ BasicBlock getAnOverwritingBB(UninitializedLocalVariable v) {
+ exists(indexOfFirstOverwriteInBB(v, result))
+ }
+
+ int indexOfFirstOverwriteInBB(LocalVariable v, BasicBlock bb) {
+ result = min(int i | overwrite(v.getAnAccess(), bb.getNode(i)))
+ }
+
+ /**
+ * Holds if the value of the variable accessed at `va` may affect the execution
+ * of the program.
+ */
+ predicate readAccess(VariableAccess va) {
+ reachable(va) and
+ not overwrite(va, _) and
+ not va = any(SizeofExprOperator so).getAChild+() and
+ not va = any(AlignofExprOperator ao).getAChild+()
+ }
+
+ /**
+ * Holds if the value of the variable accessed at `va` is completely
+ * overwritten at `node`, where `va` is uniquely determined by `node`.
+ */
+ predicate overwrite(VariableAccess va, ControlFlowNode node) {
+ va = node.(AssignExpr).getLValue()
+ }
+
+ /**
+ * Holds if `v` is modified as a side effect of evaluating `node`, receiving a
+ * value best described by `e`. This corresponds to `FlowVar::definedByExpr`,
+ * except that the case where `node instanceof Initializer` is covered by
+ * `initializer` instead of this predicate.
+ */
+ predicate assignmentLikeOperation(
+ ControlFlowNode node, Variable v, Expr assignedExpr)
+ {
+ // Together, the two following cases cover `Assignment`
+ node = any(AssignExpr ae |
+ v = ae.getLValue().(VariableAccess).getTarget() and
+ assignedExpr = ae.getRValue()
+ )
+ or
+ node = any(AssignOperation ao |
+ v = ao.getLValue().(VariableAccess).getTarget() and
+ // Here and in the `PrefixCrementOperation` case, we say that the assigned
+ // expression is the operation itself. For example, we say that `x += 1`
+ // assigns `x += 1` to `x`. The justification is that after this operation,
+ // `x` will contain the same value that `x += 1` evaluated to.
+ assignedExpr = ao
+ )
+ or
+ // This case does not add further data flow paths, except if a
+ // `PrefixCrementOperation` is itself a source
+ node = any(CrementOperation op |
+ v = op.getOperand().(VariableAccess).getTarget() and
+ assignedExpr = op
+ )
+ }
+
+ /**
+ * Holds if `v` is initialized by `init` to have value `assignedExpr`.
+ */
+ predicate initializer(
+ Initializer init, LocalVariable v, Expr assignedExpr)
+ {
+ v = init.getDeclaration() and
+ assignedExpr = init.getExpr()
+ }
+
+ /**
+ * A point in a basic block where a non-SSA variable may have a different value
+ * than it did elsewhere in the same basic block. Extending this class
+ * configures the `SubBasicBlocks` library as needed for the implementation of
+ * this library.
+ */
+ class DataFlowSubBasicBlockCutNode extends SubBasicBlockCutNode {
+ DataFlowSubBasicBlockCutNode() {
+ exists(Variable v |
+ not fullySupportedSsaVariable(v) and
+ assignmentLikeOperation(this, v, _)
+ // It is not necessary to cut the basic blocks at `Initializer` nodes
+ // because the affected variable can have no _other_ value before its
+ // initializer. It is not necessary to cut basic blocks at procedure
+ // entries for the sake of `Parameter`s since we are already guaranteed
+ // to have a `SubBasicBlock` starting at procedure entry.
+ )
+ }
+ }
+} /* module FlowVar_internal */
diff --git a/cpp/ql/src/semmle/code/cpp/dataflow/internal/SubBasicBlocks.qll b/cpp/ql/src/semmle/code/cpp/dataflow/internal/SubBasicBlocks.qll
new file mode 100644
index 000000000000..026e909cfaf3
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/dataflow/internal/SubBasicBlocks.qll
@@ -0,0 +1,187 @@
+//
+// NOTE: Maintain this file in synchrony with
+// semmlecode-cpp-queries/semmle/code/cpp/controlflow/SubBasicBlocks.qll
+//
+// This is a private copy of the `SubBasicBlocks` library for internal use by
+// the data flow library. Having an extra copy can prevent non-monotonic
+// recursion errors in queries that use both the data flow library and the
+// `SubBasicBlocks` library.
+
+/**
+ * Provides the `SubBasicBlock` class, used for partitioning basic blocks in
+ * smaller pieces.
+ */
+import cpp
+
+/**
+ * An abstract class that directs where in the control-flow graph a new
+ * `SubBasicBlock` must start. If a `ControlFlowNode` is an instance of this
+ * class, that node is guaranteed to be the first node in a `SubBasicBlock`.
+ * If multiple libraries use the `SubBasicBlock` library, basic blocks may be
+ * split in more places than either library expects, but nothing should break
+ * as a direct result of that.
+ */
+abstract class SubBasicBlockCutNode extends @cfgnode {
+ SubBasicBlockCutNode() {
+ // Some control-flow nodes are not in any basic block. This includes
+ // `Conversion`s, expressions that are evaluated at compile time, default
+ // arguments, and `Function`s without implementation.
+ exists(this.(ControlFlowNode).getBasicBlock())
+ }
+ string toString() { result = "SubBasicBlockCutNode" }
+}
+
+/**
+ * A block that can be smaller than or equal to a `BasicBlock`. Use this class
+ * when `ControlFlowNode` is too fine-grained and `BasicBlock` too
+ * coarse-grained. Their successor graph is like that of basic blocks, except
+ * that the blocks are split up with an extra edge right before any instance of
+ * the abstract class `SubBasicBlockCutNode`. Users of this library must
+ * therefore extend `SubBasicBlockCutNode` to direct where basic blocks will be
+ * split up.
+ */
+class SubBasicBlock extends @cfgnode {
+ SubBasicBlock() {
+ this instanceof BasicBlock
+ or
+ this instanceof SubBasicBlockCutNode
+ }
+
+ /** Gets the basic block in which this `SubBasicBlock` is contained. */
+ BasicBlock getBasicBlock() {
+ result = this.(ControlFlowNode).getBasicBlock()
+ }
+
+ /**
+ * Holds if this `SubBasicBlock` comes first in its basic block. This is the
+ * only condition under which a `SubBasicBlock` may have multiple
+ * predecessors.
+ */
+ predicate firstInBB() {
+ exists(BasicBlock bb | this.getPosInBasicBlock(bb) = 0)
+ }
+
+ /**
+ * Holds if this `SubBasicBlock` comes last in its basic block. This is the
+ * only condition under which a `SubBasicBlock` may have multiple successors.
+ */
+ predicate lastInBB() {
+ exists(BasicBlock bb |
+ this.getPosInBasicBlock(bb) = countSubBasicBlocksInBasicBlock(bb) - 1
+ )
+ }
+
+ /**
+ * Gets the position of this `SubBasicBlock` in its containing basic block
+ * `bb`, where `bb` is equal to `getBasicBlock()`.
+ */
+ int getPosInBasicBlock(BasicBlock bb) {
+ exists(int nodePos, int rnk |
+ bb = this.(ControlFlowNode).getBasicBlock() and
+ this = bb.getNode(nodePos) and
+ nodePos = rank[rnk](int i | exists(SubBasicBlock n | n = bb.getNode(i))) and
+ result = rnk - 1
+ )
+ }
+
+ /** Gets a successor in the control-flow graph of `SubBasicBlock`s. */
+ SubBasicBlock getASuccessor() {
+ this.lastInBB() and
+ result = this.getBasicBlock().getASuccessor()
+ or
+ exists(BasicBlock bb |
+ result.getPosInBasicBlock(bb) = this.getPosInBasicBlock(bb) + 1
+ )
+ }
+
+ /**
+ * Gets the `pos`th control-flow node in this `SubBasicBlock`. Positions
+ * start from 0, and the node at position 0 always exists and compares equal
+ * to `this`.
+ */
+ ControlFlowNode getNode(int pos) {
+ exists(BasicBlock bb | bb = this.getBasicBlock() |
+ exists(int thisPos | this = bb.getNode(thisPos) |
+ result = bb.getNode(thisPos + pos) and
+ pos >= 0 and
+ pos < this.getNumberOfNodes()
+ )
+ )
+ }
+
+ /** Gets a control-flow node in this `SubBasicBlock`. */
+ ControlFlowNode getANode() {
+ result = this.getNode(_)
+ }
+
+ /** Holds if `this` contains `node`. */
+ predicate contains(ControlFlowNode node) {
+ node = this.getANode()
+ }
+
+ /** Gets a predecessor in the control-flow graph of `SubBasicBlock`s. */
+ SubBasicBlock getAPredecessor() {
+ result.getASuccessor() = this
+ }
+
+ string toString() { result = "SubBasicBlock" }
+
+ /**
+ * Gets a node such that the control-flow edge `(this, result)` may be taken
+ * when the final node of this `SubBasicBlock` is a conditional expression
+ * and evaluates to true.
+ */
+ SubBasicBlock getATrueSuccessor() {
+ this.lastInBB() and
+ result = this.getBasicBlock().getATrueSuccessor()
+ }
+
+ /**
+ * Gets a node such that the control-flow edge `(this, result)` may be taken
+ * when the final node of this `SubBasicBlock` is a conditional expression
+ * and evaluates to false.
+ */
+ SubBasicBlock getAFalseSuccessor() {
+ this.lastInBB() and
+ result = this.getBasicBlock().getAFalseSuccessor()
+ }
+
+ /**
+ * Gets the number of control-flow nodes in this `SubBasicBlock`. There is
+ * always at least one.
+ */
+ int getNumberOfNodes() {
+ exists(BasicBlock bb | bb = this.getBasicBlock() |
+ exists(int thisPos | this = bb.getNode(thisPos) |
+ this.lastInBB() and
+ result = bb.length() - thisPos
+ or
+ exists(SubBasicBlock succ, int succPos |
+ succ.getPosInBasicBlock(bb) = this.getPosInBasicBlock(bb) + 1 and
+ bb.getNode(succPos) = succ and
+ result = succPos - thisPos
+ )
+ )
+ )
+ }
+
+ /** Gets the last control-flow node in this `SubBasicBlock`. */
+ ControlFlowNode getEnd() {
+ result = this.getNode(this.getNumberOfNodes() - 1)
+ }
+
+ /** Gets the first control-flow node in this `SubBasicBlock`. */
+ ControlFlowNode getStart() {
+ result = this
+ }
+
+ pragma[noinline]
+ Function getEnclosingFunction() {
+ result = this.getStart().getControlFlowScope()
+ }
+}
+
+/** Gets the number of `SubBasicBlock`s in the given basic block. */
+private int countSubBasicBlocksInBasicBlock(BasicBlock bb) {
+ result = strictcount(SubBasicBlock sbb | sbb.getBasicBlock() = bb)
+}
diff --git a/cpp/ql/src/semmle/code/cpp/exprs/Access.qll b/cpp/ql/src/semmle/code/cpp/exprs/Access.qll
new file mode 100644
index 000000000000..733054e7262c
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/exprs/Access.qll
@@ -0,0 +1,319 @@
+import semmle.code.cpp.exprs.Expr
+import semmle.code.cpp.Variable
+import semmle.code.cpp.Enum
+private import semmle.code.cpp.dataflow.EscapesTree
+
+/**
+ * A C/C++ access expression. This refers to a function, variable, or enum constant.
+ */
+abstract class Access extends Expr, NameQualifiableElement {
+ /** Gets the accessed function, variable, or enum constant. */
+ abstract Declaration getTarget();
+
+ override predicate mayBeImpure() {
+ none()
+ }
+ override predicate mayBeGloballyImpure() {
+ none()
+ }
+
+ override string toString() { none() }
+}
+
+/**
+ * A C/C++ enum constant access expression.
+ */
+class EnumConstantAccess extends Access, @varaccess {
+ EnumConstantAccess() {
+ exists(EnumConstant c | varbind(this, c))
+ }
+
+ /** Gets the accessed enum constant. */
+ override EnumConstant getTarget() { varbind(this, result) }
+
+ /** Gets a textual representation of this enum constant access. */
+ override string toString() { result = this.getTarget().getName() }
+}
+
+/**
+ * A C/C++ variable access expression.
+ */
+class VariableAccess extends Access, @varaccess {
+ VariableAccess() {
+ not exists(EnumConstant c | varbind(this, c))
+ }
+
+ /** Gets the accessed variable. */
+ override Variable getTarget() { varbind(this, result) }
+
+ /**
+ * Holds if this variable access is providing an LValue in a meaningful way.
+ * For example, this includes accesses on the left-hand side of an assignment.
+ * It does not include accesses on the right-hand side of an assignment, even if they could appear on the left-hand side of some assignment.
+ */
+ predicate isUsedAsLValue() {
+ exists(Assignment a | a.getLValue() = this)
+ or exists(CrementOperation c | c.getOperand() = this)
+ or exists(AddressOfExpr addof | addof.getOperand() = this)
+ or exists(ReferenceToExpr rte | this.getConversion() = rte)
+ or exists(ArrayToPointerConversion atpc | this.getConversion() = atpc)
+ }
+
+ /**
+ * Holds if this variable access is in a position where it is (directly) modified,
+ * for instance by an assignment or increment/decrement operator.
+ */
+ predicate isModified() {
+ exists(Assignment a | a.getLValue() = this)
+ or exists(CrementOperation c | c.getOperand() = this)
+ or exists(FunctionCall c | c.getQualifier() = this and c.getTarget().hasName("operator="))
+ }
+
+ /** Holds if this variable access is an rvalue. */
+ predicate isRValue() {
+ not exists(AssignExpr ae | ae.getLValue() = this) and
+ not exists(AddressOfExpr addof | addof.getOperand() = this) and
+ not exists(ReferenceToExpr rte | this.getConversion() = rte) and
+ not exists(ArrayToPointerConversion atpc | this.getConversion() = atpc)
+ }
+
+ /**
+ * Gets the expression generating the variable being accessed.
+ *
+ * As a few examples:
+ * For `ptr->x`, this gives `ptr`.
+ * For `(*ptr).x`, this gives `(*ptr)`.
+ * For `smart_ptr->x`, this gives the call to `operator->`.
+ *
+ * This applies mostly to FieldAccesses, but also to static member variables accessed
+ * "through" a pointer. Note that it does NOT apply to static member variables accessed
+ * through a type name, as in that case the type name is a qualifier on the variable
+ * rather than a qualifier on the access.
+ */
+ Expr getQualifier() { this.getChild(-1) = result }
+
+ /** Gets a textual representation of this variable access. */
+ override string toString() {
+ if exists(this.getTarget()) then
+ result = this.getTarget().getName()
+ else
+ result = "variable access"
+ }
+
+ override predicate mayBeImpure() {
+ this.getQualifier().mayBeImpure() or
+ this.getTarget().getType().isVolatile()
+ }
+ override predicate mayBeGloballyImpure() {
+ this.getQualifier().mayBeGloballyImpure() or
+ this.getTarget().getType().isVolatile()
+ }
+
+ /**
+ * Holds if this access is used to get the address of the underlying variable
+ * in such a way that the address might escape. This can be either explicit,
+ * for example `&x`, or implicit, for example `T& y = x`.
+ */
+ predicate isAddressOfAccess() {
+ variableAddressEscapesTree(this, _)
+ }
+
+ /**
+ * Holds if this access is used to get the address of the underlying variable
+ * in such a way that the address might escape as a pointer or reference to
+ * non-const data. This can be either explicit, for example `&x`, or
+ * implicit, for example `T& y = x`.
+ */
+ predicate isAddressOfAccessNonConst() {
+ variableAddressEscapesTreeNonConst(this, _)
+ }
+}
+
+/**
+ * A C/C++ field access expression.
+ */
+class FieldAccess extends VariableAccess {
+ FieldAccess() { exists(Field f | varbind(this, f)) }
+
+ /** Gets the accessed field. */
+ override Field getTarget() { result = super.getTarget() }
+}
+
+/**
+ * A field access of the form `obj->field`. The type of `obj` is a pointer,
+ * so this is equivalent to `(*obj).field`.
+ */
+class PointerFieldAccess extends FieldAccess {
+ PointerFieldAccess() {
+ exists (PointerType t
+ | t = getQualifier().getFullyConverted().getType().getUnspecifiedType() and
+ t.getBaseType() instanceof Class)
+ }
+}
+
+/**
+ * A field access of the form `obj.field`. The type of `obj` is either a
+ * class/struct/union or a reference to one. `DotFieldAccess` has two
+ * sub-classes, `ValueFieldAccess` and `ReferenceFieldAccess`, to
+ * distinguish whether or not the type of `obj` is a reference type.
+ */
+class DotFieldAccess extends FieldAccess {
+ DotFieldAccess() {
+ exists (Class c
+ | c = getQualifier().getFullyConverted().getType().getUnspecifiedType())
+ }
+}
+
+/**
+ * A field access of the form `obj.field`, where the type of `obj` is a
+ * reference to a class/struct/union.
+ */
+class ReferenceFieldAccess extends DotFieldAccess {
+ ReferenceFieldAccess() {
+ exprHasReferenceConversion(this.getQualifier())
+ }
+}
+
+/**
+ * A field access of the form `obj.field`, where the type of `obj` is a
+ * class/struct/union (and not a reference).
+ */
+class ValueFieldAccess extends DotFieldAccess {
+ ValueFieldAccess() {
+ not exprHasReferenceConversion(this.getQualifier())
+ }
+}
+
+/**
+ * Holds if `c` is a conversion from type `T&` to `T` (or from `T&&` to
+ * `T`).
+ */
+private predicate referenceConversion(Conversion c) {
+ c.getType() = c.getExpr().getType().(ReferenceType).getBaseType()
+}
+
+/**
+ * Holds if `e` is a reference expression (that is, it has a type of the
+ * form `T&`), which is converted to a value. For example:
+ *
+ * ```
+ * int myfcn(MyStruct &x) {
+ * return x.field;
+ * }
+ * ```
+ *
+ * In this example, the type of `x` is `MyStruct&`, but it gets implicitly
+ * converted to `MyStruct` in the expression `x.field`.
+ */
+private predicate exprHasReferenceConversion(Expr e) {
+ referenceConversion(e.getConversion+())
+}
+
+/**
+ * A field access of a field of `this`. The access has no qualifier because
+ * the use of `this` is implicit. For example, `field` is equivalent to
+ * `this->field` if `field` is a member of `this`.
+ *
+ * Note: the C++ front-end often automatically desugars `field` to
+ * `this->field`, so most implicit accesses of `this->field` are instances
+ * of `PointerFieldAccess` (with `ThisExpr` as the qualifier), not
+ * `ImplicitThisFieldAccess`.
+ */
+class ImplicitThisFieldAccess extends FieldAccess {
+ ImplicitThisFieldAccess() {
+ not exists (this.getQualifier())
+ }
+}
+
+/**
+ * A C/C++ function access expression.
+ */
+class FunctionAccess extends Access, @routineexpr {
+ FunctionAccess() { not iscall(this,_) }
+
+ /** Gets the accessed function. */
+ override Function getTarget() { funbind(this, result) }
+
+ /** Gets a textual representation of this function access. */
+ override string toString() {
+ if exists(this.getTarget()) then
+ result = this.getTarget().getName()
+ else
+ result = "function access"
+ }
+}
+
+/**
+ * An access to a parameter of a function signature for the purposes of a decltype.
+ *
+ * For example, given the following code:
+ * ```
+ * template
+ * auto add(L lhs, R rhs) -> decltype(lhs + rhs) {
+ * return lhs + rhs;
+ * }
+ * ```
+ * The return type of the function is a decltype, the expression of which contains
+ * an add expression, which in turn has two ParamAccessForType children.
+ */
+class ParamAccessForType extends Expr, @param_ref {
+ override string toString() {
+ result = "param access"
+ }
+}
+
+/**
+ * An access to a type. This occurs in certain contexts where a built-in
+ * works on types directly rather than variables, expressions etc.
+ */
+class TypeName extends Expr, @type_operand {
+ override string toString() {
+ result = this.getType().getName()
+ }
+}
+
+/**
+ * A C/C++ array access expression.
+ *
+ * For calls to operator[], which look syntactically identical, see OverloadedArrayExpr.
+ */
+class ArrayExpr extends Expr, @subscriptexpr {
+ /**
+ * Gets the array or pointer expression being subscripted.
+ *
+ * This is arr in both arr[0] and 0[arr].
+ */
+ Expr getArrayBase() { result = this.getChild(0) }
+
+ /**
+ * Gets the expression giving the index into the array.
+ *
+ * This is 0 in both arr[0] and 0[arr].
+ */
+ Expr getArrayOffset() { result = this.getChild(1) }
+
+ /**
+ * Holds if this array access is in a position where it is (directly) modified,
+ * for instance by an assignment or an increment/decrement operation.
+ */
+ predicate isModified() {
+ exists(Assignment a | a.getLValue() = this)
+ or exists(CrementOperation c | c.getOperand() = this)
+ or exists(FunctionCall c | c.getQualifier() = this and c.getTarget().hasName("operator="))
+ }
+
+ override string toString() { result = "access to array" }
+
+ override predicate mayBeImpure() {
+ this.getArrayBase().mayBeImpure() or
+ this.getArrayOffset().mayBeImpure() or
+ this.getArrayBase().getFullyConverted().getType().(DerivedType).getBaseType().isVolatile() or
+ this.getArrayOffset().getFullyConverted().getType().(DerivedType).getBaseType().isVolatile()
+ }
+ override predicate mayBeGloballyImpure() {
+ this.getArrayBase().mayBeGloballyImpure() or
+ this.getArrayOffset().mayBeGloballyImpure() or
+ this.getArrayBase().getFullyConverted().getType().(DerivedType).getBaseType().isVolatile() or
+ this.getArrayOffset().getFullyConverted().getType().(DerivedType).getBaseType().isVolatile()
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/exprs/ArithmeticOperation.qll b/cpp/ql/src/semmle/code/cpp/exprs/ArithmeticOperation.qll
new file mode 100644
index 000000000000..7662ec4a7757
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/exprs/ArithmeticOperation.qll
@@ -0,0 +1,297 @@
+import semmle.code.cpp.exprs.Expr
+
+/**
+ * A C/C++ arithmetic operation.
+ */
+abstract class UnaryArithmeticOperation extends UnaryOperation {
+}
+
+/**
+ * A C/C++ unary minus expression.
+ */
+class UnaryMinusExpr extends UnaryArithmeticOperation, @arithnegexpr {
+ override string getOperator() { result = "-" }
+
+ override int getPrecedence() { result = 15 }
+}
+
+/**
+ * A C/C++ unary plus expression.
+ */
+class UnaryPlusExpr extends UnaryArithmeticOperation, @unaryplusexpr {
+ override string getOperator() { result = "+" }
+
+ override int getPrecedence() { result = 15 }
+}
+
+/**
+ * A C/C++ GNU conjugation expression.
+ */
+class ConjugationExpr extends UnaryArithmeticOperation, @conjugation {
+ override string getOperator() { result = "~" }
+}
+
+/**
+ * A C/C++ `++` or `--` expression (either prefix or postfix).
+ *
+ * Note that this doesn't include calls to user-defined `operator++`
+ * or `operator--`.
+ */
+abstract class CrementOperation extends UnaryArithmeticOperation {
+ override predicate mayBeImpure() {
+ any()
+ }
+ override predicate mayBeGloballyImpure() {
+ not exists(VariableAccess va, LocalScopeVariable v |
+ va = this.getOperand()
+ and v = va.getTarget()
+ and not va.getConversion+() instanceof ReferenceDereferenceExpr
+ and not v.isStatic())
+ }
+}
+
+/**
+ * A C/C++ `++` expression (either prefix or postfix).
+ *
+ * Note that this doesn't include calls to user-defined `operator++`.
+ */
+abstract class IncrementOperation extends CrementOperation {
+}
+
+/**
+ * A C/C++ `--` expression (either prefix or postfix).
+ *
+ * Note that this doesn't include calls to user-defined `operator--`.
+ */
+abstract class DecrementOperation extends CrementOperation {
+}
+
+/**
+ * A C/C++ `++` or `--` prefix expression.
+ *
+ * Note that this doesn't include calls to user-defined operators.
+ */
+abstract class PrefixCrementOperation extends CrementOperation {
+}
+
+/**
+ * A C/C++ `++` or `--` postfix expression.
+ *
+ * Note that this doesn't include calls to user-defined operators.
+ */
+abstract class PostfixCrementOperation extends CrementOperation {
+}
+
+/**
+ * A C/C++ prefix increment expression, as in `++x`.
+ *
+ * Note that this doesn't include calls to user-defined `operator++`.
+ */
+class PrefixIncrExpr extends IncrementOperation, PrefixCrementOperation, @preincrexpr {
+ override string getOperator() { result = "++" }
+
+ override int getPrecedence() { result = 15 }
+}
+
+/**
+ * A C/C++ prefix decrement expression, as in `--x`.
+ *
+ * Note that this doesn't include calls to user-defined `operator--`.
+ */
+class PrefixDecrExpr extends DecrementOperation, PrefixCrementOperation, @predecrexpr {
+ override string getOperator() { result = "--" }
+
+ override int getPrecedence() { result = 15 }
+}
+
+/**
+ * A C/C++ postfix increment expression, as in `x++`.
+ *
+ * Note that this doesn't include calls to user-defined `operator++`.
+ */
+class PostfixIncrExpr extends IncrementOperation, PostfixCrementOperation, @postincrexpr {
+ override string getOperator() { result = "++" }
+
+ override int getPrecedence() { result = 16 }
+
+ override string toString() { result = "... " + getOperator() }
+}
+
+/**
+ * A C/C++ postfix decrement expression, as in `x--`.
+ *
+ * Note that this doesn't include calls to user-defined `operator--`.
+ */
+class PostfixDecrExpr extends DecrementOperation, PostfixCrementOperation, @postdecrexpr {
+ override string getOperator() { result = "--" }
+
+ override int getPrecedence() { result = 16 }
+
+ override string toString() { result = "... " + getOperator() }
+}
+
+/**
+ * A C/C++ GNU real part expression.
+ */
+class RealPartExpr extends UnaryArithmeticOperation, @realpartexpr {
+ override string getOperator() { result = "__real" }
+}
+
+/**
+ * A C/C++ GNU imaginary part expression.
+ */
+class ImaginaryPartExpr extends UnaryArithmeticOperation, @imagpartexpr {
+ override string getOperator() { result = "__imag" }
+}
+
+/**
+ * A C/C++ binary arithmetic operation.
+ */
+abstract class BinaryArithmeticOperation extends BinaryOperation {
+}
+
+/**
+ * A C/C++ add expression.
+ */
+class AddExpr extends BinaryArithmeticOperation, @addexpr {
+ override string getOperator() { result = "+" }
+
+ override int getPrecedence() { result = 12 }
+}
+
+/**
+ * A C/C++ subtract expression.
+ */
+class SubExpr extends BinaryArithmeticOperation, @subexpr {
+ override string getOperator() { result = "-" }
+
+ override int getPrecedence() { result = 12 }
+}
+
+/**
+ * A C/C++ multiply expression.
+ */
+class MulExpr extends BinaryArithmeticOperation, @mulexpr {
+ override string getOperator() { result = "*" }
+
+ override int getPrecedence() { result = 13 }
+}
+
+/**
+ * A C/C++ divide expression.
+ */
+class DivExpr extends BinaryArithmeticOperation, @divexpr {
+ override string getOperator() { result = "/" }
+
+ override int getPrecedence() { result = 13 }
+}
+
+/**
+ * A C/C++ remainder expression.
+ */
+class RemExpr extends BinaryArithmeticOperation, @remexpr {
+ override string getOperator() { result = "%" }
+
+ override int getPrecedence() { result = 13 }
+}
+
+/**
+ * A C/C++ multiply expression with an imaginary number.
+ */
+class ImaginaryMulExpr extends BinaryArithmeticOperation, @jmulexpr {
+ override string getOperator() { result = "*" }
+
+ override int getPrecedence() { result = 13 }
+}
+
+/**
+ * A C/C++ divide expression with an imaginary number.
+ */
+class ImaginaryDivExpr extends BinaryArithmeticOperation, @jdivexpr {
+ override string getOperator() { result = "/" }
+
+ override int getPrecedence() { result = 13 }
+}
+
+/**
+ * A C/C++ add expression with a real term and an imaginary term.
+ */
+class RealImaginaryAddExpr extends BinaryArithmeticOperation, @fjaddexpr {
+ override string getOperator() { result = "+" }
+
+ override int getPrecedence() { result = 12 }
+}
+
+/**
+ * A C/C++ add expression with an imaginary term and a real term.
+ */
+class ImaginaryRealAddExpr extends BinaryArithmeticOperation, @jfaddexpr {
+ override string getOperator() { result = "+" }
+
+ override int getPrecedence() { result = 12 }
+}
+
+/**
+ * A C/C++ subtract expression with a real term and an imaginary term.
+ */
+class RealImaginarySubExpr extends BinaryArithmeticOperation, @fjsubexpr {
+ override string getOperator() { result = "-" }
+
+ override int getPrecedence() { result = 12 }
+}
+
+/**
+ * A C/C++ subtract expression with an imaginary term and a real term.
+ */
+class ImaginaryRealSubExpr extends BinaryArithmeticOperation, @jfsubexpr {
+ override string getOperator() { result = "-" }
+
+ override int getPrecedence() { result = 12 }
+}
+
+/**
+ * A C/C++ GNU min expression.
+ */
+class MinExpr extends BinaryArithmeticOperation, @minexpr {
+ override string getOperator() { result = "?" }
+}
+
+/**
+ * A C/C++ pointer arithmetic operation.
+ */
+abstract class PointerArithmeticOperation extends BinaryArithmeticOperation {
+}
+
+/**
+ * A C/C++ pointer add expression.
+ */
+class PointerAddExpr extends PointerArithmeticOperation, @paddexpr {
+ override string getOperator() { result = "+" }
+
+ override int getPrecedence() { result = 12 }
+}
+
+/**
+ * A C/C++ pointer subtract expression.
+ */
+class PointerSubExpr extends PointerArithmeticOperation, @psubexpr {
+ override string getOperator() { result = "-" }
+
+ override int getPrecedence() { result = 12 }
+}
+
+/**
+ * A C/C++ pointer difference expression.
+ */
+class PointerDiffExpr extends PointerArithmeticOperation, @pdiffexpr {
+ override string getOperator() { result = "-" }
+
+ override int getPrecedence() { result = 12 }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/exprs/Assignment.qll b/cpp/ql/src/semmle/code/cpp/exprs/Assignment.qll
new file mode 100644
index 000000000000..7f509be1664d
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/exprs/Assignment.qll
@@ -0,0 +1,158 @@
+import semmle.code.cpp.exprs.Expr
+import semmle.code.cpp.exprs.ArithmeticOperation
+import semmle.code.cpp.exprs.BitwiseOperation
+
+/**
+ * A non-overloaded binary assignment operation, including `=`, `+=`, `&=`,
+ * etc. A C++ overloaded operation looks syntactically identical but is instead
+ * a `FunctionCall`.
+ */
+abstract class Assignment extends Operation {
+ /** Gets the lvalue of this assignment. */
+ Expr getLValue() { this.hasChild(result,0) }
+
+ /** Gets the rvalue of this assignment. */
+ Expr getRValue() { this.hasChild(result,1) }
+
+ override int getPrecedence() { result = 2 }
+
+ override predicate mayBeGloballyImpure() {
+ this.getRValue().mayBeGloballyImpure() or
+ not exists(VariableAccess va, LocalScopeVariable v |
+ va = this.getLValue()
+ and v = va.getTarget()
+ and not va.getConversion+() instanceof ReferenceDereferenceExpr
+ and not v.isStatic())
+ }
+}
+
+/**
+ * A non-overloaded assignment operation with the operator `=`.
+ */
+class AssignExpr extends Assignment, @assignexpr {
+ override string getOperator() { result = "=" }
+
+ /** Gets a textual representation of this assignment. */
+ override string toString() { result = "... = ..." }
+}
+
+/**
+ * A non-overloaded binary assignment operation other than `=`.
+ */
+abstract class AssignOperation extends Assignment {
+ override string toString() { result = "... " + this.getOperator() + " ..." }
+}
+
+/**
+ * A non-overloaded arithmetic assignment operation on a non-pointer lvalue:
+ * `+=`, `-=`, `*=`, `/=` and `%=`.
+ */
+abstract class AssignArithmeticOperation extends AssignOperation {
+}
+
+/**
+ * A non-overloaded `+=` assignment expression on a non-pointer lvalue.
+ */
+class AssignAddExpr extends AssignArithmeticOperation, @assignaddexpr {
+ override string getOperator() { result = "+=" }
+}
+
+/**
+ * A non-overloaded `-=` assignment expression on a non-pointer lvalue.
+ */
+class AssignSubExpr extends AssignArithmeticOperation, @assignsubexpr {
+ override string getOperator() { result = "-=" }
+}
+
+/**
+ * A non-overloaded `*=` assignment expression.
+ */
+class AssignMulExpr extends AssignArithmeticOperation, @assignmulexpr {
+ override string getOperator() { result = "*=" }
+}
+
+/**
+ * A non-overloaded `/=` assignment expression.
+ */
+class AssignDivExpr extends AssignArithmeticOperation, @assigndivexpr {
+ override string getOperator() { result = "/=" }
+}
+
+/**
+ * A non-overloaded `%=` assignment expression.
+ */
+class AssignRemExpr extends AssignArithmeticOperation, @assignremexpr {
+ override string getOperator() { result = "%=" }
+}
+
+/**
+ * A non-overloaded bitwise assignment operation.
+ `&=`, `|=`, `^=`, `<<=` and `>>=`
+ */
+abstract class AssignBitwiseOperation extends AssignOperation {
+}
+
+/**
+ * A non-overloaded `&=` assignment expression.
+ */
+class AssignAndExpr extends AssignBitwiseOperation, @assignandexpr {
+ override string getOperator() { result = "&=" }
+}
+
+/**
+ * A non-overloaded `|=` assignment expression.
+ */
+class AssignOrExpr extends AssignBitwiseOperation, @assignorexpr {
+ override string getOperator() { result = "|=" }
+}
+
+/**
+ * A non-overloaded `^=` assignment expression.
+ */
+class AssignXorExpr extends AssignBitwiseOperation, @assignxorexpr {
+ override string getOperator() { result = "^=" }
+}
+
+/**
+ * A non-overloaded `<<=` assignment expression.
+ */
+class AssignLShiftExpr extends AssignBitwiseOperation, @assignlshiftexpr {
+ override string getOperator() { result = "<<=" }
+}
+
+/**
+ * A non-overloaded `>>=` assignment expression.
+ */
+class AssignRShiftExpr extends AssignBitwiseOperation, @assignrshiftexpr {
+ override string getOperator() { result = ">>=" }
+}
+
+/**
+ * A non-overloaded `+=` pointer assignment expression.
+ */
+class AssignPointerAddExpr extends AssignOperation, @assignpaddexpr {
+ override string getOperator() { result = "+=" }
+}
+
+/**
+ * A non-overloaded `-=` pointer assignment expression.
+ */
+class AssignPointerSubExpr extends AssignOperation, @assignpsubexpr {
+ override string getOperator() { result = "-=" }
+}
+
+/**
+ * A C++ variable declaration in an expression where a condition is expected.
+ * For example, on the `ConditionDeclExpr` in `if (bool c = x < y)`,
+ * `getExpr()` is an access to `c` (with possible casts), and `getVariable` is
+ * the variable `c`, which has an initializer `x < y`.
+ */
+class ConditionDeclExpr extends Expr, @condition_decl {
+ /** Gets the access using the condition for this declaration. */
+ Expr getExpr() { result = this.getChild(0) }
+
+ /** Gets the variable that is declared. */
+ Variable getVariable() { condition_decl_bind(this,result) }
+
+ override string toString() { result = "(condition decl)" }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/exprs/BitwiseOperation.qll b/cpp/ql/src/semmle/code/cpp/exprs/BitwiseOperation.qll
new file mode 100644
index 000000000000..774e8099be1c
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/exprs/BitwiseOperation.qll
@@ -0,0 +1,68 @@
+import semmle.code.cpp.exprs.Expr
+
+/**
+ * A C/C++ unary bitwise operation.
+ */
+abstract class UnaryBitwiseOperation extends UnaryOperation {
+}
+
+/**
+ * A C/C++ complement expression.
+ */
+class ComplementExpr extends UnaryBitwiseOperation, @complementexpr {
+ override string getOperator() { result = "~" }
+
+ override int getPrecedence() { result = 15 }
+}
+
+/**
+ * A C/C++ binary bitwise operation.
+ */
+abstract class BinaryBitwiseOperation extends BinaryOperation {
+}
+
+
+/**
+ * A C/C++ left shift expression.
+ */
+class LShiftExpr extends BinaryBitwiseOperation, @lshiftexpr {
+ override string getOperator() { result = "<<" }
+
+ override int getPrecedence() { result = 11 }
+}
+
+/**
+ * A C/C++ right shift expression.
+ */
+class RShiftExpr extends BinaryBitwiseOperation, @rshiftexpr {
+ override string getOperator() { result = ">>" }
+
+ override int getPrecedence() { result = 11 }
+}
+
+/**
+ * A C/C++ bitwise and expression.
+ */
+class BitwiseAndExpr extends BinaryBitwiseOperation, @andexpr {
+ override string getOperator() { result = "&" }
+
+ override int getPrecedence() { result = 8 }
+}
+
+/**
+ * A C/C++ bitwise or expression.
+ */
+class BitwiseOrExpr extends BinaryBitwiseOperation, @orexpr {
+ override string getOperator() { result = "|" }
+
+ override int getPrecedence() { result = 6 }
+}
+
+/**
+ * A C/C++ bitwise or expression.
+ */
+class BitwiseXorExpr extends BinaryBitwiseOperation, @xorexpr {
+ override string getOperator() { result = "^" }
+
+ override int getPrecedence() { result = 7 }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/exprs/BuiltInOperations.qll b/cpp/ql/src/semmle/code/cpp/exprs/BuiltInOperations.qll
new file mode 100644
index 000000000000..26c01adea8c6
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/exprs/BuiltInOperations.qll
@@ -0,0 +1,371 @@
+import semmle.code.cpp.exprs.Expr
+
+/**
+ * A C/C++ builtin operation.
+ */
+abstract class BuiltInOperation extends Expr {
+}
+
+/**
+ * A C/C++ `__builtin_va_start` expression (used by some implementations of `va_start`).
+ */
+class BuiltInVarArgsStart extends BuiltInOperation, @vastartexpr {
+ override string toString() { result = "__builtin_va_start" }
+}
+
+/**
+ * A C/C++ `__builtin_va_end` expression (used by some implementations of `va_end`).
+ */
+class BuiltInVarArgsEnd extends BuiltInOperation, @vaendexpr {
+ override string toString() { result = "__builtin_va_end" }
+}
+
+/**
+ * A C/C++ `__builtin_va_arg` expression (used by some implementations of `va_arg`).
+ */
+class BuiltInVarArg extends BuiltInOperation, @vaargexpr {
+ override string toString() { result = "__builtin_va_arg" }
+}
+
+/**
+ * A C/C++ `__builtin_va_copy` expression (used by some implementations of `va_copy`).
+ */
+class BuiltInVarArgCopy extends BuiltInOperation, @vacopyexpr {
+ override string toString() { result = "__builtin_va_copy" }
+}
+
+/**
+ * A Microsoft C/C++ `__noop` expression, which does nothing.
+ */
+class BuiltInNoOp extends BuiltInOperation, @noopexpr {
+ override string toString() { result = "__noop" }
+}
+
+/**
+ * A C++ `__offsetof` expression (used by some implementations of offsetof in the presence of user-defined `operator&`).
+ */
+class BuiltInOperationOffsetOf extends BuiltInOperation, @offsetofexpr {
+ override string toString() { result = "__offsetof" }
+}
+
+/**
+ * A C++ `__has_assign` expression (used by some implementations of the type_traits header).
+ */
+class BuiltInOperationHasAssign extends BuiltInOperation, @hasassignexpr {
+ override string toString() { result = "__has_assign" }
+}
+
+/**
+ * A C++ `__has_copy` expression (used by some implementations of the type_traits header).
+ */
+class BuiltInOperationHasCopy extends BuiltInOperation, @hascopyexpr {
+ override string toString() { result = "__has_copy" }
+}
+
+/**
+ * A C++ `__has_nothrow_assign` expression (used by some implementations of the type_traits header).
+ */
+class BuiltInOperationHasNoThrowAssign extends BuiltInOperation, @hasnothrowassign {
+ override string toString() { result = "__has_nothrow_assign" }
+}
+
+/**
+ * A C++ `__has_nothrow_constructor` expression (used by some implementations of the type_traits header).
+ */
+class BuiltInOperationHasNoThrowConstructor extends BuiltInOperation, @hasnothrowconstr {
+ override string toString() { result = "__has_nothrow_constructor" }
+}
+
+/**
+ * A C++ `__has_nothrow_copy` expression (used by some implementations of the type_traits header).
+ */
+class BuiltInOperationHasNoThrowCopy extends BuiltInOperation, @hasnothrowcopy {
+ override string toString() { result = "__has_nothrow_copy" }
+}
+
+/**
+ * A C++ `__has_trivial_assign` expression (used by some implementations of the type_traits header).
+ */
+class BuiltInOperationHasTrivialAssign extends BuiltInOperation, @hastrivialassign {
+ override string toString() { result = "__has_trivial_assign" }
+}
+
+/**
+ * A C++ `__has_trivial_constructor` expression (used by some implementations of the type_traits header).
+ */
+class BuiltInOperationHasTrivialConstructor extends BuiltInOperation, @hastrivialconstr {
+ override string toString() { result = "__has_trivial_constructor" }
+}
+
+/**
+ * A C++ `__has_trivial_copy` expression (used by some implementations of the type_traits header).
+ */
+class BuiltInOperationHasTrivialCopy extends BuiltInOperation, @hastrivialcopy {
+ override string toString() { result = "__has_trivial_copy" }
+}
+
+/**
+ * A C++ `__has_trivial_destructor` expression (used by some implementations of the type_traits header).
+ */
+class BuiltInOperationHasTrivialDestructor extends BuiltInOperation, @hastrivialdestructor {
+ override string toString() { result = "__has_trivial_destructor" }
+}
+
+/**
+ * A C++ `__has_user_destructor` expression (used by some implementations of the type_traits header).
+ */
+class BuiltInOperationHasUserDestructor extends BuiltInOperation, @hasuserdestr {
+ override string toString() { result = "__has_user_destructor" }
+}
+
+/**
+ * A C++ `__has_virtual_destructor` expression (used by some implementations of the type_traits header).
+ */
+class BuiltInOperationHasVirtualDestructor extends BuiltInOperation, @hasvirtualdestr {
+ override string toString() { result = "__has_virtual_destructor" }
+}
+
+/**
+ * A C++ `__is_abstract` expression (used by some implementations of the type_traits header).
+ */
+class BuiltInOperationIsAbstract extends BuiltInOperation, @isabstractexpr {
+ override string toString() { result = "__is_abstract" }
+}
+
+/**
+ * A C++ `__is_base_of` expression (used by some implementations of the type_traits header).
+ */
+class BuiltInOperationIsBaseOf extends BuiltInOperation, @isbaseofexpr {
+ override string toString() { result = "__is_base_of" }
+}
+
+/**
+ * A C++ `__is_class` expression (used by some implementations of the type_traits header).
+ */
+class BuiltInOperationIsClass extends BuiltInOperation, @isclassexpr {
+ override string toString() { result = "__is_class" }
+}
+
+/**
+ * A C++ `__is_convertible_to` expression (used by some implementations of the type_traits header).
+ */
+class BuiltInOperationIsConvertibleTo extends BuiltInOperation, @isconvtoexpr {
+ override string toString() { result = "__is_convertible_to" }
+}
+
+/**
+ * A C++ `__is_empty` expression (used by some implementations of the type_traits header).
+ */
+class BuiltInOperationIsEmpty extends BuiltInOperation, @isemptyexpr {
+ override string toString() { result = "__is_empty" }
+}
+
+/**
+ * A C++ `__is_enum` expression (used by some implementations of the type_traits header).
+ */
+class BuiltInOperationIsEnum extends BuiltInOperation, @isenumexpr {
+ override string toString() { result = "__is_enum" }
+}
+
+/**
+ * A C++ `__is_pod` expression (used by some implementations of the type_traits header).
+ */
+class BuiltInOperationIsPod extends BuiltInOperation, @ispodexpr {
+ override string toString() { result = "__is_pod" }
+}
+
+/**
+ * A C++ `__is_polymorphic` expression (used by some implementations of the type_traits header).
+ */
+class BuiltInOperationIsPolymorphic extends BuiltInOperation, @ispolyexpr {
+ override string toString() { result = "__is_polymorphic" }
+}
+
+/**
+ * A C++ `__is_union` expression (used by some implementations of the type_traits header).
+ */
+class BuiltInOperationIsUnion extends BuiltInOperation, @isunionexpr {
+ override string toString() { result = "__is_union" }
+}
+
+/**
+ * A C++ `__builtin_types` expression (used by some implementations of the type_traits header).
+ */
+class BuiltInOperationBuiltInTypes extends BuiltInOperation, @typescompexpr {
+ override string toString() { result = "__builtin_types" }
+}
+
+/**
+ * A clang `__builtin_shufflevector` expression.
+ */
+class BuiltInOperationBuiltInShuffleVector extends BuiltInOperation, @builtinshufflevector {
+ override string toString() { result = "__builtin_shufflevector" }
+}
+
+/**
+ * The `__is_trivially_constructible` type trait.
+ */
+class BuiltInOperationIsTriviallyConstructible extends BuiltInOperation, @istriviallyconstructibleexpr {
+ override string toString() { result = "__is_trivially_constructible" }
+}
+
+/**
+ * The `__is_destructible` type trait.
+ */
+class BuiltInOperationIsDestructible extends BuiltInOperation, @isdestructibleexpr {
+ override string toString() { result = "__is_destructible" }
+}
+
+/**
+ * The `__is_nothrow_destructible` type trait.
+ */
+class BuiltInOperationIsNothrowDestructible extends BuiltInOperation, @isnothrowdestructibleexpr {
+ override string toString() { result = "__is_nothrow_destructible" }
+}
+
+/**
+ * The `__is_trivially_destructible` type trait.
+ */
+class BuiltInOperationIsTriviallyDestructible extends BuiltInOperation, @istriviallydestructibleexpr {
+ override string toString() { result = "__is_trivially_destructible" }
+}
+
+/**
+ * The `__is_trivially_assignable` type trait.
+ */
+class BuiltInOperationIsTriviallyAssignable extends BuiltInOperation, @istriviallyassignableexpr {
+ override string toString() { result = "__is_trivially_assignable" }
+}
+
+/**
+ * The `__is_nothrow_assignable` type trait.
+ */
+class BuiltInOperationIsNothrowAssignable extends BuiltInOperation, @isnothrowassignableexpr {
+ override string toString() { result = "__is_nothrow_assignable" }
+}
+
+/**
+ * The `__is_standard_layout` type trait.
+ */
+class BuiltInOperationIsStandardLayout extends BuiltInOperation, @isstandardlayoutexpr {
+ override string toString() { result = "__is_standard_layout" }
+}
+
+/**
+ * The `__is_trivially_copyable` type trait.
+ */
+class BuiltInOperationIsTriviallyCopyable extends BuiltInOperation, @istriviallycopyableexpr {
+ override string toString() { result = "__is_trivially_copyable" }
+}
+
+/**
+ * The `__is_literal_type` type trait.
+ */
+class BuiltInOperationIsLiteralType extends BuiltInOperation, @isliteraltypeexpr {
+ override string toString() { result = "__is_literal_type" }
+}
+
+/**
+ * The `__has_trivial_move_constructor` type trait.
+ */
+class BuiltInOperationHasTrivialMoveConstructor extends BuiltInOperation, @hastrivialmoveconstructorexpr {
+ override string toString() { result = "__has_trivial_move_constructor" }
+}
+
+/**
+ * The `__has_trivial_move_assign` type trait.
+ */
+class BuiltInOperationHasTrivialMoveAssign extends BuiltInOperation, @hastrivialmoveassignexpr {
+ override string toString() { result = "__has_trivial_move_assign" }
+}
+
+/**
+ * The `__has_nothrow_move_assign` type trait.
+ */
+class BuiltInOperationHasNothrowMoveAssign extends BuiltInOperation, @hasnothrowmoveassignexpr {
+ override string toString() { result = "__has_nothrow_move_assign" }
+}
+
+/**
+ * The `__is_constructible` type trait.
+ */
+class BuiltInOperationIsConstructible extends BuiltInOperation, @isconstructibleexpr {
+ override string toString() { result = "__is_constructible" }
+}
+
+/**
+ * The `__is_nothrow_constructible` type trait.
+ */
+class BuiltInOperationIsNothrowConstructible extends BuiltInOperation, @isnothrowconstructibleexpr {
+ override string toString() { result = "__is_nothrow_constructible" }
+}
+
+/**
+ * The `__has_finalizer` type trait.
+ */
+class BuiltInOperationHasFinalizer extends BuiltInOperation, @hasfinalizerexpr {
+ override string toString() { result = "__has_finalizer" }
+}
+
+/**
+ * The `__is_delegate` type trait.
+ */
+class BuiltInOperationIsDelegate extends BuiltInOperation, @isdelegateexpr {
+ override string toString() { result = "__is_delegate" }
+}
+
+/**
+ * The `__is_interface_class` type trait.
+ */
+class BuiltInOperationIsInterfaceClass extends BuiltInOperation, @isinterfaceclassexpr {
+ override string toString() { result = "__is_interface_class" }
+}
+
+/**
+ * The `__is_ref_array` type trait.
+ */
+class BuiltInOperationIsRefArray extends BuiltInOperation, @isrefarrayexpr {
+ override string toString() { result = "__is_ref_array" }
+}
+
+/**
+ * The `__is_ref_class` type trait.
+ */
+class BuiltInOperationIsRefClass extends BuiltInOperation, @isrefclassexpr {
+ override string toString() { result = "__is_ref_class" }
+}
+
+/**
+ * The `__is_sealed` type trait.
+ */
+class BuiltInOperationIsSealed extends BuiltInOperation, @issealedexpr {
+ override string toString() { result = "__is_sealed" }
+}
+
+/**
+ * The `__is_simple_value_class` type trait.
+ */
+class BuiltInOperationIsSimpleValueClass extends BuiltInOperation, @issimplevalueclassexpr {
+ override string toString() { result = "__is_simple_value_class" }
+}
+
+/**
+ * The `__is_value_class` type trait.
+ */
+class BuiltInOperationIsValueClass extends BuiltInOperation, @isvalueclassexpr {
+ override string toString() { result = "__is_value_class" }
+}
+
+/**
+ * The `__is_final` type trait.
+ */
+class BuiltInOperationIsFinal extends BuiltInOperation, @isfinalexpr {
+ override string toString() { result = "__is_final" }
+}
+
+/**
+ * The `__builtin_choose_expr` type trait.
+ */
+class BuiltInChooseExpr extends BuiltInOperation, @builtinchooseexpr {
+ override string toString() { result = "__builtin_choose_expr" }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/exprs/Call.qll b/cpp/ql/src/semmle/code/cpp/exprs/Call.qll
new file mode 100644
index 000000000000..5af03dab4a2f
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/exprs/Call.qll
@@ -0,0 +1,546 @@
+import semmle.code.cpp.exprs.Expr
+import semmle.code.cpp.Function
+private import semmle.code.cpp.dataflow.EscapesTree
+
+/**
+ * A C/C++ call.
+ */
+abstract class Call extends Expr, NameQualifiableElement {
+ /**
+ * Gets the number of actual parameters in this call; use
+ * `getArgument(i)` with `i` between `0` and `result - 1` to
+ * retrieve actuals.
+ */
+ int getNumberOfArguments() { result = count(this.getAnArgument()) }
+
+ /**
+ * Holds if this call has a qualifier.
+ *
+ * For example, `ptr->f()` has a qualifier, whereas plain `f()` does not.
+ */
+ predicate hasQualifier() {
+ exists(Expr e | this.getChild(-1) = e)
+ }
+
+ /**
+ * Gets the expression to the left of the function name or function pointer variable name.
+ *
+ * As a few examples:
+ * For the call to `f` in `ptr->f()`, this gives `ptr`.
+ * For the call to `f` in `(*ptr).f()`, this gives `(*ptr)`.
+ */
+ Expr getQualifier() {
+ result = this.getChild(-1)
+ }
+
+ /**
+ * Gets an argument for this call.
+ */
+ Expr getAnArgument() {
+ exists(int i | result = this.getChild(i) and i >= 0)
+ }
+
+ /**
+ * Gets the nth argument for this call.
+ *
+ * The range of `n` is from `0` to `getNumberOfArguments() - 1`.
+ */
+ Expr getArgument(int n) {
+ result = this.getChild(n) and n >= 0
+ }
+
+ /**
+ * Gets a sub expression of the argument at position `index`. If the
+ * argument itself contains calls, such calls will be considered
+ * leafs in the expression tree.
+ *
+ * Example: the call `f(2, 3 + 4, g(4 + 5))` has sub expression(s)
+ * `2` at index 0; `3`, `4`, and `3 + 4` at index 1; and `g(4 + 5)`
+ * at index 2, respectively.
+ */
+ Expr getAnArgumentSubExpr(int index) {
+ result = getArgument(index)
+ or
+ exists(Expr mid |
+ mid = getAnArgumentSubExpr(index)
+ and not mid instanceof Call
+ and not mid instanceof SizeofOperator
+ and result = mid.getAChild()
+ )
+ }
+
+ /**
+ * Gets the target of the call, as best as makes sense for this kind of call.
+ * The precise meaning depends on the kind of call it is:
+ * - For a call to a function, it's the function being called.
+ * - For a C++ method call, it's the statically resolved method.
+ * - For an Objective C message expression, it's the statically resolved
+ * method, and it might not exist.
+ * - For a variable call, it never exists.
+ */
+ abstract Function getTarget();
+
+ override int getPrecedence() { result = 16 }
+
+ override string toString() { none() }
+
+ /**
+ * Holds if this call passes the variable accessed by `va` by
+ * reference as the `i`th argument.
+ *
+ * A variable is passed by reference if the `i`th parameter of the function
+ * receives an address that points within the object denoted by `va`. For a
+ * variable named `x`, passing by reference includes both explicit pointers
+ * (`&x`) and implicit conversion to a C++ reference (`x`), but it also
+ * includes deeper expressions such as `&x[0] + length` or `&*&*&x`.
+ *
+ * When `Field`s are involved, an argument `i` may pass more than one
+ * variable by reference simultaneously. For example, the call `f(&x.m1.m2)`
+ * counts as passing both `x`, `m1` and `m2` to argument 0 of `f`.
+ *
+ * This predicate holds for variables passed by reference even if they are
+ * passed as references to `const` and thus cannot be changed through that
+ * reference. See `passesByNonConstReference` for a predicate that only holds
+ * for variables passed by reference to non-const.
+ */
+ predicate passesByReference(int i, VariableAccess va) {
+ variableAddressEscapesTree(va, this.getArgument(i).getFullyConverted())
+ }
+
+ /**
+ * Holds if this call passes the variable accessed by `va` by
+ * reference to non-const data as the `i`th argument.
+ *
+ * A variable is passed by reference if the `i`th parameter of the function
+ * receives an address that points within the object denoted by `va`. For a
+ * variable named `x`, passing by reference includes both explicit pointers
+ * (`&x`) and implicit conversion to a C++ reference (`x`), but it also
+ * includes deeper expressions such as `&x[0] + length` or `&*&*&x`.
+ *
+ * When `Field`s are involved, an argument `i` may pass more than one
+ * variable by reference simultaneously. For example, the call `f(&x.m1.m2)`
+ * counts as passing both `x`, `m1` and `m2` to argument 0 of `f`.
+ *
+ * This predicate only holds for variables passed by reference to non-const
+ * data and thus can be changed through that reference. See
+ * `passesByReference` for a predicate that also holds for variables passed
+ * by reference to const.
+ */
+ predicate passesByReferenceNonConst(int i, VariableAccess va) {
+ variableAddressEscapesTreeNonConst(
+ va,
+ this.getArgument(i).getFullyConverted()
+ )
+ }
+}
+
+/**
+ * A C/C++ function call where the name of the target function is known at compile-time.
+ *
+ * This includes various kinds of call:
+ * 1. Calls such as `f(x)` where `f` is the name of a function.
+ * 2. Calls such as `ptr->f()` where `f` is the name of a (possibly virtual) member function.
+ * 3. Constructor calls for stack-allocated objects.
+ * 4. Implicit and explicit calls to user-defined operators.
+ * 5. Base class initializers in constructors.
+ */
+class FunctionCall extends Call, @funbindexpr {
+ FunctionCall() { iscall(this,_) }
+
+ /** Gets an explicit template argument for this call. */
+ Type getAnExplicitTemplateArgument() {
+ result = getExplicitTemplateArgument(_)
+ }
+
+ /** Gets a template argument for this call. */
+ Type getATemplateArgument() {
+ result = getTarget().getATemplateArgument()
+ }
+
+ /** Gets the nth explicit template argument for this call. */
+ Type getExplicitTemplateArgument(int n) {
+ n < getNumberOfExplicitTemplateArguments()
+ and result = getTemplateArgument(n)
+ }
+
+ /** Gets the number of explicit template arguments for this call. */
+ int getNumberOfExplicitTemplateArguments() {
+ if numtemplatearguments(this,_) then
+ numtemplatearguments(this,result)
+ else
+ result = 0
+ }
+
+ /** Gets the number of template arguments for this call. */
+ int getNumberOfTemplateArguments() {
+ result = count(int i | exists(getTemplateArgument(i)))
+ }
+
+ /** Gets the nth template argument for this call (indexed from 0). */
+ Type getTemplateArgument(int n) {
+ result = getTarget().getTemplateArgument(n)
+ }
+
+ /** Holds if any template arguments for this call are implicit / deduced. */
+ predicate hasImplicitTemplateArguments() {
+ exists(int i |
+ exists(getTemplateArgument(i))
+ and not exists(getExplicitTemplateArgument(i))
+ )
+ }
+
+ /** Holds if a template argument list was provided for this call. */
+ predicate hasTemplateArgumentList() {
+ numtemplatearguments(this,_)
+ }
+
+ /**
+ * Gets the `RoutineType` of the call target as visible at the call site. For
+ * constructor calls, this predicate instead gets the `Class` of the constructor
+ * being called.
+ */
+ private
+ Type getTargetType() { result = Call.super.getType().stripType() }
+
+ /**
+ * Gets the expected return type of the function called by this call.
+ *
+ * In most cases, the expected return type will be the return type of the function being called.
+ * It is only different when the function being called is ambiguously declared, at which point
+ * the expected return type is the return type of the (unambiguous) function declaration that was
+ * visible at the call site.
+ */
+ Type getExpectedReturnType() {
+ if getTargetType() instanceof RoutineType then
+ result = getTargetType().(RoutineType).getReturnType()
+ else
+ result = getTarget().getType()
+ }
+
+ /**
+ * Gets the expected type of the nth parameter of the function called by this call.
+ *
+ * In most cases, the expected parameter types match the parameter types of the function being called.
+ * They are only different when the function being called is ambiguously declared, at which point
+ * the expected parameter types are the parameter types of the (unambiguous) function declaration that
+ * was visible at the call site.
+ */
+ Type getExpectedParameterType(int n) {
+ if getTargetType() instanceof RoutineType then
+ result = getTargetType().(RoutineType).getParameterType(n)
+ else
+ result = getTarget().getParameter(n).getType()
+ }
+
+ /**
+ * Gets the function called by this call.
+ *
+ * In the case of virtual function calls, the result is the most-specific function in the override tree (as
+ * determined by the compiler) such that the target at runtime will be one of result.getAnOverridingFunction*().
+ */
+ override Function getTarget() { funbind(this,result) }
+
+ /**
+ * Gets the type of this expression, that is, the return type of the function being called.
+ */
+ override Type getType() { result = getExpectedReturnType() }
+
+ /**
+ * Holds if this is a call to a virtual function.
+ *
+ * Note that this holds even in cases where a sufficiently clever compiler could perform static dispatch.
+ */
+ predicate isVirtual() {
+ iscall(this,1)
+ }
+
+ /**
+ * Holds if the target of this function call was found by argument-dependent lookup and wouldn't have been
+ * found by any other means.
+ */
+ predicate isOnlyFoundByADL() {
+ iscall(this,2)
+ }
+
+ /** Gets a textual representation of this function call. */
+ override string toString() {
+ if exists(getTarget()) then
+ result = "call to " + this.getTarget().getName()
+ else
+ result = "call to unknown function"
+ }
+
+ override predicate mayBeImpure() {
+ this.getChild(_).mayBeImpure() or
+ this.getTarget().mayHaveSideEffects() or
+ isVirtual()
+ }
+ override predicate mayBeGloballyImpure() {
+ this.getChild(_).mayBeGloballyImpure() or
+ this.getTarget().mayHaveSideEffects() or
+ isVirtual()
+ }
+}
+
+/**
+ * An instance of unary operator * applied to a user-defined type.
+ */
+class OverloadedPointerDereferenceExpr extends FunctionCall {
+ OverloadedPointerDereferenceExpr() {
+ getTarget().hasName("operator*")
+ and getTarget().getEffectiveNumberOfParameters() = 1
+ }
+
+ /**
+ * Gets the expression this operator * applies to.
+ */
+ Expr getExpr() {
+ result = this.getChild(0) or
+ result = this.getQualifier()
+ }
+
+ override predicate mayBeImpure() {
+ FunctionCall.super.mayBeImpure() and
+ (this.getExpr().mayBeImpure() or
+ not exists(Class declaring |
+ this.getTarget().getDeclaringType().isConstructedFrom*(declaring) |
+ declaring.getNamespace() instanceof StdNamespace))
+ }
+ override predicate mayBeGloballyImpure() {
+ FunctionCall.super.mayBeGloballyImpure() and
+ (this.getExpr().mayBeGloballyImpure() or
+ not exists(Class declaring |
+ this.getTarget().getDeclaringType().isConstructedFrom*(declaring) |
+ declaring.getNamespace() instanceof StdNamespace))
+ }
+}
+
+/**
+ * An instance of operator [] applied to a user-defined type.
+ */
+class OverloadedArrayExpr extends FunctionCall {
+ OverloadedArrayExpr() {
+ getTarget().hasName("operator[]")
+ }
+
+ /**
+ * Gets the expression being subscripted.
+ */
+ Expr getArrayBase() { if exists(this.getQualifier()) then result = this.getQualifier() else result = this.getChild(0) }
+
+ /**
+ * Gets the expression giving the index.
+ */
+ Expr getArrayOffset() { if exists(this.getQualifier()) then result = this.getChild(0) else result = this.getChild(1) }
+}
+
+/**
+ * A C/C++ call which is performed through a function pointer.
+ */
+class ExprCall extends Call, @callexpr {
+ /**
+ * Gets the expression which yields the function pointer to call.
+ */
+ Expr getExpr() { result = this.getChild(0) }
+
+ override Expr getAnArgument() {
+ exists(int i | result = this.getChild(i) and i >= 1)
+ }
+ override Expr getArgument(int index) {
+ result = this.getChild(index+1) and index in [0..this.getNumChild()-2]
+ }
+
+ override string toString() { result = "call to expression" }
+
+ override Function getTarget() {
+ none()
+ }
+}
+
+/**
+ * A C/C++ call which is performed through a variable of function pointer type.
+ */
+class VariableCall extends ExprCall {
+ VariableCall() { this.getExpr() instanceof VariableAccess }
+
+ /**
+ * Gets the variable which yields the function pointer to call.
+ */
+ Variable getVariable() {
+ this.getExpr().(VariableAccess).getTarget() = result
+ }
+}
+
+/**
+ * A call to a constructor.
+ */
+class ConstructorCall extends FunctionCall {
+ ConstructorCall() { super.getTarget() instanceof Constructor }
+
+ /** Gets the constructor being called. */
+ override Constructor getTarget() { result = super.getTarget() }
+}
+
+/**
+ * A C++ `throw` expression.
+ */
+class ThrowExpr extends Expr, @throw_expr {
+ /**
+ * Gets the expression that will be thrown, if any. There is no result if
+ * `this` is a `ReThrowExpr`.
+ */
+ Expr getExpr() { result = this.getChild(0) }
+
+ override string toString() { result = "throw ..." }
+
+ override int getPrecedence() { result = 1 }
+}
+
+/**
+ * A C++ `throw` expression with no argument (which causes the current exception to be re-thrown).
+ */
+class ReThrowExpr extends ThrowExpr {
+ ReThrowExpr() { this.getType() instanceof VoidType }
+
+ override string toString() { result = "re-throw exception " }
+}
+
+/**
+ * A call to a destructor.
+ */
+class DestructorCall extends FunctionCall {
+ DestructorCall() { super.getTarget() instanceof Destructor }
+
+ /** Gets the destructor being called. */
+ override Destructor getTarget() { result = super.getTarget() }
+}
+
+/**
+ * An expression that looks like a destructor call, but has no effect.
+ *
+ * For example, given a plain old data type `pod_t`, the syntax `ptr->~pod_t()` is
+ * a vacuous destructor call, as `~pod_t` isn't actually a function. This can also
+ * occur in instantiated templates, as `ptr->~T()` becomes vacuous when `T` is `int`.
+ */
+class VacuousDestructorCall extends Expr, @vacuous_destructor_call {
+ /**
+ * Gets the expression for the object whose destructor would be called.
+ */
+ Expr getQualifier() { result = this.getChild(0) }
+
+ override string toString() { result = "(vacuous destructor call)" }
+}
+
+/**
+ * An initialization of a base class or member variable performed as part
+ * of a constructor's explicit initializer list or implicit actions.
+ */
+class ConstructorInit extends Expr, @ctorinit {
+}
+
+/**
+ * A call to a constructor of a base class as part of a constructor's
+ * initializer list or compiler-generated actions.
+ */
+class ConstructorBaseInit extends ConstructorInit, ConstructorCall {
+}
+
+/**
+ * A call to a constructor of a direct non-virtual base class as part of a
+ * constructor's initializer list or compiler-generated actions.
+ */
+class ConstructorDirectInit extends ConstructorBaseInit, @ctordirectinit {
+}
+
+/**
+ * A call to a constructor of a virtual base class as part of a
+ * constructor's initializer list or compiler-generated actions.
+ *
+ * If the virtual base class has already been initialized, then this
+ * call won't be performed.
+ */
+class ConstructorVirtualInit extends ConstructorBaseInit, @ctorvirtualinit {
+}
+
+/**
+ * A call to a constructor of the same class as part of a constructor's
+ * initializer list, which delegates object construction (C++11 only).
+ */
+class ConstructorDelegationInit extends ConstructorBaseInit, @ctordelegatinginit {
+}
+
+/**
+ * An initialization of a member variable performed as part of a
+ * constructor's explicit initializer list or implicit actions.
+ */
+class ConstructorFieldInit extends ConstructorInit, @ctorfieldinit {
+ /** Gets the field being initialized. */
+ Field getTarget() { varbind(this,result) }
+
+ /**
+ * Gets the expression to which the field is initialized.
+ *
+ * This is typically either a Literal or a FunctionCall to a
+ * constructor, but more complex expressions can also occur.
+ */
+ Expr getExpr() { result = this.getChild(0) }
+
+ override string toString() {
+ result = "constructor init of field " + getTarget().getName()
+ }
+
+ override predicate mayBeImpure() {
+ this.getExpr().mayBeImpure()
+ }
+ override predicate mayBeGloballyImpure() {
+ this.getExpr().mayBeGloballyImpure()
+ }
+}
+
+/**
+ * A call to a destructor of a base class or field as part of a destructor's
+ * compiler-generated actions.
+ */
+class DestructorDestruction extends Expr, @dtordestruct {
+}
+
+/**
+ * A call to a destructor of a base class as part of a destructor's
+ * compiler-generated actions.
+ */
+class DestructorBaseDestruction extends DestructorCall, DestructorDestruction {
+}
+
+/**
+ * A call to a destructor of a direct non-virtual base class as part of a
+ * destructor's compiler-generated actions.
+ */
+class DestructorDirectDestruction extends DestructorBaseDestruction, @dtordirectdestruct {
+}
+
+/**
+ * A call to a destructor of a direct virtual base class as part of a
+ * destructor's compiler-generated actions.
+ *
+ * If the virtual base class wasn't initialized by the ConstructorVirtualInit
+ * in the corresponding constructor, then this call won't be performed.
+ */
+class DestructorVirtualDestruction extends DestructorBaseDestruction, @dtorvirtualdestruct {
+}
+
+/**
+ * A destruction of a member variable performed as part of a
+ * destructor's compiler-generated actions.
+ */
+class DestructorFieldDestruction extends DestructorDestruction, @dtorfielddestruct {
+ /** Gets the field being destructed. */
+ Field getTarget() { varbind(this,result) }
+
+ /** Gets the compiler-generated call to the variable's destructor. */
+ DestructorCall getExpr() { result = this.getChild(0) }
+
+ override string toString() {
+ result = "destructor field destruction of "
+ + this.getTarget().getName()
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/exprs/Cast.qll b/cpp/ql/src/semmle/code/cpp/exprs/Cast.qll
new file mode 100644
index 000000000000..985cca778142
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/exprs/Cast.qll
@@ -0,0 +1,672 @@
+import semmle.code.cpp.exprs.Expr
+private import semmle.code.cpp.internal.Type
+
+/**
+ * A C/C++ cast expression or similar unary expression that doesn't affect the logical value of its operand.
+ *
+ * Instances of this class are not present in the main AST which is navigated by parent/child links. Instead,
+ * instances of this class are attached to nodes in the main AST via special conversion links.
+ */
+abstract class Conversion extends Expr {
+ /** Gets the expression being converted. */
+ Expr getExpr() { result.getConversion() = this }
+
+ /** Holds if this conversion is an implicit conversion. */
+ predicate isImplicit() { this.isCompilerGenerated() }
+
+ override predicate mayBeImpure() {
+ this.getExpr().mayBeImpure()
+ }
+ override predicate mayBeGloballyImpure() {
+ this.getExpr().mayBeGloballyImpure()
+ }
+}
+
+/**
+ * A C/C++ cast expression.
+ *
+ * To get the type which the expression is being cast to, use getType().
+ *
+ * There are two groups of subtypes of `Cast`. The first group differentiates
+ * between the different cast syntax forms, e.g. `CStyleCast`, `StaticCast`,
+ * etc. The second group differentiates between the semantic operation being
+ * performed by the cast, e.g. `IntegralConversion`, `PointerBaseClassConversion`,
+ * etc.
+ * The two groups are largely orthogonal to one another. For example, a
+ * cast that is syntactically as `CStyleCast` may also be an `IntegralConversion`,
+ * a `PointerBaseClassConversion`, or some other semantic conversion. Similarly,
+ * a `PointerDerivedClassConversion` may also be a `CStyleCast` or a `StaticCast`.
+ */
+abstract class Cast extends Conversion, @cast {
+ /**
+ * Gets a string describing the semantic conversion operation being performed by
+ * this cast.
+ */
+ string getSemanticConversionString() {
+ result = "unknown conversion"
+ }
+}
+
+/**
+ * INTERNAL: Do not use.
+ * Query predicates used to check invariants that should hold for all `Cast`
+ * nodes. To run all sanity queries for the ASTs, including the ones below,
+ * run "semmle/code/cpp/ASTSanity.ql".
+ */
+module CastSanity {
+ query predicate multipleSemanticConversionStrings(Cast cast, Type fromType, string kind) {
+ // Every cast should have exactly one semantic conversion kind
+ count(cast.getSemanticConversionString()) > 1 and
+ kind = cast.getSemanticConversionString() and
+ fromType = cast.getExpr().getType().getUnspecifiedType()
+ }
+
+ query predicate missingSemanticConversionString(Cast cast, Type fromType) {
+ // Every cast should have exactly one semantic conversion kind
+ not exists(cast.getSemanticConversionString()) and
+ fromType = cast.getExpr().getType().getUnspecifiedType()
+ }
+
+ query predicate unknownSemanticConversionString(Cast cast, Type fromType) {
+ // Every cast should have a known semantic conversion kind
+ cast.getSemanticConversionString() = "unknown conversion" and
+ fromType = cast.getExpr().getType().getUnspecifiedType()
+ }
+}
+
+/**
+ * A cast expression in C, or a C-style cast expression in C++.
+ */
+class CStyleCast extends Cast, @c_style_cast {
+ override string toString() { result = "(" + this.getType().getName() + ")..." }
+
+ override int getPrecedence() { result = 15 }
+}
+
+/**
+ * A C++ `static_cast` expression.
+ */
+class StaticCast extends Cast, @static_cast {
+ override string toString() { result = "static_cast<" + this.getType().getName() + ">..." }
+
+ override int getPrecedence() { result = 16 }
+}
+
+/**
+ * A C++ `const_cast` expression.
+ */
+class ConstCast extends Cast, @const_cast {
+ override string toString() { result = "const_cast<" + this.getType().getName() + ">..." }
+
+ override int getPrecedence() { result = 16 }
+}
+
+/**
+ * A C++ `reinterpret_cast` expression.
+ */
+class ReinterpretCast extends Cast, @reinterpret_cast {
+ override string toString() { result = "reinterpret_cast<" + this.getType().getName() + ">..." }
+
+ override int getPrecedence() { result = 16 }
+}
+
+private predicate isArithmeticOrEnum(Type type) {
+ type instanceof ArithmeticType or
+ type instanceof Enum
+}
+
+private predicate isIntegralOrEnum(Type type) {
+ type instanceof IntegralType or
+ type instanceof Enum
+}
+
+private predicate isPointerOrNullPointer(Type type) {
+ type instanceof PointerType or
+ type instanceof FunctionPointerType or
+ type instanceof NullPointerType
+}
+
+private predicate isPointerToMemberOrNullPointer(Type type) {
+ type instanceof PointerToMemberType or
+ type instanceof NullPointerType
+}
+
+/**
+ * A conversion from one arithmetic or enum type to another.
+ */
+class ArithmeticConversion extends Cast {
+ ArithmeticConversion() {
+ conversionkinds(this, 0) and
+ isArithmeticOrEnum(getType().getUnspecifiedType()) and
+ isArithmeticOrEnum(getExpr().getType().getUnspecifiedType())
+ }
+
+ override string getSemanticConversionString() {
+ result = "arithmetic conversion"
+ }
+}
+
+/**
+ * A conversion from one integral or enum type to another.
+ */
+class IntegralConversion extends ArithmeticConversion {
+ IntegralConversion() {
+ isIntegralOrEnum(getType().getUnspecifiedType()) and
+ isIntegralOrEnum(getExpr().getType().getUnspecifiedType())
+ }
+
+ override string getSemanticConversionString() {
+ result = "integral conversion"
+ }
+}
+
+/**
+ * A conversion from one floating point type to another.
+ */
+class FloatingPointConversion extends ArithmeticConversion {
+ FloatingPointConversion() {
+ getType().getUnspecifiedType() instanceof FloatingPointType and
+ getExpr().getType().getUnspecifiedType() instanceof FloatingPointType
+ }
+
+ override string getSemanticConversionString() {
+ result = "floating point conversion"
+ }
+}
+
+/**
+ * A conversion from a floating point type to an integral or enum type.
+ */
+class FloatingPointToIntegralConversion extends ArithmeticConversion {
+ FloatingPointToIntegralConversion() {
+ isIntegralOrEnum(getType().getUnspecifiedType()) and
+ getExpr().getType().getUnspecifiedType() instanceof FloatingPointType
+ }
+
+ override string getSemanticConversionString() {
+ result = "floating point to integral conversion"
+ }
+}
+
+/**
+ * A conversion from an integral or enum type to a floating point type.
+ */
+class IntegralToFloatingPointConversion extends ArithmeticConversion {
+ IntegralToFloatingPointConversion() {
+ getType().getUnspecifiedType() instanceof FloatingPointType and
+ isIntegralOrEnum(getExpr().getType().getUnspecifiedType())
+ }
+
+ override string getSemanticConversionString() {
+ result = "integral to floating point conversion"
+ }
+}
+
+/**
+ * A conversion from one pointer type to another. The conversion does
+ * not modify the value of the pointer. For pointer conversions involving
+ * casts between base and derived classes, see `BaseClassConversion` and
+ * `DerivedClassConversion`.
+ */
+class PointerConversion extends Cast {
+ PointerConversion() {
+ conversionkinds(this, 0) and
+ isPointerOrNullPointer(getType().getUnspecifiedType()) and
+ isPointerOrNullPointer(getExpr().getType().getUnspecifiedType())
+ }
+
+ override string getSemanticConversionString() {
+ result = "pointer conversion"
+ }
+}
+
+/**
+ * A conversion from one pointer-to-member type to another. The conversion
+ * does not modify the value of the pointer-to-member. For pointer-to-member
+ * conversions involving casts between base and derived classes, see
+ * `PointerToMemberBaseClassConversion` and `PointerToMemberDerivedClassConversion`.
+ */
+class PointerToMemberConversion extends Cast {
+ PointerToMemberConversion() {
+ conversionkinds(this, 0) and
+ exists(Type fromType, Type toType |
+ fromType = getExpr().getType().getUnspecifiedType() and
+ toType = getType().getUnspecifiedType() and
+ isPointerToMemberOrNullPointer(fromType) and
+ isPointerToMemberOrNullPointer(toType) and
+ // A conversion from nullptr to nullptr is a `PointerConversion`, not a
+ // `PointerToMemberConversion`.
+ not (
+ fromType instanceof NullPointerType and
+ toType instanceof NullPointerType
+ )
+ )
+ }
+
+ override string getSemanticConversionString() {
+ result = "pointer-to-member conversion"
+ }
+}
+
+/**
+ * A conversion from a pointer type to an integral or enum type.
+ */
+class PointerToIntegralConversion extends Cast {
+ PointerToIntegralConversion() {
+ conversionkinds(this, 0) and
+ isIntegralOrEnum(getType().getUnspecifiedType()) and
+ isPointerOrNullPointer(getExpr().getType().getUnspecifiedType())
+ }
+
+ override string getSemanticConversionString() {
+ result = "pointer to integral conversion"
+ }
+}
+
+/**
+ * A conversion from an integral or enum type to a pointer type.
+ */
+class IntegralToPointerConversion extends Cast {
+ IntegralToPointerConversion() {
+ conversionkinds(this, 0) and
+ isPointerOrNullPointer(getType().getUnspecifiedType()) and
+ isIntegralOrEnum(getExpr().getType().getUnspecifiedType())
+ }
+
+ override string getSemanticConversionString() {
+ result = "integral to pointer conversion"
+ }
+}
+
+/**
+ * A conversion to `bool`. Returns `false` if the source value is zero,
+ * false, or nullptr. Returns `true` otherwise.
+ */
+class BoolConversion extends Cast {
+ BoolConversion() {
+ conversionkinds(this, 1)
+ }
+
+ override string getSemanticConversionString() {
+ result = "conversion to bool"
+ }
+}
+
+/**
+ * A conversion between two pointers or glvalues related by inheritance. The
+ * base class will always be either a direct base class of the derived class,
+ * or a virtual base class of the derived class. A conversion to an indirect
+ * non-virtual base class will be represented as a sequence of conversions to
+ * direct base classes.
+ */
+class InheritanceConversion extends Cast {
+ InheritanceConversion() {
+ conversionkinds(this, 2) or conversionkinds(this, 3)
+ }
+
+ /**
+ * Gets the `ClassDerivation` for the inheritance relationship between
+ * the base and derived classes. This predicate does not hold if the
+ * conversion is to an indirect virtual base class.
+ */
+ final ClassDerivation getDerivation() {
+ result.getBaseClass() = getBaseClass() and
+ result.getDerivedClass() = getDerivedClass()
+ }
+
+ /**
+ * Gets the base class of the conversion. This will be either a direct
+ * base class of the derived class, or a virtual base class of the
+ * derived class.
+ */
+ Class getBaseClass() {
+ none() // Overridden by subclasses
+ }
+
+ /**
+ * Gets the derived class of the conversion.
+ */
+ Class getDerivedClass() {
+ none() // Overridden by subclasses
+ }
+}
+
+/**
+ * Given the source operand or result of an `InheritanceConversion`, returns the
+ * class being converted from or to. If the type of the expression is a pointer,
+ * this returns the pointed-to class. Otherwise, the type of the expression must
+ * be a class, in which case the result is that class.
+ */
+private Class getConversionClass(Expr expr) {
+ exists(Type operandType |
+ operandType = expr.getType().getUnspecifiedType() and
+ (
+ result = operandType or
+ result = operandType.(PointerType).getBaseType()
+ )
+ )
+}
+
+/**
+ * A conversion from a pointer or glvalue of a derived class to a pointer or
+ * glvalue of a direct or virtual base class.
+ */
+class BaseClassConversion extends InheritanceConversion {
+ BaseClassConversion() {
+ conversionkinds(this, 2)
+ }
+
+ override string getSemanticConversionString() {
+ result = "base class conversion"
+ }
+
+ override Class getBaseClass() {
+ result = getConversionClass(this)
+ }
+
+ override Class getDerivedClass() {
+ result = getConversionClass(getExpr())
+ }
+
+ /**
+ * Holds if this conversion is to a virtual base class.
+ */
+ predicate isVirtual() {
+ getDerivation().isVirtual() or not exists(getDerivation())
+ }
+}
+
+/**
+ * A conversion from a pointer or glvalue to a base class to a pointer or glvalue
+ * to a direct derived class.
+ */
+class DerivedClassConversion extends InheritanceConversion {
+ DerivedClassConversion() {
+ conversionkinds(this, 3)
+ }
+
+ override string getSemanticConversionString() {
+ result = "derived class conversion"
+ }
+
+ override Class getBaseClass() {
+ result = getConversionClass(getExpr())
+ }
+
+ override Class getDerivedClass() {
+ result = getConversionClass(this)
+ }
+}
+
+/**
+ * A conversion from a pointer-to-member of a derived class to a pointer-to-member
+ * of an immediate base class.
+ */
+class PointerToMemberBaseClassConversion extends Cast {
+ PointerToMemberBaseClassConversion() {
+ conversionkinds(this, 4)
+ }
+
+ override string getSemanticConversionString() {
+ result = "pointer-to-member base class conversion"
+ }
+}
+
+/**
+ * A conversion from a pointer-to-member of a base class to a pointer-to-member
+ * of an immediate derived class.
+ */
+class PointerToMemberDerivedClassConversion extends Cast {
+ PointerToMemberDerivedClassConversion() {
+ conversionkinds(this, 5)
+ }
+
+ override string getSemanticConversionString() {
+ result = "pointer-to-member derived class conversion"
+ }
+}
+
+/**
+ * A conversion of a glvalue from one type to another. The conversion does not
+ * modify the address of the glvalue. For glvalue conversions involving base and
+ * derived classes, see `BaseClassConversion` and `DerivedClassConversion`.
+ */
+class GlvalueConversion extends Cast {
+ GlvalueConversion() {
+ conversionkinds(this, 6)
+ }
+
+ override string getSemanticConversionString() {
+ result = "glvalue conversion"
+ }
+}
+
+/**
+ * The adjustment of the type of a class prvalue. Most commonly seen in code
+ * similar to:
+ *
+ * class String { ... };
+ * String func();
+ * void caller() {
+ * const String& r = func();
+ * }
+ *
+ * In the above example, the result of the call to `func` is a prvalue of type
+ * `String`, which will be adjusted to type `const String` before being bound
+ * to the reference.
+ */
+class PrvalueAdjustmentConversion extends Cast {
+ PrvalueAdjustmentConversion() {
+ conversionkinds(this, 7)
+ }
+
+ override string getSemanticConversionString() {
+ result = "prvalue adjustment conversion"
+ }
+}
+
+/**
+ * A C++ `dynamic_cast` expression.
+ */
+class DynamicCast extends Cast, @dynamic_cast {
+ override string toString() { result = "dynamic_cast<" + this.getType().getName() + ">..." }
+
+ override int getPrecedence() { result = 16 }
+
+ override string getSemanticConversionString() {
+ result = "dynamic_cast"
+ }
+}
+
+/**
+ * A Microsoft C/C++ `__uuidof` expression that returns the UUID of a type, as
+ * specified by the `__declspec(uuid)` attribute.
+ */
+class UuidofOperator extends Expr, @uuidof {
+ override string toString() { result = "__uuidof(" + getTypeOperand().getName() + ")" }
+
+ override int getPrecedence() { result = 15 }
+
+ /** Gets the contained type. */
+ Type getTypeOperand() {
+ uuidof_bind(this, result)
+ }
+}
+
+/**
+ * A C++ `typeid` expression which provides runtime type information
+ * about an expression or type.
+ */
+class TypeidOperator extends Expr, @type_id {
+ /**
+ * Gets the type that is returned by this typeid expression.
+ *
+ * For example in the following code the `typeid` returns the
+ * type `MyClass *`.
+ *
+ * ```
+ * MyClass *ptr;
+ *
+ * printf("the type of ptr is: %s\n", typeid(ptr).name);
+ * ```
+ */
+ Type getResultType() { typeid_bind(this,unresolve(result)) }
+
+ /**
+ * DEPRECATED: Use `getResultType()` instead.
+ *
+ * Gets the type that is returned by this typeid expression.
+ */
+ deprecated Type getSpecifiedType() { result = this.getResultType() }
+
+ /**
+ * Gets the contained expression, if any (if this typeid contains
+ * a type rather than an expression, there is no result).
+ */
+ Expr getExpr() { result = this.getChild(0) }
+
+ override string toString() { result = "typeid ..." }
+
+ override int getPrecedence() { result = 16 }
+
+ override predicate mayBeImpure() {
+ this.getExpr().mayBeImpure()
+ }
+ override predicate mayBeGloballyImpure() {
+ this.getExpr().mayBeGloballyImpure()
+ }
+}
+
+/**
+ * A C++11 `sizeof...` expression which determines the size of a template parameter pack.
+ *
+ * This expression only appears in templates themselves - in any actual
+ * instantiations, "sizeof...(x)" will be replaced by its integer value.
+ */
+class SizeofPackOperator extends Expr, @sizeof_pack {
+ override string toString() { result = "sizeof...(...)" }
+
+ override predicate mayBeImpure() {
+ none()
+ }
+ override predicate mayBeGloballyImpure() {
+ none()
+ }
+}
+
+/**
+ * A C/C++ sizeof expression.
+ */
+abstract class SizeofOperator extends Expr, @runtime_sizeof {
+ override int getPrecedence() { result = 15 }
+}
+
+/**
+ * A C/C++ sizeof expression whose operand is an expression.
+ */
+class SizeofExprOperator extends SizeofOperator {
+ SizeofExprOperator() { exists(Expr e | this.getChild(0) = e) }
+
+ /** Gets the contained expression. */
+ Expr getExprOperand() { result = this.getChild(0) }
+
+ /**
+ * DEPRECATED: Use `getExprOperand()` instead
+ *
+ * Gets the contained expression.
+ * */
+ deprecated Expr getExpr() { result = this.getExprOperand() }
+
+ override string toString() { result = "sizeof()" }
+
+ override predicate mayBeImpure() {
+ this.getExprOperand().mayBeImpure()
+ }
+ override predicate mayBeGloballyImpure() {
+ this.getExprOperand().mayBeGloballyImpure()
+ }
+}
+
+/**
+ * A C/C++ sizeof expression whose operand is a type name.
+ */
+class SizeofTypeOperator extends SizeofOperator {
+ SizeofTypeOperator() { sizeof_bind(this,_) }
+
+ /** Gets the contained type. */
+ Type getTypeOperand() { sizeof_bind(this,unresolve(result)) }
+
+ /**
+ * DEPRECATED: Use `getTypeOperand()` instead
+ *
+ * Gets the contained type.
+ */
+ deprecated Type getSpecifiedType() { result = this.getTypeOperand() }
+
+ override string toString() { result = "sizeof(" + this.getTypeOperand().getName() + ")" }
+
+ override predicate mayBeImpure() {
+ none()
+ }
+ override predicate mayBeGloballyImpure() {
+ none()
+ }
+}
+
+/**
+ * A C++11 `alignof` expression.
+ */
+abstract class AlignofOperator extends Expr, @runtime_alignof {
+ override int getPrecedence() { result = 15 }
+}
+
+/**
+ * A C++11 `alignof` expression whose operand is an expression.
+ */
+class AlignofExprOperator extends AlignofOperator {
+ AlignofExprOperator() { exists(Expr e | this.getChild(0) = e) }
+
+ /**
+ * Gets the contained expression.
+ */
+ Expr getExprOperand() { result = this.getChild(0) }
+
+ /**
+ * DEPRECATED: Use `getExprOperand()` instead.
+ */
+ deprecated Expr getExpr() { result = this.getExprOperand() }
+
+ override string toString() { result = "alignof()" }
+}
+
+/**
+ * A C++11 `alignof` expression whose operand is a type name.
+ */
+class AlignofTypeOperator extends AlignofOperator {
+ AlignofTypeOperator() { sizeof_bind(this,_) }
+
+ /** Gets the contained type. */
+ Type getTypeOperand() { sizeof_bind(this,unresolve(result)) }
+
+ /**
+ * DEPRECATED: Use `getTypeOperand()` instead.
+ */
+ deprecated Type getSpecifiedType() { result = this.getTypeOperand() }
+
+ override string toString() { result = "alignof(" + this.getTypeOperand().getName() + ")" }
+}
+
+/**
+ * A C/C++ array to pointer conversion.
+ */
+class ArrayToPointerConversion extends Conversion, @array_to_pointer {
+ /** Gets a textual representation of this conversion. */
+ override string toString() { result = "array to pointer conversion" }
+
+ override predicate mayBeImpure() {
+ none()
+ }
+ override predicate mayBeGloballyImpure() {
+ none()
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/exprs/ComparisonOperation.qll b/cpp/ql/src/semmle/code/cpp/exprs/ComparisonOperation.qll
new file mode 100644
index 000000000000..54fa38ae21b9
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/exprs/ComparisonOperation.qll
@@ -0,0 +1,107 @@
+import semmle.code.cpp.exprs.Expr
+
+/**
+ * A C/C++ comparison operation, that is, either an equality operation or a relational operation.
+ */
+abstract class ComparisonOperation extends BinaryOperation {
+}
+
+/**
+ * A C/C++ equality operation, that is, either "==" or "!=".
+ */
+abstract class EqualityOperation extends ComparisonOperation {
+ override int getPrecedence() { result = 9 }
+}
+
+/**
+ * A C/C++ equal expression.
+ */
+class EQExpr extends EqualityOperation, @eqexpr {
+ override string getOperator() { result = "==" }
+}
+
+/**
+ * A C/C++ not equal expression.
+ */
+class NEExpr extends EqualityOperation, @neexpr {
+ override string getOperator() { result = "!=" }
+}
+
+/**
+ * A C/C++ relational operation, that is, one of `<=`, `<`, `>`, or `>=`.
+ */
+abstract class RelationalOperation extends ComparisonOperation {
+ override int getPrecedence() { result = 10 }
+
+ /**
+ * DEPRECATED: Use `getGreaterOperand()` instead.
+ */
+ deprecated
+ Expr getLarge() {
+ result = getGreaterOperand()
+ }
+
+ /**
+ * DEPRECATED: Use `getLesserOperand()` instead.
+ */
+ deprecated
+ Expr getSmall() {
+ result = getLesserOperand()
+ }
+
+ /**
+ * Gets the operand on the "greater" (or "greater-or-equal") side
+ * of this relational expression, that is, the side that is larger
+ * if the overall expression evaluates to `true`; for example on
+ * `x <= 20` this is the `20`, and on `y > 0` it is `y`.
+ */
+ abstract Expr getGreaterOperand();
+
+ /**
+ * Gets the operand on the "lesser" (or "lesser-or-equal") side
+ * of this relational expression, that is, the side that is smaller
+ * if the overall expression evaluates to `true`; for example on
+ * `x <= 20` this is `x`, and on `y > 0` it is the `0`.
+ */
+ abstract Expr getLesserOperand();
+}
+
+/**
+ * A C/C++ greater than expression.
+ */
+class GTExpr extends RelationalOperation, @gtexpr {
+ override string getOperator() { result = ">" }
+
+ override Expr getGreaterOperand() { result = getLeftOperand() }
+ override Expr getLesserOperand() { result = getRightOperand() }
+}
+
+/**
+ * A C/C++ lesser than expression.
+ */
+class LTExpr extends RelationalOperation, @ltexpr {
+ override string getOperator() { result = "<" }
+
+ override Expr getGreaterOperand() { result = getRightOperand() }
+ override Expr getLesserOperand() { result = getLeftOperand() }
+}
+
+/**
+ * A C/C++ greater than or equal expression.
+ */
+class GEExpr extends RelationalOperation, @geexpr {
+ override string getOperator() { result = ">=" }
+
+ override Expr getGreaterOperand() { result = getLeftOperand() }
+ override Expr getLesserOperand() { result = getRightOperand() }
+}
+
+/**
+ * A C/C++ lesser than or equal expression.
+ */
+class LEExpr extends RelationalOperation, @leexpr {
+ override string getOperator() { result = "<=" }
+
+ override Expr getGreaterOperand() { result = getRightOperand() }
+ override Expr getLesserOperand() { result = getLeftOperand() }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/exprs/Expr.qll b/cpp/ql/src/semmle/code/cpp/exprs/Expr.qll
new file mode 100644
index 000000000000..7e713c19f4bb
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/exprs/Expr.qll
@@ -0,0 +1,986 @@
+
+import semmle.code.cpp.Element
+private import semmle.code.cpp.Enclosing
+private import semmle.code.cpp.internal.Type
+
+/**
+ * A C/C++ expression.
+ */
+class Expr extends StmtParent, @expr {
+ /** Gets the nth child of this expression. */
+ Expr getChild(int n) { exprparents(result,n,this) }
+
+ /** Gets the number of direct children of this expression. */
+ int getNumChild() { result = count(this.getAChild()) }
+
+ /** Holds if e is the nth child of this expression. */
+ predicate hasChild(Expr e, int n) { e = this.getChild(n) }
+
+ /** Gets the enclosing function of this expression, if any. */
+ Function getEnclosingFunction() { result = exprEnclosingElement(this) }
+
+ /** Gets the nearest enclosing set of curly braces around this expression in the source, if any. */
+ Block getEnclosingBlock() {
+ result = getEnclosingStmt().getEnclosingBlock()
+ }
+
+ override Stmt getEnclosingStmt() {
+ result = this.getParent().(Expr).getEnclosingStmt() or
+ result = this.getParent().(Stmt) or
+ exists(Expr other | result = other.getEnclosingStmt() and other.getConversion() = this) or
+ exists(DeclStmt d, LocalVariable v | d.getADeclaration() = v and v.getInitializer().getExpr() = this and result = d)
+ }
+
+ /** Gets the enclosing variable of this expression, if any. */
+ Variable getEnclosingVariable() { result = exprEnclosingElement(this) }
+
+ /** Gets a child of this expression. */
+ Expr getAChild() { exists (int n | result = this.getChild(n)) }
+
+ /** Gets the parent of this expression, if any. */
+ Element getParent() { exprparents(this,_,result) }
+
+ /** Gets the location of this expression. */
+ override Location getLocation() { exprs(this,_,result) }
+
+ /** Holds if this is an auxiliary expression generated by the compiler. */
+ predicate isCompilerGenerated() {
+ compgenerated(this) or
+ this.getParent().(ConstructorFieldInit).isCompilerGenerated()
+ }
+
+ /**
+ * Gets the type of this expression.
+ *
+ * As the type of an expression can sometimes be a TypedefType, calling getUnderlyingType()
+ * is often more useful than calling this predicate.
+ */
+ pragma[nomagic] Type getType() { expr_types(this,unresolve(result),_) }
+
+ /**
+ * Gets the type of this expression after typedefs have been resolved.
+ *
+ * In most cases, this predicate will be the same as getType(). It will
+ * only differ when the result of getType() is a TypedefType, in which
+ * case this predicate will (possibly recursively) resolve the typedef.
+ */
+ Type getUnderlyingType() { result = this.getType().getUnderlyingType() }
+
+ /**
+ * Gets an integer indicating the type of expression that this represents.
+ *
+ * Consider using subclasses of `Expr` rather than relying on this predicate.
+ */
+ int getKind() { exprs(this,result,_) }
+
+ /** Gets a textual representation of this expression. */
+ override string toString() { none() }
+
+ /** Gets the value of this expression, if it is a constant. */
+ string getValue() { exists(@value v | values(v,result,_) and valuebind(v,this)) }
+
+ /** Gets the source text for the value of this expression, if it is a constant. */
+ string getValueText() { exists(@value v | values(v,_,result) and valuebind(v,this)) }
+
+ /** Holds if this expression has a value that can be determined at compile time. */
+ predicate isConstant() { valuebind(_,this) }
+
+ /**
+ * Holds if this expression is side-effect free (conservative
+ * approximation). This predicate cannot be overridden;
+ * override mayBeImpure() instead.
+ *
+ * Note that this predicate does not strictly correspond with
+ * the usual definition of a 'pure' function because reading
+ * from global state is permitted, just not writing / output.
+ */
+ final predicate isPure() {
+ not this.mayBeImpure()
+ }
+
+ /**
+ * Holds if it is possible that the expression may be impure. If we are not
+ * sure, then it holds.
+ */
+ predicate mayBeImpure() {
+ any()
+ }
+
+ /**
+ * Holds if it is possible that the expression may be impure. If we are not
+ * sure, then it holds. Unlike `mayBeImpure()`, this predicate does not
+ * consider modifications to temporary local variables to be impure. If you
+ * call a function in which nothing may be globally impure then the function
+ * as a whole will have no side-effects, even if it mutates its own fresh
+ * stack variables.
+ */
+ predicate mayBeGloballyImpure() {
+ any()
+ }
+
+ /**
+ * Holds if this expression is an lvalue. An lvalue is an expression that
+ * represents a location, rather than a value.
+ * See [basic.lval] for more about lvalues.
+ */
+ predicate isLValueCategory() {
+ expr_types(this, _, 3)
+ }
+
+ /**
+ * Holds if this expression is an xvalue. An xvalue is a location whose
+ * lifetime is about to end (e.g. an rvalue reference returned from a function
+ * call).
+ * See [basic.lval] for more about xvalues.
+ */
+ predicate isXValueCategory() {
+ expr_types(this, _, 2)
+ }
+
+ /**
+ * Holds if this expression is a prvalue. A prvalue is an expression that
+ * represents a value, rather than a location.
+ * See [basic.lval] for more about prvalues.
+ */
+ predicate isPRValueCategory() {
+ expr_types(this, _, 1)
+ }
+
+ /**
+ * Holds if this expression is a glvalue. A glvalue is either an lvalue or an
+ * xvalue.
+ */
+ predicate isGLValueCategory() {
+ isLValueCategory() or isXValueCategory()
+ }
+
+ /**
+ * Holds if this expression is an rvalue. An rvalue is either a prvalue or an
+ * xvalue.
+ */
+ predicate isRValueCategory() {
+ isPRValueCategory() or isXValueCategory()
+ }
+
+ /**
+ * Gets a string representation of the value category of the expression.
+ * This is intended only for debugging. The possible values are:
+ *
+ * - "lvalue"
+ * - "xvalue"
+ * - "prvalue"
+ * - "prvalue(load)"
+ *
+ * The "prvalue(load)" string is used when the expression is a prvalue, but
+ * `hasLValueToRvalueConversion()` holds.
+ */
+ string getValueCategoryString() {
+ (
+ isLValueCategory() and
+ result = "lvalue"
+ ) or (
+ isXValueCategory() and
+ result = "xvalue"
+ ) or (
+ isPRValueCategory() and
+ if hasLValueToRValueConversion() then
+ result = "prvalue(load)"
+ else
+ result = "prvalue"
+
+ )
+ }
+
+ /**
+ * Gets the parent of this expression, if any, in an alternative syntax tree
+ * that has `Conversion`s as part of the tree.
+ */
+ Element getParentWithConversions() { convparents(this,_,result) }
+
+ /**
+ * Holds if this expression will not be evaluated because of its context,
+ * such as an expression inside a sizeof.
+ */
+ predicate isUnevaluated() {
+ exists (Element e |
+ e = getParentWithConversions+() |
+ e instanceof SizeofOperator or
+ exists ( Expr e2 |
+ e.(TypeidOperator).getExpr() = e2 and
+ (
+ not e2.getActualType().getUnspecifiedType().(Class).isPolymorphic() or
+ not e2.isGLValueCategory()
+ )
+ ) or
+ e instanceof NoExceptExpr or
+ e instanceof AlignofOperator
+ ) or exists (Decltype d |
+ d.getExpr() = getParentWithConversions*()
+ )
+ }
+
+ /**
+ * Holds if this expression has undergone an lvalue-to-rvalue conversion to
+ * extract its value.
+ * for example:
+ * ```
+ * y = x;
+ * ```
+ * The VariableAccess for `x` is a prvalue, and hasLValueToRValueConversion()
+ * holds because the value of `x` was loaded from the location of `x`.
+ * The VariableAccess for `y` is an lvalue, and hasLValueToRValueConversion()
+ * does not hold because the value of `y` was not extracted.
+ *
+ * See [conv.lval] for more about the lvalue-to-rvalue conversion
+ */
+ predicate hasLValueToRValueConversion() {
+ expr_isload(this)
+ }
+
+ /**
+ * Holds if this expression is an LValue, in the sense of having an address.
+ *
+ * Being an LValue is best approximated as having an address.
+ * This is a strict superset of modifiable LValues, which are best approximated by things which could be on the left-hand side of an assignment.
+ * This is also a strict superset of expressions which provide an LValue, which is best approximated by things whose address is important.
+ *
+ * See [basic.lval] in the C++ language specification.
+ * In C++03, every expression is either an LValue or an RValue.
+ * In C++11, every expression is exactly one of an LValue, an XValue, or a PRValue (with RValues being the union of XValues and PRValues).
+ * Using the C++11 terminology, this predicate selects expressions whose value category is lvalue.
+ */
+ predicate isLValue() {
+ this instanceof StringLiteral /* C++ n3337 - 5.1.1 clause 1 */
+ or this.(ParenthesisExpr).getExpr().isLValue() /* C++ n3337 - 5.1.1 clause 6 */
+ or (this instanceof VariableAccess and not this instanceof FieldAccess) /* C++ n3337 - 5.1.1 clauses 8 and 9, variables and data members */
+ or exists(FunctionAccess fa | fa = this | /* C++ n3337 - 5.1.1 clauses 8 and 9, functions */
+ fa.getTarget().isStatic()
+ or not fa.getTarget().isMember()
+ )
+ or this instanceof ArrayExpr /* C++ n3337 - 5.2.1 clause 1 */
+ or this.getType() instanceof ReferenceType /* C++ n3337 - 5.2.2 clause 10
+ 5.2.5 clause 4, no bullet point
+ 5.2.7 clauses 2 and 5
+ 5.2.9 clause 1
+ 5.2.10 clause 1
+ 5.2.11 clause 1
+ 5.4 clause 1 */
+ or this.(FieldAccess).getQualifier().isLValue() /* C++ n3337 - 5.2.5 clause 4, 2nd bullet point */
+ or this instanceof TypeidOperator /* C++ n3337 - 5.2.8 clause 1 */
+ or this instanceof PointerDereferenceExpr /* C++ n3337 - 5.3.1 clause 1 */
+ or this instanceof PrefixIncrExpr /* C++ n3337 - 5.3.2 clause 1 */
+ or this instanceof PrefixDecrExpr /* C++ n3337 - 5.3.2 clause 2 */
+ or exists(ConditionalExpr ce | ce = this | /* C++ n3337 - 5.16 clause 4 */
+ ce.getThen().isLValue() and
+ ce.getElse().isLValue() and
+ ce.getThen().getType() = ce.getElse().getType()
+ )
+ or this instanceof Assignment /* C++ n3337 - 5.17 clause 1 */
+ or this.(CommaExpr).getRightOperand().isLValue() /* C++ n3337 - 5.18 clause 1 */
+ }
+
+ /**
+ * Gets the precedence of the main operator of this expression;
+ * higher precedence binds tighter.
+ */
+ int getPrecedence() {
+ none()
+ }
+
+ /**
+ * Holds if this expression has a conversion.
+ *
+ * Type casts and parameterized expressions are not part of the main
+ * expression tree structure but attached on the nodes they convert,
+ * for example:
+ * ```
+ * 2 + (int)(bool)1
+ * ```
+ * has the main tree:
+ * ```
+ * 2 + 1
+ * ```
+ * and 1 has a bool conversion, while the bool conversion itself has
+ * an int conversion.
+ */
+ predicate hasConversion() { exists(Expr e | exprconv(this,e)) }
+
+ /**
+ * Holds if this expression has an implicit conversion.
+ *
+ * For example in `char *str = 0`, the `0` has an implicit conversion to type `char *`.
+ */
+ predicate hasImplicitConversion() { exists(Expr e | exprconv(this,e) and e.(Cast).isImplicit()) }
+
+ /**
+ * Holds if this expression has an explicit conversion.
+ *
+ * For example in `(MyClass *)ptr`, the `ptr` has an explicit
+ * conversion to type `MyClass *`.
+ */
+ predicate hasExplicitConversion() { exists(Expr e | exprconv(this,e) and not e.(Cast).isImplicit()) }
+
+ /**
+ * Gets the conversion associated with this expression, if any.
+ */
+ Expr getConversion() { exprconv(this,result) }
+
+ /**
+ * Gets a string describing the conversion associated with this expression,
+ * or "" if there is none.
+ */
+ string getConversionString() { (result = this.getConversion().toString() and this.hasConversion()) or (result = "" and not this.hasConversion()) }
+
+ /** Gets the fully converted form of this expression, including all type casts and other conversions. */
+ cached
+ Expr getFullyConverted() {
+ if this.hasConversion() then
+ result = this.getConversion().getFullyConverted()
+ else
+ result = this
+ }
+
+ /**
+ * Gets this expression with all of its explicit casts, but none of its
+ * implicit casts. More precisely this takes conversions up to the last
+ * explicit cast (there may be implicit conversions along the way), but does
+ * not include conversions after the last explicit cast.
+ *
+ * C++ example: `C c = (B)d` might have three casts: (1) an implicit cast
+ * from A to some D, (2) an explicit cast from D to B, and (3) an implicit
+ * cast from B to C. Only (1) and (2) would be included.
+ */
+ Expr getExplicitlyConverted() {
+ // result is this or one of its conversions
+ result = this.getConversion*() and
+ // result is not an implicit conversion - it's either the expr or an explicit cast
+ (result = this or not result.(Cast).isImplicit()) and
+ // there is no further explicit conversion after result
+ not exists(Cast other | other = result.getConversion+() and not other.isImplicit())
+ }
+
+ /**
+ * Gets this expression with all of its initial implicit casts, but none of
+ * its explicit casts. More precisely, this takes all implicit conversions
+ * up to (but not including) the first explicit cast (if any).
+ */
+ Expr getImplicitlyConverted() {
+ if this.hasImplicitConversion() then
+ result = this.getConversion().getImplicitlyConverted()
+ else
+ result = this
+ }
+
+ /**
+ * Gets the type of this expression, after any implicit conversions and explicit casts, and after resolving typedefs.
+ *
+ * As an example, consider the AST fragment `(i64)(void*)0` in the context of `typedef long long i64;`. The fragment
+ * contains three expressions: two CStyleCasts and one literal Zero. For all three expressions, the result of this
+ * predicate will be `long long`.
+ */
+ Type getActualType() {
+ result = this.getFullyConverted().getType().getUnderlyingType()
+ }
+
+ /** Holds if this expression is parenthesised. */
+ predicate isParenthesised() { this.getConversion() instanceof ParenthesisExpr }
+
+ /** Gets the function containing this control-flow node. */
+ override Function getControlFlowScope() {
+ result = this.getEnclosingFunction()
+ }
+}
+
+/**
+ * A C/C++ operation.
+ */
+abstract class Operation extends Expr {
+ /** Gets the operator of this operation. */
+ abstract string getOperator();
+
+ /** Gets an operand of this operation. */
+ Expr getAnOperand() {
+ result = this.getAChild()
+ }
+}
+
+/**
+ * A C/C++ unary operation.
+ */
+abstract class UnaryOperation extends Operation {
+ /** Gets the operand of this unary operation. */
+ Expr getOperand() { this.hasChild(result,0) }
+
+ override string toString() { result = this.getOperator() + " ..." }
+
+ override predicate mayBeImpure() {
+ this.getOperand().mayBeImpure()
+ }
+ override predicate mayBeGloballyImpure() {
+ this.getOperand().mayBeGloballyImpure()
+ }
+}
+
+/**
+ * A C/C++ binary operation.
+ */
+abstract class BinaryOperation extends Operation {
+ /** Gets the left operand of this binary operation. */
+ Expr getLeftOperand() { this.hasChild(result,0) }
+
+ /** Gets the right operand of this binary operation. */
+ Expr getRightOperand() { this.hasChild(result,1) }
+
+ override string toString() { result = "... " + this.getOperator() + " ..." }
+
+ override predicate mayBeImpure() {
+ this.getLeftOperand().mayBeImpure() or
+ this.getRightOperand().mayBeImpure()
+ }
+ override predicate mayBeGloballyImpure() {
+ this.getLeftOperand().mayBeGloballyImpure() or
+ this.getRightOperand().mayBeGloballyImpure()
+ }
+}
+
+/**
+ * A C++11 parenthesized braced initializer list within a template.
+ *
+ * This is used to represent particular syntax within templates where the final
+ * form of the expression is not known. In actual instantiations, it will have
+ * been turned into a constructor call or aggregate initializer or similar.
+ */
+class ParenthesizedBracedInitializerList extends Expr, @braced_init_list {
+ override string toString() { result = "({...})" }
+}
+
+/**
+ * A C/C++ parenthesis expression.
+*/
+class ParenthesisExpr extends Conversion, @parexpr {
+ override string toString() { result = "(...)" }
+}
+
+/**
+ * A C/C++ expression that has not been resolved.
+ */
+class ErrorExpr extends Expr, @errorexpr {
+ override string toString() { result = "" }
+}
+
+/**
+ * A Microsoft C/C++ __assume expression.
+ */
+class AssumeExpr extends Expr, @assume {
+ override string toString() { result = "__assume(...)" }
+}
+
+/**
+ * A C/C++ comma expression.
+ */
+class CommaExpr extends Expr, @commaexpr {
+ /**
+ * Gets the left operand, which is the one whose value is discarded.
+ */
+ Expr getLeftOperand() { this.hasChild(result,0) }
+
+ /**
+ * Gets the right operand, which is the one whose value is equal to the value
+ * of the comma expression itself.
+ */
+ Expr getRightOperand() { this.hasChild(result,1) }
+
+ override string toString() { result = "... , ..." }
+
+ override int getPrecedence() { result = 0 }
+
+ override predicate mayBeImpure() {
+ this.getLeftOperand().mayBeImpure() or
+ this.getRightOperand().mayBeImpure()
+ }
+ override predicate mayBeGloballyImpure() {
+ this.getLeftOperand().mayBeGloballyImpure() or
+ this.getRightOperand().mayBeGloballyImpure()
+ }
+}
+
+/**
+ * A C/C++ address-of expression.
+ */
+class AddressOfExpr extends UnaryOperation, @address_of {
+ /** Gets the function or variable whose address is taken. */
+ Declaration getAddressable() {
+ result = this.getOperand().(Access).getTarget()
+ // this handles the case where we are taking the address of a reference variable
+ or result = this.getOperand().(ReferenceDereferenceExpr).getChild(0).(Access).getTarget()
+ }
+
+ override string getOperator() { result = "&" }
+
+ override int getPrecedence() { result = 15 }
+
+ override predicate mayBeImpure() {
+ this.getOperand().mayBeImpure()
+ }
+ override predicate mayBeGloballyImpure() {
+ this.getOperand().mayBeGloballyImpure()
+ }
+}
+
+/**
+ * An implicit conversion from type T to type T&.
+ *
+ * This typically occurs when an expression of type T is used to initialize a variable or parameter of
+ * type T&, and is to reference types what AddressOfExpr is to pointer types - though this class is
+ * considered to be a conversion rather than an operation, and as such doesn't occur in the main AST.
+ */
+class ReferenceToExpr extends Conversion, @reference_to {
+ override string toString() { result = "(reference to)" }
+
+ override int getPrecedence() { result = 15 }
+}
+
+/**
+ * An instance of unary operator * applied to a built-in type.
+ *
+ * For user-defined types, see OverloadedPointerDereferenceExpr.
+ */
+class PointerDereferenceExpr extends UnaryOperation, @indirect {
+ /**
+ * DEPRECATED: Use getOperand() instead.
+ *
+ * Gets the expression that is being dereferenced.
+ */
+ deprecated Expr getExpr() {
+ result = getOperand()
+ }
+
+ override string getOperator() { result = "*" }
+
+ override int getPrecedence() { result = 15 }
+
+ override predicate mayBeImpure() {
+ this.getChild(0).mayBeImpure() or
+ this.getChild(0).getFullyConverted().getType().(DerivedType).getBaseType().isVolatile()
+ }
+ override predicate mayBeGloballyImpure() {
+ this.getChild(0).mayBeGloballyImpure() or
+ this.getChild(0).getFullyConverted().getType().(DerivedType).getBaseType().isVolatile()
+ }
+}
+
+/**
+ * An implicit conversion from type T& to type T.
+ *
+ * This typically occurs when an variable of type T& is used in a context which expects type T, and
+ * is to reference types what PointerDereferenceExpr is to pointer types - though this class is
+ * considered to be a conversion rather than an operation, and as such doesn't occur in the main AST.
+ */
+class ReferenceDereferenceExpr extends Conversion, @ref_indirect {
+ override string toString() { result = "(reference dereference)" }
+}
+
+/**
+ * A C++ `new` (non-array) expression.
+ */
+class NewExpr extends Expr, @new_expr {
+ override string toString() { result = "new" }
+
+ override int getPrecedence() { result = 15 }
+
+ /**
+ * Gets the type that is being allocated.
+ *
+ * For example, for `new int` the result is `int`.
+ */
+ Type getAllocatedType() {
+ new_allocated_type(this, unresolve(result))
+ }
+
+ /**
+ * Gets the `operator new` that allocates storage.
+ */
+ Function getAllocator() {
+ expr_allocator(this, result, _)
+ }
+
+ /**
+ * Holds if the allocation function is the version that expects an alignment
+ * argument of type `std::align_val_t`.
+ */
+ predicate hasAlignedAllocation() {
+ expr_allocator(this, _, 1)
+ }
+
+ /**
+ * Gets the call to a non-default `operator new` that allocates storage, if any.
+ *
+ * As a rule of thumb, there will be an allocator call precisely when the type
+ * being allocated has a custom `operator new`, or when an argument list appears
+ * after the `new` keyword and before the name of the type being allocated.
+ *
+ * In particular note that uses of placement-new and nothrow-new will have an
+ * allocator call.
+ */
+ FunctionCall getAllocatorCall() { result = this.getChild(0) }
+
+ /**
+ * Gets the `operator delete` that deallocates storage if the initialization
+ * throws an exception, if any.
+ */
+ Function getDeallocator() {
+ expr_deallocator(this, result, _)
+ }
+
+ /**
+ * Holds if the deallocation function expects a size argument.
+ */
+ predicate hasSizedDeallocation() {
+ exists(int form |
+ expr_deallocator(this, _, form) and
+ form.bitAnd(1) != 0 // Bit zero is the "size" bit
+ )
+ }
+
+ /**
+ * Holds if the deallocation function expects an alignment argument.
+ */
+ predicate hasAlignedDeallocation() {
+ exists(int form |
+ expr_deallocator(this, _, form) and
+ form.bitAnd(2) != 0 // Bit one is the "alignment" bit
+ )
+ }
+
+ /**
+ * Gets the call or expression that initializes the allocated object, if any.
+ *
+ * As examples, for `new int(4)`, this will be `4`, and for `new std::vector(4)`, this will
+ * be a call to the constructor `std::vector::vector(size_t)` with `4` as an argument.
+ */
+ Expr getInitializer() { result = this.getChild(1) }
+}
+
+/**
+ * A C++ `new[]` (array) expression.
+ */
+class NewArrayExpr extends Expr, @new_array_expr {
+ override string toString() { result = "new[]" }
+
+ override int getPrecedence() { result = 15 }
+
+ /**
+ * Gets the type that is being allocated.
+ *
+ * For example, for `new int[5]` the result is `int[5]`.
+ */
+ Type getAllocatedType() {
+ new_array_allocated_type(this, unresolve(result))
+ }
+
+ /**
+ * Gets the element type of the array being allocated.
+ */
+ Type getAllocatedElementType() {
+ result = getType().getUnderlyingType().(PointerType).getBaseType()
+ }
+
+ /**
+ * Gets the `operator new[]` that allocates storage.
+ */
+ Function getAllocator() {
+ expr_allocator(this, result, _)
+ }
+
+ /**
+ * Holds if the allocation function is the version that expects an alignment
+ * argument of type `std::align_val_t`.
+ */
+ predicate hasAlignedAllocation() {
+ expr_allocator(this, _, 1)
+ }
+
+ /**
+ * Gets the call to a non-default `operator new[]` that allocates storage for the array, if any.
+ *
+ * If the default `operator new[]` is used, then there will be no call.
+ */
+ FunctionCall getAllocatorCall() { result = this.getChild(0) }
+
+ /**
+ * Gets the `operator delete` that deallocates storage if the initialization
+ * throws an exception, if any.
+ */
+ Function getDeallocator() {
+ expr_deallocator(this, result, _)
+ }
+
+ /**
+ * Holds if the deallocation function expects a size argument.
+ */
+ predicate hasSizedDeallocation() {
+ exists(int form |
+ expr_deallocator(this, _, form) and
+ form.bitAnd(1) != 0 // Bit zero is the "size" bit
+ )
+ }
+
+ /**
+ * Holds if the deallocation function expects an alignment argument.
+ */
+ predicate hasAlignedDeallocation() {
+ exists(int form |
+ expr_deallocator(this, _, form) and
+ form.bitAnd(2) != 0 // Bit one is the "alignment" bit
+ )
+ }
+
+ /**
+ * Gets the call or expression that initializes the first element of the array, if any.
+ *
+ * This will either be a call to the default constructor for the array's element type (as
+ * in `new std::string[10]`), or a literal zero for arrays of scalars which are zero-initialized
+ * due to extra parentheses (as in `new int[10]()`).
+ *
+ * At runtime, the constructor will be called once for each element in the array, but the
+ * constructor call only exists once in the AST.
+ */
+ Expr getInitializer() { result = this.getChild(1) }
+
+ /**
+ * Gets the extent of the non-constant array dimension, if any.
+ *
+ * As examples, for `new char[n]` and `new char[n][10]`, this gives `n`, but for `new char[10]` this
+ * gives nothing, as the 10 is considered part of the type.
+ */
+ Expr getExtent() { result = this.getChild(2) }
+}
+
+/**
+ * A C++ `delete` (non-array) expression.
+ */
+class DeleteExpr extends Expr, @delete_expr {
+ override string toString() { result = "delete" }
+
+ override int getPrecedence() { result = 15 }
+
+ /**
+ * Gets the compile-time type of the object being deleted.
+ */
+ Type getDeletedObjectType() {
+ result = getExpr().getFullyConverted().getType().stripTopLevelSpecifiers().(PointerType).getBaseType()
+ }
+
+ /**
+ * Gets the call to a destructor that occurs prior to the object's memory being deallocated, if any.
+ */
+ DestructorCall getDestructorCall() { result = this.getChild(1) }
+
+ /**
+ * Gets the destructor to be called to destroy the object, if any.
+ */
+ Destructor getDestructor() { result = getDestructorCall().getTarget() }
+
+ /**
+ * Gets the `operator delete` that deallocates storage. Does not hold
+ * if the type being destroyed has a virtual destructor. In that case, the
+ * `operator delete` that will be called is determined at runtime based on the
+ * dynamic type of the object.
+ */
+ Function getDeallocator() {
+ expr_deallocator(this, result, _)
+ }
+
+ /**
+ * Holds if the deallocation function expects a size argument.
+ */
+ predicate hasSizedDeallocation() {
+ exists(int form |
+ expr_deallocator(this, _, form) and
+ form.bitAnd(1) != 0 // Bit zero is the "size" bit
+ )
+ }
+
+ /**
+ * Holds if the deallocation function expects an alignment argument.
+ */
+ predicate hasAlignedDeallocation() {
+ exists(int form |
+ expr_deallocator(this, _, form) and
+ form.bitAnd(2) != 0 // Bit one is the "alignment" bit
+ )
+ }
+
+/**
+ * Gets the call to a non-default `operator delete` that deallocates storage, if any.
+ *
+ * This will only be present when the type being deleted has a custom `operator delete`.
+ */
+ FunctionCall getAllocatorCall() { result = this.getChild(0) }
+
+ /**
+ * Gets the object being deleted.
+ */
+ Expr getExpr() { result = this.getChild(3) or result = this.getChild(1).getChild(-1) }
+}
+
+/**
+ * A C++ `delete[]` (array) expression.
+ */
+class DeleteArrayExpr extends Expr, @delete_array_expr {
+ override string toString() { result = "delete[]" }
+
+ override int getPrecedence() { result = 15 }
+
+ /**
+ * Gets the element type of the array being deleted.
+ */
+ Type getDeletedElementType() {
+ result = getExpr().getFullyConverted().getType().stripTopLevelSpecifiers().(PointerType).getBaseType()
+ }
+
+ /**
+ * Gets the call to a destructor that occurs prior to the array's memory being deallocated, if any.
+ *
+ * At runtime, the destructor will be called once for each element in the array, but the
+ * destructor call only exists once in the AST.
+ */
+ DestructorCall getDestructorCall() { result = this.getChild(1) }
+
+ /**
+ * Gets the destructor to be called to destroy each element in the array, if any.
+ */
+ Destructor getDestructor() { result = getDestructorCall().getTarget() }
+
+ /**
+ * Gets the `operator delete[]` that deallocates storage.
+ */
+ Function getDeallocator() {
+ expr_deallocator(this, result, _)
+ }
+
+ /**
+ * Holds if the deallocation function expects a size argument.
+ */
+ predicate hasSizedDeallocation() {
+ exists(int form |
+ expr_deallocator(this, _, form) and
+ form.bitAnd(1) != 0 // Bit zero is the "size" bit
+ )
+ }
+
+ /**
+ * Holds if the deallocation function expects an alignment argument.
+ */
+ predicate hasAlignedDeallocation() {
+ exists(int form |
+ expr_deallocator(this, _, form) and
+ form.bitAnd(2) != 0 // Bit one is the "alignment" bit
+ )
+ }
+
+ /**
+ * Gets the call to a non-default `operator delete` that deallocates storage, if any.
+ *
+ * This will only be present when the type being deleted has a custom `operator delete`.
+ */
+ FunctionCall getAllocatorCall() { result = this.getChild(0) }
+
+ /**
+ * Gets the array being deleted.
+ */
+ Expr getExpr() { result = this.getChild(3) or result = this.getChild(1).getChild(-1) }
+}
+
+/**
+ * A compound statement enclosed in parentheses used as an expression (a GNU extension to C/C++).
+ */
+class StmtExpr extends Expr, @expr_stmt {
+ override string toString() { result = "(statement expression)" }
+
+ /**
+ * Gets the statement enclosed by this `StmtExpr`.
+ */
+ Stmt getStmt() { result.getParent() = this }
+
+ /**
+ * Gets the result expression of the enclosed statement. For example,
+ * `a+b` is the result expression in this example:
+ *
+ * ```
+ * x = ({ dosomething(); a+b; });
+ * ```
+ */
+ Expr getResultExpr() {
+ result = getStmtResultExpr(getStmt())
+ }
+}
+
+/** Get the result expression of a statement. (Helper function for StmtExpr.) */
+private Expr getStmtResultExpr(Stmt stmt) {
+ result = stmt.(ExprStmt).getExpr() or
+ result = getStmtResultExpr(stmt.(Block).getLastStmt())
+}
+
+/**
+ * A C/C++ this expression.
+ */
+class ThisExpr extends Expr, @thisaccess {
+ override string toString() { result = "this" }
+
+ override predicate mayBeImpure() {
+ none()
+ }
+ override predicate mayBeGloballyImpure() {
+ none()
+ }
+}
+
+/**
+ * A code block expression, for example `^ int (int x, int y) {return x + y;}`.
+ *
+ * Blocks are a language extension supported by Clang, and by Apple's
+ * branch of GCC.
+ */
+class BlockExpr extends Literal {
+ BlockExpr() {
+ code_block(this, _)
+ }
+
+ override string toString() { result = "^ { ... }" }
+
+ /**
+ * Gets the (anonymous) function associated with this code block expression.
+ */
+ Function getFunction() {
+ code_block(this, result)
+ }
+}
+
+/**
+ * A C++11 `noexcept` expression, for example `noexcept(1 + 2)`.
+ */
+class NoExceptExpr extends Expr, @noexceptexpr {
+ override string toString() { result = "noexcept(...)" }
+
+ /**
+ * Gets the expression inside this noexcept expression.
+ */
+ Expr getExpr() {
+ result = this.getChild(0)
+ }
+}
+
+/**
+ * Holds if `child` is the `n`th child of `parent` in an alternative syntax
+ * tree that has `Conversion`s as part of the tree.
+ */
+private predicate convparents(Expr child, int idx, Element parent) {
+ child.getConversion() = parent and
+ idx = 0
+ or
+ exists(Expr astChild |
+ exprparents(astChild, idx, parent) and
+ child = astChild.getFullyConverted()
+ )
+}
diff --git a/cpp/ql/src/semmle/code/cpp/exprs/Lambda.qll b/cpp/ql/src/semmle/code/cpp/exprs/Lambda.qll
new file mode 100644
index 000000000000..e99e85edb028
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/exprs/Lambda.qll
@@ -0,0 +1,148 @@
+import semmle.code.cpp.exprs.Expr
+import semmle.code.cpp.Class
+
+/**
+ * A C++11 lambda expression, such as `[&, =y](int x) mutable -> double {return z = (y += x);}`.
+ *
+ * The type given by `getType()` will be an instance of `Closure`.
+ */
+class LambdaExpression extends Expr, @lambdaexpr {
+ override string toString() {
+ result = "[...](...){...}"
+ }
+
+ /**
+ * Gets an implicitly or explicitly captured value of this lambda expression.
+ */
+ LambdaCapture getACapture() {
+ result = getCapture(_)
+ }
+
+ /**
+ * Gets the nth implicitly or explicitly captured value of this lambda expression.
+ */
+ LambdaCapture getCapture(int index) {
+ lambda_capture(result, this, index, _, _, _)
+ }
+
+ /**
+ * Gets the default variable capture mode for the lambda expression.
+ *
+ * Will be one of:
+ * - "" if no default was specified, meaning that all captures must be explicit.
+ * - "&" if capture-by-reference is the default for implicit captures.
+ * - "=" if capture-by-value is the default for implicit captures.
+ */
+ string getDefaultCaptureMode() {
+ lambdas(this, result, _)
+ }
+
+ /**
+ * Holds if the return type (of the call operator of the resulting object) was explicitly specified.
+ */
+ predicate returnTypeIsExplicit() {
+ lambdas(this, _, true)
+ }
+
+ /**
+ * Gets the function which will be invoked when the resulting object is called.
+ *
+ * Various components of the lambda expression can be obtained from components of this
+ * function, such as:
+ * - The number and type of parameters.
+ * - Whether the mutable keyword was used (iff this function is not const).
+ * - The return type.
+ * - The statements comprising the lambda body.
+ */
+ Operator getLambdaFunction() {
+ result = getType().(Closure).getLambdaFunction()
+ }
+}
+
+/**
+ * A class written by the compiler to be the type of a C++11 lambda expression.
+ */
+class Closure extends Class {
+ Closure() {
+ exists(LambdaExpression e | this = e.getType())
+ }
+
+ /** Gets the lambda expression of which this is the type. */
+ LambdaExpression getLambdaExpression() {
+ result.getType() = this
+ }
+
+ /** Gets the compiler-generated operator() of this closure type. */
+ Operator getLambdaFunction() {
+ result = this.getAMember()
+ and result.getName() = "operator()"
+ }
+
+ override string toString() {
+ result = "decltype([...](...){...})"
+ }
+}
+
+/**
+ * Information about a value captured as part of a lambda expression.
+ */
+class LambdaCapture extends @lambdacapture {
+ string toString() {
+ result = getField().toString()
+ }
+
+ /**
+ * Holds if this capture was made implicitly.
+ */
+ predicate isImplicit() {
+ lambda_capture(this, _, _, _, true, _)
+ }
+
+ /**
+ * Holds if the variable was captured by reference.
+ *
+ * An identifier is captured by reference if:
+ * - It is explicitly captured by reference.
+ * - It is implicitly captured, and the lambda's default capture mode is by-reference.
+ * - The identifier is "this". [Said behaviour is dictated by the C++11 standard, but it
+ * is actually "*this" being captured rather than "this".]
+ */
+ predicate isCapturedByReference() {
+ lambda_capture(this, _, _, true, _, _)
+ }
+
+ /**
+ * Gets the location of the declaration of this capture.
+ *
+ * For explicit captures, this is a location within the "[...]" part of the lambda expression.
+ *
+ * For implicit captures, this is the first location within the "{...}" part of the lambda
+ * expression which accesses the captured variable.
+ */
+ Location getLocation() {
+ lambda_capture(this, _, _, _, _, result)
+ }
+
+ /**
+ * Gets the field of the lambda expression's closure type which is used to store this capture.
+ */
+ MemberVariable getField() {
+ exists(LambdaExpression lambda, int index | this = lambda.getCapture(index) |
+ result = lambda.getType().(Closure).getCanonicalMember(index)
+ )
+ }
+
+ /**
+ * Gets the expression which yields the final captured value.
+ *
+ * In many cases, this will be an instance of VariableAccess.
+ * If a this-pointer is being captured, this will be an instance of ThisExpr.
+ * For by-value captures of non-primitive types, this will be a call to a copy constructor.
+ */
+ Expr getInitializer() {
+ exists(LambdaExpression lambda, int index | this = lambda.getCapture(index) |
+ result = lambda.getChild(0) // Call to the constructor of the closure type.
+ .getChild(index) // The appropriate argument to the constructor.
+ )
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/exprs/Literal.qll b/cpp/ql/src/semmle/code/cpp/exprs/Literal.qll
new file mode 100644
index 000000000000..262d99251713
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/exprs/Literal.qll
@@ -0,0 +1,259 @@
+import semmle.code.cpp.exprs.Expr
+
+/**
+ * A C/C++ literal.
+ */
+class Literal extends Expr, @literal {
+ /** Gets a textual representation of this literal. */
+ override string toString() {
+ result = this.getValue() or
+ (
+ not exists(this.getValue()) and
+ result = "Unknown literal"
+ )
+ }
+
+ override predicate mayBeImpure() {
+ none()
+ }
+ override predicate mayBeGloballyImpure() {
+ none()
+ }
+}
+
+/**
+ * A label literal, that is, a use of the '&&' operator to take the address of a
+ * label for use in a computed goto statement. This is a non-standard C/C++ extension.
+ *
+ * For example:
+ * ```
+ * void *label_ptr = &&myLabel; // &&myLabel is a LabelLiteral
+ *
+ * goto *label_ptr; // this is a ComputedGotoStmt
+ *
+ * myLabel: // this is a LabelStmt
+ * ```
+ */
+class LabelLiteral extends Literal {
+ LabelLiteral() {
+ jumpinfo(this,_,_)
+ }
+
+ /** Gets the corresponding label statement. */
+ LabelStmt getLabel() {
+ jumpinfo(this,_,result)
+ }
+}
+
+/** A character literal or a string literal. */
+abstract class TextLiteral extends Literal {
+ /** Gets a hex escape sequence that appears in the character or string literal (see [lex.ccon] in the C++ Standard). */
+ string getAHexEscapeSequence(int occurrence, int offset) {
+ result = getValueText().regexpFind("(?` for some protocol `P`,
+ * then there will be no result. If the receiving expression has type `C*` or type
+ * `C*` for some protocol `P`, then the result will be the type `C`.
+ */
+ ObjectiveClass getReceiverClass() {
+ none()
+ }
+
+ /**
+ * Gets the Objective C classes and/or protocols which are statically implemented
+ * by the receiving expression.
+ *
+ * If the receiving expression has type `id`, then there will be no result.
+ * If the receiving expression has type `id
`, then `P` will be the sole result.
+ * If the receiving expression has type `C*`, then `C` will be the sole result.
+ * If the receiving expression has type `C
*`, then `C` and `P` will both be results.
+ */
+ Class getAReceiverClassOrProtocol() {
+ none()
+ }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An access to an Objective C property using dot syntax.
+ *
+ * Such accesses are de-sugared into a message expression to the property's getter or setter.
+ */
+deprecated class PropertyAccess extends ExprMessageExpr {
+ PropertyAccess() { none() }
+
+ /**
+ * Gets the property being accessed by this expression.
+ */
+ Property getProperty() {
+ none()
+ }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C `@selector` expression, for example `@selector(driveForDistance:)`.
+ */
+deprecated class AtSelectorExpr extends Expr {
+ AtSelectorExpr() { none() }
+
+ override string toString() {
+ none()
+ }
+
+ /**
+ * Gets the selector of this `@selector` expression, for example `driveForDistance:`.
+ */
+ string getSelector() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C `@protocol` expression, for example `@protocol(SomeProtocol)`.
+ */
+deprecated class AtProtocolExpr extends Expr {
+ AtProtocolExpr() { none() }
+
+ override string toString() {
+ none()
+ }
+
+ /**
+ * Gets the protocol of this `@protocol` expression, for example `SomeProtocol`.
+ */
+ Protocol getProtocol() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C `@encode` expression, for example `@encode(int *)`.
+ */
+deprecated class AtEncodeExpr extends Expr {
+ AtEncodeExpr() { none() }
+
+ override string toString() {
+ none()
+ }
+
+ /**
+ * Gets the type this `@encode` expression encodes, for example `int *`.
+ */
+ Type getEncodedType() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C throw expression.
+ */
+deprecated class ObjcThrowExpr extends ThrowExpr {
+ ObjcThrowExpr() { none() }
+
+ override string toString() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C throw expression with no argument (which causes the
+ * current exception to be re-thrown).
+ */
+deprecated class ObjcReThrowExpr extends ReThrowExpr, ObjcThrowExpr {
+ ObjcReThrowExpr() { none() }
+
+ override string toString() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C @ expression which boxes a single value, such as @(22).
+ */
+deprecated class AtExpr extends UnaryOperation {
+ AtExpr() { none() }
+
+ override string toString() { none() }
+
+ override string getOperator() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C @[...] literal.
+ */
+deprecated class ArrayLiteral extends Expr {
+ ArrayLiteral() { none() }
+
+ /** Gets a textual representation of this array literal. */
+ override string toString() { none() }
+
+ /** An element of the array */
+ Expr getElement(int i) { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C @{...} literal.
+ */
+deprecated class DictionaryLiteral extends Expr {
+ DictionaryLiteral() { none() }
+
+ /** Gets a textual representation of this dictionary literal. */
+ override string toString() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C @"..." string literal.
+ */
+deprecated class ObjCLiteralString extends TextLiteral {
+ ObjCLiteralString() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C/C++ overloaded subscripting access expression.
+ *
+ * Either
+ * obj[idx]
+ * or
+ * obj[idx] = expr
+ */
+deprecated class SubscriptExpr extends Expr {
+ SubscriptExpr() { none() }
+
+ /**
+ * Gets the object expression being subscripted.
+ */
+ Expr getSubscriptBase() { none() }
+
+ /**
+ * Gets the expression giving the index into the object.
+ */
+ Expr getSubscriptIndex() { none() }
+
+ /**
+ * Gets the expression being assigned (if this is an assignment).
+ */
+ Expr getAssignedExpr() { none() }
+
+ override string toString() { none() }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * An Objective C _cmd expression.
+ */
+deprecated class CmdExpr extends Expr {
+ CmdExpr() { none() }
+
+ override string toString() { none() }
+
+ override predicate mayBeImpure() {
+ none()
+ }
+ override predicate mayBeGloballyImpure() {
+ none()
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/headers/MultipleInclusion.qll b/cpp/ql/src/semmle/code/cpp/headers/MultipleInclusion.qll
new file mode 100644
index 000000000000..d259d1ef8059
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/headers/MultipleInclusion.qll
@@ -0,0 +1,176 @@
+/**
+ * Provides definitions related to _include guards_: techniques for preventing
+ * multiple inclusion of header files.
+ */
+
+import cpp
+
+/**
+ * A header file with an include guard.
+ */
+abstract class IncludeGuardedHeader extends HeaderFile {
+
+}
+
+/**
+ * A header file that uses a non-portable mechanism to prevent multiple
+ * inclusion.
+ */
+abstract class BadIncludeGuard extends IncludeGuardedHeader {
+
+ /** Gets the element to blame for this bad include guard pattern. */
+ abstract Element blame();
+
+}
+
+/**
+ * A header file with the correct include guard: `#ifndef` (or equivalent),
+ * `#define`, and `#endif`.
+ */
+class CorrectIncludeGuard extends IncludeGuardedHeader {
+
+ CorrectIncludeGuard() { correctIncludeGuard(this,_,_,_,_) }
+
+ /** Gets the name of the preprocessor define used to prevent multiple inclusion of this file. */
+ string getIncludeGuardName() { correctIncludeGuard(this, _, _, _, result) }
+
+ /** Gets the preprocessor macro used to prevent multiple inclusion of this file. */
+ Macro getDefine() { correctIncludeGuard(this, _, result, _, _) }
+
+ /** Gets the `#ifndef` or `#if` directive used to prevent multiple inclusion of this file. */
+ PreprocessorDirective getIfndef() { correctIncludeGuard(this, result, _, _, _) }
+
+ /** Gets the `#endif` directive closing this file. */
+ PreprocessorEndif getEndif() { correctIncludeGuard(this, _, _, result, _) }
+
+}
+
+/**
+ * DEPRECATED: no longer useful.
+ */
+deprecated
+class NotIncludedGuard extends IncludeGuardedHeader {
+ NotIncludedGuard() {
+ none()
+ }
+
+ /** Gets the `#ifndef` directive used to prevent multiple inclusion of this file. */
+ PreprocessorIfndef getIfndef() { result.getFile() = this }
+
+ /** Gets the `#endif` directive closing this file. */
+ PreprocessorEndif getEndif() { result.getFile() = this }
+}
+
+/**
+ * A file with no code in it.
+ */
+class EmptyFile extends IncludeGuardedHeader {
+ EmptyFile() {
+ this.(MetricFile).getNumberOfLinesOfCode() = 0
+ }
+}
+
+private predicate hasMacro(HeaderFile hf, string name, Macro define) {
+ define.getFile() = hf and define.getName() = name
+}
+
+/**
+ * Holds if `hf` begins with an `#ifndef` or `#if` directive `ifndef`, to test
+ * the macro named `includeGuard`, and ends with the matching `endif`.
+ */
+predicate hasIncludeGuard(HeaderFile hf, PreprocessorDirective ifndef, PreprocessorEndif endif, string includeGuard) {
+ startsWithIfndef(hf, ifndef, includeGuard) and
+ endsWithEndif(hf, endif) and
+ endif.getIf() = ifndef
+}
+
+/**
+ * Holds if `hf` uses a valid include guard with the macro named `includeGuard`
+ * and the preprocessor directives `ifndef`, `define`, and `endif`. This
+ * analysis is also exposed in an object-oriented style through the class
+ * `CorrectIncludeGuard`.
+ */
+pragma[noopt] predicate correctIncludeGuard(HeaderFile hf, PreprocessorDirective ifndef, Macro define, PreprocessorEndif endif, string includeGuard) {
+ hasIncludeGuard(hf, ifndef, endif, includeGuard) and
+ hasMacro(hf, includeGuard, define) and
+ // we already know the ifndef is first and the endif last, so we just need
+ // to check there is nothing before the define that isn't the ifndef.
+ not exists(int relevant,
+ Location ifndefLocation, int ifndefLine,
+ Location defineLocation, int defineLine |
+ includeGuardRelevantLine(hf, relevant) and
+ ifndefLocation = ifndef.getLocation() and
+ ifndefLine = ifndefLocation.getStartLine() and
+ relevant != ifndefLine and
+ defineLocation = define.getLocation() and
+ defineLine = defineLocation.getStartLine() and
+ relevant < defineLine
+ )
+}
+
+/**
+ * Holds if `hf` begins with an `#ifndef` or `#if` directive `ifndef`, to test
+ * the macro named `macroName`.
+ */
+predicate startsWithIfndef(HeaderFile hf, PreprocessorDirective ifndef, string macroName) {
+ ifndefDirective(ifndef, macroName) and
+ ifndef.getFile() = hf and
+ ifndef.getLocation().getStartLine() = min(int l | includeGuardRelevantLine(hf, l))
+}
+
+private predicate endifLocation(PreprocessorEndif endif, File f, int line) {
+ endif.getFile() = f and
+ endif.getLocation().getStartLine() = line
+}
+
+private predicate lastEndifLocation(PreprocessorEndif endif, File f, int line) {
+ endifLocation(endif, f, line) and
+ line = max(int line2 | endifLocation(_, f, line2))
+}
+
+/**
+ * Holds if `hf` ends with `endif`.
+ */
+predicate endsWithEndif(HeaderFile hf, PreprocessorEndif endif) {
+ exists(int line | lastEndifLocation(endif, hf, line) |
+ line = max(int l | includeGuardRelevantLine(hf, l) | l)
+ )
+}
+
+private predicate includeGuardRelevantLine(HeaderFile hf, int line) {
+ exists(Location l | l.getFile() = hf and line = l.getStartLine() |
+ // any declaration
+ exists(Declaration d | l = d.getADeclarationLocation()) or
+
+ // most preprocessor directives
+ exists(PreprocessorDirective p |
+ l = p.getLocation() and
+
+ // included files may be outside the include guards, as they
+ // should contain an include guarding mechanism of their own.
+ not p instanceof Include
+ )
+ )
+}
+
+/**
+ * Holds if `ppd` is effectively an `#ifndef` directive that tests `macro`.
+ * This includes `#if !defined(macro)`.
+ */
+predicate ifndefDirective(PreprocessorDirective ppd, string macro) {
+ (ppd instanceof PreprocessorIfndef and macro = ppd.getHead())
+ or
+ (ppd instanceof PreprocessorIf and
+ exists(string head | head = ppd.getHead() |
+ macro = head.replaceAll("(", " ").replaceAll(")", "").replaceAll("\t", " ").regexpCapture("[ ]*![ ]*defined[ ]+([^ ]*)[ ]*", 1).trim()
+ ))
+}
+
+/**
+ * A header file with the `#pragma once` include guard.
+ */
+class PragmaOnceIncludeGuard extends BadIncludeGuard {
+ PragmaOnceIncludeGuard() { exists(PreprocessorPragma p | p.getFile() = this and p.getHead() = "once") }
+
+ override Element blame() { exists(PreprocessorPragma p | p.getFile() = this and p = result and p.getHead() = "once") }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/internal/Type.qll b/cpp/ql/src/semmle/code/cpp/internal/Type.qll
new file mode 100644
index 000000000000..35d6cec58e51
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/internal/Type.qll
@@ -0,0 +1,64 @@
+import semmle.code.cpp.Type
+
+/** Holds if `d` is a complete class named `name`. */
+pragma[noinline]
+private predicate existsCompleteWithName(string name, @usertype d) {
+ isClass(d) and
+ is_complete(d) and
+ usertypes(d, name, _)
+}
+
+/** Holds if `c` is an incomplete class named `name`. */
+pragma[noinline]
+private predicate existsIncompleteWithName(string name, @usertype c) {
+ isClass(c) and
+ not is_complete(c) and
+ usertypes(c, name, _)
+}
+
+/**
+ * Holds if `c` is an imcomplete class, and there exists a complete class `d`
+ * with the same name.
+ */
+private predicate hasCompleteTwin(@usertype c, @usertype d) {
+ exists(string name |
+ existsIncompleteWithName(name, c) and
+ existsCompleteWithName(name, d)
+ )
+}
+
+import Cached
+cached private module Cached {
+ /**
+ * If `c` is incomplete, and there exists a complete class with the same name,
+ * then the result is that complete class. Otherwise, the result is `c`. If
+ * multiple complete classes have the same name, this predicate may have
+ * multiple results.
+ */
+ cached @usertype resolve(@usertype c) {
+ hasCompleteTwin(c, result)
+ or
+ (not hasCompleteTwin(c, _) and result = c)
+ }
+
+ /**
+ * Gets a type from the database for which `t` is a complete definition.
+ */
+ cached @type unresolve(Type t) {
+ if isClass(t)
+ then resolve(result) = t
+ else result = t
+ }
+
+ /**
+ * Holds if `t` is a struct, class, union, or template.
+ */
+ cached predicate isClass(@usertype t) {
+ (usertypes(t,_,1) or usertypes(t,_,2) or usertypes(t,_,3) or usertypes(t,_,6)
+ or usertypes(t,_,10) or usertypes(t,_,11) or usertypes(t,_,12))
+ }
+
+ cached predicate isElement(@element e) {
+ isClass(e) implies e = resolve(_)
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ir/EdgeKind.qll b/cpp/ql/src/semmle/code/cpp/ir/EdgeKind.qll
new file mode 100644
index 000000000000..172a879c6642
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/EdgeKind.qll
@@ -0,0 +1,141 @@
+import cpp
+
+private newtype TEdgeKind =
+ TGotoEdge() or // Single successor (including fall-through)
+ TTrueEdge() or // 'true' edge of conditional branch
+ TFalseEdge() or // 'false' edge of conditional branch
+ TExceptionEdge() or // Thrown exception
+ TDefaultEdge() or // 'default' label of switch
+ TCaseEdge(string minValue, string maxValue) { // Case label of switch
+ exists(SwitchCase switchCase |
+ hasCaseEdge(switchCase, minValue, maxValue)
+ )
+ }
+
+/**
+ * Represents the kind of an edge in the IR control flow graph. Each
+ * `Instruction` or `IRBlock` has at most one successor of any single
+ * `EdgeKind`.
+ */
+abstract class EdgeKind extends TEdgeKind {
+ abstract string toString();
+}
+
+/**
+ * A "goto" edge, representing the unconditional successor of an `Instruction`
+ * or `IRBlock`.
+ */
+class GotoEdge extends EdgeKind, TGotoEdge {
+ override final string toString() {
+ result = "Goto"
+ }
+}
+
+GotoEdge gotoEdge() {
+ result = TGotoEdge()
+}
+
+/**
+ * A "true" edge, representing the successor of a conditional branch when the
+ * condition is non-zero.
+ */
+class TrueEdge extends EdgeKind, TTrueEdge {
+ override final string toString() {
+ result = "True"
+ }
+}
+
+TrueEdge trueEdge() {
+ result = TTrueEdge()
+}
+
+/**
+ * A "false" edge, representing the successor of a conditional branch when the
+ * condition is zero.
+ */
+class FalseEdge extends EdgeKind, TFalseEdge {
+ override final string toString() {
+ result = "False"
+ }
+}
+
+FalseEdge falseEdge() {
+ result = TFalseEdge()
+}
+
+/**
+ * An "exception" edge, representing the successor of an instruction when that
+ * instruction's evaluation throws an exception.
+ */
+class ExceptionEdge extends EdgeKind, TExceptionEdge {
+ override final string toString() {
+ result = "Exception"
+ }
+}
+
+ExceptionEdge exceptionEdge() {
+ result = TExceptionEdge()
+}
+
+/**
+ * A "default" edge, representing the successor of a `Switch` instruction when
+ * none of the case values matches the condition value.
+ */
+class DefaultEdge extends EdgeKind, TDefaultEdge {
+ override final string toString() {
+ result = "Default"
+ }
+}
+
+DefaultEdge defaultEdge() {
+ result = TDefaultEdge()
+}
+
+/**
+ * A "case" edge, representing the successor of a `Switch` instruction when the
+ * the condition value matches a correponding `case` label.
+ */
+class CaseEdge extends EdgeKind, TCaseEdge {
+ string minValue;
+ string maxValue;
+
+ CaseEdge() {
+ this = TCaseEdge(minValue, maxValue)
+ }
+
+ override final string toString() {
+ if minValue = maxValue then
+ result = "Case[" + minValue + "]"
+ else
+ result = "Case[" + minValue + ".." + maxValue + "]"
+ }
+
+ string getMinValue() {
+ result = minValue
+ }
+
+ string getMaxValue() {
+ result = maxValue
+ }
+}
+
+CaseEdge caseEdge(string minValue, string maxValue) {
+ result = TCaseEdge(minValue, maxValue)
+}
+
+private predicate hasCaseEdge(SwitchCase switchCase, string minValue,
+ string maxValue) {
+ minValue = switchCase.getExpr().getFullyConverted().getValue() and
+ if exists(switchCase.getEndExpr()) then
+ maxValue = switchCase.getEndExpr().getFullyConverted().getValue()
+ else
+ maxValue = minValue
+}
+
+EdgeKind getCaseEdge(SwitchCase switchCase) {
+ exists(CaseEdge edge |
+ result = edge and
+ hasCaseEdge(switchCase, edge.getMinValue(), edge.getMaxValue())
+ ) or
+ (switchCase instanceof DefaultCase and result instanceof DefaultEdge)
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ir/IR.qll b/cpp/ql/src/semmle/code/cpp/ir/IR.qll
new file mode 100644
index 000000000000..07c19ae8fbad
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/IR.qll
@@ -0,0 +1 @@
+import internal.IRImpl
diff --git a/cpp/ql/src/semmle/code/cpp/ir/IRSanity.ql b/cpp/ql/src/semmle/code/cpp/ir/IRSanity.ql
new file mode 100644
index 000000000000..151470849fdb
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/IRSanity.ql
@@ -0,0 +1,8 @@
+/**
+ * @name IR Sanity Check
+ * @description Performs sanity checks on the Intermediate Representation. This query should have no results.
+ * @kind problem
+ * @id cpp/ir-sanity-check
+ */
+
+import internal.IRSanityImpl
diff --git a/cpp/ql/src/semmle/code/cpp/ir/MemoryAccessKind.qll b/cpp/ql/src/semmle/code/cpp/ir/MemoryAccessKind.qll
new file mode 100644
index 000000000000..a71da214a7c7
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/MemoryAccessKind.qll
@@ -0,0 +1,54 @@
+import cpp
+
+newtype TMemoryAccessKind =
+ TIndirectMemoryAccess() or
+ TEscapedMemoryAccess() or
+ TPhiMemoryAccess() or
+ TUnmodeledMemoryAccess()
+
+/**
+ * Describes the set of memory locations memory accessed by a memory operand or
+ * memory result.
+ */
+class MemoryAccessKind extends TMemoryAccessKind {
+ abstract string toString();
+}
+
+/**
+ * The operand or result accesses memory at the address specified by the
+ * `LoadStoreAddressOperand` on the same instruction.
+ */
+class IndirectMemoryAccess extends MemoryAccessKind, TIndirectMemoryAccess {
+ override string toString() {
+ result = "indirect"
+ }
+}
+
+/**
+ * The operand or result accesses all memory whose address has escaped.
+ */
+class EscapedMemoryAccess extends MemoryAccessKind, TEscapedMemoryAccess {
+ override string toString() {
+ result = "escaped"
+ }
+}
+
+/**
+ * The operand is a Phi operand, which accesses the same memory as its
+ * definition.
+ */
+class PhiMemoryAccess extends MemoryAccessKind, TPhiMemoryAccess {
+ override string toString() {
+ result = "phi"
+ }
+}
+
+/**
+ * The operand accesses memory not modeled in SSA. Used only on the result of
+ * `UnmodeledDefinition` and on the operands of `UnmodeledUse`.
+ */
+class UnmodeledMemoryAccess extends MemoryAccessKind, TUnmodeledMemoryAccess {
+ override string toString() {
+ result = "unmodeled"
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ir/Opcode.qll b/cpp/ql/src/semmle/code/cpp/ir/Opcode.qll
new file mode 100644
index 000000000000..4104c6a104ec
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/Opcode.qll
@@ -0,0 +1 @@
+import internal.Opcode
diff --git a/cpp/ql/src/semmle/code/cpp/ir/PrintIR.qll b/cpp/ql/src/semmle/code/cpp/ir/PrintIR.qll
new file mode 100644
index 000000000000..2a8ffdf61693
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/PrintIR.qll
@@ -0,0 +1 @@
+import internal.PrintIRImpl
diff --git a/cpp/ql/src/semmle/code/cpp/ir/TempVariableTag.qll b/cpp/ql/src/semmle/code/cpp/ir/TempVariableTag.qll
new file mode 100644
index 000000000000..b19d20503c85
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/TempVariableTag.qll
@@ -0,0 +1,8 @@
+import cpp
+private import internal.TempVariableTag
+
+class TempVariableTag extends TTempVariableTag {
+ string toString() {
+ result = "Tag"
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ir/ValueCategory.qll b/cpp/ql/src/semmle/code/cpp/ir/ValueCategory.qll
new file mode 100644
index 000000000000..02f3883a8105
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/ValueCategory.qll
@@ -0,0 +1,44 @@
+import cpp
+
+private newtype TValueCategory =
+ TLValue() or
+ TXValue() or
+ TPRValue()
+
+abstract class ValueCategory extends TValueCategory {
+ abstract string toString();
+}
+
+abstract class GLValue extends ValueCategory {
+}
+
+abstract class RValue extends ValueCategory {
+}
+
+class LValue extends GLValue, TLValue {
+ override string toString() {
+ result = "lvalue"
+ }
+}
+
+class XValue extends GLValue, RValue, TXValue {
+ override string toString() {
+ result = "xvalue"
+ }
+}
+
+class PRValue extends RValue, TPRValue {
+ override string toString() {
+ result = "prvalue"
+ }
+}
+
+ValueCategory getExprValueCategory(Expr expr) {
+ (
+ expr.isLValueCategory() and result instanceof LValue
+ ) or (
+ expr.isXValueCategory() and result instanceof XValue
+ ) or (
+ expr.isPRValueCategory() and result instanceof PRValue
+ )
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ir/internal/FunctionIR.qll b/cpp/ql/src/semmle/code/cpp/ir/internal/FunctionIR.qll
new file mode 100644
index 000000000000..ba8f524f202f
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/internal/FunctionIR.qll
@@ -0,0 +1,91 @@
+private import IRInternal
+import Instruction
+import cpp
+
+private newtype TFunctionIR =
+ MkFunctionIR(Function func) {
+ Construction::functionHasIR(func)
+ }
+
+/**
+ * Represents the IR for a function.
+ */
+class FunctionIR extends TFunctionIR {
+ Function func;
+
+ FunctionIR() {
+ this = MkFunctionIR(func)
+ }
+
+ final string toString() {
+ result = "IR: " + func.toString()
+ }
+
+ /**
+ * Gets the function whose IR is represented.
+ */
+ final Function getFunction() {
+ result = func
+ }
+
+ /**
+ * Gets the location of the function.
+ */
+ final Location getLocation() {
+ result = func.getLocation()
+ }
+
+ /**
+ * Gets the entry point for this function.
+ */
+ final EnterFunctionInstruction getEnterFunctionInstruction() {
+ result.getFunctionIR() = this
+ }
+
+ /**
+ * Gets the exit point for this function.
+ */
+ final ExitFunctionInstruction getExitFunctionInstruction() {
+ result.getFunctionIR() = this
+ }
+
+ final UnmodeledDefinitionInstruction getUnmodeledDefinitionInstruction() {
+ result.getFunctionIR() = this
+ }
+
+ /**
+ * Gets the single return instruction for this function.
+ */
+ final ReturnInstruction getReturnInstruction() {
+ result.getFunctionIR() = this
+ }
+
+ /**
+ * Gets the variable used to hold the return value of this function. If this
+ * function does not return a value, this predicate does not hold.
+ */
+ final IRReturnVariable getReturnVariable() {
+ result.getFunctionIR() = this
+ }
+
+ /**
+ * Gets the block containing the entry point of this function.
+ */
+ final IRBlock getEntryBlock() {
+ result.getFirstInstruction() = getEnterFunctionInstruction()
+ }
+
+ /**
+ * Gets all instructions in this function.
+ */
+ final Instruction getAnInstruction() {
+ result.getFunctionIR() = this
+ }
+
+ /**
+ * Gets all blocks in this function.
+ */
+ final IRBlock getABlock() {
+ result.getFunctionIR() = this
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ir/internal/IRBlock.qll b/cpp/ql/src/semmle/code/cpp/ir/internal/IRBlock.qll
new file mode 100644
index 000000000000..98ec650036db
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/internal/IRBlock.qll
@@ -0,0 +1,131 @@
+private import IRInternal
+import Instruction
+import cpp
+import semmle.code.cpp.ir.EdgeKind
+
+private predicate startsBasicBlock(Instruction instr) {
+ not instr instanceof PhiInstruction and
+ (
+ count(Instruction predecessor |
+ instr = predecessor.getASuccessor()
+ ) != 1 or // Multiple predecessors or no predecessor
+ exists(Instruction predecessor |
+ instr = predecessor.getASuccessor() and
+ strictcount(Instruction other |
+ other = predecessor.getASuccessor()
+ ) > 1
+ ) or // Predecessor has multiple successors
+ exists(Instruction predecessor, EdgeKind kind |
+ instr = predecessor.getSuccessor(kind) and
+ not kind instanceof GotoEdge
+ ) // Incoming edge is not a GotoEdge
+ )
+}
+
+private newtype TIRBlock =
+ MkIRBlock(Instruction firstInstr) {
+ startsBasicBlock(firstInstr)
+ }
+
+cached private predicate isEntryBlock(IRBlock block) {
+ block.getFirstInstruction() instanceof EnterFunctionInstruction
+}
+
+cached private predicate blockSuccessor(IRBlock pred, IRBlock succ) {
+ succ = pred.getASuccessor()
+}
+
+private predicate blockImmediatelyDominates(IRBlock dominator, IRBlock block) =
+ idominance(isEntryBlock/1, blockSuccessor/2)(_, dominator, block)
+
+class IRBlock extends TIRBlock {
+ Instruction firstInstr;
+
+ IRBlock() {
+ this = MkIRBlock(firstInstr)
+ }
+
+ final string toString() {
+ result = firstInstr.toString()
+ }
+
+ final Location getLocation() {
+ result = getFirstInstruction().getLocation()
+ }
+
+ final string getUniqueId() {
+ result = firstInstr.getUniqueId()
+ }
+
+ final cached Instruction getInstruction(int index) {
+ index = 0 and result = firstInstr or
+ (
+ index > 0 and
+ not startsBasicBlock(result) and
+ exists(Instruction predecessor, GotoEdge edge |
+ predecessor = getInstruction(index - 1) and
+ result = predecessor.getSuccessor(edge)
+ )
+ )
+ }
+
+ final PhiInstruction getAPhiInstruction() {
+ Construction::getPhiInstructionBlockStart(result) =
+ getFirstInstruction()
+ }
+
+ final Instruction getAnInstruction() {
+ result = getInstruction(_) or
+ result = getAPhiInstruction()
+ }
+
+ final Instruction getFirstInstruction() {
+ result = firstInstr
+ }
+
+ final Instruction getLastInstruction() {
+ result = getInstruction(getInstructionCount() - 1)
+ }
+
+ final int getInstructionCount() {
+ result = strictcount(getInstruction(_))
+ }
+
+ final FunctionIR getFunctionIR() {
+ result = firstInstr.getFunctionIR()
+ }
+
+ final Function getFunction() {
+ result = firstInstr.getFunction()
+ }
+
+ final IRBlock getASuccessor() {
+ result.getFirstInstruction() = getLastInstruction().getASuccessor()
+ }
+
+ final IRBlock getAPredecessor() {
+ firstInstr = result.getLastInstruction().getASuccessor()
+ }
+
+ final IRBlock getSuccessor(EdgeKind kind) {
+ result.getFirstInstruction() = getLastInstruction().getSuccessor(kind)
+ }
+
+ final predicate immediatelyDominates(IRBlock block) {
+ blockImmediatelyDominates(this, block)
+ }
+
+ final predicate strictlyDominates(IRBlock block) {
+ blockImmediatelyDominates+(this, block)
+ }
+
+ final predicate dominates(IRBlock block) {
+ strictlyDominates(block) or this = block
+ }
+
+ pragma[noinline]
+ final IRBlock dominanceFrontier() {
+ dominates(result.getAPredecessor()) and
+ not strictlyDominates(result)
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ir/internal/IRConstruction.qll b/cpp/ql/src/semmle/code/cpp/ir/internal/IRConstruction.qll
new file mode 100644
index 000000000000..9f0b7e5b1015
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/internal/IRConstruction.qll
@@ -0,0 +1,166 @@
+import cpp
+import semmle.code.cpp.ir.IR
+private import InstructionTag
+private import Opcode
+private import TempVariableTag
+private import TranslatedElement
+private import TranslatedFunction
+
+class InstructionTagType extends TInstructionTag {
+ final string toString() {
+ result = "Tag"
+ }
+}
+
+private TranslatedElement getInstructionTranslatedElement(
+ Instruction instruction) {
+ result = getInstructionTranslatedElementAndTag(instruction, _)
+}
+
+private TranslatedElement getInstructionTranslatedElementAndTag(
+ Instruction instruction, InstructionTag tag) {
+ result.getAST() = instruction.getAST() and
+ tag = instruction.getTag() and
+ result.hasInstruction(_, tag, _, _)
+}
+
+private TranslatedElement getTempVariableTranslatedElement(
+ IRTempVariable var) {
+ result.getAST() = var.getAST() and
+ result.hasTempVariable(var.getTag(), _)
+}
+
+import Cached
+cached private module Cached {
+ cached predicate functionHasIR(Function func) {
+ exists(getTranslatedFunction(func))
+ }
+
+ cached int getMaxCallArgIndex() {
+ result = max(int argIndex |
+ exists(FunctionCall call |
+ exists(call.getArgument(argIndex))
+ )
+ )
+ }
+
+ cached newtype TInstruction =
+ MkInstruction(FunctionIR funcIR, Opcode opcode, Locatable ast,
+ InstructionTag tag, Type resultType, boolean isGLValue) {
+ hasInstruction(funcIR.getFunction(), opcode, ast, tag,
+ resultType, isGLValue)
+ }
+
+ private predicate hasInstruction(Function func, Opcode opcode, Locatable ast,
+ InstructionTag tag, Type resultType, boolean isGLValue) {
+ exists(TranslatedElement element |
+ element.getAST() = ast and
+ func = element.getFunction() and
+ element.hasInstruction(opcode, tag, resultType, isGLValue)
+ )
+ }
+
+ cached predicate hasTempVariable(Function func, Locatable ast, TempVariableTag tag,
+ Type type) {
+ exists(TranslatedElement element |
+ element.getAST() = ast and
+ func = element.getFunction() and
+ element.hasTempVariable(tag, type)
+ )
+ }
+
+ cached predicate hasModeledMemoryResult(Instruction instruction) {
+ none()
+ }
+
+ cached Instruction getInstructionOperand(Instruction instruction, OperandTag tag) {
+ result = getInstructionTranslatedElement(instruction).getInstructionOperand(
+ instruction.getTag(), tag)
+ }
+
+ cached Instruction getPhiInstructionBlockStart(PhiInstruction instr) {
+ none()
+ }
+
+ cached Instruction getInstructionSuccessor(Instruction instruction, EdgeKind kind) {
+ result = getInstructionTranslatedElement(instruction).getInstructionSuccessor(
+ instruction.getTag(), kind)
+ }
+
+ cached IRVariable getInstructionVariable(Instruction instruction) {
+ result = getInstructionTranslatedElement(instruction).getInstructionVariable(
+ instruction.getTag())
+ }
+
+ cached Field getInstructionField(Instruction instruction) {
+ exists(TranslatedElement element, InstructionTag tag |
+ instructionOrigin(instruction, element, tag) and
+ result = element.getInstructionField(tag)
+ )
+ }
+
+ cached Function getInstructionFunction(Instruction instruction) {
+ exists(InstructionTag tag |
+ result = getInstructionTranslatedElementAndTag(instruction, tag)
+ .getInstructionFunction(tag)
+ )
+ }
+
+ cached string getInstructionConstantValue(Instruction instruction) {
+ result =
+ getInstructionTranslatedElement(instruction).getInstructionConstantValue(
+ instruction.getTag())
+ }
+
+ cached StringLiteral getInstructionStringLiteral(Instruction instruction) {
+ result =
+ getInstructionTranslatedElement(instruction).getInstructionStringLiteral(
+ instruction.getTag())
+ }
+
+ cached Type getInstructionExceptionType(Instruction instruction) {
+ result =
+ getInstructionTranslatedElement(instruction).getInstructionExceptionType(
+ instruction.getTag())
+ }
+
+ cached predicate getInstructionInheritance(Instruction instruction,
+ Class baseClass, Class derivedClass) {
+ getInstructionTranslatedElement(instruction).getInstructionInheritance(
+ instruction.getTag(), baseClass, derivedClass)
+ }
+
+ pragma[noinline]
+ private predicate instructionOrigin(Instruction instruction,
+ TranslatedElement element, InstructionTag tag) {
+ element = getInstructionTranslatedElement(instruction) and
+ tag = instruction.getTag()
+ }
+
+ cached int getInstructionElementSize(Instruction instruction) {
+ exists(TranslatedElement element, InstructionTag tag |
+ instructionOrigin(instruction, element, tag) and
+ result = element.getInstructionElementSize(tag)
+ )
+ }
+
+ cached int getInstructionResultSize(Instruction instruction) {
+ exists(TranslatedElement element, InstructionTag tag |
+ instructionOrigin(instruction, element, tag) and
+ result = element.getInstructionResultSize(tag)
+ )
+ }
+}
+
+import CachedForDebugging
+cached private module CachedForDebugging {
+ cached string getTempVariableUniqueId(IRTempVariable var) {
+ result = getTempVariableTranslatedElement(var).getId() + ":" +
+ getTempVariableTagId(var.getTag())
+ }
+
+ cached string getInstructionUniqueId(Instruction instruction) {
+ result = getInstructionTranslatedElement(instruction).getId() + ":" +
+ getInstructionTagId(instruction.getTag())
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ir/internal/IRImpl.qll b/cpp/ql/src/semmle/code/cpp/ir/internal/IRImpl.qll
new file mode 100644
index 000000000000..97c027cc1280
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/internal/IRImpl.qll
@@ -0,0 +1,7 @@
+import FunctionIR
+import Instruction
+import IRBlock
+import IRVariable
+import OperandTag
+import semmle.code.cpp.ir.EdgeKind
+import semmle.code.cpp.ir.MemoryAccessKind
diff --git a/cpp/ql/src/semmle/code/cpp/ir/internal/IRInternal.qll b/cpp/ql/src/semmle/code/cpp/ir/internal/IRInternal.qll
new file mode 100644
index 000000000000..79a47b0f8079
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/internal/IRInternal.qll
@@ -0,0 +1 @@
+import IRConstruction as Construction
diff --git a/cpp/ql/src/semmle/code/cpp/ir/internal/IRSanityImpl.qll b/cpp/ql/src/semmle/code/cpp/ir/internal/IRSanityImpl.qll
new file mode 100644
index 000000000000..744b28704604
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/internal/IRSanityImpl.qll
@@ -0,0 +1,3 @@
+private import IRImpl
+import InstructionSanity
+
diff --git a/cpp/ql/src/semmle/code/cpp/ir/internal/IRVariable.qll b/cpp/ql/src/semmle/code/cpp/ir/internal/IRVariable.qll
new file mode 100644
index 000000000000..a903e227b26c
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/internal/IRVariable.qll
@@ -0,0 +1,202 @@
+private import IRInternal
+import FunctionIR
+import cpp
+import semmle.code.cpp.ir.TempVariableTag
+private import semmle.code.cpp.ir.internal.TempVariableTag
+
+private newtype TIRVariable =
+ TIRAutomaticUserVariable(LocalScopeVariable var, FunctionIR funcIR) {
+ exists(Function func |
+ func = funcIR.getFunction() and
+ (
+ var.getFunction() = func or
+ var.(Parameter).getCatchBlock().getEnclosingFunction() = func
+ )
+ )
+ } or
+ TIRStaticUserVariable(Variable var, FunctionIR funcIR) {
+ (
+ var instanceof GlobalOrNamespaceVariable or
+ var instanceof MemberVariable and not var instanceof Field
+ ) and
+ exists(VariableAccess access |
+ access.getTarget() = var and
+ access.getEnclosingFunction() = funcIR.getFunction()
+ )
+ } or
+ TIRTempVariable(FunctionIR funcIR, Locatable ast, TempVariableTag tag,
+ Type type) {
+ Construction::hasTempVariable(funcIR.getFunction(), ast, tag, type)
+ }
+
+IRUserVariable getIRUserVariable(Function func, Variable var) {
+ result.getVariable() = var and
+ result.getFunction() = func
+}
+
+/**
+ * Represents a variable referenced by the IR for a function. The variable may
+ * be a user-declared variable (`IRUserVariable`) or a temporary variable
+ * generated by the AST-to-IR translation (`IRTempVariable`).
+ */
+abstract class IRVariable extends TIRVariable {
+ FunctionIR funcIR;
+
+ abstract string toString();
+
+ /**
+ * Gets the type of the variable.
+ */
+ abstract Type getType();
+
+ /**
+ * Gets the AST node that declared this variable, or that introduced this
+ * variable as part of the AST-to-IR translation.
+ */
+ abstract Locatable getAST();
+
+ /**
+ * Gets an identifier string for the variable. This identifier is unique
+ * within the function.
+ */
+ abstract string getUniqueId();
+
+ /**
+ * Gets the source location of this variable.
+ */
+ final Location getLocation() {
+ result = getAST().getLocation()
+ }
+
+ /**
+ * Gets the IR for the function that references this variable.
+ */
+ final FunctionIR getFunctionIR() {
+ result = funcIR
+ }
+
+ /**
+ * Gets the function that references this variable.
+ */
+ final Function getFunction() {
+ result = funcIR.getFunction()
+ }
+}
+
+/**
+ * Represents a user-declared variable referenced by the IR for a function.
+ */
+abstract class IRUserVariable extends IRVariable {
+ Variable var;
+
+ override final string toString() {
+ result = var.toString()
+ }
+
+ override final Type getType() {
+ result = var.getType().getUnspecifiedType()
+ }
+
+ override final Locatable getAST() {
+ result = var
+ }
+
+ override final string getUniqueId() {
+ result = var.toString() + " " + var.getLocation().toString()
+ }
+
+ /**
+ * Gets the original user-declared variable.
+ */
+ final Variable getVariable() {
+ result = var
+ }
+}
+
+/**
+ * Represents a variable (user-declared or temporary) that is allocated on the
+ * stack. This includes all parameters, non-static local variables, and
+ * temporary variables.
+ */
+abstract class IRAutomaticVariable extends IRVariable {
+}
+
+class IRAutomaticUserVariable extends IRUserVariable, IRAutomaticVariable,
+ TIRAutomaticUserVariable {
+ LocalScopeVariable localVar;
+
+ IRAutomaticUserVariable() {
+ this = TIRAutomaticUserVariable(localVar, funcIR) and
+ var = localVar
+ }
+
+ final LocalScopeVariable getLocalVariable() {
+ result = localVar
+ }
+}
+
+class IRStaticUserVariable extends IRUserVariable, TIRStaticUserVariable {
+ IRStaticUserVariable() {
+ this = TIRStaticUserVariable(var, funcIR)
+ }
+}
+
+IRTempVariable getIRTempVariable(Locatable ast, TempVariableTag tag) {
+ result.getAST() = ast and
+ result.getTag() = tag
+}
+
+class IRTempVariable extends IRVariable, IRAutomaticVariable, TIRTempVariable {
+ Locatable ast;
+ TempVariableTag tag;
+ Type type;
+
+ IRTempVariable() {
+ this = TIRTempVariable(funcIR, ast, tag, type)
+ }
+
+ override final Type getType() {
+ result = type
+ }
+
+ override final Locatable getAST() {
+ result = ast
+ }
+
+ override final string getUniqueId() {
+ result = "Temp: " + Construction::getTempVariableUniqueId(this)
+ }
+
+ final TempVariableTag getTag() {
+ result = tag
+ }
+
+ override string toString() {
+ result = getBaseString() + ast.getLocation().getStartLine().toString() + ":" +
+ ast.getLocation().getStartColumn().toString()
+ }
+
+ string getBaseString() {
+ result = "#temp"
+ }
+}
+
+class IRReturnVariable extends IRTempVariable {
+ IRReturnVariable() {
+ tag = ReturnValueTempVar()
+ }
+
+ override final string toString() {
+ result = "#return"
+ }
+}
+
+class IRThrowVariable extends IRTempVariable {
+ IRThrowVariable() {
+ tag = ThrowTempVar()
+ }
+
+ override string getBaseString() {
+ result = "#throw"
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ir/internal/Instruction.qll b/cpp/ql/src/semmle/code/cpp/ir/internal/Instruction.qll
new file mode 100644
index 000000000000..d00999f894aa
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/internal/Instruction.qll
@@ -0,0 +1,978 @@
+private import IRInternal
+import FunctionIR
+import IRBlock
+import IRVariable
+import OperandTag
+import cpp
+import semmle.code.cpp.ir.EdgeKind
+import semmle.code.cpp.ir.MemoryAccessKind
+import semmle.code.cpp.ir.Opcode
+private import semmle.code.cpp.ir.internal.Opcode
+
+class InstructionTag = Construction::InstructionTagType;
+
+module InstructionSanity {
+ /**
+ * Holds if the instruction `instr` should be expected to have an operand
+ * with operand tag `tag`. Only holds for singleton operand tags. Tags with
+ * parameters, such as `PhiOperand` and `PositionalArgumentOperand` are handled
+ * separately in `unexpectedOperand`.
+ */
+ private predicate expectsOperand(Instruction instr, OperandTag tag) {
+ exists(Opcode opcode |
+ opcode = instr.getOpcode() and
+ (
+ opcode instanceof UnaryOpcode and tag instanceof UnaryOperand or
+ (
+ opcode instanceof BinaryOpcode and
+ (
+ tag instanceof LeftOperand or
+ tag instanceof RightOperand
+ )
+ ) or
+ opcode instanceof CopyOpcode and tag instanceof CopySourceOperand or
+ opcode instanceof MemoryAccessOpcode and tag instanceof LoadStoreAddressOperand or
+ opcode instanceof OpcodeWithCondition and tag instanceof ConditionOperand or
+ opcode instanceof Opcode::ReturnValue and tag instanceof ReturnValueOperand or
+ opcode instanceof Opcode::ThrowValue and tag instanceof ExceptionOperand or
+ opcode instanceof Opcode::UnmodeledUse and tag instanceof UnmodeledUseOperand or
+ opcode instanceof Opcode::Invoke and tag instanceof CallTargetOperand
+ )
+ )
+ }
+
+ /**
+ * Holds if instruction `instr` is missing an expected operand with tag `tag`.
+ */
+ query predicate missingOperand(Instruction instr, OperandTag tag) {
+ expectsOperand(instr, tag) and not exists(instr.getOperand(tag))
+ }
+
+ /**
+ * Holds if instruction `instr` has an unexpected operand with tag `tag`.
+ */
+ query predicate unexpectedOperand(Instruction instr, OperandTag tag) {
+ exists(instr.getOperand(tag)) and
+ not expectsOperand(instr, tag) and
+ not (instr instanceof InvokeInstruction and tag instanceof ArgumentOperand) and
+ not (instr instanceof BuiltInInstruction and tag instanceof PositionalArgumentOperand) and
+ not (instr instanceof PhiInstruction and tag instanceof PhiOperand)
+ }
+
+ /**
+ * Holds if instruction `instr` has multiple operands with tag `tag`.
+ */
+ query predicate duplicateOperand(Instruction instr, OperandTag tag) {
+ count(instr.getOperand(tag)) > 1 and
+ not tag instanceof UnmodeledUseOperand
+ }
+}
+
+/**
+ * Represents a single operation in the IR.
+ */
+class Instruction extends Construction::TInstruction {
+ Opcode opcode;
+ Locatable ast;
+ InstructionTag instructionTag;
+ Type resultType;
+ FunctionIR funcIR;
+ boolean glvalue;
+
+ Instruction() {
+ this = Construction::MkInstruction(funcIR, opcode, ast, instructionTag, resultType, glvalue)
+ }
+
+ string toString() {
+ result = opcode.toString()
+ }
+
+ /**
+ * Gets a string identifier for this function that is unique among all
+ * instructions in the same function.
+ *
+ * This is used for sorting IR output for tests, and is likely to be
+ * inefficient for any other use.
+ */
+ final string getUniqueId() {
+ result = Construction::getInstructionUniqueId(this)
+ }
+
+ /**
+ * Gets the basic block that contains this instruction.
+ */
+ final IRBlock getBlock() {
+ result.getAnInstruction() = this
+ }
+
+ /**
+ * Gets the function that contains this instruction.
+ */
+ final Function getFunction() {
+ result = funcIR.getFunction()
+ }
+
+ /**
+ * Gets the FunctionIR object that contains the IR for this instruction.
+ */
+ final FunctionIR getFunctionIR() {
+ result = funcIR
+ }
+
+ /**
+ * Gets the AST that caused this instruction to be generated.
+ */
+ final Locatable getAST() {
+ result = ast
+ }
+
+ /**
+ * Gets the location of the source code for this instruction.
+ */
+ final Location getLocation() {
+ result = ast.getLocation()
+ }
+
+ /**
+ * Gets the type of the result produced by this instruction. If the
+ * instruction does not produce a result, its result type will be `VoidType`.
+ */
+ final Type getResultType() {
+ result = resultType
+ }
+
+ /**
+ * Holds if the result produced by this instruction is a glvalue. If this
+ * holds, the result of the instruction represents the address of a location,
+ * and the type of the location is given by `getResultType()`. If this does
+ * not hold, the result of the instruction represents a value whose type is
+ * given by `getResultType()`.
+ *
+ * For example, the statement `y = x;` generates the following IR:
+ * r1_0(glval: int) = VariableAddress[x]
+ * r1_1(int) = Load r1_0, mu0_1
+ * r1_2(glval: int) = VariableAddress[y]
+ * mu1_3(int) = Store r1_2, r1_1
+ *
+ * The result of each `VariableAddress` instruction is a glvalue of type
+ * `int`, representing the address of the corresponding integer variable. The
+ * result of the `Load` instruction is a prvalue of type `int`, representing
+ * the integer value loaded from variable `x`.
+ */
+ final predicate isGLValue() {
+ glvalue = true
+ }
+
+ /**
+ * Gets the size of the result produced by this instruction, in bytes. If the
+ * instruction does not produce a result, or if the result does not have a
+ * known constant size, this predicate does not hold.
+ *
+ * If `this.isGLValue()` holds for this instruction, the value of
+ * `getResultSize()` will always be the size of a pointer.
+ */
+ final int getResultSize() {
+ if isGLValue() then (
+ // a glvalue is always pointer-sized.
+ exists(NullPointerType nullptr |
+ result = nullptr.getSize()
+ )
+ )
+ else if resultType instanceof UnknownType then
+ result = Construction::getInstructionResultSize(this)
+ else (
+ not resultType instanceof VoidType and
+ result = resultType.getSize()
+ )
+ }
+
+ /**
+ * Gets the opcode that specifies the operation performed by this instruction.
+ */
+ final Opcode getOpcode() {
+ result = opcode
+ }
+
+ final InstructionTag getTag() {
+ result = instructionTag
+ }
+
+ /**
+ * Gets the instruction that produced the value of the specified source
+ * operand.
+ */
+ final Instruction getOperand(OperandTag tag) {
+ result = Construction::getInstructionOperand(this, tag)
+ }
+
+ /**
+ * Gets all instructions consumed by this instruction's operands.
+ */
+ final Instruction getAnOperand() {
+ result = getOperand(_)
+ }
+
+ /**
+ * Holds if this instruction has a memory operand with the specified tag.
+ */
+ final predicate isMemoryOperand(OperandTag tag) {
+ exists(getOperandMemoryAccess(tag))
+ }
+
+ /**
+ * Gets the kind of memory access performed by the specified operand. Holds
+ * only for memory operands.
+ */
+ MemoryAccessKind getOperandMemoryAccess(OperandTag tag) {
+ none()
+ }
+
+ /**
+ * Holds if this instruction produces a memory result.
+ */
+ final predicate hasMemoryResult() {
+ exists(getResultMemoryAccess())
+ }
+
+ /**
+ * Gets the kind of memory access performed by this instruction's result.
+ * Holds only for instructions with a memory result.
+ */
+ MemoryAccessKind getResultMemoryAccess() {
+ none()
+ }
+
+ /**
+ * Holds if the result of this instruction is precisely modeled in SSA. Always
+ * holds for a register result. For a memory result, a modeled result is
+ * connected to its actual uses. An unmodeled result is connected to the
+ * `UnmodeledUse` instruction.
+ *
+ * For example:
+ * ```
+ * int x = 1;
+ * int *p = &x;
+ * int y = *p;
+ * ```
+ * In non-aliased SSA, `x` will not be modeled because it has its address
+ * taken. In that case, `isResultModeled()` would not hold for the result of
+ * the `Store` to `x`.
+ */
+ final predicate isResultModeled() {
+ // Register results are always in SSA form.
+ not hasMemoryResult() or
+ // An unmodeled result will have a use on the `UnmodeledUse` instruction.
+ not exists(UnmodeledUseOperand useTag |
+ hasUse(_, useTag)
+ )
+ }
+
+ /**
+ * Gets the successor of this instruction along the control flow edge
+ * specified by `kind`.
+ */
+ final Instruction getSuccessor(EdgeKind kind) {
+ result = Construction::getInstructionSuccessor(this, kind)
+ }
+
+ /**
+ * Gets all direct successors of this instruction.
+ */
+ final Instruction getASuccessor() {
+ result = getSuccessor(_)
+ }
+
+ /**
+ * Gets a predecessor of this instruction such that the predecessor reaches
+ * this instruction along the control flow edge specified by `kind`.
+ */
+ final Instruction getPredecessor(EdgeKind kind) {
+ result.getSuccessor(kind) = this
+ }
+
+ /**
+ * Gets all direct predecessors of this instruction.
+ */
+ final Instruction getAPredecessor() {
+ result = getPredecessor(_)
+ }
+
+ /**
+ * Holds if the result of this instruction is consumed by `useInstruction` as
+ * an operand with tag `useTag`.
+ */
+ final predicate hasUse(Instruction useInstruction, OperandTag useTag) {
+ useInstruction.getFunctionIR() = funcIR and
+ this = useInstruction.getOperand(useTag)
+ }
+}
+
+class VariableInstruction extends Instruction {
+ IRVariable var;
+
+ VariableInstruction() {
+ var = Construction::getInstructionVariable(this)
+ }
+
+ override final string toString() {
+ result = super.toString() + "[" + var.toString() + "]"
+ }
+
+ final IRVariable getVariable() {
+ result = var
+ }
+}
+
+class FieldInstruction extends Instruction {
+ Field field;
+
+ FieldInstruction() {
+ field = Construction::getInstructionField(this)
+ }
+
+ override final string toString() {
+ result = super.toString() + "[" + field.toString() + "]"
+ }
+
+ final Field getField() {
+ result = field
+ }
+}
+
+class FunctionInstruction extends Instruction {
+ Function funcSymbol;
+
+ FunctionInstruction() {
+ funcSymbol = Construction::getInstructionFunction(this)
+ }
+
+ override final string toString() {
+ result = super.toString() + "[" + funcSymbol.toString() + "]"
+ }
+
+ final Function getFunctionSymbol() {
+ result = funcSymbol
+ }
+}
+
+class ConstantValueInstruction extends Instruction {
+ string value;
+
+ ConstantValueInstruction() {
+ value = Construction::getInstructionConstantValue(this)
+ }
+
+ override final string toString() {
+ result = super.toString() + "[" + value + "]"
+ }
+
+ final string getValue() {
+ result = value
+ }
+}
+
+class EnterFunctionInstruction extends Instruction {
+ EnterFunctionInstruction() {
+ opcode instanceof Opcode::EnterFunction
+ }
+}
+
+class VariableAddressInstruction extends VariableInstruction {
+ VariableAddressInstruction() {
+ opcode instanceof Opcode::VariableAddress
+ }
+}
+
+class InitializeParameterInstruction extends VariableInstruction {
+ InitializeParameterInstruction() {
+ opcode instanceof Opcode::InitializeParameter
+ }
+
+ final Parameter getParameter() {
+ result = var.(IRUserVariable).getVariable()
+ }
+}
+
+class FieldAddressInstruction extends FieldInstruction {
+ FieldAddressInstruction() {
+ opcode instanceof Opcode::FieldAddress
+ }
+
+ final Instruction getObjectAddress() {
+ result = getOperand(unaryOperand())
+ }
+}
+
+class UninitializedInstruction extends Instruction {
+ UninitializedInstruction() {
+ opcode instanceof Opcode::Uninitialized
+ }
+}
+
+class NoOpInstruction extends Instruction {
+ NoOpInstruction() {
+ opcode instanceof Opcode::NoOp
+ }
+}
+
+class ReturnInstruction extends Instruction {
+ ReturnInstruction() {
+ opcode instanceof ReturnOpcode
+ }
+}
+
+class ReturnVoidInstruction extends ReturnInstruction {
+ ReturnVoidInstruction() {
+ opcode instanceof Opcode::ReturnVoid
+ }
+}
+
+class ReturnValueInstruction extends ReturnInstruction {
+ ReturnValueInstruction() {
+ opcode instanceof Opcode::ReturnValue
+ }
+
+ final Instruction getReturnValue() {
+ result = getOperand(returnValueOperand())
+ }
+
+ override final MemoryAccessKind getOperandMemoryAccess(OperandTag tag) {
+ tag instanceof ReturnValueOperand and
+ result instanceof IndirectMemoryAccess
+ }
+}
+
+class CopyInstruction extends Instruction {
+ CopyInstruction() {
+ opcode instanceof CopyOpcode
+ }
+
+ final Instruction getSourceValue() {
+ result = getOperand(copySourceOperand())
+ }
+}
+
+class CopyValueInstruction extends CopyInstruction {
+ CopyValueInstruction() {
+ opcode instanceof Opcode::CopyValue
+ }
+}
+
+class LoadInstruction extends CopyInstruction {
+ LoadInstruction() {
+ opcode instanceof Opcode::Load
+ }
+
+ override final MemoryAccessKind getOperandMemoryAccess(OperandTag tag) {
+ tag instanceof CopySourceOperand and
+ result instanceof IndirectMemoryAccess
+ }
+
+ final Instruction getSourceAddress() {
+ result = getOperand(loadStoreAddressOperand())
+ }
+}
+
+class StoreInstruction extends CopyInstruction {
+ StoreInstruction() {
+ opcode instanceof Opcode::Store
+ }
+
+ override final MemoryAccessKind getResultMemoryAccess() {
+ result instanceof IndirectMemoryAccess
+ }
+
+ final Instruction getDestinationAddress() {
+ result = getOperand(loadStoreAddressOperand())
+ }
+}
+
+class ConditionalBranchInstruction extends Instruction {
+ ConditionalBranchInstruction() {
+ opcode instanceof Opcode::ConditionalBranch
+ }
+
+ final Instruction getCondition() {
+ result = getOperand(conditionOperand())
+ }
+
+ final Instruction getTrueSuccessor() {
+ result = getSuccessor(trueEdge())
+ }
+
+ final Instruction getFalseSuccessor() {
+ result = getSuccessor(falseEdge())
+ }
+}
+
+class ExitFunctionInstruction extends Instruction {
+ ExitFunctionInstruction() {
+ opcode instanceof Opcode::ExitFunction
+ }
+}
+
+class ConstantInstruction extends ConstantValueInstruction {
+ ConstantInstruction() {
+ opcode instanceof Opcode::Constant
+ }
+}
+
+class IntegerConstantInstruction extends ConstantInstruction {
+ IntegerConstantInstruction() {
+ resultType instanceof IntegralType
+ }
+}
+
+class FloatConstantInstruction extends ConstantInstruction {
+ FloatConstantInstruction() {
+ resultType instanceof FloatingPointType
+ }
+}
+
+class StringConstantInstruction extends Instruction {
+ StringLiteral value;
+
+ StringConstantInstruction() {
+ value = Construction::getInstructionStringLiteral(this)
+ }
+
+ override final string toString() {
+ result = super.toString() + "[" +
+ value.getValueText().replaceAll("\n", " ").replaceAll("\r", "").replaceAll("\t", " ") +
+ "]"
+ }
+
+ final StringLiteral getValue() {
+ result = value
+ }
+}
+
+class BinaryInstruction extends Instruction {
+ BinaryInstruction() {
+ opcode instanceof BinaryOpcode
+ }
+
+ final Instruction getLeftOperand() {
+ result = getOperand(leftOperand())
+ }
+
+ final Instruction getRightOperand() {
+ result = getOperand(rightOperand())
+ }
+}
+
+class AddInstruction extends BinaryInstruction {
+ AddInstruction() {
+ opcode instanceof Opcode::Add
+ }
+}
+
+class SubInstruction extends BinaryInstruction {
+ SubInstruction() {
+ opcode instanceof Opcode::Sub
+ }
+}
+
+class MulInstruction extends BinaryInstruction {
+ MulInstruction() {
+ opcode instanceof Opcode::Mul
+ }
+}
+
+class DivInstruction extends BinaryInstruction {
+ DivInstruction() {
+ opcode instanceof Opcode::Div
+ }
+}
+
+class RemInstruction extends BinaryInstruction {
+ RemInstruction() {
+ opcode instanceof Opcode::Rem
+ }
+}
+
+class BitAndInstruction extends BinaryInstruction {
+ BitAndInstruction() {
+ opcode instanceof Opcode::BitAnd
+ }
+}
+
+class BitOrInstruction extends BinaryInstruction {
+ BitOrInstruction() {
+ opcode instanceof Opcode::BitOr
+ }
+}
+
+class BitXorInstruction extends BinaryInstruction {
+ BitXorInstruction() {
+ opcode instanceof Opcode::BitXor
+ }
+}
+
+class ShiftLeftInstruction extends BinaryInstruction {
+ ShiftLeftInstruction() {
+ opcode instanceof Opcode::ShiftLeft
+ }
+}
+
+class ShiftRightInstruction extends BinaryInstruction {
+ ShiftRightInstruction() {
+ opcode instanceof Opcode::ShiftRight
+ }
+}
+
+class PointerArithmeticInstruction extends BinaryInstruction {
+ int elementSize;
+
+ PointerArithmeticInstruction() {
+ opcode instanceof PointerArithmeticOpcode and
+ elementSize = Construction::getInstructionElementSize(this)
+ }
+
+ override final string toString() {
+ result = super.toString() + "[" + elementSize.toString() + "]"
+ }
+
+ final int getElementSize() {
+ result = elementSize
+ }
+}
+
+class PointerOffsetInstruction extends PointerArithmeticInstruction {
+ PointerOffsetInstruction() {
+ opcode instanceof PointerOffsetOpcode
+ }
+}
+
+class PointerAddInstruction extends PointerOffsetInstruction {
+ PointerAddInstruction() {
+ opcode instanceof Opcode::PointerAdd
+ }
+}
+
+class PointerSubInstruction extends PointerOffsetInstruction {
+ PointerSubInstruction() {
+ opcode instanceof Opcode::PointerSub
+ }
+}
+
+class PointerDiffInstruction extends PointerArithmeticInstruction {
+ PointerDiffInstruction() {
+ opcode instanceof Opcode::PointerDiff
+ }
+}
+
+class UnaryInstruction extends Instruction {
+ UnaryInstruction() {
+ opcode instanceof UnaryOpcode
+ }
+
+ final Instruction getOperand() {
+ result = getOperand(unaryOperand())
+ }
+}
+
+class ConvertInstruction extends UnaryInstruction {
+ ConvertInstruction() {
+ opcode instanceof Opcode::Convert
+ }
+}
+
+/**
+ * Represents an instruction that converts between two addresses
+ * related by inheritance.
+ */
+class InheritanceConversionInstruction extends UnaryInstruction {
+ Class baseClass;
+ Class derivedClass;
+
+ InheritanceConversionInstruction() {
+ Construction::getInstructionInheritance(this, baseClass, derivedClass)
+ }
+
+ override final string toString() {
+ result = super.toString() + "[" + derivedClass.toString() + " : " + baseClass.toString() + "]"
+ }
+
+ /**
+ * Gets the `ClassDerivation` for the inheritance relationship between
+ * the base and derived classes. This predicate does not hold if the
+ * conversion is to an indirect virtual base class.
+ */
+ final ClassDerivation getDerivation() {
+ result.getBaseClass() = baseClass and result.getDerivedClass() = derivedClass
+ }
+
+ /**
+ * Gets the base class of the conversion. This will be either a direct
+ * base class of the derived class, or a virtual base class of the
+ * derived class.
+ */
+ final Class getBaseClass() {
+ result = baseClass
+ }
+
+ /**
+ * Gets the derived class of the conversion.
+ */
+ final Class getDerivedClass() {
+ result = derivedClass
+ }
+}
+
+/**
+ * Represents an instruction that converts from the address of a derived class
+ * to the address of a direct non-virtual base class.
+ */
+class ConvertToBaseInstruction extends InheritanceConversionInstruction {
+ ConvertToBaseInstruction() {
+ opcode instanceof Opcode::ConvertToBase
+ }
+}
+
+/**
+ * Represents an instruction that converts from the address of a derived class
+ * to the address of a virtual base class.
+ */
+class ConvertToVirtualBaseInstruction extends InheritanceConversionInstruction {
+ ConvertToVirtualBaseInstruction() {
+ opcode instanceof Opcode::ConvertToVirtualBase
+ }
+}
+
+/**
+ * Represents an instruction that converts from the address of a base class
+ * to the address of a direct non-virtual derived class.
+ */
+class ConvertToDerivedInstruction extends InheritanceConversionInstruction {
+ ConvertToDerivedInstruction() {
+ opcode instanceof Opcode::ConvertToDerived
+ }
+}
+
+class BitComplementInstruction extends UnaryInstruction {
+ BitComplementInstruction() {
+ opcode instanceof Opcode::BitComplement
+ }
+}
+
+class LogicalNotInstruction extends UnaryInstruction {
+ LogicalNotInstruction() {
+ opcode instanceof Opcode::LogicalNot
+ }
+}
+
+class CompareInstruction extends BinaryInstruction {
+ CompareInstruction() {
+ opcode instanceof CompareOpcode
+ }
+}
+
+class CompareEQInstruction extends CompareInstruction {
+ CompareEQInstruction() {
+ opcode instanceof Opcode::CompareEQ
+ }
+}
+
+class CompareNEInstruction extends CompareInstruction {
+ CompareNEInstruction() {
+ opcode instanceof Opcode::CompareNE
+ }
+}
+
+class CompareLTInstruction extends CompareInstruction {
+ CompareLTInstruction() {
+ opcode instanceof Opcode::CompareLT
+ }
+}
+
+class CompareGTInstruction extends CompareInstruction {
+ CompareGTInstruction() {
+ opcode instanceof Opcode::CompareGT
+ }
+}
+
+class CompareLEInstruction extends CompareInstruction {
+ CompareLEInstruction() {
+ opcode instanceof Opcode::CompareLE
+ }
+}
+
+class CompareGEInstruction extends CompareInstruction {
+ CompareGEInstruction() {
+ opcode instanceof Opcode::CompareGE
+ }
+}
+
+class SwitchInstruction extends Instruction {
+ SwitchInstruction() {
+ opcode instanceof Opcode::Switch
+ }
+
+ final Instruction getExpression() {
+ result = getOperand(conditionOperand())
+ }
+
+ final Instruction getACaseSuccessor() {
+ exists(CaseEdge edge |
+ result = getSuccessor(edge)
+ )
+ }
+
+ final Instruction getDefaultSuccessor() {
+ result = getSuccessor(defaultEdge())
+ }
+}
+
+class InvokeInstruction extends Instruction {
+ InvokeInstruction() {
+ opcode instanceof Opcode::Invoke
+ }
+
+ final Instruction getCallTarget() {
+ result = getOperand(callTargetOperand())
+ }
+}
+
+/**
+ * An instruction that throws an exception.
+ */
+class ThrowInstruction extends Instruction {
+ ThrowInstruction() {
+ opcode instanceof ThrowOpcode
+ }
+}
+
+/**
+ * An instruction that throws a new exception.
+ */
+class ThrowValueInstruction extends ThrowInstruction {
+ ThrowValueInstruction() {
+ opcode instanceof Opcode::ThrowValue
+ }
+
+ override final MemoryAccessKind getOperandMemoryAccess(OperandTag tag) {
+ tag instanceof ExceptionOperand and
+ result instanceof IndirectMemoryAccess
+ }
+
+
+ /**
+ * Gets the address of the exception thrown by this instruction.
+ */
+ final Instruction getExceptionAddress() {
+ result = getOperand(loadStoreAddressOperand())
+ }
+
+ /**
+ * Gets the exception thrown by this instruction.
+ */
+ final Instruction getException() {
+ result = getOperand(exceptionOperand())
+ }
+}
+
+/**
+ * An instruction that re-throws the current exception.
+ */
+class ReThrowInstruction extends ThrowInstruction {
+ ReThrowInstruction() {
+ opcode instanceof Opcode::ReThrow
+ }
+}
+
+/**
+ * An instruction that exits the current function by propagating an exception.
+ */
+class UnwindInstruction extends Instruction {
+ UnwindInstruction() {
+ opcode instanceof Opcode::Unwind
+ }
+}
+
+/**
+ * An instruction that starts a `catch` handler.
+ */
+class CatchInstruction extends Instruction {
+ CatchInstruction() {
+ opcode instanceof CatchOpcode
+ }
+}
+
+/**
+ * An instruction that catches an exception of a specific type.
+ */
+class CatchByTypeInstruction extends CatchInstruction {
+ Type exceptionType;
+
+ CatchByTypeInstruction() {
+ opcode instanceof Opcode::CatchByType and
+ exceptionType = Construction::getInstructionExceptionType(this)
+ }
+
+ final override string toString() {
+ result = super.toString() + "[" + exceptionType.toString() + "]"
+ }
+
+ /**
+ * Gets the type of exception to be caught.
+ */
+ final Type getExceptionType() {
+ result = exceptionType
+ }
+}
+
+/**
+ * An instruction that catches any exception.
+ */
+class CatchAnyInstruction extends CatchInstruction {
+ CatchAnyInstruction() {
+ opcode instanceof Opcode::CatchAny
+ }
+}
+
+class UnmodeledDefinitionInstruction extends Instruction {
+ UnmodeledDefinitionInstruction() {
+ opcode instanceof Opcode::UnmodeledDefinition
+ }
+
+ override final MemoryAccessKind getResultMemoryAccess() {
+ result instanceof UnmodeledMemoryAccess
+ }
+}
+
+class UnmodeledUseInstruction extends Instruction {
+ UnmodeledUseInstruction() {
+ opcode instanceof Opcode::UnmodeledUse
+ }
+
+ override final MemoryAccessKind getOperandMemoryAccess(OperandTag tag) {
+ tag instanceof UnmodeledUseOperand and
+ result instanceof UnmodeledMemoryAccess
+ }
+}
+
+class PhiInstruction extends Instruction {
+ PhiInstruction() {
+ opcode instanceof Opcode::Phi
+ }
+
+ override final MemoryAccessKind getOperandMemoryAccess(OperandTag tag) {
+ tag instanceof PhiOperand and
+ result instanceof PhiMemoryAccess
+ }
+
+ override final MemoryAccessKind getResultMemoryAccess() {
+ result instanceof PhiMemoryAccess
+ }
+}
+
+/**
+ * An instruction representing a built-in operation. This is used to represent
+ * operations such as access to variable argument lists.
+ */
+class BuiltInInstruction extends Instruction {
+ BuiltInInstruction() {
+ opcode instanceof BuiltInOpcode
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ir/internal/InstructionTag.qll b/cpp/ql/src/semmle/code/cpp/ir/internal/InstructionTag.qll
new file mode 100644
index 000000000000..bec350fd22eb
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/internal/InstructionTag.qll
@@ -0,0 +1,146 @@
+import cpp
+
+private predicate fieldIsInitialized(Field field) {
+ exists(ClassAggregateLiteral initList |
+ initList.isInitialized(field)
+ ) or
+ exists(ConstructorFieldInit init |
+ field = init.getTarget()
+ )
+}
+
+private predicate elementIsInitialized(int elementIndex) {
+ exists(ArrayAggregateLiteral initList |
+ initList.isInitialized(elementIndex)
+ )
+}
+
+newtype TInstructionTag =
+ OnlyInstructionTag() or // Single instruction (not including implicit Load)
+ InitializerUninitializedTag() or // Source expression of initializer
+ ParameterInitializerTag() or
+ InitializeThisTag() or
+ InitializerVariableAddressTag() or
+ InitializerLoadStringTag() or
+ InitializerStoreTag() or
+ ZeroPadStringConstantTag() or
+ ZeroPadStringElementIndexTag() or
+ ZeroPadStringElementAddressTag() or
+ ZeroPadStringStoreTag() or
+ AssignOperationLoadTag() or
+ AssignOperationConvertLeftTag() or
+ AssignOperationOpTag() or
+ AssignOperationConvertResultTag() or
+ AssignmentStoreTag() or
+ CrementLoadTag() or
+ CrementConstantTag() or
+ CrementOpTag() or
+ CrementStoreTag() or
+ EnterFunctionTag() or
+ ReturnValueAddressTag() or
+ ReturnTag() or
+ ExitFunctionTag() or
+ UnmodeledDefinitionTag() or
+ UnmodeledUseTag() or
+ SwitchBranchTag() or
+ CallTargetTag() or
+ CallTag() or
+ ValueConditionConditionalBranchTag() or
+ ConditionValueTrueTempAddressTag() or
+ ConditionValueTrueConstantTag() or
+ ConditionValueTrueStoreTag() or
+ ConditionValueFalseTempAddressTag() or
+ ConditionValueFalseConstantTag() or
+ ConditionValueFalseStoreTag() or
+ ConditionValueResultTempAddressTag() or
+ ConditionValueResultLoadTag() or
+ BoolConversionConstantTag() or
+ BoolConversionCompareTag() or
+ LoadTag() or // Implicit load due to lvalue-to-rvalue conversion
+ CatchTag() or
+ ThrowTag() or
+ UnwindTag() or
+ InitializerFieldAddressTag(Field field) {
+ fieldIsInitialized(field)
+ } or
+ InitializerFieldDefaultValueTag(Field field) {
+ fieldIsInitialized(field)
+ } or
+ InitializerFieldDefaultValueStoreTag(Field field) {
+ fieldIsInitialized(field)
+ } or
+ InitializerElementIndexTag(int elementIndex) {
+ elementIsInitialized(elementIndex)
+ } or
+ InitializerElementAddressTag(int elementIndex) {
+ elementIsInitialized(elementIndex)
+ } or
+ InitializerElementDefaultValueTag(int elementIndex) {
+ elementIsInitialized(elementIndex)
+ } or
+ InitializerElementDefaultValueStoreTag(int elementIndex) {
+ elementIsInitialized(elementIndex)
+ }
+
+/**
+ * Gets a unique string for the instruction tag. Primarily used for generating
+ * instruction IDs to ensure stable IR dumps.
+ */
+string getInstructionTagId(TInstructionTag tag) {
+ tag = OnlyInstructionTag() and result = "Only" or // Single instruction (not including implicit Load)
+ tag = InitializerUninitializedTag() and result = "InitUninit" or // Source expression of initializer
+ tag = ParameterInitializerTag() and result = "ParamInit" or
+ tag = InitializerVariableAddressTag() and result = "InitVarAddr" or
+ tag = InitializerStoreTag() and result = "InitStore" or
+ tag = AssignOperationLoadTag() and result = "AssignOpLoad" or
+ tag = AssignOperationConvertLeftTag() and result = "AssignOpConvLeft" or
+ tag = AssignOperationOpTag() and result = "AssignOpOp" or
+ tag = AssignOperationConvertResultTag() and result = "AssignOpConvRes" or
+ tag = AssignmentStoreTag() and result = "AssigStore" or
+ tag = CrementLoadTag() and result = "CrementLoad" or
+ tag = CrementConstantTag() and result = "CrementConst" or
+ tag = CrementOpTag() and result = "CrementOp" or
+ tag = CrementStoreTag() and result = "CrementStore" or
+ tag = EnterFunctionTag() and result = "EnterFunc" or
+ tag = ReturnValueAddressTag() and result = "RetValAddr" or
+ tag = ReturnTag() and result = "Ret" or
+ tag = ExitFunctionTag() and result = "ExitFunc" or
+ tag = UnmodeledDefinitionTag() and result = "UnmodeledDef" or
+ tag = UnmodeledUseTag() and result = "UnmodeledUse" or
+ tag = SwitchBranchTag() and result = "SwitchBranch" or
+ tag = CallTargetTag() and result = "CallTarget" or
+ tag = CallTag() and result = "Call" or
+ tag = ValueConditionConditionalBranchTag() and result = "ValCondCondBranch" or
+ tag = ConditionValueTrueTempAddressTag() and result = "CondValTrueTempAddr" or
+ tag = ConditionValueTrueConstantTag() and result = "CondValTrueConst" or
+ tag = ConditionValueTrueStoreTag() and result = "CondValTrueStore" or
+ tag = ConditionValueFalseTempAddressTag() and result = "CondValFalseTempAddr" or
+ tag = ConditionValueFalseConstantTag() and result = "CondValFalseConst" or
+ tag = ConditionValueFalseStoreTag() and result = "CondValFalseStore" or
+ tag = ConditionValueResultTempAddressTag() and result = "CondValResTempAddr" or
+ tag = ConditionValueResultLoadTag() and result = "CondValResLoad" or
+ tag = BoolConversionConstantTag() and result = "BoolConvConst" or
+ tag = BoolConversionCompareTag() and result = "BoolConvComp" or
+ tag = LoadTag() and result = "Load" or // Implicit load due to lvalue-to-rvalue conversion
+ tag = CatchTag() and result = "Catch" or
+ tag = ThrowTag() and result = "Throw" or
+ tag = UnwindTag() and result = "Unwind" or
+ exists(Field field, Class cls, int index, string tagName |
+ field = cls.getCanonicalMember(index) and
+ (
+ tag = InitializerFieldAddressTag(field) and tagName = "InitFieldAddr" or
+ tag = InitializerFieldDefaultValueTag(field) and tagName = "InitFieldDefVal" or
+ tag = InitializerFieldDefaultValueStoreTag(field) and tagName = "InitFieldDefValStore"
+ ) and
+ result = tagName + "(" + index + ")"
+ ) or
+ exists(int index, string tagName |
+ (
+ tag = InitializerElementIndexTag(index) and tagName = "InitElemIndex" or
+ tag = InitializerElementAddressTag(index) and tagName = "InitElemAddr" or
+ tag = InitializerElementDefaultValueTag(index) and tagName = "InitElemDefVal" or
+ tag = InitializerElementDefaultValueStoreTag(index) and tagName = "InitElemDefValStore"
+ ) and
+ result = tagName + "(" + index + ")"
+ )
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ir/internal/Opcode.qll b/cpp/ql/src/semmle/code/cpp/ir/internal/Opcode.qll
new file mode 100644
index 000000000000..922c2a0d95cc
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/internal/Opcode.qll
@@ -0,0 +1,154 @@
+private newtype TOpcode =
+ TNoOp() or
+ TUninitialized() or
+ TInitializeParameter() or
+ TInitializeThis() or
+ TEnterFunction() or
+ TExitFunction() or
+ TReturnValue() or
+ TReturnVoid() or
+ TCopyValue() or
+ TLoad() or
+ TStore() or
+ TAdd() or
+ TSub() or
+ TMul() or
+ TDiv() or
+ TRem() or
+ TNegate() or
+ TShiftLeft() or
+ TShiftRight() or
+ TBitAnd() or
+ TBitOr() or
+ TBitXor() or
+ TBitComplement() or
+ TLogicalNot() or
+ TCompareEQ() or
+ TCompareNE() or
+ TCompareLT() or
+ TCompareGT() or
+ TCompareLE() or
+ TCompareGE() or
+ TPointerAdd() or
+ TPointerSub() or
+ TPointerDiff() or
+ TConvert() or
+ TConvertToBase() or
+ TConvertToVirtualBase() or
+ TConvertToDerived() or
+ TCheckedConvertOrNull() or
+ TCheckedConvertOrThrow() or
+ TDynamicCastToVoid() or
+ TVariableAddress() or
+ TFieldAddress() or
+ TFunctionAddress() or
+ TConstant() or
+ TStringConstant() or
+ TConditionalBranch() or
+ TSwitch() or
+ TInvoke() or
+ TCatchByType() or
+ TCatchAny() or
+ TThrowValue() or
+ TReThrow() or
+ TUnwind() or
+ TUnmodeledDefinition() or
+ TUnmodeledUse() or
+ TPhi() or
+ TVarArgsStart() or
+ TVarArgsEnd() or
+ TVarArg() or
+ TVarArgCopy()
+
+class Opcode extends TOpcode {
+ string toString() {
+ result = "UnknownOpcode"
+ }
+}
+
+abstract class UnaryOpcode extends Opcode {}
+
+abstract class BinaryOpcode extends Opcode {}
+
+abstract class PointerArithmeticOpcode extends BinaryOpcode {}
+
+abstract class PointerOffsetOpcode extends PointerArithmeticOpcode {}
+
+abstract class CompareOpcode extends BinaryOpcode {}
+
+abstract class CopyOpcode extends Opcode {}
+
+abstract class MemoryAccessOpcode extends Opcode {}
+
+abstract class ReturnOpcode extends Opcode {}
+
+abstract class ThrowOpcode extends Opcode {}
+
+abstract class CatchOpcode extends Opcode {}
+
+abstract class OpcodeWithCondition extends Opcode {}
+
+abstract class BuiltInOpcode extends Opcode {}
+
+module Opcode {
+ class NoOp extends Opcode, TNoOp { override final string toString() { result = "NoOp" } }
+ class Uninitialized extends Opcode, TUninitialized { override final string toString() { result = "Uninitialized" } }
+ class InitializeParameter extends Opcode, TInitializeParameter { override final string toString() { result = "InitializeParameter" } }
+ class InitializeThis extends Opcode, TInitializeThis { override final string toString() { result = "InitializeThis" } }
+ class EnterFunction extends Opcode, TEnterFunction { override final string toString() { result = "EnterFunction" } }
+ class ExitFunction extends Opcode, TExitFunction { override final string toString() { result = "ExitFunction" } }
+ class ReturnValue extends ReturnOpcode, MemoryAccessOpcode, TReturnValue { override final string toString() { result = "ReturnValue" } }
+ class ReturnVoid extends ReturnOpcode, TReturnVoid { override final string toString() { result = "ReturnVoid" } }
+ class CopyValue extends CopyOpcode, TCopyValue { override final string toString() { result = "CopyValue" } }
+ class Load extends CopyOpcode, MemoryAccessOpcode, TLoad { override final string toString() { result = "Load" } }
+ class Store extends CopyOpcode, MemoryAccessOpcode, TStore { override final string toString() { result = "Store" } }
+ class Add extends BinaryOpcode, TAdd { override final string toString() { result = "Add" } }
+ class Sub extends BinaryOpcode, TSub { override final string toString() { result = "Sub" } }
+ class Mul extends BinaryOpcode, TMul { override final string toString() { result = "Mul" } }
+ class Div extends BinaryOpcode, TDiv { override final string toString() { result = "Div" } }
+ class Rem extends BinaryOpcode, TRem { override final string toString() { result = "Rem" } }
+ class Negate extends UnaryOpcode, TNegate { override final string toString() { result = "Negate" } }
+ class ShiftLeft extends BinaryOpcode, TShiftLeft { override final string toString() { result = "ShiftLeft" } }
+ class ShiftRight extends BinaryOpcode, TShiftRight { override final string toString() { result = "ShiftRight" } }
+ class BitAnd extends BinaryOpcode, TBitAnd { override final string toString() { result = "BitAnd" } }
+ class BitOr extends BinaryOpcode, TBitOr { override final string toString() { result = "BitOr" } }
+ class BitXor extends BinaryOpcode, TBitXor { override final string toString() { result = "BitXor" } }
+ class BitComplement extends UnaryOpcode, TBitComplement { override final string toString() { result = "BitComplement" } }
+ class LogicalNot extends UnaryOpcode, TLogicalNot { override final string toString() { result = "LogicalNot" } }
+ class CompareEQ extends CompareOpcode, TCompareEQ { override final string toString() { result = "CompareEQ" } }
+ class CompareNE extends CompareOpcode, TCompareNE { override final string toString() { result = "CompareNE" } }
+ class CompareLT extends CompareOpcode, TCompareLT { override final string toString() { result = "CompareLT" } }
+ class CompareGT extends CompareOpcode, TCompareGT { override final string toString() { result = "CompareGT" } }
+ class CompareLE extends CompareOpcode, TCompareLE { override final string toString() { result = "CompareLE" } }
+ class CompareGE extends CompareOpcode, TCompareGE { override final string toString() { result = "CompareGE" } }
+ class PointerAdd extends PointerOffsetOpcode, TPointerAdd { override final string toString() { result = "PointerAdd" } }
+ class PointerSub extends PointerOffsetOpcode, TPointerSub { override final string toString() { result = "PointerSub" } }
+ class PointerDiff extends PointerArithmeticOpcode, TPointerDiff { override final string toString() { result = "PointerDiff" } }
+ class Convert extends UnaryOpcode, TConvert { override final string toString() { result = "Convert" } }
+ class ConvertToBase extends UnaryOpcode, TConvertToBase { override final string toString() { result = "ConvertToBase" } }
+ class ConvertToVirtualBase extends UnaryOpcode, TConvertToVirtualBase { override final string toString() { result = "ConvertToVirtualBase" } }
+ class ConvertToDerived extends UnaryOpcode, TConvertToDerived { override final string toString() { result = "ConvertToDerived" } }
+ class CheckedConvertOrNull extends UnaryOpcode, TCheckedConvertOrNull { override final string toString() { result = "CheckedConvertOrNull" } }
+ class CheckedConvertOrThrow extends UnaryOpcode, TCheckedConvertOrThrow { override final string toString() { result = "CheckedConvertOrThrow" } }
+ class DynamicCastToVoid extends UnaryOpcode, TDynamicCastToVoid { override final string toString() { result = "DynamicCastToVoid" } }
+ class VariableAddress extends Opcode, TVariableAddress { override final string toString() { result = "VariableAddress" } }
+ class FieldAddress extends UnaryOpcode, TFieldAddress { override final string toString() { result = "FieldAddress" } }
+ class FunctionAddress extends Opcode, TFunctionAddress { override final string toString() { result = "FunctionAddress" } }
+ class Constant extends Opcode, TConstant { override final string toString() { result = "Constant" } }
+ class StringConstant extends Opcode, TStringConstant { override final string toString() { result = "StringConstant" } }
+ class ConditionalBranch extends OpcodeWithCondition, TConditionalBranch { override final string toString() { result = "ConditionalBranch" } }
+ class Switch extends OpcodeWithCondition, TSwitch { override final string toString() { result = "Switch" } }
+ class Invoke extends Opcode, TInvoke { override final string toString() { result = "Invoke" } }
+ class CatchByType extends CatchOpcode, TCatchByType { override final string toString() { result = "CatchByType" } }
+ class CatchAny extends CatchOpcode, TCatchAny { override final string toString() { result = "CatchAny" } }
+ class ThrowValue extends ThrowOpcode, MemoryAccessOpcode, TThrowValue { override final string toString() { result = "ThrowValue" } }
+ class ReThrow extends ThrowOpcode, TReThrow { override final string toString() { result = "ReThrow" } }
+ class Unwind extends Opcode, TUnwind { override final string toString() { result = "Unwind" } }
+ class UnmodeledDefinition extends Opcode, TUnmodeledDefinition { override final string toString() { result = "UnmodeledDefinition" } }
+ class UnmodeledUse extends Opcode, TUnmodeledUse { override final string toString() { result = "UnmodeledUse" } }
+ class Phi extends Opcode, TPhi { override final string toString() { result = "Phi" } }
+ class VarArgsStart extends BuiltInOpcode, TVarArgsStart { override final string toString() { result = "VarArgsStart" } }
+ class VarArgsEnd extends BuiltInOpcode, TVarArgsEnd { override final string toString() { result = "VarArgsEnd" } }
+ class VarArg extends BuiltInOpcode, TVarArg { override final string toString() { result = "VarArg" } }
+ class VarArgCopy extends BuiltInOpcode, TVarArgCopy { override final string toString() { result = "VarArgCopy" } }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ir/internal/OperandTag.qll b/cpp/ql/src/semmle/code/cpp/ir/internal/OperandTag.qll
new file mode 100644
index 000000000000..ece7fb5bd15b
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/internal/OperandTag.qll
@@ -0,0 +1,299 @@
+private import IRInternal
+import Instruction
+import IRBlock
+import cpp
+
+private newtype TOperandTag =
+ TLoadStoreAddressOperand() or
+ TCopySourceOperand() or
+ TUnaryOperand() or
+ TLeftOperand() or
+ TRightOperand() or
+ TReturnValueOperand() or
+ TExceptionOperand() or
+ TConditionOperand() or
+ TUnmodeledUseOperand() or
+ TCallTargetOperand() or
+ TThisArgumentOperand() or
+ TPositionalArgumentOperand(int argIndex) {
+ argIndex in [0..Construction::getMaxCallArgIndex()] or
+ exists(BuiltInOperation op |
+ exists(op.getChild(argIndex))
+ )
+ } or
+ TPhiOperand(IRBlock predecessorBlock) {
+ exists(PhiInstruction phi |
+ predecessorBlock = Construction::getPhiInstructionBlockStart(phi).getBlock().getAPredecessor()
+ )
+ }
+
+/**
+ * Identifies the kind of operand on an instruction. Each `Instruction` has at
+ * most one operand of any single `OperandTag`. The set of `OperandTag`s used by
+ * an `Instruction` is determined by the instruction's opcode.
+ */
+abstract class OperandTag extends TOperandTag {
+ abstract string toString();
+ abstract int getSortOrder();
+}
+
+// Note: individual subtypes are listed in the order that the operands should
+// appear in the operand list of the instruction when printing.
+
+/**
+ * The address operand of an instruction that loads or stores a value from
+ * memory (e.g. `Load`, `Store`).
+ */
+class LoadStoreAddressOperand extends OperandTag, TLoadStoreAddressOperand {
+ override final string toString() {
+ result = "LoadStoreAddress"
+ }
+
+ override final int getSortOrder() {
+ result = 0
+ }
+}
+
+LoadStoreAddressOperand loadStoreAddressOperand() {
+ result = TLoadStoreAddressOperand()
+}
+
+/**
+ * The source value operand of an instruction that copies this value to its
+ * result (e.g. `Copy`, `Load`, `Store`).
+ */
+class CopySourceOperand extends OperandTag, TCopySourceOperand {
+ override final string toString() {
+ result = "CopySource"
+ }
+
+ override final int getSortOrder() {
+ result = 1
+ }
+}
+
+CopySourceOperand copySourceOperand() {
+ result = TCopySourceOperand()
+}
+
+/**
+ * The sole operand of a unary instruction (e.g. `Convert`, `Negate`).
+ */
+class UnaryOperand extends OperandTag, TUnaryOperand {
+ override final string toString() {
+ result = "Unary"
+ }
+
+ override final int getSortOrder() {
+ result = 2
+ }
+}
+
+UnaryOperand unaryOperand() {
+ result = TUnaryOperand()
+}
+
+/**
+ * The left operand of a binary instruction (e.g. `Add`, `CompareEQ`).
+ */
+class LeftOperand extends OperandTag, TLeftOperand {
+ override final string toString() {
+ result = "Left"
+ }
+
+ override final int getSortOrder() {
+ result = 3
+ }
+}
+
+LeftOperand leftOperand() {
+ result = TLeftOperand()
+}
+
+/**
+ * The right operand of a binary instruction (e.g. `Add`, `CompareEQ`).
+ */
+class RightOperand extends OperandTag, TRightOperand {
+ override final string toString() {
+ result = "Right"
+ }
+
+ override final int getSortOrder() {
+ result = 4
+ }
+}
+
+RightOperand rightOperand() {
+ result = TRightOperand()
+}
+
+/**
+ * The return value operand of a `ReturnValue` instruction.
+ */
+class ReturnValueOperand extends OperandTag, TReturnValueOperand {
+ override final string toString() {
+ result = "ReturnValue"
+ }
+
+ override final int getSortOrder() {
+ result = 5
+ }
+}
+
+ReturnValueOperand returnValueOperand() {
+ result = TReturnValueOperand()
+}
+
+/**
+ * The exception thrown by a `ThrowValue` instruction.
+ */
+class ExceptionOperand extends OperandTag, TExceptionOperand {
+ override final string toString() {
+ result = "Exception"
+ }
+
+ override final int getSortOrder() {
+ result = 6
+ }
+}
+
+ExceptionOperand exceptionOperand() {
+ result = TExceptionOperand()
+}
+
+/**
+ * The condition operand of a `ConditionalBranch` or `Switch` instruction.
+ */
+class ConditionOperand extends OperandTag, TConditionOperand {
+ override final string toString() {
+ result = "Condition"
+ }
+
+ override final int getSortOrder() {
+ result = 7
+ }
+}
+
+ConditionOperand conditionOperand() {
+ result = TConditionOperand()
+}
+
+/**
+ * An operand of the special `UnmodeledUse` instruction, representing a value
+ * whose set of uses is unknown.
+ */
+class UnmodeledUseOperand extends OperandTag, TUnmodeledUseOperand {
+ override final string toString() {
+ result = "UnmodeledUse"
+ }
+
+ override final int getSortOrder() {
+ result = 8
+ }
+}
+
+UnmodeledUseOperand unmodeledUseOperand() {
+ result = TUnmodeledUseOperand()
+}
+
+/**
+ * The operand representing the target function of an `Invoke` instruction.
+ */
+class CallTargetOperand extends OperandTag, TCallTargetOperand {
+ override final string toString() {
+ result = "CallTarget"
+ }
+
+ override final int getSortOrder() {
+ result = 9
+ }
+}
+
+CallTargetOperand callTargetOperand() {
+ result = TCallTargetOperand()
+}
+
+/**
+ * An operand representing an argument to a function call. This includes both
+ * positional arguments (represented by `PositionalArgumentOperand`) and the
+ * implicit `this` argument, if any (represented by `ThisArgumentOperand`).
+ */
+abstract class ArgumentOperand extends OperandTag {
+}
+
+/**
+ * An operand representing the implicit 'this' argument to a member function
+ * call.
+ */
+class ThisArgumentOperand extends ArgumentOperand, TThisArgumentOperand {
+ ThisArgumentOperand() {
+ this = TThisArgumentOperand()
+ }
+
+ override final string toString() {
+ result = "Arg(this)"
+ }
+
+ override final int getSortOrder() {
+ result = 10
+ }
+}
+
+ThisArgumentOperand thisArgumentOperand() {
+ result = TThisArgumentOperand()
+}
+
+/**
+ * An operand representing an argument to a function call.
+ */
+class PositionalArgumentOperand extends ArgumentOperand,
+ TPositionalArgumentOperand {
+ int argIndex;
+
+ PositionalArgumentOperand() {
+ this = TPositionalArgumentOperand(argIndex)
+ }
+
+ override final string toString() {
+ result = "Arg(" + argIndex + ")"
+ }
+
+ override final int getSortOrder() {
+ result = 11 + argIndex
+ }
+
+ final int getArgIndex() {
+ result = argIndex
+ }
+}
+
+PositionalArgumentOperand positionalArgumentOperand(int argIndex) {
+ result = TPositionalArgumentOperand(argIndex)
+}
+
+/**
+ * An operand of an SSA `Phi` instruction.
+ */
+class PhiOperand extends OperandTag, TPhiOperand {
+ IRBlock predecessorBlock;
+
+ PhiOperand() {
+ this = TPhiOperand(predecessorBlock)
+ }
+
+ override final string toString() {
+ result = "Phi"
+ }
+
+ override final int getSortOrder() {
+ result = 11
+ }
+
+ final IRBlock getPredecessorBlock() {
+ result = predecessorBlock
+ }
+}
+
+PhiOperand phiOperand(IRBlock predecessorBlock) {
+ result = TPhiOperand(predecessorBlock)
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ir/internal/PrintIRImpl.qll b/cpp/ql/src/semmle/code/cpp/ir/internal/PrintIRImpl.qll
new file mode 100644
index 000000000000..9cf77f21c04a
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/internal/PrintIRImpl.qll
@@ -0,0 +1,175 @@
+private import IRImpl
+import cpp
+
+private int getInstructionIndexInBlock(Instruction instr) {
+ exists(IRBlock block |
+ block = instr.getBlock() and
+ (
+ exists(int index, int phiCount |
+ phiCount = count(block.getAPhiInstruction()) and
+ instr = block.getInstruction(index) and
+ result = index + phiCount
+ ) or
+ (
+ instr instanceof PhiInstruction and
+ instr = rank[result + 1](PhiInstruction phiInstr |
+ phiInstr = block.getAPhiInstruction() |
+ phiInstr order by phiInstr.getUniqueId()
+ )
+ )
+ )
+ )
+}
+
+private string getInstructionResultId(Instruction instr) {
+ result = getResultPrefix(instr) + getBlockId(instr.getBlock()) + "_" +
+ getInstructionIndexInBlock(instr).toString()
+}
+
+private string getResultPrefix(Instruction instr) {
+ if instr.hasMemoryResult() then
+ if instr.isResultModeled() then
+ result = "@m"
+ else
+ result = "@mu"
+ else
+ result = "@r"
+}
+
+/**
+ * Gets the identifier of the specified function scope.
+ * Currently just returns the signature of the function.
+ */
+private string getScopeId(Function func) {
+ result = func.getFullSignature()
+}
+
+/**
+ * Gets the unique identifier of the block within its function.
+ * Currently returns a string representation of an integer in the range
+ * [0..numBlocks - 1].
+ */
+private string getBlockId(IRBlock block) {
+ exists(int rankIndex |
+ block = rank[rankIndex + 1](IRBlock funcBlock |
+ funcBlock.getFunction() = block.getFunction() |
+ funcBlock order by funcBlock.getUniqueId()
+ ) and
+ result = rankIndex.toString()
+ )
+}
+
+/**
+ * Prints the full signature and qualified name for each scope. This is primarily
+ * so that post-processing tools can identify function overloads, which will have
+ * different signatures but the same qualified name.
+ */
+query predicate printIRGraphScopes(string scopeId, string qualifiedName) {
+ exists(FunctionIR ir, Function func |
+ func = ir.getFunction() and
+ scopeId = getScopeId(func) and
+ qualifiedName = func.getQualifiedName()
+ )
+}
+
+query predicate printIRGraphNodes(string scopeId, string blockId, string label, string location) {
+ exists(IRBlock block |
+ scopeId = getScopeId(block.getFunction()) and
+ blockId = getBlockId(block) and
+ label = "" and
+ location = ""
+ )
+}
+
+query predicate printIRGraphInstructions(string scopeId, string blockId,
+ string id, string label, string location) {
+ exists(IRBlock block, Instruction instr |
+ instr = block.getAnInstruction() and
+ label = instr.toString() and
+ location = instr.getLocation().toString() and
+ scopeId = getScopeId(block.getFunction()) and
+ blockId = getBlockId(block) and
+ id = getInstructionIndexInBlock(instr).toString()
+ )
+}
+
+query predicate printIRGraphEdges(string scopeId,
+ string predecessorId, string successorId, string label) {
+ exists(IRBlock predecessor, IRBlock successor, EdgeKind kind |
+ scopeId = getScopeId(predecessor.getFunction()) and
+ predecessor.getSuccessor(kind) = successor and
+ predecessorId = getBlockId(predecessor) and
+ successorId = getBlockId(successor) and
+ label = kind.toString()
+ )
+}
+
+private string getValueCategoryString(Instruction instr) {
+ if instr.isGLValue() then
+ result = "glval:"
+ else
+ result = ""
+}
+
+private string getResultTypeString(Instruction instr) {
+ exists(Type resultType, string valcat |
+ resultType = instr.getResultType() and
+ valcat = getValueCategoryString(instr) and
+ if resultType instanceof UnknownType and exists(instr.getResultSize()) then
+ result = valcat + resultType.toString() + "[" + instr.getResultSize().toString() + "]"
+ else
+ result = valcat + resultType.toString()
+ )
+}
+
+query predicate printIRGraphDestinationOperands(string scopeId, string blockId,
+ string instructionId, int operandId, string label) {
+ exists(IRBlock block, Instruction instr |
+ block.getAnInstruction() = instr and
+ scopeId = getScopeId(block.getFunction()) and
+ blockId = getBlockId(block) and
+ instructionId = getInstructionIndexInBlock(instr).toString() and
+ not instr.getResultType() instanceof VoidType and
+ operandId = 0 and
+ label = getInstructionResultId(instr) +
+ "(" + getResultTypeString(instr) + ")"
+ )
+}
+
+private string getOperandTagLabel(OperandTag tag) {
+ (
+ tag instanceof PhiOperand and
+ result = "from " + getBlockId(tag.(PhiOperand).getPredecessorBlock()) + ": "
+ )
+ or (
+ tag instanceof ThisArgumentOperand and
+ result = "this:"
+ )
+ or (
+ not tag instanceof PhiOperand and
+ not tag instanceof ThisArgumentOperand and
+ result = ""
+ )
+}
+
+query predicate printIRGraphSourceOperands(string scopeId, string blockId,
+ string instructionId, int operandId, string label) {
+ exists(IRBlock block, Instruction instr |
+ block.getAnInstruction() = instr and
+ blockId = getBlockId(block) and
+ scopeId = getScopeId(block.getFunction()) and
+ instructionId = getInstructionIndexInBlock(instr).toString() and
+ if (instr instanceof UnmodeledUseInstruction) then (
+ operandId = 0 and
+ label = "@mu*"
+ )
+ else (
+ exists(OperandTag tag, Instruction operandInstr |
+ operandInstr = instr.getOperand(tag) and
+ operandId = tag.getSortOrder() and
+ label = getOperandTagLabel(tag) +
+ getInstructionResultId(operandInstr)
+ )
+ )
+ )
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ir/internal/TempVariableTag.qll b/cpp/ql/src/semmle/code/cpp/ir/internal/TempVariableTag.qll
new file mode 100644
index 000000000000..e2decffc6c7b
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/internal/TempVariableTag.qll
@@ -0,0 +1,12 @@
+import cpp
+
+newtype TTempVariableTag =
+ ConditionValueTempVar() or
+ ReturnValueTempVar() or
+ ThrowTempVar()
+
+string getTempVariableTagId(TTempVariableTag tag) {
+ tag = ConditionValueTempVar() and result = "CondVal" or
+ tag = ReturnValueTempVar() and result = "Ret" or
+ tag = ThrowTempVar() and result = "Throw"
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ir/internal/TranslatedCondition.qll b/cpp/ql/src/semmle/code/cpp/ir/internal/TranslatedCondition.qll
new file mode 100644
index 000000000000..dd306632747b
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/internal/TranslatedCondition.qll
@@ -0,0 +1,263 @@
+import cpp
+private import InstructionTag
+private import Opcode
+private import TranslatedElement
+private import TranslatedExpr
+
+abstract class ConditionContext extends TranslatedElement {
+ abstract Instruction getChildTrueSuccessor(TranslatedCondition child);
+
+ abstract Instruction getChildFalseSuccessor(TranslatedCondition child);
+}
+
+TranslatedCondition getTranslatedCondition(Expr expr) {
+ result.getExpr() = expr
+}
+
+abstract class TranslatedCondition extends TranslatedElement {
+ Expr expr;
+
+ override final string toString() {
+ result = expr.toString()
+ }
+
+ override final Locatable getAST() {
+ result = expr
+ }
+
+ final ConditionContext getConditionContext() {
+ result = getParent()
+ }
+
+ final Expr getExpr() {
+ result = expr
+ }
+
+ override final Function getFunction() {
+ result = expr.getEnclosingFunction()
+ }
+
+ final Type getResultType() {
+ result = expr.getType().getUnspecifiedType()
+ }
+}
+
+abstract class TranslatedFlexibleCondition extends TranslatedCondition,
+ ConditionContext, TTranslatedFlexibleCondition {
+ TranslatedFlexibleCondition() {
+ this = TTranslatedFlexibleCondition(expr)
+ }
+
+ override final TranslatedElement getChild(int id) {
+ id = 0 and result = getOperand()
+ }
+
+ override final Instruction getFirstInstruction() {
+ result = getOperand().getFirstInstruction()
+ }
+
+ override final predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ none()
+ }
+
+ override final Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ none()
+ }
+
+ override final Instruction getChildSuccessor(TranslatedElement child) {
+ none()
+ }
+
+ abstract TranslatedCondition getOperand();
+}
+
+class TranslatedParenthesisCondition extends TranslatedFlexibleCondition {
+ ParenthesisExpr paren;
+
+ TranslatedParenthesisCondition() {
+ paren = expr
+ }
+
+ final override Instruction getChildTrueSuccessor(TranslatedCondition child) {
+ child = getOperand() and
+ result = getConditionContext().getChildTrueSuccessor(this)
+ }
+
+ final override Instruction getChildFalseSuccessor(TranslatedCondition child) {
+ child = getOperand() and
+ result = getConditionContext().getChildFalseSuccessor(this)
+ }
+
+ final override TranslatedCondition getOperand() {
+ result = getTranslatedCondition(paren.getExpr())
+ }
+}
+
+class TranslatedNotCondition extends TranslatedFlexibleCondition {
+ NotExpr notExpr;
+
+ TranslatedNotCondition() {
+ notExpr = expr
+ }
+
+ override Instruction getChildTrueSuccessor(TranslatedCondition child) {
+ child = getOperand() and
+ result = getConditionContext().getChildFalseSuccessor(this)
+ }
+
+ override Instruction getChildFalseSuccessor(TranslatedCondition child) {
+ child = getOperand() and
+ result = getConditionContext().getChildTrueSuccessor(this)
+ }
+
+ override TranslatedCondition getOperand() {
+ result = getTranslatedCondition(notExpr.getOperand().getFullyConverted())
+ }
+}
+
+abstract class TranslatedNativeCondition extends TranslatedCondition,
+ TTranslatedNativeCondition {
+ TranslatedNativeCondition() {
+ this = TTranslatedNativeCondition(expr)
+ }
+
+ override final Instruction getChildSuccessor(TranslatedElement child) {
+ none()
+ }
+}
+
+abstract class TranslatedBinaryLogicalOperation extends
+ TranslatedNativeCondition, ConditionContext {
+ BinaryLogicalOperation op;
+
+ TranslatedBinaryLogicalOperation() {
+ op = expr
+ }
+
+ override final TranslatedElement getChild(int id) {
+ id = 0 and result = getLeftOperand() or
+ id = 1 and result = getRightOperand()
+ }
+
+ override final Instruction getFirstInstruction() {
+ result = getLeftOperand().getFirstInstruction()
+ }
+
+ override final predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ none()
+ }
+
+ override final Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ none()
+ }
+
+ final TranslatedCondition getLeftOperand() {
+ result = getTranslatedCondition(op.getLeftOperand().getFullyConverted())
+ }
+
+ final TranslatedCondition getRightOperand() {
+ result = getTranslatedCondition(op.getRightOperand().getFullyConverted())
+ }
+}
+
+class TranslatedLogicalAndExpr extends TranslatedBinaryLogicalOperation {
+ TranslatedLogicalAndExpr() {
+ op instanceof LogicalAndExpr
+ }
+
+ override Instruction getChildTrueSuccessor(TranslatedCondition child) {
+ (
+ child = getLeftOperand() and
+ result = getRightOperand().getFirstInstruction()
+ ) or
+ (
+ child = getRightOperand() and
+ result = getConditionContext().getChildTrueSuccessor(this)
+ )
+ }
+
+ override Instruction getChildFalseSuccessor(TranslatedCondition child) {
+ (child = getLeftOperand() or child = getRightOperand()) and
+ result = getConditionContext().getChildFalseSuccessor(this)
+ }
+}
+
+class TranslatedLogicalOrExpr extends TranslatedBinaryLogicalOperation {
+ TranslatedLogicalOrExpr() {
+ op instanceof LogicalOrExpr
+ }
+
+ override Instruction getChildTrueSuccessor(TranslatedCondition child) {
+ (child = getLeftOperand() or child = getRightOperand()) and
+ result = getConditionContext().getChildTrueSuccessor(this)
+ }
+
+ override Instruction getChildFalseSuccessor(TranslatedCondition child) {
+ (
+ child = getLeftOperand() and
+ result = getRightOperand().getFirstInstruction()
+ ) or
+ (
+ child = getRightOperand() and
+ result = getConditionContext().getChildFalseSuccessor(this)
+ )
+ }
+}
+
+class TranslatedValueCondition extends TranslatedCondition,
+ TTranslatedValueCondition {
+ TranslatedValueCondition() {
+ this = TTranslatedValueCondition(expr)
+ }
+
+ override TranslatedElement getChild(int id) {
+ id = 0 and result = getValueExpr()
+ }
+
+ override Instruction getFirstInstruction() {
+ result = getValueExpr().getFirstInstruction()
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ tag = ValueConditionConditionalBranchTag() and
+ opcode instanceof Opcode::ConditionalBranch and
+ resultType instanceof VoidType and
+ isGLValue = false
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ child = getValueExpr() and
+ result = getInstruction(ValueConditionConditionalBranchTag())
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ tag = ValueConditionConditionalBranchTag() and
+ (
+ (
+ kind instanceof TrueEdge and
+ result = getConditionContext().getChildTrueSuccessor(this)
+ ) or
+ (
+ kind instanceof FalseEdge and
+ result = getConditionContext().getChildFalseSuccessor(this)
+ )
+ )
+ }
+
+ override Instruction getInstructionOperand(InstructionTag tag,
+ OperandTag operandTag) {
+ tag = ValueConditionConditionalBranchTag() and
+ operandTag instanceof ConditionOperand and
+ result = getValueExpr().getResult()
+ }
+
+ private TranslatedExpr getValueExpr() {
+ result = getTranslatedExpr(expr)
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ir/internal/TranslatedDeclarationEntry.qll b/cpp/ql/src/semmle/code/cpp/ir/internal/TranslatedDeclarationEntry.qll
new file mode 100644
index 000000000000..5e060fa08fb5
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/internal/TranslatedDeclarationEntry.qll
@@ -0,0 +1,240 @@
+import cpp
+private import InstructionTag
+private import Opcode
+private import TranslatedElement
+private import TranslatedExpr
+private import TranslatedInitialization
+
+/**
+ * Gets the `TranslatedDeclarationEntry` that represents the declaration
+ * `entry`.
+ */
+TranslatedDeclarationEntry getTranslatedDeclarationEntry(
+ DeclarationEntry entry) {
+ result.getAST() = entry
+}
+
+/**
+ * Represents the IR translation of a declaration within the body of a function.
+ * Most often, this is the declaration of an automatic local variable, although
+ * it can also be the declaration of a static local variable, an extern
+ * variable, or an extern function.
+ */
+abstract class TranslatedDeclarationEntry extends TranslatedElement,
+ TTranslatedDeclarationEntry {
+ DeclarationEntry entry;
+
+ TranslatedDeclarationEntry() {
+ this = TTranslatedDeclarationEntry(entry)
+ }
+
+ override final Function getFunction() {
+ exists(DeclStmt stmt |
+ stmt.getADeclarationEntry() = entry and
+ result = stmt.getEnclosingFunction()
+ )
+ }
+
+ override final string toString() {
+ result = entry.toString()
+ }
+
+ override final Locatable getAST() {
+ result = entry
+ }
+}
+
+/**
+ * Represents the IR translation of a declaration within the body of a function,
+ * for declarations other than local variables. Since these have no semantic
+ * effect, they are translated as `NoOp`.
+ */
+class TranslatedNonVariableDeclaration extends
+ TranslatedDeclarationEntry {
+ TranslatedNonVariableDeclaration() {
+ not entry.getDeclaration() instanceof LocalVariable
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ opcode instanceof Opcode::NoOp and
+ tag = OnlyInstructionTag() and
+ resultType instanceof VoidType and
+ isGLValue = false
+ }
+
+ override Instruction getFirstInstruction() {
+ result = getInstruction(OnlyInstructionTag())
+ }
+
+ override TranslatedElement getChild(int id) {
+ none()
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ tag = OnlyInstructionTag() and
+ result = getParent().getChildSuccessor(this) and
+ kind instanceof GotoEdge
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ none()
+ }
+}
+
+/**
+ * Represents the IR translation of the declaration of a local variable,
+ * including its initialization, if any.
+ */
+abstract class TranslatedVariableDeclaration extends
+ TranslatedDeclarationEntry {
+ LocalVariable var;
+
+ TranslatedVariableDeclaration() {
+ entry.getDeclaration() = var
+ }
+}
+
+/**
+ * Represents the IR translation of a local variable with no initializer. The
+ * generated IR stores the result of an `Uninitialized` instruction into the
+ * variable.
+ */
+class TranslatedUninitializedVariable extends
+ TranslatedVariableDeclaration {
+ TranslatedUninitializedVariable() {
+ not exists(Initializer init |
+ init.getDeclaration() = var
+ )
+ }
+
+ override TranslatedElement getChild(int id) {
+ none()
+ }
+
+ override Instruction getFirstInstruction() {
+ result = getInstruction(InitializerVariableAddressTag())
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ (
+ tag = InitializerVariableAddressTag() and
+ opcode instanceof Opcode::VariableAddress and
+ resultType = var.getType().getUnspecifiedType() and
+ isGLValue = true
+ ) or
+ (
+ tag = InitializerStoreTag() and
+ opcode instanceof Opcode::Store and
+ resultType = var.getType().getUnspecifiedType() and
+ isGLValue = false
+ ) or
+ (
+ tag = InitializerUninitializedTag() and
+ opcode instanceof Opcode::Uninitialized and
+ resultType = var.getType().getUnspecifiedType() and
+ isGLValue = false
+ )
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ kind instanceof GotoEdge and
+ (
+ (
+ tag = InitializerVariableAddressTag() and
+ result = getInstruction(InitializerUninitializedTag())
+ ) or
+ (
+ tag = InitializerUninitializedTag() and
+ result = getInstruction(InitializerStoreTag())
+ ) or
+ (
+ tag = InitializerStoreTag() and
+ result = getParent().getChildSuccessor(this)
+ )
+ )
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ none()
+ }
+
+ override Instruction getInstructionOperand(InstructionTag tag,
+ OperandTag operandTag) {
+ tag = InitializerStoreTag() and
+ (
+ (
+ operandTag instanceof LoadStoreAddressOperand and
+ result = getInstruction(InitializerVariableAddressTag())
+ ) or
+ (
+ operandTag instanceof CopySourceOperand and
+ result = getInstruction(InitializerUninitializedTag())
+ )
+ )
+ }
+
+ override IRVariable getInstructionVariable(InstructionTag tag) {
+ tag = InitializerVariableAddressTag() and
+ result = getIRUserVariable(var.getFunction(), var)
+ }
+}
+
+/**
+ * Represents the IR translation of a local variable with an initializer.
+ */
+class TranslatedInitializedVariable extends
+ TranslatedVariableDeclaration, InitializationContext {
+ Initializer init;
+
+ TranslatedInitializedVariable() {
+ init.getDeclaration() = var
+ }
+
+ override TranslatedElement getChild(int id) {
+ id = 0 and result = getInitialization()
+ }
+
+ override Instruction getFirstInstruction() {
+ result = getInstruction(InitializerVariableAddressTag())
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ tag = InitializerVariableAddressTag() and
+ opcode instanceof Opcode::VariableAddress and
+ resultType = var.getType().getUnspecifiedType() and
+ isGLValue = true
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ tag = InitializerVariableAddressTag() and
+ result = getInitialization().getFirstInstruction() and
+ kind instanceof GotoEdge
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ child = getInitialization() and result = getParent().getChildSuccessor(this)
+ }
+
+ override IRVariable getInstructionVariable(InstructionTag tag) {
+ tag = InitializerVariableAddressTag() and
+ result = getIRUserVariable(var.getFunction(), var)
+ }
+
+ override Instruction getTargetAddress() {
+ result = getInstruction(InitializerVariableAddressTag())
+ }
+
+ override Type getTargetType() {
+ result = var.getType().getUnspecifiedType()
+ }
+
+ private TranslatedInitialization getInitialization() {
+ result = getTranslatedInitialization(init.getExpr().getFullyConverted())
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ir/internal/TranslatedElement.qll b/cpp/ql/src/semmle/code/cpp/ir/internal/TranslatedElement.qll
new file mode 100644
index 000000000000..eb233bf6bae9
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/internal/TranslatedElement.qll
@@ -0,0 +1,563 @@
+import cpp
+import semmle.code.cpp.ir.IR
+private import InstructionTag
+private import Opcode
+private import TempVariableTag
+private import TranslatedCondition
+private import TranslatedFunction
+private import TranslatedStmt
+
+/**
+ * Gets the built-in `int` type.
+ */
+Type getIntType() {
+ result.(IntType).isImplicitlySigned()
+}
+
+/**
+ * If `expr` is a conversion, gets the expression being converted. Otherwise,
+ * returns `expr`.
+ */
+private Expr getUnconvertedExpr(Expr expr) {
+ if expr instanceof Conversion then (
+ result = getUnconvertedExpr(expr.(Conversion).getExpr())
+ ) else (
+ result = expr
+ )
+}
+
+/**
+ * Gets the "real" parent of `expr`. This predicate treats conversions as if
+ * they were explicit nodes in the expression tree, rather than as implicit
+ * nodes as in the regular AST representation.
+ */
+private Element getRealParent(Expr expr) {
+ if expr.hasConversion() then (
+ // The expression has a conversion, so treat that as its parent
+ result = expr.getConversion()
+ )
+ else (
+ // Either the expression is a top-level conversion, or it's not a
+ // conversion. The real parent is the parent of the original unconverted
+ // expression.
+ result = getUnconvertedExpr(expr).getParent() or
+ // The parent of a DestructorDestruction is the destructor itself.
+ result.(Destructor).getADestruction() = expr
+ )
+}
+
+/**
+ * Holds if `expr` should be ignored for the purposes of code generation due to
+ * some property of `expr` itself. Unlike `ignoreExpr()`, this predicate does
+ * not ignore an expression solely because it is a descendant of an ignored
+ * element.
+ */
+private predicate ignoreExprLocal(Expr expr) {
+ // Ignore parentless expressions
+ not exists(getRealParent(expr)) or
+ // Ignore the constants in SwitchCase, since their values are embedded in the
+ // CaseEdge.
+ getRealParent(expr) instanceof SwitchCase or
+ // Ignore descendants of constant expressions, since we'll just substitute the
+ // constant value.
+ getRealParent(expr).(Expr).isConstant() or
+ // The `DestructorCall` node for a `DestructorFieldDestruction` has a `FieldAccess`
+ // node as its qualifier, but that `FieldAccess` does not have a child of its own.
+ // We'll ignore that `FieldAccess`, and supply the receiver as part of the calling
+ // context, much like we do with constructor calls.
+ expr.getParent().(DestructorCall).getParent() instanceof DestructorFieldDestruction
+}
+
+/**
+ * Holds if `expr` should be ignored for the purposes of IR generation.
+ */
+private predicate ignoreExpr(Expr expr) {
+ ignoreExprLocal(expr) or
+ // Ignore all descendants of ignored elements as well.
+ ignoreElement(getRealParent(expr))
+}
+
+/**
+ * Holds if `element` should be ignored for the purposes of IR generation.
+ */
+private predicate ignoreElement(Element element) {
+ ignoreExpr(element.(Expr))
+}
+
+/**
+ * Holds if `expr` is most naturally evaluated as control flow, rather than as
+ * a value.
+ */
+private predicate isNativeCondition(Expr expr) {
+ expr instanceof BinaryLogicalOperation
+}
+
+/**
+ * Holds if `expr` can be evaluated as either a condition or a value expression,
+ * depending on context.
+ */
+private predicate isFlexibleCondition(Expr expr) {
+ (
+ expr instanceof ParenthesisExpr or
+ expr instanceof NotExpr
+ ) and
+ usedAsCondition(expr)
+}
+
+/**
+ * Holds if `expr` is used in a condition context, i.e. the Boolean result of
+ * the expression is directly used to determine control flow.
+ */
+private predicate usedAsCondition(Expr expr) {
+ exists(BinaryLogicalOperation op |
+ op.getLeftOperand().getFullyConverted() = expr or
+ op.getRightOperand().getFullyConverted() = expr
+ ) or
+ exists(Loop loop |
+ loop.getCondition().getFullyConverted() = expr
+ ) or
+ exists(IfStmt ifStmt |
+ ifStmt.getCondition().getFullyConverted() = expr
+ ) or
+ exists(ConditionalExpr condExpr |
+ condExpr.getCondition().getFullyConverted() = expr
+ ) or
+ exists(NotExpr notExpr |
+ notExpr.getOperand().getFullyConverted() = expr and
+ usedAsCondition(notExpr)
+ ) or
+ exists(ParenthesisExpr paren |
+ paren.getExpr() = expr and
+ usedAsCondition(paren)
+ )
+}
+
+/**
+ * Holds if `expr` has an lvalue-to-rvalue conversion that should be ignored
+ * when generating IR. This occurs for conversion from an lvalue of function type
+ * to an rvalue of function pointer type. The conversion is represented in the
+ * AST as an lvalue-to-rvalue conversion, but the IR represents both a function
+ * lvalue and a function pointer prvalue the same.
+ */
+predicate ignoreLoad(Expr expr) {
+ expr.hasLValueToRValueConversion() and
+ (
+ expr instanceof ThisExpr or
+ expr instanceof FunctionAccess or
+ expr.(PointerDereferenceExpr).getOperand().getFullyConverted().getType().
+ getUnspecifiedType() instanceof FunctionPointerType or
+ expr.(ReferenceDereferenceExpr).getExpr().getType().
+ getUnspecifiedType() instanceof FunctionReferenceType
+ )
+}
+
+newtype TTranslatedElement =
+ // An expression that is not being consumed as a condition
+ TTranslatedNonLoadExpr(Expr expr) {
+ not ignoreExpr(expr) and
+ not isNativeCondition(expr) and
+ not isFlexibleCondition(expr)
+ } or
+ // A separate element to handle the lvalue-to-rvalue conversion step of an
+ // expression.
+ TTranslatedLoad(Expr expr) {
+ not ignoreExpr(expr) and
+ not isNativeCondition(expr) and
+ not isFlexibleCondition(expr) and
+ expr.hasLValueToRValueConversion() and
+ not ignoreLoad(expr)
+ } or
+ // An expression most naturally translated as control flow.
+ TTranslatedNativeCondition(Expr expr) {
+ not ignoreExpr(expr) and
+ isNativeCondition(expr)
+ } or
+ // An expression that can best be translated as control flow given the context
+ // in which it is used.
+ TTranslatedFlexibleCondition(Expr expr) {
+ not ignoreExpr(expr) and
+ isFlexibleCondition(expr)
+ } or
+ // An expression that is not naturally translated as control flow, but is
+ // consumed in a condition context. This element adapts the original element
+ // to the condition context.
+ TTranslatedValueCondition(Expr expr) {
+ not ignoreExpr(expr) and
+ not isNativeCondition(expr) and
+ not isFlexibleCondition(expr) and
+ usedAsCondition(expr)
+ } or
+ // An expression that is naturally translated as control flow, but is used in
+ // a context where a simple value is expected. This element adapts the
+ // original condition to the value context.
+ TTranslatedConditionValue(Expr expr) {
+ not ignoreExpr(expr) and
+ isNativeCondition(expr) and
+ not usedAsCondition(expr)
+ } or
+ // An expression used as an initializer.
+ TTranslatedInitialization(Expr expr) {
+ not ignoreExpr(expr) and
+ (
+ exists(Initializer init |
+ init.getExpr().getFullyConverted() = expr
+ ) or
+ exists(ClassAggregateLiteral initList |
+ initList.getFieldExpr(_).getFullyConverted() = expr
+ ) or
+ exists(ArrayAggregateLiteral initList |
+ initList.getElementExpr(_).getFullyConverted() = expr
+ ) or
+ exists(ReturnStmt returnStmt |
+ returnStmt.getExpr().getFullyConverted() = expr
+ ) or
+ exists(ConstructorFieldInit fieldInit |
+ fieldInit.getExpr().getFullyConverted() = expr
+ ) or
+ exists(ThrowExpr throw |
+ throw.getExpr().getFullyConverted() = expr
+ )
+ )
+ } or
+ // The initialization of a field via a member of an initializer list.
+ TTranslatedExplicitFieldInitialization(Expr ast, Field field,
+ Expr expr) {
+ exists(ClassAggregateLiteral initList |
+ not ignoreExpr(initList) and
+ ast = initList and
+ expr = initList.getFieldExpr(field).getFullyConverted()
+ ) or
+ exists(ConstructorFieldInit init |
+ not ignoreExpr(init) and
+ ast = init and
+ field = init.getTarget() and
+ expr = init.getExpr().getFullyConverted()
+ )
+ } or
+ // The value initialization of a field due to an omitted member of an
+ // initializer list.
+ TTranslatedFieldValueInitialization(Expr ast, Field field) {
+ exists(ClassAggregateLiteral initList |
+ not ignoreExpr(initList) and
+ ast = initList and
+ initList.isValueInitialized(field)
+ )
+ } or
+ // The initialization of an array element via a member of an initializer list.
+ TTranslatedExplicitElementInitialization(
+ ArrayAggregateLiteral initList, int elementIndex) {
+ not ignoreExpr(initList) and
+ exists(initList.getElementExpr(elementIndex))
+ } or
+ // The value initialization of a range of array elements that were omitted
+ // from an initializer list.
+ TTranslatedElementValueInitialization(ArrayAggregateLiteral initList,
+ int elementIndex, int elementCount) {
+ not ignoreExpr(initList) and
+ isFirstValueInitializedElementInRange(initList, elementIndex) and
+ elementCount =
+ getNextExplicitlyInitializedElementAfter(initList, elementIndex) -
+ elementIndex
+ } or
+ // The initialization of a base class from within a constructor.
+ TTranslatedConstructorBaseInit(ConstructorBaseInit init) {
+ not ignoreExpr(init)
+ } or
+ // The destruction of a base class from within a destructor.
+ TTranslatedDestructorBaseDestruction(DestructorBaseDestruction destruction) {
+ not ignoreExpr(destruction)
+ } or
+ // The destruction of a field from within a destructor.
+ TTranslatedDestructorFieldDestruction(DestructorFieldDestruction destruction) {
+ not ignoreExpr(destruction)
+ } or
+ // A statement
+ TTranslatedStmt(Stmt stmt) or
+ // A function
+ TTranslatedFunction(Function func) {
+ func.hasEntryPoint() and
+ not func.isFromUninstantiatedTemplate(_)
+ } or
+ // A constructor init list
+ TTranslatedConstructorInitList(Function func) {
+ func.hasEntryPoint()
+ } or
+ // A destructor destruction list
+ TTranslatedDestructorDestructionList(Function func) {
+ func.hasEntryPoint()
+ } or
+ // A function parameter
+ TTranslatedParameter(Parameter param) {
+ param.getFunction().hasEntryPoint() or
+ exists(param.getCatchBlock())
+ } or
+ // A local declaration
+ TTranslatedDeclarationEntry(DeclarationEntry entry) {
+ exists(DeclStmt declStmt |
+ declStmt.getADeclarationEntry() = entry
+ )
+ }
+
+/**
+ * Gets the index of the first explicitly initialized element in `initList`
+ * whose index is greater than `afterElementIndex`. If there are no remaining
+ * explicitly initialized elements in `initList`, the result is the total number
+ * of elements in the array being initialized.
+ */
+ private int getNextExplicitlyInitializedElementAfter(
+ ArrayAggregateLiteral initList, int afterElementIndex) {
+ if exists(int x |
+ x > afterElementIndex and
+ exists(initList.getElementExpr(x)))
+ then (
+ if exists(initList.getElementExpr(afterElementIndex + 1))
+ then result = afterElementIndex + 1
+ else result = getNextExplicitlyInitializedElementAfter(initList, afterElementIndex+1))
+ else
+ result = initList.getType().getUnspecifiedType().(ArrayType).getArraySize() and
+ // required for binding
+ initList.isInitialized(afterElementIndex)
+}
+
+/**
+ * Holds if element `elementIndex` is the first value-initialized element in a
+ * range of one or more consecutive value-initialized elements in `initList`.
+ */
+private predicate isFirstValueInitializedElementInRange(
+ ArrayAggregateLiteral initList, int elementIndex) {
+ initList.isValueInitialized(elementIndex) and
+ (
+ elementIndex = 0 or
+ not initList.isValueInitialized(elementIndex - 1)
+ )
+}
+
+/**
+ * Represents an AST node for which IR needs to be generated.
+ *
+ * In most cases, there is a single `TranslatedElement` for each AST node.
+ * However, when a single AST node performs two separable operations (e.g.
+ * a `VariableAccess` that is also a load), there may be multiple
+ * `TranslatedElement` nodes for a single AST node.
+ */
+abstract class TranslatedElement extends TTranslatedElement {
+ abstract string toString();
+
+ /**
+ * Gets the AST node being translated.
+ */
+ abstract Locatable getAST();
+
+ /**
+ * Get the first instruction to be executed in the evaluation of this element.
+ */
+ abstract Instruction getFirstInstruction();
+
+ /**
+ * Get the immediate child elements of this element.
+ */
+ final TranslatedElement getAChild() {
+ result = getChild(_)
+ }
+
+ /**
+ * Gets the immediate child element of this element. The `id` is unique
+ * among all children of this element, but the values are not necessarily
+ * consecutive.
+ */
+ abstract TranslatedElement getChild(int id);
+
+ /**
+ * Gets the an identifier string for the element. This string is unique within
+ * the scope of the element's function.
+ */
+ final string getId() {
+ result = getUniqueId().toString()
+ }
+
+ private TranslatedElement getChildByRank(int rankIndex) {
+ result = rank[rankIndex + 1](TranslatedElement child, int id |
+ child = getChild(id) |
+ child order by id
+ )
+ }
+
+ language[monotonicAggregates]
+ private int getDescendantCount() {
+ result = 1 + sum(TranslatedElement child |
+ child = getChildByRank(_) |
+ child.getDescendantCount()
+ )
+ }
+
+ private int getUniqueId() {
+ if not exists(getParent()) then
+ result = 0
+ else
+ exists(TranslatedElement parent |
+ parent = getParent() and
+ if this = parent.getChildByRank(0) then
+ result = 1 + parent.getUniqueId()
+ else
+ exists(int childIndex, TranslatedElement previousChild |
+ this = parent.getChildByRank(childIndex) and
+ previousChild = parent.getChildByRank(childIndex - 1) and
+ result = previousChild.getUniqueId() +
+ previousChild.getDescendantCount()
+ )
+ )
+ }
+
+ /**
+ * Holds if this element generates an instruction with opcode `opcode` and
+ * result type `resultType`. `tag` must be unique for each instruction
+ * generated from the same AST node (not just from the same
+ * `TranslatedElement`).
+ * If the instruction does not return a result, `resultType` should be
+ * `VoidType`.
+ */
+ abstract predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue);
+
+ /**
+ * Gets the `Function` that contains this element.
+ */
+ abstract Function getFunction();
+
+ /**
+ * Gets the successor instruction of the instruction that was generated by
+ * this element for tag `tag`. The successor edge kind is specified by `kind`.
+ */
+ abstract Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind);
+
+ /**
+ * Gets the successor instruction to which control should flow after the
+ * child element specified by `child` has finished execution.
+ */
+ abstract Instruction getChildSuccessor(TranslatedElement child);
+
+ /**
+ * Gets the instruction to which control should flow if an exception is thrown
+ * within this element. This will generally return first `catch` block of the
+ * nearest enclosing `try`, or the `Unwind` instruction for the function if
+ * there is no enclosing `try`.
+ */
+ Instruction getExceptionSuccessorInstruction() {
+ result = getParent().getExceptionSuccessorInstruction()
+ }
+
+ /**
+ * Holds if this element generates a temporary variable with type `type`.
+ * `tag` must be unique for each variable generated from the same AST node
+ * (not just from the same `TranslatedElement`).
+ */
+ predicate hasTempVariable(TempVariableTag tag, Type type) {
+ none()
+ }
+
+ /**
+ * If the instruction specified by `tag` is a `FunctionInstruction`, gets the
+ * `Function` for that instruction.
+ */
+ Function getInstructionFunction(InstructionTag tag) {
+ none()
+ }
+
+ /**
+ * If the instruction specified by `tag` is a `VariableInstruction`, gets the
+ * `IRVariable` for that instruction.
+ */
+ IRVariable getInstructionVariable(InstructionTag tag) {
+ none()
+ }
+
+ /**
+ * If the instruction specified by `tag` is a `FieldInstruction`, gets the
+ * `Field` for that instruction.
+ */
+ Field getInstructionField(InstructionTag tag) {
+ none()
+ }
+
+ /**
+ * If the instruction specified by `tag` is a `ConstantValueInstruction`, gets
+ * the constant value for that instruction.
+ */
+ string getInstructionConstantValue(InstructionTag tag) {
+ none()
+ }
+
+ /**
+ * If the instruction specified by `tag` is a `PointerArithmeticInstruction`,
+ * gets the size of the type pointed to by the pointer.
+ */
+ int getInstructionElementSize(InstructionTag tag) {
+ none()
+ }
+
+ /**
+ * If the instruction specified by `tag` has a result of type `UnknownType`,
+ * gets the size of the result in bytes. If the result does not have a knonwn
+ * constant size, this predicate does not hold.
+ */
+ int getInstructionResultSize(InstructionTag tag) {
+ none()
+ }
+
+ /**
+ * If the instruction specified by `tag` is a `StringConstantInstruction`,
+ * gets the `StringLiteral` for that instruction.
+ */
+ StringLiteral getInstructionStringLiteral(InstructionTag tag) {
+ none()
+ }
+
+ /**
+ * If the instruction specified by `tag` is a `CatchByTypeInstruction`,
+ * gets the type of the exception to be caught.
+ */
+ Type getInstructionExceptionType(InstructionTag tag) {
+ none()
+ }
+
+ /**
+ * If the instruction specified by `tag` is an `InheritanceConversionInstruction`,
+ * gets the inheritance relationship for that instruction.
+ */
+ predicate getInstructionInheritance(InstructionTag tag, Class baseClass,
+ Class derivedClass) {
+ none()
+ }
+
+ /**
+ * Gets the instruction whose result is consumed as an operand of the
+ * instruction specified by `tag`, with the operand specified by `operandTag`.
+ */
+ Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+ none()
+ }
+
+ /**
+ * Gets the instruction generated by this element with tag `tag`.
+ */
+ final Instruction getInstruction(InstructionTag tag) {
+ result.getAST() = getAST() and
+ result.getTag() = tag
+ }
+
+ /**
+ * Gets the temporary variable generated by this element with tag `tag`.
+ */
+ final IRTempVariable getTempVariable(TempVariableTag tag) {
+ result.getAST() = getAST() and
+ result.getTag() = tag
+ }
+
+ /**
+ * Gets the parent element of this element.
+ */
+ final TranslatedElement getParent() {
+ result.getAChild() = this
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ir/internal/TranslatedExpr.qll b/cpp/ql/src/semmle/code/cpp/ir/internal/TranslatedExpr.qll
new file mode 100644
index 000000000000..c259067867cb
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/internal/TranslatedExpr.qll
@@ -0,0 +1,2499 @@
+import cpp
+private import InstructionTag
+private import Opcode
+private import TempVariableTag
+private import TranslatedCondition
+private import TranslatedElement
+private import TranslatedFunction
+private import TranslatedInitialization
+
+/**
+ * Gets the TranslatedExpr for the specified expression. If `expr` is a load,
+ * the result is the TranslatedExpr for the load portion.
+ */
+TranslatedExpr getTranslatedExpr(Expr expr) {
+ result.getExpr() = expr and
+ result.producesExprResult()
+}
+
+abstract class TranslatedExpr extends TranslatedElement {
+ Expr expr;
+
+ override final string toString() {
+ result = expr.toString()
+ }
+
+ override final Locatable getAST() {
+ result = expr
+ }
+
+ final Expr getExpr() {
+ result = expr
+ }
+
+ override final Function getFunction() {
+ result = expr.getEnclosingFunction()
+ }
+
+ final TranslatedFunction getEnclosingFunction() {
+ result = getTranslatedFunction(expr.getEnclosingFunction())
+ }
+
+ final Type getResultType() {
+ result = expr.getType().getUnspecifiedType()
+ }
+
+ abstract Instruction getResult();
+
+ /**
+ * Holds if this `TranslatedExpr` produces the final result of the original
+ * expression from the AST.
+ *
+ * For example, in `y = x;`, the TranslatedLoad for the VariableAccess `x`
+ * produces the result of that VariableAccess expression, but the
+ * TranslatedVariableAccess for `x` does not. The TranslatedVariableAccess
+ * for `y` does produce its result, however, because there is no load on `y`.
+ */
+ final predicate producesExprResult() {
+ // A load always produces the result of the expression.
+ this instanceof TranslatedLoad or
+ // If there's no load, then this is the only TranslatedExpr for this
+ // expression.
+ not expr.hasLValueToRValueConversion() or
+ // If we're supposed to ignore the load on this expression, then this
+ // is the only TranslatedExpr.
+ ignoreLoad(expr)
+ }
+
+ /**
+ * Returns `true` if the result of this `TranslatedExpr` is a glvalue, or
+ * `false` if the result is a prvalue.
+ *
+ * This predicate returns a `boolean` value instead of just a being a plain
+ * predicate because all of the subclass predicates that call it require a
+ * `boolean` value.
+ */
+ final boolean isResultGLValue() {
+ if(
+ expr.isGLValueCategory() or
+ // If this TranslatedExpr doesn't produce the result, then it must represent
+ // a glvalue that is then loaded by a TranslatedLoad.
+ not producesExprResult()
+ ) then
+ result = true
+ else
+ result = false
+ }
+}
+
+class TranslatedConditionValue extends TranslatedExpr, ConditionContext,
+ TTranslatedConditionValue {
+ TranslatedConditionValue() {
+ this = TTranslatedConditionValue(expr)
+ }
+
+ override TranslatedElement getChild(int id) {
+ id = 0 and result = getCondition()
+ }
+
+ override Instruction getFirstInstruction() {
+ result = getCondition().getFirstInstruction()
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ (
+ (
+ tag = ConditionValueTrueTempAddressTag() or
+ tag = ConditionValueFalseTempAddressTag() or
+ tag = ConditionValueResultTempAddressTag()
+ ) and
+ opcode instanceof Opcode::VariableAddress and
+ resultType = getResultType() and
+ isGLValue = true
+ ) or
+ (
+ (
+ tag = ConditionValueTrueConstantTag() or
+ tag = ConditionValueFalseConstantTag()
+ ) and
+ opcode instanceof Opcode::Constant and
+ resultType = getResultType() and
+ isGLValue = isResultGLValue()
+ ) or
+ (
+ (
+ tag = ConditionValueTrueStoreTag() or
+ tag = ConditionValueFalseStoreTag()
+ ) and
+ opcode instanceof Opcode::Store and
+ resultType = getResultType() and
+ isGLValue = isResultGLValue()
+ ) or
+ (
+ tag = ConditionValueResultLoadTag() and
+ opcode instanceof Opcode::Load and
+ resultType = getResultType() and
+ isGLValue = isResultGLValue()
+ )
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ kind instanceof GotoEdge and
+ (
+ (
+ tag = ConditionValueTrueTempAddressTag() and
+ result = getInstruction(ConditionValueTrueConstantTag())
+ ) or
+ (
+ tag = ConditionValueTrueConstantTag() and
+ result = getInstruction(ConditionValueTrueStoreTag())
+ ) or
+ (
+ tag = ConditionValueTrueStoreTag() and
+ result = getInstruction(ConditionValueResultTempAddressTag())
+ ) or
+ (
+ tag = ConditionValueFalseTempAddressTag() and
+ result = getInstruction(ConditionValueFalseConstantTag())
+ ) or
+ (
+ tag = ConditionValueFalseConstantTag() and
+ result = getInstruction(ConditionValueFalseStoreTag())
+ ) or
+ (
+ tag = ConditionValueFalseStoreTag() and
+ result = getInstruction(ConditionValueResultTempAddressTag())
+ ) or
+ (
+ tag = ConditionValueResultTempAddressTag() and
+ result = getInstruction(ConditionValueResultLoadTag())
+ ) or
+ (
+ tag = ConditionValueResultLoadTag() and
+ result = getParent().getChildSuccessor(this)
+ )
+ )
+ }
+
+ override Instruction getInstructionOperand(InstructionTag tag,
+ OperandTag operandTag) {
+ (
+ tag = ConditionValueTrueStoreTag() and
+ (
+ (
+ operandTag instanceof LoadStoreAddressOperand and
+ result = getInstruction(ConditionValueTrueTempAddressTag())
+ ) or
+ (
+ operandTag instanceof CopySourceOperand and
+ result = getInstruction(ConditionValueTrueConstantTag())
+ )
+ )
+ ) or
+ (
+ tag = ConditionValueFalseStoreTag() and
+ (
+ (
+ operandTag instanceof LoadStoreAddressOperand and
+ result = getInstruction(ConditionValueFalseTempAddressTag())
+ ) or
+ (
+ operandTag instanceof CopySourceOperand and
+ result = getInstruction(ConditionValueFalseConstantTag())
+ )
+ )
+ ) or
+ (
+ tag = ConditionValueResultLoadTag() and
+ (
+ (
+ operandTag instanceof LoadStoreAddressOperand and
+ result = getInstruction(ConditionValueResultTempAddressTag())
+ ) or
+ (
+ operandTag instanceof CopySourceOperand and
+ result = getEnclosingFunction().getUnmodeledDefinitionInstruction()
+ )
+ )
+ )
+ }
+
+ override predicate hasTempVariable(TempVariableTag tag, Type type) {
+ tag = ConditionValueTempVar() and
+ type = getResultType()
+ }
+
+ override IRVariable getInstructionVariable(InstructionTag tag) {
+ (
+ tag = ConditionValueTrueTempAddressTag() or
+ tag = ConditionValueFalseTempAddressTag() or
+ tag = ConditionValueResultTempAddressTag()
+ ) and
+ result = getTempVariable(ConditionValueTempVar())
+ }
+
+ override string getInstructionConstantValue(InstructionTag tag) {
+ tag = ConditionValueTrueConstantTag() and result = "1" or
+ tag = ConditionValueFalseConstantTag() and result = "0"
+ }
+
+ override Instruction getResult() {
+ result = getInstruction(ConditionValueResultLoadTag())
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ none()
+ }
+
+ override Instruction getChildTrueSuccessor(TranslatedCondition child) {
+ child = getCondition() and
+ result = getInstruction(ConditionValueTrueTempAddressTag())
+ }
+
+ override Instruction getChildFalseSuccessor(TranslatedCondition child) {
+ child = getCondition() and
+ result = getInstruction(ConditionValueFalseTempAddressTag())
+ }
+
+ private TranslatedCondition getCondition() {
+ result = getTranslatedCondition(expr)
+ }
+}
+
+class TranslatedLoad extends TranslatedExpr, TTranslatedLoad {
+ TranslatedLoad() {
+ this = TTranslatedLoad(expr)
+ }
+
+ override Instruction getFirstInstruction() {
+ result = getOperand().getFirstInstruction()
+ }
+
+ override TranslatedElement getChild(int id) {
+ id = 0 and result = getOperand()
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ tag = LoadTag() and
+ opcode instanceof Opcode::Load and
+ resultType = getResultType() and
+ isGLValue = isResultGLValue()
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ tag = LoadTag() and
+ result = getParent().getChildSuccessor(this) and
+ kind instanceof GotoEdge
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ child = getOperand() and result = getInstruction(LoadTag())
+ }
+
+ override Instruction getResult() {
+ result = getInstruction(LoadTag())
+ }
+
+ override Instruction getInstructionOperand(InstructionTag tag,
+ OperandTag operandTag) {
+ tag = LoadTag() and
+ (
+ (
+ operandTag instanceof LoadStoreAddressOperand and
+ result = getOperand().getResult()
+ ) or
+ (
+ operandTag instanceof CopySourceOperand and
+ result = getEnclosingFunction().getUnmodeledDefinitionInstruction()
+ )
+ )
+ }
+
+ private TranslatedExpr getOperand() {
+ result.getExpr() = expr and not result instanceof TranslatedLoad
+ }
+}
+
+class TranslatedCommaExpr extends TranslatedNonConstantExpr {
+ CommaExpr comma;
+
+ TranslatedCommaExpr() {
+ comma = expr
+ }
+
+ override Instruction getFirstInstruction() {
+ result = getLeftOperand().getFirstInstruction()
+ }
+
+ override TranslatedElement getChild(int id) {
+ id = 0 and result = getLeftOperand() or
+ id = 1 and result = getRightOperand()
+ }
+
+ override Instruction getResult() {
+ result = getRightOperand().getResult()
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ none()
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ (
+ child = getLeftOperand() and
+ result = getRightOperand().getFirstInstruction()
+ ) or
+ child = getRightOperand() and result = getParent().getChildSuccessor(this)
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ none()
+ }
+
+ override Instruction getInstructionOperand(InstructionTag tag,
+ OperandTag operandTag) {
+ none()
+ }
+
+ private TranslatedExpr getLeftOperand() {
+ result = getTranslatedExpr(comma.getLeftOperand().getFullyConverted())
+ }
+
+ private TranslatedExpr getRightOperand() {
+ result = getTranslatedExpr(comma.getRightOperand().getFullyConverted())
+ }
+}
+
+abstract class TranslatedCrementOperation extends TranslatedNonConstantExpr {
+ CrementOperation op;
+
+ TranslatedCrementOperation() {
+ op = expr
+ }
+
+ override final TranslatedElement getChild(int id) {
+ id = 0 and result = getOperand()
+ }
+
+ override final string getInstructionConstantValue(InstructionTag tag) {
+ tag = CrementConstantTag() and
+ exists(Type resultType |
+ resultType = getResultType() and
+ (
+ resultType instanceof IntegralType and result = "1" or
+ resultType instanceof FloatingPointType and result = "1.0" or
+ resultType instanceof PointerType and result = "1"
+ )
+ )
+ }
+
+ private Type getConstantType() {
+ exists(Type resultType |
+ resultType = getResultType() and
+ (
+ resultType instanceof ArithmeticType and result = resultType or
+ resultType instanceof PointerType and result = getIntType()
+ )
+ )
+ }
+
+ override final predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ isGLValue = false and
+ (
+ (
+ tag = CrementLoadTag() and
+ opcode instanceof Opcode::Load and
+ resultType = getResultType()
+ ) or
+ (
+ tag = CrementConstantTag() and
+ opcode instanceof Opcode::Constant and
+ resultType = getConstantType()
+ ) or
+ (
+ tag = CrementOpTag() and
+ opcode = getOpcode() and
+ resultType = getResultType()
+ ) or
+ (
+ tag = CrementStoreTag() and
+ opcode instanceof Opcode::Store and
+ resultType = getResultType()
+ )
+ )
+ }
+
+ override final Instruction getInstructionOperand(InstructionTag tag,
+ OperandTag operandTag) {
+ (
+ tag = CrementLoadTag() and
+ (
+ (
+ operandTag instanceof LoadStoreAddressOperand and
+ result = getOperand().getResult()
+ ) or
+ (
+ operandTag instanceof CopySourceOperand and
+ result = getEnclosingFunction().getUnmodeledDefinitionInstruction()
+ )
+ )
+ ) or
+ (
+ tag = CrementOpTag() and
+ (
+ (
+ operandTag instanceof LeftOperand and
+ result = getInstruction(CrementLoadTag())
+ ) or
+ (
+ operandTag instanceof RightOperand and
+ result = getInstruction(CrementConstantTag())
+ )
+ )
+ ) or
+ (
+ tag = CrementStoreTag() and
+ (
+ (
+ operandTag instanceof LoadStoreAddressOperand and
+ result = getOperand().getResult()
+ ) or
+ (
+ operandTag instanceof CopySourceOperand and
+ result = getInstruction(CrementOpTag())
+ )
+ )
+ )
+ }
+
+ override final Instruction getFirstInstruction() {
+ result = getOperand().getFirstInstruction()
+ }
+
+ override final Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ kind instanceof GotoEdge and
+ (
+ (
+ tag = CrementLoadTag() and
+ result = getInstruction(CrementConstantTag())
+ ) or
+ (
+ tag = CrementConstantTag() and
+ result = getInstruction(CrementOpTag())
+ ) or
+ (
+ tag = CrementOpTag() and
+ result = getInstruction(CrementStoreTag())
+ ) or
+ (
+ tag = CrementStoreTag() and
+ result = getParent().getChildSuccessor(this)
+ )
+ )
+ }
+
+ override final Instruction getChildSuccessor(TranslatedElement child) {
+ child = getOperand() and result = getInstruction(CrementLoadTag())
+ }
+
+ override final int getInstructionElementSize(InstructionTag tag) {
+ tag = CrementOpTag() and
+ (
+ getOpcode() instanceof Opcode::PointerAdd or
+ getOpcode() instanceof Opcode::PointerSub
+ ) and
+ result = max(getResultType().(PointerType).getBaseType().getSize())
+ }
+
+ final TranslatedExpr getOperand() {
+ result = getTranslatedExpr(op.getOperand().getFullyConverted())
+ }
+
+ final Opcode getOpcode() {
+ exists(Type resultType |
+ resultType = getResultType() and
+ (
+ (
+ op instanceof IncrementOperation and
+ if resultType instanceof PointerType then
+ result instanceof Opcode::PointerAdd
+ else
+ result instanceof Opcode::Add
+ ) or
+ (
+ op instanceof DecrementOperation and
+ if resultType instanceof PointerType then
+ result instanceof Opcode::PointerSub
+ else
+ result instanceof Opcode::Sub
+ )
+ )
+ )
+ }
+}
+
+class TranslatedPrefixCrementOperation extends TranslatedCrementOperation {
+ TranslatedPrefixCrementOperation() {
+ op instanceof PrefixCrementOperation
+ }
+
+ override Instruction getResult() {
+ if expr.isPRValueCategory() then (
+ // If this is C, then the result of a prefix crement is a prvalue for the
+ // new value assigned to the operand. If this is C++, then the result is
+ // an lvalue, but that lvalue is being loaded as part of this expression.
+ // EDG doesn't mark this as a load.
+ result = getInstruction(CrementOpTag())
+ )
+ else (
+ // This is C++, where the result is an lvalue for the operand, and that
+ // lvalue is not being loaded as part of this expression.
+ result = getOperand().getResult()
+ )
+ }
+}
+
+class TranslatedPostfixCrementOperation extends TranslatedCrementOperation {
+ TranslatedPostfixCrementOperation() {
+ op instanceof PostfixCrementOperation
+ }
+
+ override Instruction getResult() {
+ // The result is a prvalue copy of the original value
+ result = getInstruction(CrementLoadTag())
+ }
+}
+
+class TranslatedArrayExpr extends TranslatedNonConstantExpr {
+ ArrayExpr arrayExpr;
+
+ TranslatedArrayExpr() {
+ arrayExpr = expr
+ }
+
+ override Instruction getFirstInstruction() {
+ result = getBaseOperand().getFirstInstruction()
+ }
+
+ override final TranslatedElement getChild(int id) {
+ id = 0 and result = getBaseOperand() or
+ id = 1 and result = getOffsetOperand()
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ tag = OnlyInstructionTag() and
+ result = getParent().getChildSuccessor(this) and
+ kind instanceof GotoEdge
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ (
+ child = getBaseOperand() and
+ result = getOffsetOperand().getFirstInstruction()
+ ) or
+ (
+ child = getOffsetOperand() and
+ result = getInstruction(OnlyInstructionTag())
+ )
+ }
+
+ override Instruction getResult() {
+ result = getInstruction(OnlyInstructionTag())
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ tag = OnlyInstructionTag() and
+ opcode instanceof Opcode::PointerAdd and
+ resultType = getBaseOperand().getResultType() and
+ isGLValue = false
+ }
+
+ override Instruction getInstructionOperand(InstructionTag tag,
+ OperandTag operandTag) {
+ tag = OnlyInstructionTag() and
+ (
+ (
+ operandTag instanceof LeftOperand and
+ result = getBaseOperand().getResult()
+ ) or
+ (
+ operandTag instanceof RightOperand and
+ result = getOffsetOperand().getResult()
+ )
+ )
+ }
+
+ override int getInstructionElementSize(InstructionTag tag) {
+ tag = OnlyInstructionTag() and
+ result = max(getBaseOperand().getResultType().(PointerType).getBaseType().getSize())
+ }
+
+ private TranslatedExpr getBaseOperand() {
+ result = getTranslatedExpr(arrayExpr.getArrayBase().getFullyConverted())
+ }
+
+ private TranslatedExpr getOffsetOperand() {
+ result = getTranslatedExpr(arrayExpr.getArrayOffset().getFullyConverted())
+ }
+}
+
+abstract class TranslatedTransparentExpr extends TranslatedNonConstantExpr {
+ override final Instruction getFirstInstruction() {
+ result = getOperand().getFirstInstruction()
+ }
+
+ override final TranslatedElement getChild(int id) {
+ id = 0 and result = getOperand()
+ }
+
+ override final Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ none()
+ }
+
+ override final Instruction getChildSuccessor(TranslatedElement child) {
+ child = getOperand() and result = getParent().getChildSuccessor(this)
+ }
+
+ override final predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ none()
+ }
+
+ override final Instruction getResult() {
+ result = getOperand().getResult()
+ }
+
+ override final Instruction getInstructionOperand(InstructionTag tag,
+ OperandTag operandTag) {
+ none()
+ }
+
+ abstract TranslatedExpr getOperand();
+}
+
+class TranslatedTransparentUnaryOperation extends TranslatedTransparentExpr {
+ UnaryOperation op;
+
+ TranslatedTransparentUnaryOperation() {
+ op = expr and
+ (
+ // *p is the same as p until the result is loaded.
+ expr instanceof PointerDereferenceExpr or
+ // &x is the same as x. &x isn't loadable, but is included
+ // here to avoid having two nearly identical classes.
+ expr instanceof AddressOfExpr
+ )
+ }
+
+ override TranslatedExpr getOperand() {
+ result = getTranslatedExpr(op.getOperand().getFullyConverted())
+ }
+}
+
+class TranslatedTransparentConversion extends TranslatedTransparentExpr {
+ Conversion conv;
+
+ TranslatedTransparentConversion() {
+ conv = expr and
+ (
+ conv instanceof ParenthesisExpr or
+ conv instanceof ReferenceDereferenceExpr or
+ conv instanceof ReferenceToExpr
+ )
+ }
+
+ override TranslatedExpr getOperand() {
+ result = getTranslatedExpr(conv.getExpr())
+ }
+}
+
+class TranslatedThisExpr extends TranslatedNonConstantExpr {
+ TranslatedThisExpr() {
+ expr instanceof ThisExpr
+ }
+
+ override final TranslatedElement getChild(int id) {
+ none()
+ }
+
+ override final predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ tag = OnlyInstructionTag() and
+ opcode instanceof Opcode::CopyValue and
+ resultType = expr.getType().getUnspecifiedType() and
+ isGLValue = false
+ }
+
+ override final Instruction getResult() {
+ result = getInstruction(OnlyInstructionTag())
+ }
+
+ override final Instruction getFirstInstruction() {
+ result = getInstruction(OnlyInstructionTag())
+ }
+
+ override final Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ kind instanceof GotoEdge and
+ tag = OnlyInstructionTag() and
+ result = getParent().getChildSuccessor(this)
+ }
+
+ override final Instruction getChildSuccessor(TranslatedElement child) {
+ none()
+ }
+
+ override final Instruction getInstructionOperand(InstructionTag tag,
+ OperandTag operandTag) {
+ tag = OnlyInstructionTag() and
+ operandTag instanceof CopySourceOperand and
+ result = getInitializeThisInstruction()
+ }
+
+ private Instruction getInitializeThisInstruction() {
+ result = getTranslatedFunction(expr.getEnclosingFunction()).getInitializeThisInstruction()
+ }
+}
+
+abstract class TranslatedVariableAccess extends TranslatedNonConstantExpr {
+ VariableAccess access;
+
+ TranslatedVariableAccess() {
+ access = expr
+ }
+
+ override final TranslatedElement getChild(int id) {
+ id = 0 and result = getQualifier() // Might not exist
+ }
+
+ final TranslatedExpr getQualifier() {
+ result = getTranslatedExpr(access.getQualifier().getFullyConverted())
+ }
+
+ override Instruction getResult() {
+ result = getInstruction(OnlyInstructionTag())
+ }
+
+ override final Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ tag = OnlyInstructionTag() and
+ result = getParent().getChildSuccessor(this) and
+ kind instanceof GotoEdge
+ }
+
+ override final Instruction getChildSuccessor(TranslatedElement child) {
+ child = getQualifier() and result = getInstruction(OnlyInstructionTag())
+ }
+}
+
+class TranslatedNonFieldVariableAccess extends TranslatedVariableAccess {
+ TranslatedNonFieldVariableAccess() {
+ not expr instanceof FieldAccess
+ }
+
+ override Instruction getFirstInstruction() {
+ if exists(getQualifier()) then
+ result = getQualifier().getFirstInstruction()
+ else
+ result = getInstruction(OnlyInstructionTag())
+ }
+
+ override Instruction getInstructionOperand(InstructionTag tag,
+ OperandTag operandTag) {
+ none()
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ tag = OnlyInstructionTag() and
+ opcode instanceof Opcode::VariableAddress and
+ resultType = getResultType() and
+ isGLValue = true
+ }
+
+ override IRVariable getInstructionVariable(InstructionTag tag) {
+ tag = OnlyInstructionTag() and
+ result = getIRUserVariable(access.getEnclosingFunction(),
+ access.getTarget())
+ }
+}
+
+class TranslatedFieldAccess extends TranslatedVariableAccess {
+ FieldAccess fieldAccess;
+
+ TranslatedFieldAccess() {
+ //REVIEW: Implicit 'this'?
+ fieldAccess = access
+ }
+
+ override Instruction getFirstInstruction() {
+ result = getQualifier().getFirstInstruction()
+ }
+
+ override Instruction getInstructionOperand(InstructionTag tag,
+ OperandTag operandTag) {
+ tag = OnlyInstructionTag() and
+ operandTag instanceof UnaryOperand and
+ result = getQualifier().getResult()
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ tag = OnlyInstructionTag() and
+ opcode instanceof Opcode::FieldAddress and
+ resultType = getResultType() and
+ isGLValue = true
+ }
+
+ override Field getInstructionField(InstructionTag tag) {
+ tag = OnlyInstructionTag() and
+ result = access.getTarget()
+ }
+}
+
+class TranslatedFunctionAccess extends TranslatedNonConstantExpr {
+ FunctionAccess access;
+
+ TranslatedFunctionAccess() {
+ access = expr
+ }
+
+ override TranslatedElement getChild(int id) {
+ none()
+ }
+
+ override Instruction getFirstInstruction() {
+ result = getInstruction(OnlyInstructionTag())
+ }
+
+ override Instruction getResult() {
+ result = getInstruction(OnlyInstructionTag())
+ }
+
+ override final Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ tag = OnlyInstructionTag() and
+ result = getParent().getChildSuccessor(this) and
+ kind instanceof GotoEdge
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ tag = OnlyInstructionTag() and
+ opcode instanceof Opcode::FunctionAddress and
+ resultType = access.getType().getUnspecifiedType() and
+ isGLValue = true
+ }
+
+ override Function getInstructionFunction(InstructionTag tag) {
+ tag = OnlyInstructionTag() and
+ result = access.getTarget()
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ none()
+ }
+}
+
+abstract class TranslatedNonLoadExpr extends TranslatedExpr,
+ TTranslatedNonLoadExpr {
+ TranslatedNonLoadExpr() {
+ this = TTranslatedNonLoadExpr(expr)
+ }
+}
+
+abstract class TranslatedNonConstantExpr extends TranslatedNonLoadExpr {
+ TranslatedNonConstantExpr() {
+ not expr.isConstant()
+ }
+}
+
+abstract class TranslatedConstantExpr extends TranslatedNonLoadExpr {
+ TranslatedConstantExpr() {
+ expr.isConstant()
+ }
+
+ override final Instruction getFirstInstruction() {
+ result = getInstruction(OnlyInstructionTag())
+ }
+
+ override final TranslatedElement getChild(int id) {
+ none()
+ }
+
+ override final Instruction getResult() {
+ result = getInstruction(OnlyInstructionTag())
+ }
+
+ override final Instruction getInstructionOperand(InstructionTag tag,
+ OperandTag operandTag) {
+ none()
+ }
+
+ override final predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ tag = OnlyInstructionTag() and
+ opcode = getOpcode() and
+ resultType = getResultType() and
+ if(expr.isGLValueCategory() or expr.hasLValueToRValueConversion()) then
+ isGLValue = true
+ else
+ isGLValue = false
+ }
+
+ override final Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ tag = OnlyInstructionTag() and
+ result = getParent().getChildSuccessor(this) and
+ kind instanceof GotoEdge
+ }
+
+ override final Instruction getChildSuccessor(TranslatedElement child) {
+ none()
+ }
+
+ abstract Opcode getOpcode();
+}
+
+class TranslatedArithmeticLiteral extends TranslatedConstantExpr {
+ TranslatedArithmeticLiteral() {
+ not expr instanceof StringLiteral
+ }
+
+ override string getInstructionConstantValue(InstructionTag tag) {
+ tag = OnlyInstructionTag() and
+ result = expr.getValue()
+ }
+
+ override Opcode getOpcode() {
+ result instanceof Opcode::Constant
+ }
+}
+
+class TranslatedStringLiteral extends TranslatedConstantExpr {
+ StringLiteral stringLiteral;
+
+ TranslatedStringLiteral() {
+ stringLiteral = expr
+ }
+
+ override StringLiteral getInstructionStringLiteral(InstructionTag tag) {
+ tag = OnlyInstructionTag() and
+ result = stringLiteral
+ }
+
+ override Opcode getOpcode() {
+ result instanceof Opcode::StringConstant
+ }
+}
+
+abstract class TranslatedValueExpr extends TranslatedNonConstantExpr {
+ abstract Opcode getOpcode();
+
+ override final predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ opcode = getOpcode() and
+ tag = OnlyInstructionTag() and
+ resultType = getResultType() and
+ isGLValue = isResultGLValue()
+ }
+
+ override final Instruction getResult() {
+ result = getInstruction(OnlyInstructionTag())
+ }
+}
+
+class TranslatedUnaryExpr extends TranslatedValueExpr {
+ TranslatedUnaryExpr() {
+ expr instanceof NotExpr or
+ expr instanceof ComplementExpr or
+ expr instanceof UnaryPlusExpr or
+ expr instanceof UnaryMinusExpr
+ }
+
+ override final Instruction getFirstInstruction() {
+ result = getOperand().getFirstInstruction()
+ }
+
+ override final TranslatedElement getChild(int id) {
+ id = 0 and result = getOperand()
+ }
+
+ override final Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ tag = OnlyInstructionTag() and
+ result = getParent().getChildSuccessor(this) and
+ kind instanceof GotoEdge
+ }
+
+ override final Instruction getChildSuccessor(TranslatedElement child) {
+ child = getOperand() and result = getInstruction(OnlyInstructionTag())
+ }
+
+ override final Instruction getInstructionOperand(InstructionTag tag,
+ OperandTag operandTag) {
+ tag = OnlyInstructionTag() and
+ result = getOperand().getResult() and
+ if getOpcode() instanceof Opcode::CopyValue then
+ operandTag instanceof CopySourceOperand
+ else
+ operandTag instanceof UnaryOperand
+ }
+
+ override final Opcode getOpcode() {
+ expr instanceof NotExpr and result instanceof Opcode::LogicalNot or
+ expr instanceof ComplementExpr and result instanceof Opcode::BitComplement or
+ expr instanceof UnaryPlusExpr and result instanceof Opcode::CopyValue or
+ expr instanceof UnaryMinusExpr and result instanceof Opcode::Negate
+ }
+
+ private TranslatedExpr getOperand() {
+ result = getTranslatedExpr(
+ expr.(UnaryOperation).getOperand().getFullyConverted()
+ )
+ }
+}
+
+abstract class TranslatedConversion extends TranslatedNonConstantExpr {
+ Conversion conv;
+
+ TranslatedConversion() {
+ conv = expr
+ }
+
+ override Instruction getFirstInstruction() {
+ result = getOperand().getFirstInstruction()
+ }
+
+ override final TranslatedElement getChild(int id) {
+ id = 0 and result = getOperand()
+ }
+
+ final TranslatedExpr getOperand() {
+ result = getTranslatedExpr(expr.(Conversion).getExpr())
+ }
+}
+
+/**
+ * Represents the translation of a conversion expression that generates a
+ * single instruction.
+ */
+abstract class TranslatedSingleInstructionConversion extends TranslatedConversion {
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ tag = OnlyInstructionTag() and
+ result = getParent().getChildSuccessor(this) and
+ kind instanceof GotoEdge
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ child = getOperand() and result = getInstruction(OnlyInstructionTag())
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ tag = OnlyInstructionTag() and
+ opcode = getOpcode() and
+ resultType = getResultType() and
+ isGLValue = isResultGLValue()
+ }
+
+ override Instruction getResult() {
+ result = getInstruction(OnlyInstructionTag())
+ }
+
+ override Instruction getInstructionOperand(InstructionTag tag,
+ OperandTag operandTag) {
+ tag = OnlyInstructionTag() and
+ operandTag instanceof UnaryOperand and
+ result = getOperand().getResult()
+ }
+
+ /**
+ * Gets the opcode of the generated instruction.
+ */
+ abstract Opcode getOpcode();
+}
+
+/**
+ * Represents the translation of a conversion expression that generates a
+ * `Convert` instruction.
+ */
+class TranslatedSimpleConversion extends TranslatedSingleInstructionConversion {
+ TranslatedSimpleConversion() {
+ conv instanceof ArithmeticConversion or
+ conv instanceof PointerConversion or
+ conv instanceof PointerToMemberConversion or
+ conv instanceof PointerToIntegralConversion or
+ conv instanceof IntegralToPointerConversion or
+ conv instanceof GlvalueConversion or
+ conv instanceof ArrayToPointerConversion or
+ conv instanceof PrvalueAdjustmentConversion
+ }
+
+ override Opcode getOpcode() {
+ result instanceof Opcode::Convert
+ }
+}
+
+/**
+ * Represents the translation of a dynamic_cast expression.
+ */
+class TranslatedDynamicCast extends TranslatedSingleInstructionConversion {
+ TranslatedDynamicCast() {
+ conv instanceof DynamicCast
+ }
+
+ override Opcode getOpcode() {
+ exists(Type resultType |
+ resultType = getResultType() and
+ if resultType instanceof PointerType then (
+ if resultType.(PointerType).getBaseType() instanceof VoidType then
+ result instanceof Opcode::DynamicCastToVoid
+ else
+ result instanceof Opcode::CheckedConvertOrNull
+ )
+ else
+ result instanceof Opcode::CheckedConvertOrThrow
+ )
+ }
+}
+
+/**
+ * Represents the translation of a `BaseClassConversion` or `DerivedClassConversion`
+ * expression.
+ */
+class TranslatedInheritanceConversion extends TranslatedSingleInstructionConversion {
+ InheritanceConversion inheritanceConv;
+
+ TranslatedInheritanceConversion() {
+ inheritanceConv = conv
+ }
+
+ override predicate getInstructionInheritance(InstructionTag tag, Class baseClass,
+ Class derivedClass) {
+ tag = OnlyInstructionTag() and
+ baseClass = inheritanceConv.getBaseClass() and
+ derivedClass = inheritanceConv.getDerivedClass()
+ }
+
+ override Opcode getOpcode() {
+ if inheritanceConv instanceof BaseClassConversion then (
+ if inheritanceConv.(BaseClassConversion).isVirtual() then
+ result instanceof Opcode::ConvertToVirtualBase
+ else
+ result instanceof Opcode::ConvertToBase
+ )
+ else
+ result instanceof Opcode::ConvertToDerived
+ }
+}
+
+/**
+ * Represents the translation of a `BoolConversion` expression, which generates
+ * a comparison with zero.
+ */
+class TranslatedBoolConversion extends TranslatedConversion {
+ TranslatedBoolConversion() {
+ conv instanceof BoolConversion
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ kind instanceof GotoEdge and
+ (
+ (
+ tag = BoolConversionConstantTag() and
+ result = getInstruction(BoolConversionCompareTag())
+ ) or
+ (
+ tag = BoolConversionCompareTag() and
+ result = getParent().getChildSuccessor(this)
+ )
+ )
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ child = getOperand() and result = getInstruction(BoolConversionConstantTag())
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ isGLValue = false and
+ (
+ (
+ tag = BoolConversionConstantTag() and
+ opcode instanceof Opcode::Constant and
+ resultType = getOperand().getResultType()
+ ) or
+ (
+ tag = BoolConversionCompareTag() and
+ opcode instanceof Opcode::CompareNE and
+ resultType instanceof BoolType
+ )
+ )
+ }
+
+ override Instruction getResult() {
+ result = getInstruction(BoolConversionCompareTag())
+ }
+
+ override Instruction getInstructionOperand(InstructionTag tag,
+ OperandTag operandTag) {
+ tag = BoolConversionCompareTag() and
+ (
+ (
+ operandTag instanceof LeftOperand and
+ result = getOperand().getResult()
+ ) or
+ (
+ operandTag instanceof RightOperand and
+ result = getInstruction(BoolConversionConstantTag())
+ )
+ )
+ }
+
+ override string getInstructionConstantValue(InstructionTag tag) {
+ tag = BoolConversionConstantTag() and
+ result = "0"
+ }
+}
+
+private Opcode binaryBitwiseOpcode(BinaryBitwiseOperation expr) {
+ expr instanceof LShiftExpr and result instanceof Opcode::ShiftLeft or
+ expr instanceof RShiftExpr and result instanceof Opcode::ShiftRight or
+ expr instanceof BitwiseAndExpr and result instanceof Opcode::BitAnd or
+ expr instanceof BitwiseOrExpr and result instanceof Opcode::BitOr or
+ expr instanceof BitwiseXorExpr and result instanceof Opcode::BitXor
+}
+
+private Opcode binaryArithmeticOpcode(BinaryArithmeticOperation expr) {
+ expr instanceof AddExpr and result instanceof Opcode::Add or
+ expr instanceof SubExpr and result instanceof Opcode::Sub or
+ expr instanceof MulExpr and result instanceof Opcode::Mul or
+ expr instanceof DivExpr and result instanceof Opcode::Div or
+ expr instanceof RemExpr and result instanceof Opcode::Rem or
+ expr instanceof PointerAddExpr and result instanceof Opcode::PointerAdd or
+ expr instanceof PointerSubExpr and result instanceof Opcode::PointerSub or
+ expr instanceof PointerDiffExpr and result instanceof Opcode::PointerDiff
+}
+
+private Opcode comparisonOpcode(ComparisonOperation expr) {
+ expr instanceof EQExpr and result instanceof Opcode::CompareEQ or
+ expr instanceof NEExpr and result instanceof Opcode::CompareNE or
+ expr instanceof LTExpr and result instanceof Opcode::CompareLT or
+ expr instanceof GTExpr and result instanceof Opcode::CompareGT or
+ expr instanceof LEExpr and result instanceof Opcode::CompareLE or
+ expr instanceof GEExpr and result instanceof Opcode::CompareGE
+}
+
+class TranslatedBinaryOperation extends TranslatedValueExpr {
+ TranslatedBinaryOperation() {
+ expr instanceof BinaryArithmeticOperation or
+ expr instanceof BinaryBitwiseOperation or
+ expr instanceof ComparisonOperation
+ }
+
+ override Instruction getFirstInstruction() {
+ result = getLeftOperand().getFirstInstruction()
+ }
+
+ override final TranslatedElement getChild(int id) {
+ id = 0 and result = getLeftOperand() or
+ id = 1 and result = getRightOperand()
+ }
+
+ override final Instruction getInstructionOperand(InstructionTag tag,
+ OperandTag operandTag) {
+ tag = OnlyInstructionTag() and
+ if swapOperandsOnOp() then (
+ (
+ operandTag instanceof RightOperand and
+ result = getLeftOperand().getResult()
+ ) or
+ (
+ operandTag instanceof LeftOperand and
+ result = getRightOperand().getResult()
+ )
+ )
+ else (
+ (
+ operandTag instanceof LeftOperand and
+ result = getLeftOperand().getResult()
+ ) or
+ (
+ operandTag instanceof RightOperand and
+ result = getRightOperand().getResult()
+ )
+ )
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ tag = OnlyInstructionTag() and
+ result = getParent().getChildSuccessor(this) and
+ kind instanceof GotoEdge
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ (
+ child = getLeftOperand() and
+ result = getRightOperand().getFirstInstruction()
+ ) or
+ (
+ child = getRightOperand() and
+ result = getInstruction(OnlyInstructionTag())
+ )
+ }
+
+ override Opcode getOpcode() {
+ result = binaryArithmeticOpcode(expr.(BinaryArithmeticOperation)) or
+ result = binaryBitwiseOpcode(expr.(BinaryBitwiseOperation)) or
+ result = comparisonOpcode(expr.(ComparisonOperation))
+ }
+
+ override int getInstructionElementSize(InstructionTag tag) {
+ tag = OnlyInstructionTag() and
+ exists(Opcode opcode |
+ opcode = getOpcode() and
+ (
+ opcode instanceof Opcode::PointerAdd or opcode instanceof Opcode::PointerSub or opcode instanceof Opcode::PointerDiff
+ ) and
+ result = max(getPointerOperand().getResultType().(PointerType).getBaseType().getSize())
+ )
+ }
+
+ private TranslatedExpr getPointerOperand() {
+ if swapOperandsOnOp() then
+ result = getRightOperand()
+ else
+ result = getLeftOperand()
+ }
+
+ private predicate swapOperandsOnOp() {
+ // Swap the operands on a pointer add 'i + p', so that the pointer operand
+ // always comes first. Note that we still evaluate the operands
+ // left-to-right.
+ exists(PointerAddExpr ptrAdd, Type rightType |
+ ptrAdd = expr and
+ rightType = ptrAdd.getRightOperand().getType().getUnspecifiedType() and
+ rightType instanceof PointerType
+ )
+ }
+
+ private TranslatedExpr getLeftOperand() {
+ result = getTranslatedExpr(
+ expr.(BinaryOperation).getLeftOperand().getFullyConverted()
+ )
+ }
+
+ private TranslatedExpr getRightOperand() {
+ result = getTranslatedExpr(
+ expr.(BinaryOperation).getRightOperand().getFullyConverted()
+ )
+ }
+}
+
+abstract class TranslatedAssignment extends TranslatedNonConstantExpr {
+ Assignment assign;
+
+ TranslatedAssignment() {
+ expr = assign
+ }
+
+ override final TranslatedElement getChild(int id) {
+ id = 0 and result = getLeftOperand() or
+ id = 1 and result = getRightOperand()
+ }
+
+ override final Instruction getFirstInstruction() {
+ // Evaluation is right-to-left
+ result = getRightOperand().getFirstInstruction()
+ }
+
+ override final Instruction getResult() {
+ if expr.isPRValueCategory() then (
+ // If this is C, then the result of an assignment is a prvalue for the new
+ // value assigned to the left operand. If this is C++, then the result is
+ // an lvalue, but that lvalue is being loaded as part of this expression.
+ // EDG doesn't mark this as a load.
+ result = getStoredValue()
+ )
+ else (
+ // This is C++, where the result is an lvalue for the left operand,
+ // and that lvalue is not being loaded as part of this expression.
+ result = getLeftOperand().getResult()
+ )
+ }
+
+ abstract Instruction getStoredValue();
+
+ final TranslatedExpr getLeftOperand() {
+ result = getTranslatedExpr(
+ assign.getLValue().getFullyConverted()
+ )
+ }
+
+ final TranslatedExpr getRightOperand() {
+ result = getTranslatedExpr(
+ assign.getRValue().getFullyConverted()
+ )
+ }
+}
+
+class TranslatedAssignExpr extends TranslatedAssignment {
+ TranslatedAssignExpr() {
+ assign instanceof AssignExpr
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ tag = AssignmentStoreTag() and
+ result = getParent().getChildSuccessor(this) and
+ kind instanceof GotoEdge
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ // Operands are evaluated right-to-left.
+ (
+ child = getRightOperand() and
+ result = getLeftOperand().getFirstInstruction()
+ ) or
+ (
+ child = getLeftOperand() and
+ result = getInstruction(AssignmentStoreTag())
+ )
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ tag = AssignmentStoreTag() and
+ opcode instanceof Opcode::Store and
+ resultType = getResultType() and
+ isGLValue = false
+ }
+
+ override Instruction getInstructionOperand(InstructionTag tag,
+ OperandTag operandTag) {
+ tag = AssignmentStoreTag() and
+ (
+ (
+ operandTag instanceof LoadStoreAddressOperand and
+ result = getLeftOperand().getResult()
+ ) or
+ (
+ operandTag instanceof CopySourceOperand and
+ result = getRightOperand().getResult()
+ )
+ )
+ }
+
+ override Instruction getStoredValue() {
+ result = getRightOperand().getResult()
+ }
+}
+
+class TranslatedAssignOperation extends TranslatedAssignment {
+ AssignOperation assignOp;
+
+ TranslatedAssignOperation() {
+ expr = assignOp
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ kind instanceof GotoEdge and
+ (
+ (
+ tag = AssignOperationLoadTag() and
+ if leftOperandNeedsConversion() then
+ result = getInstruction(AssignOperationConvertLeftTag())
+ else
+ result = getInstruction(AssignOperationOpTag())
+ ) or
+ (
+ tag = AssignOperationConvertLeftTag() and
+ result = getInstruction(AssignOperationOpTag())
+ ) or
+ (
+ tag = AssignOperationOpTag() and
+ if leftOperandNeedsConversion() then
+ result = getInstruction(AssignOperationConvertResultTag())
+ else
+ result = getInstruction(AssignmentStoreTag())
+ ) or
+ (
+ tag = AssignOperationConvertResultTag() and
+ result = getInstruction(AssignmentStoreTag())
+ ) or
+ (
+ tag = AssignmentStoreTag() and
+ result = getParent().getChildSuccessor(this)
+ )
+ )
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ // Operands are evaluated right-to-left.
+ (
+ child = getRightOperand() and
+ result = getLeftOperand().getFirstInstruction()
+ ) or
+ (
+ child = getLeftOperand() and
+ result = getInstruction(AssignOperationLoadTag())
+ )
+ }
+
+ override Instruction getStoredValue() {
+ if leftOperandNeedsConversion() then
+ result = getInstruction(AssignOperationConvertResultTag())
+ else
+ result = getInstruction(AssignOperationOpTag())
+ }
+
+ private Type getConvertedLeftOperandType() {
+ if(assignOp instanceof AssignLShiftExpr or
+ assignOp instanceof AssignRShiftExpr or
+ assignOp instanceof AssignPointerAddExpr or
+ assignOp instanceof AssignPointerSubExpr) then (
+ // No need to convert for a shift. Technically, the left side should
+ // undergo integral promotion, and then the result would be converted back
+ // to the destination type. There's not much point to this, though,
+ // because the result will be the same for any well-defined program
+ // anyway. If we really want to model this case perfectly, we'll need the
+ // extractor to tell us what the promoted type of the left operand would
+ // be.
+ result = getLeftOperand().getResultType()
+ ) else (
+ // The right operand has already been converted to the type of the op.
+ result = getRightOperand().getResultType()
+ )
+ }
+
+ private predicate leftOperandNeedsConversion() {
+ getConvertedLeftOperandType() != getLeftOperand().getResultType()
+ }
+
+ private Opcode getOpcode() {
+ assignOp instanceof AssignAddExpr and result instanceof Opcode::Add or
+ assignOp instanceof AssignSubExpr and result instanceof Opcode::Sub or
+ assignOp instanceof AssignMulExpr and result instanceof Opcode::Mul or
+ assignOp instanceof AssignDivExpr and result instanceof Opcode::Div or
+ assignOp instanceof AssignRemExpr and result instanceof Opcode::Rem or
+ assignOp instanceof AssignAndExpr and result instanceof Opcode::BitAnd or
+ assignOp instanceof AssignOrExpr and result instanceof Opcode::BitOr or
+ assignOp instanceof AssignXorExpr and result instanceof Opcode::BitXor or
+ assignOp instanceof AssignLShiftExpr and result instanceof Opcode::ShiftLeft or
+ assignOp instanceof AssignRShiftExpr and result instanceof Opcode::ShiftRight or
+ assignOp instanceof AssignPointerAddExpr and result instanceof Opcode::PointerAdd or
+ assignOp instanceof AssignPointerSubExpr and result instanceof Opcode::PointerSub
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ isGLValue = false and
+ (
+ (
+ tag = AssignOperationLoadTag() and
+ opcode instanceof Opcode::Load and
+ resultType = getLeftOperand().getResultType()
+ ) or
+ (
+ tag = AssignOperationOpTag() and
+ opcode = getOpcode() and
+ resultType = getConvertedLeftOperandType()
+ ) or
+ (
+ tag = AssignmentStoreTag() and
+ opcode instanceof Opcode::Store and
+ resultType = getResultType()
+ ) or
+ (
+ leftOperandNeedsConversion() and
+ opcode instanceof Opcode::Convert and
+ (
+ (
+ tag = AssignOperationConvertLeftTag() and
+ resultType = getConvertedLeftOperandType()
+ ) or
+ (
+ tag = AssignOperationConvertResultTag() and
+ resultType = getLeftOperand().getResultType()
+ )
+ )
+ )
+ )
+ }
+
+ override int getInstructionElementSize(InstructionTag tag) {
+ tag = AssignOperationOpTag() and
+ exists(Opcode opcode |
+ opcode = getOpcode() and
+ (opcode instanceof Opcode::PointerAdd or opcode instanceof Opcode::PointerSub)
+ ) and
+ result = max(getResultType().(PointerType).getBaseType().getSize())
+ }
+
+ override Instruction getInstructionOperand(InstructionTag tag,
+ OperandTag operandTag) {
+ (
+ tag = AssignOperationLoadTag() and
+ (
+ (
+ operandTag instanceof LoadStoreAddressOperand and
+ result = getLeftOperand().getResult()
+ ) or
+ (
+ operandTag instanceof CopySourceOperand and
+ result = getEnclosingFunction().getUnmodeledDefinitionInstruction()
+ )
+ )
+ ) or
+ (
+ leftOperandNeedsConversion() and
+ tag = AssignOperationConvertLeftTag() and
+ operandTag instanceof UnaryOperand and
+ result = getInstruction(AssignOperationLoadTag())
+ ) or
+ (
+ tag = AssignOperationOpTag() and
+ (
+ (
+ operandTag instanceof LeftOperand and
+ if leftOperandNeedsConversion() then
+ result = getInstruction(AssignOperationConvertLeftTag())
+ else
+ result = getInstruction(AssignOperationLoadTag())
+ ) or
+ (
+ operandTag instanceof RightOperand and
+ result = getRightOperand().getResult()
+ )
+ )
+ ) or
+ (
+ leftOperandNeedsConversion() and
+ tag = AssignOperationConvertResultTag() and
+ operandTag instanceof UnaryOperand and
+ result = getInstruction(AssignOperationOpTag())
+ ) or
+ (
+ tag = AssignmentStoreTag() and
+ (
+ (
+ operandTag instanceof LoadStoreAddressOperand and
+ result = getLeftOperand().getResult()
+ ) or
+ (
+ operandTag instanceof CopySourceOperand and
+ result = getStoredValue()
+ )
+ )
+ )
+ }
+}
+
+/**
+ * Represents the IR translation of a call to a function.
+ */
+abstract class TranslatedCall extends TranslatedNonConstantExpr {
+ Call call;
+
+ TranslatedCall() {
+ expr = call
+ }
+
+ override final Instruction getFirstInstruction() {
+ if exists(getQualifier()) then
+ result = getQualifier().getFirstInstruction()
+ else
+ result = getFirstCallTargetInstruction()
+ }
+
+ override final Instruction getResult() {
+ result = getInstruction(CallTag())
+ }
+
+ override final TranslatedElement getChild(int id) {
+ // We choose the child's id in the order of evaluation.
+ // The qualifier is evaluated before the call target, because the value of
+ // the call target may depend on the value of the qualifier for virtual
+ // calls.
+ id = -2 and result = getQualifier() or
+ id = -1 and result = getCallTarget() or
+ result = getArgument(id)
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ (
+ child = getQualifier() and
+ result = getFirstCallTargetInstruction()
+ ) or
+ (
+ child = getCallTarget() and
+ result = getFirstArgumentOrCallInstruction()
+ ) or
+ exists(int argIndex |
+ child = getArgument(argIndex) and
+ if exists(getArgument(argIndex + 1)) then
+ result = getArgument(argIndex + 1).getFirstInstruction()
+ else
+ result = getInstruction(CallTag())
+ )
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ tag = CallTag() and
+ opcode instanceof Opcode::Invoke and
+ resultType = call.getType().getUnspecifiedType() and
+ isGLValue = false
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ kind instanceof GotoEdge and
+ tag = CallTag() and
+ result = getParent().getChildSuccessor(this)
+ }
+
+ override Instruction getInstructionOperand(InstructionTag tag,
+ OperandTag operandTag) {
+ tag = CallTag() and
+ (
+ (
+ operandTag instanceof CallTargetOperand and
+ result = getCallTargetResult()
+ ) or
+ (
+ operandTag instanceof ThisArgumentOperand and
+ result = getQualifierResult()
+ ) or
+ exists(PositionalArgumentOperand argTag |
+ argTag = operandTag and
+ result = getArgument(argTag.getArgIndex()).getResult()
+ )
+ )
+ }
+
+ /**
+ * Holds if the call has any arguments, not counting the `this` argument.
+ */
+ final predicate hasArguments() {
+ exists(call.getArgument(0))
+ }
+
+ /**
+ * Holds if the call has a `this` argument.
+ */
+ predicate hasQualifier() {
+ exists(getQualifier())
+ }
+
+ /**
+ * Gets the `TranslatedExpr` for the indirect target of the call, if any.
+ */
+ TranslatedExpr getCallTarget() {
+ none()
+ }
+
+ /**
+ * Gets the first instruction of the sequence to evaluate the call target.
+ * By default, this is just the first instruction of `getCallTarget()`, but
+ * it can be overridden by a subclass for cases where there is a call target
+ * that is not computed from an expression (e.g. a direct call).
+ */
+ Instruction getFirstCallTargetInstruction() {
+ result = getCallTarget().getFirstInstruction()
+ }
+
+ /**
+ * Gets the instruction whose result value is the target of the call. By
+ * default, this is just the result of `getCallTarget()`, but it can be
+ * overridden by a subclass for cases where there is a call target that is not
+ * computed from an expression (e.g. a direct call).
+ */
+ Instruction getCallTargetResult() {
+ result = getCallTarget().getResult()
+ }
+
+ /**
+ * Gets the `TranslatedExpr` for the qualifier of the call (i.e. the value
+ * that is passed as the `this` argument.
+ */
+ final TranslatedExpr getQualifier() {
+ result = getTranslatedExpr(call.getQualifier().getFullyConverted())
+ }
+
+ /**
+ * Gets the instruction whose result value is the `this` argument of the call.
+ * By default, this is just the result of `getQualifier()`, but it can be
+ * overridden by a subclass for cases where there is a `this` argument that is
+ * not computed from a child expression (e.g. a constructor call).
+ */
+ Instruction getQualifierResult() {
+ result = getQualifier().getResult()
+ }
+
+ /**
+ * Gets the argument with the specified `index`. Does not include the `this`
+ * argument.
+ */
+ final TranslatedExpr getArgument(int index) {
+ result = getTranslatedExpr(call.getArgument(index).getFullyConverted())
+ }
+
+ /**
+ * If there are any arguments, gets the first instruction of the first
+ * argument. Otherwise, returns the call instruction.
+ */
+ final Instruction getFirstArgumentOrCallInstruction() {
+ if hasArguments() then
+ result = getArgument(0).getFirstInstruction()
+ else
+ result = getInstruction(CallTag())
+ }
+}
+
+/**
+ * Represents the IR translation of a call through a function pointer.
+ */
+class TranslatedExprCall extends TranslatedCall {
+ ExprCall exprCall;
+
+ TranslatedExprCall() {
+ expr = exprCall
+ }
+
+ override TranslatedExpr getCallTarget() {
+ result = getTranslatedExpr(exprCall.getExpr().getFullyConverted())
+ }
+}
+
+/**
+ * Represents the IR translation of a direct function call.
+ */
+class TranslatedFunctionCall extends TranslatedCall {
+ FunctionCall funcCall;
+
+ TranslatedFunctionCall() {
+ expr = funcCall
+ }
+
+ override final Instruction getFirstCallTargetInstruction() {
+ result = getInstruction(CallTargetTag())
+ }
+
+ override final Instruction getCallTargetResult() {
+ result = getInstruction(CallTargetTag())
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ super.hasInstruction(opcode, tag, resultType, isGLValue) or
+ (
+ tag = CallTargetTag() and
+ opcode instanceof Opcode::FunctionAddress and
+ resultType instanceof BoolType and //HACK
+ isGLValue = false
+ )
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ result = super.getInstructionSuccessor(tag, kind) or
+ (
+ tag = CallTargetTag() and
+ kind instanceof GotoEdge and
+ result = getFirstArgumentOrCallInstruction()
+ )
+ }
+
+ override Function getInstructionFunction(InstructionTag tag) {
+ tag = CallTargetTag() and result = funcCall.getTarget()
+ }
+}
+
+/**
+ * Abstract class implemented by any `TranslatedElement` that has a child
+ * expression that is a call to a constructor or destructor, in order to
+ * provide a pointer to the object being constructed or destroyed.
+ */
+abstract class StructorCallContext extends TranslatedElement {
+ /**
+ * Gets the instruction whose result value is the address of the object to be
+ * constructed or destroyed.
+ */
+ abstract Instruction getReceiver();
+}
+
+/**
+ * Represents the IR translation of a call to a constructor.
+ */
+class TranslatedStructorCall extends TranslatedFunctionCall {
+ TranslatedStructorCall() {
+ funcCall instanceof ConstructorCall or
+ funcCall instanceof DestructorCall
+ }
+
+ override Instruction getQualifierResult() {
+ exists(StructorCallContext context |
+ context = getParent() and
+ result = context.getReceiver()
+ )
+ }
+
+ override predicate hasQualifier() {
+ any()
+ }
+}
+
+/**
+ * Represents the IR translation of the destruction of a field from within
+ * the destructor of the field's declaring class.
+ */
+class TranslatedDestructorFieldDestruction extends TranslatedNonConstantExpr,
+ StructorCallContext {
+ DestructorFieldDestruction destruction;
+
+ TranslatedDestructorFieldDestruction() {
+ destruction = expr
+ }
+
+ override final TranslatedElement getChild(int id) {
+ id = 0 and result = getDestructorCall()
+ }
+
+ override final predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ tag = OnlyInstructionTag() and
+ opcode instanceof Opcode::FieldAddress and
+ resultType = destruction.getTarget().getType().getUnspecifiedType() and
+ isGLValue = true
+ }
+
+ override final Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ tag = OnlyInstructionTag() and
+ kind instanceof GotoEdge and
+ result = getDestructorCall().getFirstInstruction()
+ }
+
+ override final Instruction getChildSuccessor(TranslatedElement child) {
+ child = getDestructorCall() and
+ result = getParent().getChildSuccessor(this)
+ }
+
+ override final Instruction getResult() {
+ none()
+ }
+
+ override final Instruction getFirstInstruction() {
+ result = getInstruction(OnlyInstructionTag())
+ }
+
+ override final Instruction getInstructionOperand(InstructionTag tag, OperandTag operandTag) {
+ tag = OnlyInstructionTag() and
+ operandTag instanceof UnaryOperand and
+ result = getTranslatedFunction(destruction.getEnclosingFunction()).getInitializeThisInstruction()
+ }
+
+ override final Field getInstructionField(InstructionTag tag) {
+ tag = OnlyInstructionTag() and
+ result = destruction.getTarget()
+ }
+
+ override final Instruction getReceiver() {
+ result = getInstruction(OnlyInstructionTag())
+ }
+
+ private TranslatedExpr getDestructorCall() {
+ result = getTranslatedExpr(destruction.getExpr())
+ }
+}
+
+class TranslatedConditionalExpr extends TranslatedNonConstantExpr,
+ ConditionContext {
+ ConditionalExpr condExpr;
+
+ TranslatedConditionalExpr() {
+ condExpr = expr
+ }
+
+ override final TranslatedElement getChild(int id) {
+ id = 0 and result = getCondition() or
+ id = 1 and result = getThen() or
+ id = 2 and result = getElse()
+ }
+
+ override Instruction getFirstInstruction() {
+ result = getCondition().getFirstInstruction()
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ not resultIsVoid() and
+ (
+ (
+ (
+ (not thenIsVoid() and (tag = ConditionValueTrueTempAddressTag())) or
+ (not elseIsVoid() and (tag = ConditionValueFalseTempAddressTag())) or
+ tag = ConditionValueResultTempAddressTag()
+ ) and
+ opcode instanceof Opcode::VariableAddress and
+ resultType = getResultType() and
+ isGLValue = true
+ ) or
+ (
+ (
+ (not thenIsVoid() and (tag = ConditionValueTrueStoreTag())) or
+ (not elseIsVoid() and (tag = ConditionValueFalseStoreTag()))
+ ) and
+ opcode instanceof Opcode::Store and
+ resultType = getResultType() and
+ isGLValue = false
+ ) or
+ (
+ tag = ConditionValueResultLoadTag() and
+ opcode instanceof Opcode::Load and
+ resultType = getResultType() and
+ isGLValue = isResultGLValue()
+ )
+ )
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ not resultIsVoid() and
+ kind instanceof GotoEdge and
+ (
+ (
+ not thenIsVoid() and
+ (
+ (
+ tag = ConditionValueTrueTempAddressTag() and
+ result = getInstruction(ConditionValueTrueStoreTag())
+ ) or
+ (
+ tag = ConditionValueTrueStoreTag() and
+ result = getInstruction(ConditionValueResultTempAddressTag())
+ )
+ )
+ ) or
+ (
+ not elseIsVoid() and
+ (
+ (
+ tag = ConditionValueFalseTempAddressTag() and
+ result = getInstruction(ConditionValueFalseStoreTag())
+ ) or
+ (
+ tag = ConditionValueFalseStoreTag() and
+ result = getInstruction(ConditionValueResultTempAddressTag())
+ )
+ )
+ ) or
+ (
+ tag = ConditionValueResultTempAddressTag() and
+ result = getInstruction(ConditionValueResultLoadTag())
+ ) or
+ (
+ tag = ConditionValueResultLoadTag() and
+ result = getParent().getChildSuccessor(this)
+ )
+ )
+ }
+
+ override Instruction getInstructionOperand(InstructionTag tag,
+ OperandTag operandTag) {
+ not resultIsVoid() and
+ (
+ (
+ not thenIsVoid() and
+ tag = ConditionValueTrueStoreTag() and
+ (
+ (
+ operandTag instanceof LoadStoreAddressOperand and
+ result = getInstruction(ConditionValueTrueTempAddressTag())
+ ) or
+ (
+ operandTag instanceof CopySourceOperand and
+ result = getThen().getResult()
+ )
+ )
+ ) or
+ (
+ not elseIsVoid() and
+ tag = ConditionValueFalseStoreTag() and
+ (
+ (
+ operandTag instanceof LoadStoreAddressOperand and
+ result = getInstruction(ConditionValueFalseTempAddressTag())
+ ) or
+ (
+ operandTag instanceof CopySourceOperand and
+ result = getElse().getResult()
+ )
+ )
+ ) or
+ (
+ tag = ConditionValueResultLoadTag() and
+ (
+ (
+ operandTag instanceof LoadStoreAddressOperand and
+ result = getInstruction(ConditionValueResultTempAddressTag())
+ ) or
+ (
+ operandTag instanceof CopySourceOperand and
+ result = getEnclosingFunction().getUnmodeledDefinitionInstruction()
+ )
+ )
+ )
+ )
+ }
+
+ override predicate hasTempVariable(TempVariableTag tag, Type type) {
+ not resultIsVoid() and
+ tag = ConditionValueTempVar() and
+ type = getResultType()
+ }
+
+ override IRVariable getInstructionVariable(InstructionTag tag) {
+ not resultIsVoid() and
+ (
+ tag = ConditionValueTrueTempAddressTag() or
+ tag = ConditionValueFalseTempAddressTag() or
+ tag = ConditionValueResultTempAddressTag()
+ ) and
+ result = getTempVariable(ConditionValueTempVar())
+ }
+
+ override Instruction getResult() {
+ not resultIsVoid() and
+ result = getInstruction(ConditionValueResultLoadTag())
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ (
+ child = getThen() and
+ if thenIsVoid() then
+ result = getParent().getChildSuccessor(this)
+ else
+ result = getInstruction(ConditionValueTrueTempAddressTag())
+ ) or
+ (
+ child = getElse() and
+ if elseIsVoid() then
+ result = getParent().getChildSuccessor(this)
+ else
+ result = getInstruction(ConditionValueFalseTempAddressTag())
+ )
+ }
+
+ override Instruction getChildTrueSuccessor(TranslatedCondition child) {
+ child = getCondition() and
+ result = getThen().getFirstInstruction()
+ }
+
+ override Instruction getChildFalseSuccessor(TranslatedCondition child) {
+ child = getCondition() and
+ result = getElse().getFirstInstruction()
+ }
+
+ private TranslatedCondition getCondition() {
+ result = getTranslatedCondition(condExpr.getCondition().getFullyConverted())
+ }
+
+ private TranslatedExpr getThen() {
+ result = getTranslatedExpr(condExpr.getThen().getFullyConverted())
+ }
+
+ private TranslatedExpr getElse() {
+ result = getTranslatedExpr(condExpr.getElse().getFullyConverted())
+ }
+
+ private predicate thenIsVoid() {
+ getThen().getResultType() instanceof VoidType or
+ // A `ThrowExpr.getType()` incorrectly returns the type of exception being
+ // thrown, rather than `void`. Handle that case here.
+ condExpr.getThen() instanceof ThrowExpr
+ }
+
+ private predicate elseIsVoid() {
+ getElse().getResultType() instanceof VoidType or
+ // A `ThrowExpr.getType()` incorrectly returns the type of exception being
+ // thrown, rather than `void`. Handle that case here.
+ condExpr.getElse() instanceof ThrowExpr
+ }
+
+ private predicate resultIsVoid() {
+ getResultType() instanceof VoidType
+ }
+}
+
+/**
+ * IR translation of a `throw` expression.
+ */
+abstract class TranslatedThrowExpr extends TranslatedNonConstantExpr {
+ ThrowExpr throw;
+
+ TranslatedThrowExpr() {
+ throw = expr
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ tag = ThrowTag() and
+ opcode = getThrowOpcode() and
+ resultType instanceof VoidType and
+ isGLValue = false
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ tag = ThrowTag() and
+ kind instanceof ExceptionEdge and
+ result = getParent().getExceptionSuccessorInstruction()
+ }
+
+ override Instruction getResult() {
+ none()
+ }
+
+ abstract Opcode getThrowOpcode();
+}
+
+/**
+ * IR translation of a `throw` expression with an argument
+ * (e.g. `throw std::bad_alloc()`).
+ */
+class TranslatedThrowValueExpr extends TranslatedThrowExpr,
+ InitializationContext {
+ TranslatedThrowValueExpr() {
+ not throw instanceof ReThrowExpr
+ }
+
+ override TranslatedElement getChild(int id) {
+ id = 0 and result = getInitialization()
+ }
+
+ override Instruction getFirstInstruction() {
+ result = getInstruction(InitializerVariableAddressTag())
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ TranslatedThrowExpr.super.hasInstruction(opcode, tag, resultType, isGLValue) or
+ tag = InitializerVariableAddressTag() and
+ opcode instanceof Opcode::VariableAddress and
+ resultType = getExceptionType() and
+ isGLValue = true
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ result = TranslatedThrowExpr.super.getInstructionSuccessor(tag, kind) or
+ (
+ tag = InitializerVariableAddressTag() and
+ result = getInitialization().getFirstInstruction() and
+ kind instanceof GotoEdge
+ )
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ child = getInitialization() and
+ result = getInstruction(ThrowTag())
+ }
+
+ override IRVariable getInstructionVariable(InstructionTag tag) {
+ tag = InitializerVariableAddressTag() and
+ result = getIRTempVariable(throw, ThrowTempVar())
+ }
+
+ override final predicate hasTempVariable(TempVariableTag tag, Type type) {
+ tag = ThrowTempVar() and
+ type = getExceptionType()
+ }
+
+ override final Instruction getInstructionOperand(InstructionTag tag,
+ OperandTag operandTag) {
+ tag = ThrowTag() and
+ (
+ (
+ operandTag instanceof LoadStoreAddressOperand and
+ result = getInstruction(InitializerVariableAddressTag())
+ ) or
+ (
+ operandTag instanceof ExceptionOperand and
+ result = getEnclosingFunction().getUnmodeledDefinitionInstruction()
+ )
+ )
+ }
+
+ override Instruction getTargetAddress() {
+ result = getInstruction(InitializerVariableAddressTag())
+ }
+
+ override Type getTargetType() {
+ result = getExceptionType()
+ }
+
+ TranslatedInitialization getInitialization() {
+ result = getTranslatedInitialization(
+ throw.getExpr().getFullyConverted())
+ }
+
+ override final Opcode getThrowOpcode() {
+ result instanceof Opcode::ThrowValue
+ }
+
+ private Type getExceptionType() {
+ result = throw.getType().getUnspecifiedType()
+ }
+}
+
+/**
+ * IR translation of a `throw` expression with no argument (e.g. `throw;`).
+ */
+class TranslatedReThrowExpr extends TranslatedThrowExpr {
+ TranslatedReThrowExpr() {
+ throw instanceof ReThrowExpr
+ }
+
+ override TranslatedElement getChild(int id) {
+ none()
+ }
+
+ override Instruction getFirstInstruction() {
+ result = getInstruction(ThrowTag())
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ none()
+ }
+
+ override final Opcode getThrowOpcode() {
+ result instanceof Opcode::ReThrow
+ }
+}
+
+/**
+ * The IR translation of a built-in operation (i.e. anything that extends
+ * `BuiltInOperation`).
+ */
+abstract class TranslatedBuiltInOperation extends TranslatedNonConstantExpr {
+ override final Instruction getResult() {
+ result = getInstruction(OnlyInstructionTag())
+ }
+
+ override final Instruction getFirstInstruction() {
+ if exists(getChild(0)) then
+ result = getChild(0).getFirstInstruction()
+ else
+ result = getInstruction(OnlyInstructionTag())
+ }
+
+ override final TranslatedElement getChild(int id) {
+ result = getTranslatedExpr(expr.getChild(id).getFullyConverted())
+ }
+
+ override final Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ tag = OnlyInstructionTag() and
+ kind instanceof GotoEdge and
+ result = getParent().getChildSuccessor(this)
+ }
+
+ override final Instruction getChildSuccessor(TranslatedElement child) {
+ exists(int id |
+ child = getChild(id) and
+ (
+ result = getChild(id + 1).getFirstInstruction() or
+ not exists(getChild(id + 1)) and result = getInstruction(OnlyInstructionTag())
+ )
+ )
+ }
+
+ override final predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ tag = OnlyInstructionTag() and
+ opcode = getOpcode() and
+ resultType = getResultType() and
+ isGLValue = isResultGLValue()
+ }
+
+ override final Instruction getInstructionOperand(InstructionTag tag,
+ OperandTag operandTag) {
+ tag = OnlyInstructionTag() and
+ exists(int index |
+ operandTag = positionalArgumentOperand(index) and
+ result = getChild(index).(TranslatedExpr).getResult()
+ )
+ }
+
+ abstract Opcode getOpcode();
+}
+
+/**
+ * The IR translation of a `BuiltInVarArgsStart` expression.
+ */
+class TranslatedVarArgsStart extends TranslatedBuiltInOperation {
+ TranslatedVarArgsStart() {
+ expr instanceof BuiltInVarArgsStart
+ }
+
+ override final Opcode getOpcode() {
+ result instanceof Opcode::VarArgsStart
+ }
+}
+
+/**
+ * The IR translation of a `BuiltInVarArgsEnd` expression.
+ */
+class TranslatedVarArgsEnd extends TranslatedBuiltInOperation {
+ TranslatedVarArgsEnd() {
+ expr instanceof BuiltInVarArgsEnd
+ }
+
+ override final Opcode getOpcode() {
+ result instanceof Opcode::VarArgsEnd
+ }
+}
+
+/**
+ * The IR translation of a `BuiltInVarArg` expression.
+ */
+class TranslatedVarArg extends TranslatedBuiltInOperation {
+ TranslatedVarArg() {
+ expr instanceof BuiltInVarArg
+ }
+
+ override final Opcode getOpcode() {
+ result instanceof Opcode::VarArg
+ }
+}
+
+/**
+ * The IR translation of a `BuiltInVarArgCopy` expression.
+ */
+class TranslatedVarArgCopy extends TranslatedBuiltInOperation {
+ TranslatedVarArgCopy() {
+ expr instanceof BuiltInVarArgCopy
+ }
+
+ override final Opcode getOpcode() {
+ result instanceof Opcode::VarArgCopy
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ir/internal/TranslatedFunction.qll b/cpp/ql/src/semmle/code/cpp/ir/internal/TranslatedFunction.qll
new file mode 100644
index 000000000000..a13815fdbb14
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/internal/TranslatedFunction.qll
@@ -0,0 +1,549 @@
+import cpp
+import semmle.code.cpp.ir.IR
+private import InstructionTag
+private import Opcode
+private import TempVariableTag
+private import TranslatedElement
+private import TranslatedExpr
+private import TranslatedInitialization
+private import TranslatedStmt
+
+/**
+ * Gets the `TranslatedFunction` that represents function `func`.
+ */
+TranslatedFunction getTranslatedFunction(Function func) {
+ result.getAST() = func
+}
+
+/**
+ * Represents the IR translation of a function. This is the root elements for
+ * all other elements associated with this function.
+ */
+class TranslatedFunction extends TranslatedElement,
+ TTranslatedFunction {
+ Function func;
+
+ TranslatedFunction() {
+ this = TTranslatedFunction(func)
+ }
+
+ override final string toString() {
+ result = func.toString()
+ }
+
+ override final Locatable getAST() {
+ result = func
+ }
+
+ /**
+ * Gets the function being translated.
+ */
+ override final Function getFunction() {
+ result = func
+ }
+
+ override final TranslatedElement getChild(int id) {
+ id = -3 and result = getConstructorInitList() or
+ id = -2 and result = getBody() or
+ id = -1 and result = getDestructorDestructionList() or
+ id >= 0 and result = getParameter(id)
+ }
+
+ private final TranslatedConstructorInitList getConstructorInitList() {
+ result = getTranslatedConstructorInitList(func)
+ }
+
+ private final TranslatedDestructorDestructionList getDestructorDestructionList() {
+ result = getTranslatedDestructorDestructionList(func)
+ }
+
+ private final TranslatedStmt getBody() {
+ result = getTranslatedStmt(func.getEntryPoint())
+ }
+
+ private final TranslatedParameter getParameter(int index) {
+ result = getTranslatedParameter(func.getParameter(index))
+ }
+
+ override final Instruction getFirstInstruction() {
+ result = getInstruction(EnterFunctionTag())
+ }
+
+ override final Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ kind instanceof GotoEdge and
+ (
+ (
+ tag = EnterFunctionTag() and
+ result = getInstruction(UnmodeledDefinitionTag())
+ ) or
+ (
+ tag = UnmodeledDefinitionTag() and
+ if exists(getThisType()) then
+ result = getInstruction(InitializeThisTag())
+ else if exists(getParameter(0)) then
+ result = getParameter(0).getFirstInstruction()
+ else
+ result = getBody().getFirstInstruction()
+ ) or
+ (
+ tag = InitializeThisTag() and
+ if exists(getParameter(0)) then
+ result = getParameter(0).getFirstInstruction()
+ else
+ result = getConstructorInitList().getFirstInstruction()
+ ) or
+ (
+ tag = ReturnValueAddressTag() and
+ result = getInstruction(ReturnTag())
+ ) or
+ (
+ tag = ReturnTag() and
+ result = getInstruction(UnmodeledUseTag())
+ ) or
+ (
+ tag = UnwindTag() and
+ result = getInstruction(UnmodeledUseTag())
+ ) or
+ (
+ tag = UnmodeledUseTag() and
+ result = getInstruction(ExitFunctionTag())
+ )
+ )
+ }
+
+ override final Instruction getChildSuccessor(TranslatedElement child) {
+ exists(int paramIndex |
+ child = getParameter(paramIndex) and
+ if exists(func.getParameter(paramIndex + 1)) then
+ result = getParameter(paramIndex + 1).getFirstInstruction()
+ else
+ result = getConstructorInitList().getFirstInstruction()
+ ) or
+ (
+ child = getConstructorInitList() and
+ result = getBody().getFirstInstruction()
+ ) or
+ (
+ child = getBody() and
+ result = getReturnSuccessorInstruction()
+ ) or
+ (
+ child = getDestructorDestructionList() and
+ if getReturnType() instanceof VoidType then
+ result = getInstruction(ReturnTag())
+ else
+ result = getInstruction(ReturnValueAddressTag())
+ )
+ }
+
+ override final predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ (
+ (
+ tag = EnterFunctionTag() and
+ opcode instanceof Opcode::EnterFunction and
+ resultType instanceof VoidType and
+ isGLValue = false
+ ) or
+ (
+ tag = UnmodeledDefinitionTag() and
+ opcode instanceof Opcode::UnmodeledDefinition and
+ resultType instanceof UnknownType and
+ isGLValue = false
+ ) or
+ (
+ tag = InitializeThisTag() and
+ opcode instanceof Opcode::InitializeThis and
+ resultType = getThisType() and
+ isGLValue = true
+ ) or
+ (
+ tag = ReturnValueAddressTag() and
+ opcode instanceof Opcode::VariableAddress and
+ resultType = getReturnType() and
+ not resultType instanceof VoidType and
+ isGLValue = true
+ ) or
+ (
+ tag = ReturnTag() and
+ resultType instanceof VoidType and
+ isGLValue = false and
+ if getReturnType() instanceof VoidType then
+ opcode instanceof Opcode::ReturnVoid
+ else
+ opcode instanceof Opcode::ReturnValue
+ ) or
+ (
+ tag = UnwindTag() and
+ opcode instanceof Opcode::Unwind and
+ resultType instanceof VoidType and
+ isGLValue = false and
+ (
+ // Only generate the `Unwind` instruction if there is any exception
+ // handling present in the function.
+ exists(TryStmt try |
+ try.getEnclosingFunction() = func
+ ) or
+ exists(ThrowExpr throw |
+ throw.getEnclosingFunction() = func
+ )
+ )
+ ) or
+ (
+ tag = UnmodeledUseTag() and
+ opcode instanceof Opcode::UnmodeledUse and
+ resultType instanceof VoidType and
+ isGLValue = false
+ ) or
+ (
+ tag = ExitFunctionTag() and
+ opcode instanceof Opcode::ExitFunction and
+ resultType instanceof VoidType and
+ isGLValue = false
+ )
+ )
+ }
+
+ override final Instruction getExceptionSuccessorInstruction() {
+ result = getInstruction(UnwindTag())
+ }
+
+ override final Instruction getInstructionOperand(InstructionTag tag,
+ OperandTag operandTag) {
+ (
+ tag = UnmodeledUseTag() and
+ operandTag instanceof UnmodeledUseOperand and
+ result.getFunction() = func and
+ result.hasMemoryResult()
+ ) or
+ (
+ tag = ReturnTag() and
+ not getReturnType() instanceof VoidType and
+ (
+ (
+ operandTag instanceof LoadStoreAddressOperand and
+ result = getInstruction(ReturnValueAddressTag())
+ ) or
+ (
+ operandTag instanceof ReturnValueOperand and
+ result = getUnmodeledDefinitionInstruction()
+ )
+ )
+ )
+ }
+
+ override final IRVariable getInstructionVariable(InstructionTag tag) {
+ tag = ReturnValueAddressTag() and
+ result = getReturnVariable()
+ }
+
+ override final predicate hasTempVariable(TempVariableTag tag, Type type) {
+ tag = ReturnValueTempVar() and
+ type = getReturnType() and
+ not type instanceof VoidType
+ }
+
+ /**
+ * Gets the instruction to which control should flow after a `return`
+ * statement.
+ */
+ final Instruction getReturnSuccessorInstruction() {
+ result = getDestructorDestructionList().getFirstInstruction()
+ }
+
+ /**
+ * Gets the variable that represents the return value of this function.
+ */
+ final IRReturnVariable getReturnVariable() {
+ result = getIRTempVariable(func, ReturnValueTempVar())
+ }
+
+ /**
+ * Gets the single `UnmodeledDefinition` instruction for this function.
+ */
+ final Instruction getUnmodeledDefinitionInstruction() {
+ result = getInstruction(UnmodeledDefinitionTag())
+ }
+
+ /**
+ * Gets the single `InitializeThis` instruction for this function. Holds only
+ * if the function is an instance member function, constructor, or destructor.
+ */
+ final Instruction getInitializeThisInstruction() {
+ result = getInstruction(InitializeThisTag())
+ }
+
+ /**
+ * Gets the type pointed to by the `this` pointer for this function (i.e. `*this`).
+ * Holds only if the function is an instance member function, constructor, or destructor.
+ */
+ final Type getThisType() {
+ exists(MemberFunction mfunc |
+ mfunc = func and
+ not mfunc.isStatic() and
+ result = mfunc.getDeclaringType()
+ )
+ }
+
+ private final Type getReturnType() {
+ result = func.getType().getUnspecifiedType()
+ }
+}
+
+/**
+ * Gets the `TranslatedParameter` that represents parameter `param`.
+ */
+TranslatedParameter getTranslatedParameter(Parameter param) {
+ result.getAST() = param
+}
+
+/**
+ * Represents the IR translation of a function parameter, including the
+ * initialization of that parameter with the incoming argument.
+ */
+class TranslatedParameter extends TranslatedElement, TTranslatedParameter {
+ Parameter param;
+
+ TranslatedParameter() {
+ this = TTranslatedParameter(param)
+ }
+
+ override final string toString() {
+ result = param.toString()
+ }
+
+ override final Locatable getAST() {
+ result = param
+ }
+
+ override final Function getFunction() {
+ result = param.getFunction() or
+ result = param.getCatchBlock().getEnclosingFunction()
+ }
+
+ override final Instruction getFirstInstruction() {
+ result = getInstruction(ParameterInitializerTag())
+ }
+
+ override final TranslatedElement getChild(int id) {
+ none()
+ }
+
+ override final Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ kind instanceof GotoEdge and
+ (
+ (
+ tag = ParameterInitializerTag() and
+ result = getInstruction(InitializerVariableAddressTag())
+ ) or
+ (
+ tag = InitializerVariableAddressTag() and
+ result = getInstruction(InitializerStoreTag())
+ ) or
+ (
+ tag = InitializerStoreTag() and
+ result = getParent().getChildSuccessor(this)
+ )
+ )
+ }
+
+ override final Instruction getChildSuccessor(TranslatedElement child) {
+ none()
+ }
+
+ override final predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ (
+ tag = ParameterInitializerTag() and
+ opcode instanceof Opcode::InitializeParameter and
+ resultType = param.getType().getUnspecifiedType() and
+ isGLValue = false
+ ) or
+ (
+ tag = InitializerVariableAddressTag() and
+ opcode instanceof Opcode::VariableAddress and
+ resultType = param.getType().getUnspecifiedType() and
+ isGLValue = true
+ ) or
+ (
+ tag = InitializerStoreTag() and
+ opcode instanceof Opcode::Store and
+ resultType = param.getType().getUnspecifiedType() and
+ isGLValue = false
+ )
+ }
+
+ override final IRVariable getInstructionVariable(InstructionTag tag) {
+ (
+ tag = ParameterInitializerTag() or
+ tag = InitializerVariableAddressTag()
+ ) and
+ result = getIRUserVariable(getFunction(), param)
+ }
+
+ override final Instruction getInstructionOperand(InstructionTag tag,
+ OperandTag operandTag) {
+ tag = InitializerStoreTag() and
+ (
+ (
+ operandTag instanceof LoadStoreAddressOperand and
+ result = getInstruction(InitializerVariableAddressTag())
+ ) or
+ (
+ operandTag instanceof CopySourceOperand and
+ result = getInstruction(ParameterInitializerTag())
+ )
+ )
+ }
+}
+
+private TranslatedConstructorInitList
+getTranslatedConstructorInitList(Function func) {
+ result.getAST() = func
+}
+
+/**
+ * Represents the IR translation of a constructor initializer list. To simplify
+ * the implementation of `TranslatedFunction`, a `TranslatedConstructorInitList`
+ * exists for every function, not just for constructors. Of course, only the
+ * instances for constructors can actually contain initializers.
+ */
+class TranslatedConstructorInitList extends TranslatedElement,
+ InitializationContext, TTranslatedConstructorInitList {
+ Function func;
+
+ TranslatedConstructorInitList() {
+ this = TTranslatedConstructorInitList(func)
+ }
+
+ override string toString() {
+ result = "ctor init: " + func.toString()
+ }
+
+ override Locatable getAST() {
+ result = func
+ }
+
+ override TranslatedElement getChild(int id) {
+ exists(ConstructorFieldInit fieldInit |
+ fieldInit = func.(Constructor).getInitializer(id) and
+ result = getTranslatedConstructorFieldInitialization(fieldInit)
+ ) or
+ exists(ConstructorBaseInit baseInit |
+ baseInit = func.(Constructor).getInitializer(id) and
+ result = getTranslatedConstructorBaseInit(baseInit)
+ )
+ }
+
+ override Instruction getFirstInstruction() {
+ if exists(getChild(0)) then
+ result = getChild(0).getFirstInstruction()
+ else
+ result = getParent().getChildSuccessor(this)
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ none()
+ }
+
+ override Function getFunction() {
+ result = func
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ none()
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ exists(int id |
+ child = getChild(id) and
+ if exists(getChild(id + 1)) then
+ result = getChild(id + 1).getFirstInstruction()
+ else
+ result = getParent().getChildSuccessor(this)
+ )
+ }
+
+ override Instruction getTargetAddress() {
+ result = getTranslatedFunction(func).getInitializeThisInstruction()
+ }
+
+ override Type getTargetType() {
+ result = getTranslatedFunction(func).getThisType()
+ }
+}
+
+private TranslatedDestructorDestructionList
+getTranslatedDestructorDestructionList(Function func) {
+ result.getAST() = func
+}
+
+/**
+ * Represents the IR translation of a destructor's implicit calls to destructors
+ * for fields and base classes. To simplify the implementation of `TranslatedFunction`,
+ * a `TranslatedDestructorDestructionList` exists for every function, not just for
+ * destructors. Of course, only the instances for destructors can actually contain
+ * destructions.
+ */
+class TranslatedDestructorDestructionList extends TranslatedElement,
+ TTranslatedDestructorDestructionList {
+ Function func;
+
+ TranslatedDestructorDestructionList() {
+ this = TTranslatedDestructorDestructionList(func)
+ }
+
+ override string toString() {
+ result = "dtor destruction: " + func.toString()
+ }
+
+ override Locatable getAST() {
+ result = func
+ }
+
+ override TranslatedElement getChild(int id) {
+ exists(DestructorFieldDestruction fieldDestruction |
+ fieldDestruction = func.(Destructor).getDestruction(id) and
+ result = getTranslatedExpr(fieldDestruction)
+ ) or
+ exists(DestructorBaseDestruction baseDestruction |
+ baseDestruction = func.(Destructor).getDestruction(id) and
+ result = getTranslatedDestructorBaseDestruction(baseDestruction)
+ )
+ }
+
+ override Instruction getFirstInstruction() {
+ if exists(getChild(0)) then
+ result = getChild(0).getFirstInstruction()
+ else
+ result = getParent().getChildSuccessor(this)
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ none()
+ }
+
+ override Function getFunction() {
+ result = func
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ none()
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ exists(int id |
+ child = getChild(id) and
+ if exists(getChild(id + 1)) then
+ result = getChild(id + 1).getFirstInstruction()
+ else
+ result = getParent().getChildSuccessor(this)
+ )
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ir/internal/TranslatedInitialization.qll b/cpp/ql/src/semmle/code/cpp/ir/internal/TranslatedInitialization.qll
new file mode 100644
index 000000000000..8116b2cb302c
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/internal/TranslatedInitialization.qll
@@ -0,0 +1,1074 @@
+import cpp
+private import InstructionTag
+private import Opcode
+private import TranslatedElement
+private import TranslatedExpr
+private import TranslatedFunction
+
+/**
+ * Gets the `TranslatedInitialization` for the expression `expr`.
+ */
+TranslatedInitialization getTranslatedInitialization(Expr expr) {
+ result.getExpr() = expr
+}
+
+/**
+ * Base class for any `TranslatedElement` that has an initialization as a child.
+ * Provides the child with the address and type of the location to be
+ * initialized.
+ */
+abstract class InitializationContext extends TranslatedElement {
+ /**
+ * Gets the instruction that produces the address of the location to be
+ * initialized.
+ */
+ abstract Instruction getTargetAddress();
+
+ /**
+ * Gets the type of the location to be initialized.
+ */
+ abstract Type getTargetType();
+}
+
+/**
+ * Represents the IR translation of any initialization, whether from an
+ * initializer list or from a direct initializer.
+ */
+abstract class TranslatedInitialization extends TranslatedElement,
+ TTranslatedInitialization {
+ Expr expr;
+
+ TranslatedInitialization() {
+ this = TTranslatedInitialization(expr)
+ }
+
+ override final string toString() {
+ result = "init: " + expr.toString()
+ }
+
+ override final Function getFunction() {
+ result = expr.getEnclosingFunction()
+ }
+
+ override final Locatable getAST() {
+ result = expr
+ }
+
+ /**
+ * Gets the expression that is doing the initialization.
+ */
+ final Expr getExpr() {
+ result = expr
+ }
+
+ /**
+ * Gets the initialization context that describes the location being
+ * initialized.
+ */
+ final InitializationContext getContext() {
+ result = getParent()
+ }
+
+ final TranslatedFunction getEnclosingFunction() {
+ result = getTranslatedFunction(expr.getEnclosingFunction())
+ }
+}
+
+/**
+ * Represents the IR translation of an initialization from an initializer list.
+ */
+abstract class TranslatedListInitialization extends TranslatedInitialization,
+ InitializationContext {
+ override Instruction getFirstInstruction() {
+ result = getChild(0).getFirstInstruction()
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ exists(int index |
+ child = getChild(index) and
+ if exists(getChild(index + 1)) then
+ result = getChild(index + 1).getFirstInstruction()
+ else
+ result = getParent().getChildSuccessor(this)
+ )
+ }
+
+ override final predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ none()
+ }
+
+ override final Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ none()
+ }
+
+ override Instruction getTargetAddress() {
+ result = getContext().getTargetAddress()
+ }
+
+ override Type getTargetType() {
+ result = getContext().getTargetType()
+ }
+}
+
+/**
+ * Represents the IR translation of an initialization of a class object from an
+ * initializer list.
+ */
+class TranslatedClassListInitialization extends
+ TranslatedListInitialization
+{
+ ClassAggregateLiteral initList;
+
+ TranslatedClassListInitialization() {
+ initList = expr
+ }
+
+ override TranslatedElement getChild(int id) {
+ exists(TranslatedFieldInitialization fieldInit |
+ result = fieldInit and
+ fieldInit = getTranslatedFieldInitialization(initList, _) and
+ fieldInit.getOrder() = id
+ )
+ }
+}
+
+/**
+ * Represents the IR translation of an initialization of an array from an
+ * initializer list.
+ */
+class TranslatedArrayListInitialization extends
+ TranslatedListInitialization {
+ ArrayAggregateLiteral initList;
+
+ TranslatedArrayListInitialization() {
+ initList = expr
+ }
+
+ override TranslatedElement getChild(int id) {
+ result = getTranslatedElementInitialization(initList, id)
+ }
+}
+
+/**
+ * Represents the IR translation of an initialization from a single initializer
+ * expression.
+ */
+abstract class TranslatedDirectInitialization extends TranslatedInitialization {
+ TranslatedDirectInitialization() {
+ not expr instanceof AggregateLiteral
+ }
+
+ override TranslatedElement getChild(int id) {
+ id = 0 and result = getInitializer()
+ }
+
+ override Instruction getFirstInstruction() {
+ result = getInitializer().getFirstInstruction()
+ }
+
+ final TranslatedExpr getInitializer() {
+ result = getTranslatedExpr(expr)
+ }
+}
+
+/**
+ * Represents the IR translation of an initialization from a single initializer
+ * expression, where the initialization is performed via bitwise copy (as
+ * opposed to a constructor).
+ */
+class TranslatedSimpleDirectInitialization extends
+ TranslatedDirectInitialization {
+ TranslatedSimpleDirectInitialization() {
+ not expr instanceof ConstructorCall and
+ not expr instanceof StringLiteral
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ tag = InitializerStoreTag() and
+ opcode instanceof Opcode::Store and
+ resultType = getContext().getTargetType() and
+ isGLValue = false
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ tag = InitializerStoreTag() and
+ result = getParent().getChildSuccessor(this) and
+ kind instanceof GotoEdge
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ child = getInitializer() and result = getInstruction(InitializerStoreTag())
+ }
+
+ override Instruction getInstructionOperand(InstructionTag tag,
+ OperandTag operandTag) {
+ tag = InitializerStoreTag() and
+ (
+ (
+ operandTag instanceof LoadStoreAddressOperand and
+ result = getContext().getTargetAddress()
+ ) or
+ (
+ operandTag instanceof CopySourceOperand and
+ result = getInitializer().getResult()
+ )
+ )
+ }
+}
+
+/**
+ * Represents the IR translation of an initialization of an array from a string
+ * literal.
+ */
+class TranslatedStringLiteralInitialization extends
+ TranslatedDirectInitialization {
+ TranslatedStringLiteralInitialization() {
+ expr instanceof StringLiteral
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ (
+ // Load the string literal to make it a prvalue of type `char[len]`
+ tag = InitializerLoadStringTag() and
+ opcode instanceof Opcode::Load and
+ resultType = getInitializer().getResultType() and
+ isGLValue = false
+ ) or
+ (
+ // Store the string into the target.
+ tag = InitializerStoreTag() and
+ opcode instanceof Opcode::Store and
+ resultType = getInitializer().getResultType() and
+ isGLValue = false
+ ) or
+ exists(int startIndex, int elementCount |
+ // If the initializer string isn't large enough to fill the target, then
+ // we have to generate another instruction sequence to store a constant
+ // zero into the remainder of the array.
+ zeroInitRange(startIndex, elementCount) and
+ (
+ (
+ // Create a constant zero whose size is the size of the remaining
+ // space in the target array.
+ tag = ZeroPadStringConstantTag() and
+ opcode instanceof Opcode::Constant and
+ resultType instanceof UnknownType and
+ isGLValue = false
+ ) or
+ (
+ // The index of the first element to be zero initialized.
+ tag = ZeroPadStringElementIndexTag() and
+ opcode instanceof Opcode::Constant and
+ resultType = getIntType() and
+ isGLValue = false
+ ) or
+ (
+ // Compute the address of the first element to be zero initialized.
+ tag = ZeroPadStringElementAddressTag() and
+ opcode instanceof Opcode::PointerAdd and
+ resultType = getElementType() and
+ isGLValue = true
+ ) or
+ (
+ // Store the constant zero into the remainder of the string.
+ tag = ZeroPadStringStoreTag() and
+ opcode instanceof Opcode::Store and
+ resultType instanceof UnknownType and
+ isGLValue = false
+ )
+ )
+ )
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ kind instanceof GotoEdge and
+ (
+ (
+ tag = InitializerLoadStringTag() and
+ result = getInstruction(InitializerStoreTag())
+ ) or
+ if zeroInitRange(_, _) then (
+ (
+ tag = InitializerStoreTag() and
+ result = getInstruction(ZeroPadStringConstantTag())
+ ) or
+ (
+ tag = ZeroPadStringConstantTag() and
+ result = getInstruction(ZeroPadStringElementIndexTag())
+ ) or
+ (
+ tag = ZeroPadStringElementIndexTag() and
+ result = getInstruction(ZeroPadStringElementAddressTag())
+ ) or
+ (
+ tag = ZeroPadStringElementAddressTag() and
+ result = getInstruction(ZeroPadStringStoreTag())
+ ) or
+ (
+ tag = ZeroPadStringStoreTag() and
+ result = getParent().getChildSuccessor(this)
+ )
+ )
+ else (
+ tag = InitializerStoreTag() and
+ result = getParent().getChildSuccessor(this)
+ )
+ )
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ child = getInitializer() and result = getInstruction(InitializerLoadStringTag())
+ }
+
+ override Instruction getInstructionOperand(InstructionTag tag,
+ OperandTag operandTag) {
+ (
+ tag = InitializerLoadStringTag() and
+ (
+ (
+ operandTag instanceof LoadStoreAddressOperand and
+ result = getInitializer().getResult()
+ ) or
+ (
+ operandTag instanceof CopySourceOperand and
+ result = getEnclosingFunction().getUnmodeledDefinitionInstruction()
+ )
+ )
+ ) or
+ (
+ tag = InitializerStoreTag() and
+ (
+ (
+ operandTag instanceof LoadStoreAddressOperand and
+ result = getContext().getTargetAddress()
+ ) or
+ (
+ operandTag instanceof CopySourceOperand and
+ result = getInstruction(InitializerLoadStringTag())
+ )
+ )
+ ) or
+ (
+ tag = ZeroPadStringElementAddressTag() and
+ (
+ (
+ operandTag instanceof LeftOperand and
+ result = getContext().getTargetAddress()
+ ) or
+ (
+ operandTag instanceof RightOperand and
+ result = getInstruction(ZeroPadStringElementIndexTag())
+ )
+ )
+ ) or
+ (
+ tag = ZeroPadStringStoreTag() and
+ (
+ (
+ operandTag instanceof LoadStoreAddressOperand and
+ result = getInstruction(ZeroPadStringElementAddressTag())
+ ) or
+ (
+ operandTag instanceof CopySourceOperand and
+ result = getInstruction(ZeroPadStringConstantTag())
+ )
+ )
+ )
+ }
+
+ override string getInstructionConstantValue(InstructionTag tag) {
+ exists(int startIndex |
+ zeroInitRange(startIndex, _) and
+ (
+ (
+ tag = ZeroPadStringConstantTag() and
+ result = "0"
+ ) or
+ (
+ tag = ZeroPadStringElementIndexTag() and
+ result = startIndex.toString()
+ )
+ )
+ )
+ }
+
+ override int getInstructionResultSize(InstructionTag tag) {
+ exists(int elementCount |
+ zeroInitRange(_, elementCount) and
+ (
+ tag = ZeroPadStringConstantTag() or
+ tag = ZeroPadStringStoreTag()
+ ) and
+ result = elementCount * getElementType().getSize()
+ )
+ }
+
+ private Type getElementType() {
+ result = getContext().getTargetType().(ArrayType).getBaseType().getUnspecifiedType()
+ }
+
+ /**
+ * Holds if the `elementCount` array elements starting at `startIndex` must be
+ * zero initialized.
+ */
+ private predicate zeroInitRange(int startIndex, int elementCount) {
+ exists(int targetCount |
+ startIndex = expr.getType().getUnspecifiedType().(ArrayType).getArraySize() and
+ targetCount = getContext().getTargetType().(ArrayType).getArraySize() and
+ elementCount = targetCount - startIndex and
+ elementCount > 0
+ )
+ }
+}
+
+class TranslatedConstructorInitialization extends
+ TranslatedDirectInitialization, StructorCallContext {
+ ConstructorCall ctorCall;
+
+ TranslatedConstructorInitialization() {
+ ctorCall = expr
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ none()
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ none()
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ child = getInitializer() and result = getParent().getChildSuccessor(this)
+ }
+
+ override Instruction getInstructionOperand(InstructionTag tag,
+ OperandTag operandTag) {
+ none()
+ }
+
+ override Instruction getReceiver() {
+ result = getContext().getTargetAddress()
+ }
+}
+
+/**
+ * Gets the `TranslatedFieldInitialization` for field `field` within initializer
+ * list `initList`.
+ */
+TranslatedFieldInitialization getTranslatedFieldInitialization(
+ ClassAggregateLiteral initList, Field field) {
+ result.getAST() = initList and result.getField() = field
+}
+
+TranslatedFieldInitialization getTranslatedConstructorFieldInitialization(
+ ConstructorFieldInit init) {
+ result.getAST() = init
+}
+
+/**
+ * Represents the IR translation of the initialization of a field from an
+ * element of an initializer list.
+ */
+abstract class TranslatedFieldInitialization extends TranslatedElement {
+ Expr ast;
+ Field field;
+
+ override final string toString() {
+ result = ast.toString() + "." + field.toString()
+ }
+
+ override final Locatable getAST() {
+ result = ast
+ }
+
+ override final Function getFunction() {
+ result = ast.getEnclosingFunction()
+ }
+
+ override final Instruction getFirstInstruction() {
+ result = getInstruction(getFieldAddressTag())
+ }
+
+ /**
+ * Gets the zero-based index describing the order in which this field is to be
+ * initialized relative to the other fields in the class.
+ */
+ final int getOrder() {
+ result = field.getInitializationOrder()
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ tag = getFieldAddressTag() and
+ opcode instanceof Opcode::FieldAddress and
+ resultType = field.getType().getUnspecifiedType() and
+ isGLValue = true
+ }
+
+ override Instruction getInstructionOperand(InstructionTag tag,
+ OperandTag operandTag) {
+ tag = getFieldAddressTag() and
+ operandTag instanceof UnaryOperand and
+ result = getParent().(InitializationContext).getTargetAddress()
+ }
+
+ override Field getInstructionField(InstructionTag tag) {
+ tag = getFieldAddressTag() and result = field
+ }
+
+ final InstructionTag getFieldAddressTag() {
+ result = InitializerFieldAddressTag(field)
+ }
+
+ final Field getField() {
+ result = field
+ }
+}
+
+/**
+ * Represents the IR translation of the initialization of a field from an
+ * explicit element in an initializer list.
+ */
+class TranslatedExplicitFieldInitialization extends
+ TranslatedFieldInitialization, InitializationContext,
+ TTranslatedExplicitFieldInitialization {
+ Expr expr;
+
+ TranslatedExplicitFieldInitialization() {
+ this = TTranslatedExplicitFieldInitialization(ast, field, expr)
+ }
+
+ override Instruction getTargetAddress() {
+ result = getInstruction(getFieldAddressTag())
+ }
+
+ override Type getTargetType() {
+ result = field.getType().getUnspecifiedType()
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ tag = getFieldAddressTag() and
+ result = getInitialization().getFirstInstruction() and
+ kind instanceof GotoEdge
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ child = getInitialization() and result = getParent().getChildSuccessor(this)
+ }
+
+ override TranslatedElement getChild(int id) {
+ id = 0 and result = getInitialization()
+ }
+
+ private TranslatedInitialization getInitialization() {
+ result = getTranslatedInitialization(expr)
+ }
+}
+
+private string getZeroValue(Type type) {
+ if type instanceof FloatingPointType then
+ result = "0.0"
+ else
+ result = "0"
+}
+
+/**
+ * Represents the IR translation of the initialization of a field without a
+ * corresponding element in the initializer list.
+ */
+class TranslatedFieldValueInitialization extends
+ TranslatedFieldInitialization, TTranslatedFieldValueInitialization {
+ TranslatedFieldValueInitialization() {
+ this = TTranslatedFieldValueInitialization(ast, field)
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ TranslatedFieldInitialization.super.hasInstruction(opcode, tag, resultType, isGLValue) or
+ (
+ tag = getFieldDefaultValueTag() and
+ opcode instanceof Opcode::Constant and
+ resultType = field.getType().getUnspecifiedType() and
+ isGLValue = false
+ ) or
+ (
+ tag = getFieldDefaultValueStoreTag() and
+ opcode instanceof Opcode::Store and
+ resultType = field.getType().getUnspecifiedType() and
+ isGLValue = false
+ )
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ kind instanceof GotoEdge and
+ (
+ (
+ tag = getFieldAddressTag() and
+ result = getInstruction(getFieldDefaultValueTag())
+ ) or
+ (
+ tag = getFieldDefaultValueTag() and
+ result = getInstruction(getFieldDefaultValueStoreTag())
+ ) or
+ (
+ tag = getFieldDefaultValueStoreTag() and
+ result = getParent().getChildSuccessor(this)
+ )
+ )
+ }
+
+ override string getInstructionConstantValue(InstructionTag tag) {
+ tag = getFieldDefaultValueTag() and
+ result = getZeroValue(field.getType().getUnspecifiedType())
+ }
+
+ override Instruction getInstructionOperand(InstructionTag tag,
+ OperandTag operandTag) {
+ result = TranslatedFieldInitialization.super.getInstructionOperand(tag, operandTag) or
+ (
+ tag = getFieldDefaultValueStoreTag() and
+ (
+ (
+ operandTag instanceof LoadStoreAddressOperand and
+ result = getInstruction(getFieldAddressTag())
+ ) or
+ (
+ operandTag instanceof CopySourceOperand and
+ result = getInstruction(getFieldDefaultValueTag())
+ )
+ )
+ )
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ none()
+ }
+
+ override TranslatedElement getChild(int id) {
+ none()
+ }
+
+ private InstructionTag getFieldDefaultValueTag() {
+ result = InitializerFieldDefaultValueTag(field)
+ }
+
+ private InstructionTag getFieldDefaultValueStoreTag() {
+ result = InitializerFieldDefaultValueStoreTag(field)
+ }
+}
+
+/**
+ * Gets the `TranslatedElementInitialization` for element `elementIndex` in
+ * initializer list `initList`.
+ */
+TranslatedElementInitialization getTranslatedElementInitialization(
+ ArrayAggregateLiteral initList, int elementIndex) {
+ result.getInitList() = initList and result.getElementIndex() = elementIndex
+}
+
+/**
+ * Represents the IR translation of the initialization of an array element from
+ * an element of an initializer list.
+ */
+abstract class TranslatedElementInitialization extends TranslatedElement {
+ ArrayAggregateLiteral initList;
+
+ override final string toString() {
+ result = initList.toString() + "[" + getElementIndex().toString() + "]"
+ }
+
+ override final Locatable getAST() {
+ result = initList
+ }
+
+ override final Function getFunction() {
+ result = initList.getEnclosingFunction()
+ }
+
+ override final Instruction getFirstInstruction() {
+ result = getInstruction(getElementIndexTag())
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ (
+ tag = getElementIndexTag() and
+ opcode instanceof Opcode::Constant and
+ resultType = getIntType() and
+ isGLValue = false
+ ) or
+ (
+ tag = getElementAddressTag() and
+ opcode instanceof Opcode::PointerAdd and
+ resultType = getElementType() and
+ isGLValue = true
+ )
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ tag = getElementIndexTag() and
+ result = getInstruction(getElementAddressTag()) and
+ kind instanceof GotoEdge
+ }
+
+ override Instruction getInstructionOperand(InstructionTag tag,
+ OperandTag operandTag) {
+ tag = getElementAddressTag() and
+ (
+ (
+ operandTag instanceof LeftOperand and
+ result = getParent().(InitializationContext).getTargetAddress()
+ ) or
+ (
+ operandTag instanceof RightOperand and
+ result = getInstruction(getElementIndexTag())
+ )
+ )
+ }
+
+ override string getInstructionConstantValue(InstructionTag tag) {
+ tag = getElementIndexTag() and
+ result = getElementIndex().toString()
+ }
+
+ abstract int getElementIndex();
+
+ final InstructionTag getElementAddressTag() {
+ result = InitializerElementAddressTag(getElementIndex())
+ }
+
+ final InstructionTag getElementIndexTag() {
+ result = InitializerElementIndexTag(getElementIndex())
+ }
+
+ final ArrayAggregateLiteral getInitList() {
+ result = initList
+ }
+
+ final Type getElementType() {
+ result = initList.getType().getUnspecifiedType().(ArrayType).
+ getBaseType().getUnspecifiedType()
+ }
+}
+
+/**
+ * Represents the IR translation of the initialization of an array element from
+ * an explicit element in an initializer list.
+ */
+class TranslatedExplicitElementInitialization extends
+ TranslatedElementInitialization, TTranslatedExplicitElementInitialization,
+ InitializationContext {
+ int elementIndex;
+
+ TranslatedExplicitElementInitialization() {
+ this = TTranslatedExplicitElementInitialization(initList, elementIndex)
+ }
+
+ override Instruction getTargetAddress() {
+ result = getInstruction(getElementAddressTag())
+ }
+
+ override Type getTargetType() {
+ result = getElementType()
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ result = TranslatedElementInitialization.super.getInstructionSuccessor(tag, kind) or
+ (
+ tag = getElementAddressTag() and
+ result = getInitialization().getFirstInstruction() and
+ kind instanceof GotoEdge
+ )
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ child = getInitialization() and result = getParent().getChildSuccessor(this)
+ }
+
+ override TranslatedElement getChild(int id) {
+ id = 0 and result = getInitialization()
+ }
+
+ override int getElementIndex() {
+ result = elementIndex
+ }
+
+ TranslatedInitialization getInitialization() {
+ result = getTranslatedInitialization(
+ initList.getElementExpr(elementIndex).getFullyConverted())
+ }
+}
+
+/**
+ * Represents the IR translation of the initialization of a range of array
+ * elements without corresponding elements in the initializer list.
+ */
+class TranslatedElementValueInitialization extends
+ TranslatedElementInitialization, TTranslatedElementValueInitialization {
+ int elementIndex;
+ int elementCount;
+
+ TranslatedElementValueInitialization() {
+ this = TTranslatedElementValueInitialization(initList, elementIndex,
+ elementCount)
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ TranslatedElementInitialization.super.hasInstruction(opcode, tag, resultType, isGLValue) or
+ (
+ tag = getElementDefaultValueTag() and
+ opcode instanceof Opcode::Constant and
+ resultType = getDefaultValueType() and
+ isGLValue = false
+ ) or
+ (
+ tag = getElementDefaultValueStoreTag() and
+ opcode instanceof Opcode::Store and
+ resultType = getDefaultValueType() and
+ isGLValue = false
+ )
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ result = TranslatedElementInitialization.super.getInstructionSuccessor(tag, kind) or
+ (
+ kind instanceof GotoEdge and
+ (
+ (
+ tag = getElementAddressTag() and
+ result = getInstruction(getElementDefaultValueTag())
+ ) or
+ (
+ tag = getElementDefaultValueTag() and
+ result = getInstruction(getElementDefaultValueStoreTag())
+ ) or
+ (
+ tag = getElementDefaultValueStoreTag() and
+ result = getParent().getChildSuccessor(this)
+ )
+ )
+ )
+ }
+
+ override string getInstructionConstantValue(InstructionTag tag) {
+ result = TranslatedElementInitialization.super.getInstructionConstantValue(tag) or
+ (
+ tag = getElementDefaultValueTag() and
+ result = getZeroValue(getElementType())
+ )
+ }
+
+ override int getInstructionResultSize(InstructionTag tag) {
+ elementCount > 1 and
+ (
+ tag = getElementDefaultValueTag() or
+ tag = getElementDefaultValueStoreTag()
+ ) and
+ result = elementCount * getElementType().getSize()
+ }
+
+ override Instruction getInstructionOperand(InstructionTag tag,
+ OperandTag operandTag) {
+ result = TranslatedElementInitialization.super.getInstructionOperand(tag, operandTag) or
+ (
+ tag = getElementDefaultValueStoreTag() and
+ (
+ (
+ operandTag instanceof LoadStoreAddressOperand and
+ result = getInstruction(getElementAddressTag())
+ ) or
+ (
+ operandTag instanceof CopySourceOperand and
+ result = getInstruction(getElementDefaultValueTag())
+ )
+ )
+ )
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ none()
+ }
+
+ override TranslatedElement getChild(int id) {
+ none()
+ }
+
+ override int getElementIndex() {
+ result = elementIndex
+ }
+
+ private InstructionTag getElementDefaultValueTag() {
+ result = InitializerElementDefaultValueTag(elementIndex)
+ }
+
+ private InstructionTag getElementDefaultValueStoreTag() {
+ result = InitializerElementDefaultValueStoreTag(elementIndex)
+ }
+
+ private Type getDefaultValueType() {
+ if elementCount = 1 then
+ result = getElementType()
+ else
+ result instanceof UnknownType
+ }
+}
+
+abstract class TranslatedStructorCallFromStructor extends TranslatedElement, StructorCallContext {
+ FunctionCall call;
+
+ override final Locatable getAST() {
+ result = call
+ }
+
+ override final TranslatedElement getChild(int id) {
+ id = 0 and
+ result = getStructorCall()
+ }
+
+ override final Function getFunction() {
+ result = call.getEnclosingFunction()
+ }
+
+ override final Instruction getChildSuccessor(TranslatedElement child) {
+ child = getStructorCall() and
+ result = getParent().getChildSuccessor(this)
+ }
+
+ final TranslatedExpr getStructorCall() {
+ result = getTranslatedExpr(call)
+ }
+}
+
+/**
+ * Represents the IR translation of a call to a base class constructor or
+ * destructor from within a derived class constructor or destructor.
+ */
+abstract class TranslatedBaseStructorCall extends TranslatedStructorCallFromStructor {
+ override final Instruction getFirstInstruction() {
+ result = getInstruction(OnlyInstructionTag())
+ }
+
+ override final predicate hasInstruction(Opcode opcode, InstructionTag tag, Type resultType,
+ boolean isGLValue) {
+ tag = OnlyInstructionTag() and
+ opcode instanceof Opcode::ConvertToBase and
+ resultType = call.getTarget().getDeclaringType().getUnspecifiedType() and
+ isGLValue = true
+ }
+
+ override final Instruction getInstructionSuccessor(InstructionTag tag, EdgeKind kind) {
+ tag = OnlyInstructionTag() and
+ kind instanceof GotoEdge and
+ result = getStructorCall().getFirstInstruction()
+ }
+
+ override final Instruction getReceiver() {
+ result = getInstruction(OnlyInstructionTag())
+ }
+
+ override final Instruction getInstructionOperand(InstructionTag tag,
+ OperandTag operandTag) {
+ tag = OnlyInstructionTag() and
+ operandTag instanceof UnaryOperand and
+ result = getTranslatedFunction(getFunction()).getInitializeThisInstruction()
+ }
+
+ override final predicate getInstructionInheritance(InstructionTag tag,
+ Class baseClass, Class derivedClass) {
+ tag = OnlyInstructionTag() and
+ baseClass = call.getTarget().getDeclaringType().getUnspecifiedType() and
+ derivedClass = getFunction().getDeclaringType().getUnspecifiedType()
+ }
+}
+
+/**
+ * Represents a call to a delegating or base class constructor from within a constructor.
+ */
+abstract class TranslatedConstructorCallFromConstructor extends TranslatedStructorCallFromStructor,
+ TTranslatedConstructorBaseInit {
+ TranslatedConstructorCallFromConstructor() {
+ this = TTranslatedConstructorBaseInit(call)
+ }
+}
+
+TranslatedConstructorCallFromConstructor getTranslatedConstructorBaseInit(ConstructorBaseInit init) {
+ result.getAST() = init
+}
+
+/**
+ * Represents the IR translation of a delegating constructor call from within a constructor.
+ */
+class TranslatedConstructorDelegationInit extends TranslatedConstructorCallFromConstructor {
+ TranslatedConstructorDelegationInit() {
+ call instanceof ConstructorDelegationInit
+ }
+
+ override final string toString() {
+ result = "delegation construct: " + call.toString()
+ }
+
+ override final Instruction getFirstInstruction() {
+ result = getStructorCall().getFirstInstruction()
+ }
+
+ override final predicate hasInstruction(Opcode opcode, InstructionTag tag, Type resultType,
+ boolean isGLValue) {
+ none()
+ }
+
+ override final Instruction getInstructionSuccessor(InstructionTag tag, EdgeKind kind) {
+ none()
+ }
+
+ override final Instruction getReceiver() {
+ result = getTranslatedFunction(getFunction()).getInitializeThisInstruction()
+ }
+}
+
+/**
+ * Represents the IR translation of a call to a base class constructor from within a
+ * derived class constructor
+ */
+class TranslatedConstructorBaseInit extends TranslatedConstructorCallFromConstructor,
+ TranslatedBaseStructorCall {
+ TranslatedConstructorBaseInit() {
+ not call instanceof ConstructorDelegationInit
+ }
+
+ override final string toString() {
+ result = "construct base: " + call.toString()
+ }
+}
+
+TranslatedDestructorBaseDestruction getTranslatedDestructorBaseDestruction(DestructorBaseDestruction destruction) {
+ result.getAST() = destruction
+}
+
+/**
+ * Represents the IR translation of a call to a base class destructor from within a
+ * derived class destructor.
+ */
+class TranslatedDestructorBaseDestruction extends TranslatedBaseStructorCall,
+ TTranslatedDestructorBaseDestruction {
+ TranslatedDestructorBaseDestruction() {
+ this = TTranslatedDestructorBaseDestruction(call)
+ }
+
+ override final string toString() {
+ result = "destroy base: " + call.toString()
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ir/internal/TranslatedStmt.qll b/cpp/ql/src/semmle/code/cpp/ir/internal/TranslatedStmt.qll
new file mode 100644
index 000000000000..407507531da4
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ir/internal/TranslatedStmt.qll
@@ -0,0 +1,753 @@
+import cpp
+private import InstructionTag
+private import Opcode
+private import TranslatedCondition
+private import TranslatedDeclarationEntry
+private import TranslatedElement
+private import TranslatedExpr
+private import TranslatedFunction
+private import TranslatedInitialization
+
+TranslatedStmt getTranslatedStmt(Stmt stmt) {
+ result.getAST() = stmt
+}
+
+abstract class TranslatedStmt extends TranslatedElement, TTranslatedStmt {
+ Stmt stmt;
+
+ TranslatedStmt() {
+ this = TTranslatedStmt(stmt)
+ }
+
+ override final string toString() {
+ result = stmt.toString()
+ }
+
+ override final Locatable getAST() {
+ result = stmt
+ }
+
+ override final Function getFunction() {
+ result = stmt.getEnclosingFunction()
+ }
+}
+
+class TranslatedEmptyStmt extends TranslatedStmt {
+ TranslatedEmptyStmt() {
+ stmt instanceof EmptyStmt or
+ stmt instanceof LabelStmt or
+ stmt instanceof SwitchCase
+ }
+
+ override TranslatedElement getChild(int id) {
+ none()
+ }
+
+ override Instruction getFirstInstruction() {
+ result = getInstruction(OnlyInstructionTag())
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ tag = OnlyInstructionTag() and
+ opcode instanceof Opcode::NoOp and
+ resultType instanceof VoidType and
+ isGLValue = false
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ tag = OnlyInstructionTag() and
+ result = getParent().getChildSuccessor(this) and
+ kind instanceof GotoEdge
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ none()
+ }
+}
+
+class TranslatedDeclStmt extends TranslatedStmt {
+ DeclStmt declStmt;
+
+ TranslatedDeclStmt() {
+ declStmt = stmt
+ }
+
+ override TranslatedElement getChild(int id) {
+ result = getDeclarationEntry(id)
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ none()
+ }
+
+ override Instruction getFirstInstruction() {
+ result = getDeclarationEntry(0).getFirstInstruction() //REVIEW: Empty?
+ }
+
+ private int getChildCount() {
+ result = declStmt.getNumDeclarations()
+ }
+
+ private TranslatedDeclarationEntry getDeclarationEntry(int index) {
+ result = getTranslatedDeclarationEntry(declStmt.getDeclarationEntry(index))
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ none()
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ exists(int index |
+ child = getDeclarationEntry(index) and
+ if index = (getChildCount() - 1) then
+ result = getParent().getChildSuccessor(this)
+ else
+ result = getDeclarationEntry(index + 1).getFirstInstruction()
+ )
+ }
+}
+
+class TranslatedExprStmt extends TranslatedStmt {
+ TranslatedExprStmt() {
+ stmt instanceof ExprStmt
+ }
+
+ TranslatedExpr getExpr() {
+ result = getTranslatedExpr(stmt.(ExprStmt).getExpr().getFullyConverted())
+ }
+
+ override TranslatedElement getChild(int id) {
+ id = 0 and result = getExpr()
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ none()
+ }
+
+ override Instruction getFirstInstruction() {
+ result = getExpr().getFirstInstruction()
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ none()
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ child = getExpr() and
+ result = getParent().getChildSuccessor(this)
+ }
+}
+
+abstract class TranslatedReturnStmt extends TranslatedStmt {
+ ReturnStmt returnStmt;
+
+ TranslatedReturnStmt() {
+ returnStmt = stmt
+ }
+
+ final TranslatedFunction getEnclosingFunction() {
+ result = getTranslatedFunction(returnStmt.getEnclosingFunction())
+ }
+}
+
+class TranslatedReturnValueStmt extends TranslatedReturnStmt,
+ InitializationContext {
+ TranslatedReturnValueStmt() {
+ returnStmt.hasExpr()
+ }
+
+ override TranslatedElement getChild(int id) {
+ id = 0 and result = getInitialization()
+ }
+
+ override Instruction getFirstInstruction() {
+ result = getInstruction(InitializerVariableAddressTag())
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ tag = InitializerVariableAddressTag() and
+ opcode instanceof Opcode::VariableAddress and
+ resultType = getEnclosingFunction().getReturnVariable().getType() and
+ isGLValue = true
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ tag = InitializerVariableAddressTag() and
+ result = getInitialization().getFirstInstruction() and
+ kind instanceof GotoEdge
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ child = getInitialization() and
+ result = getEnclosingFunction().getReturnSuccessorInstruction()
+ }
+
+ override IRVariable getInstructionVariable(InstructionTag tag) {
+ tag = InitializerVariableAddressTag() and
+ result = getEnclosingFunction().getReturnVariable()
+ }
+
+ override Instruction getTargetAddress() {
+ result = getInstruction(InitializerVariableAddressTag())
+ }
+
+ override Type getTargetType() {
+ result = getEnclosingFunction().getReturnVariable().getType()
+ }
+
+ TranslatedInitialization getInitialization() {
+ result = getTranslatedInitialization(
+ returnStmt.getExpr().getFullyConverted())
+ }
+}
+
+class TranslatedReturnVoidStmt extends TranslatedReturnStmt {
+ TranslatedReturnVoidStmt() {
+ not returnStmt.hasExpr()
+ }
+
+ override TranslatedElement getChild(int id) {
+ none()
+ }
+
+ override Instruction getFirstInstruction() {
+ result = getInstruction(OnlyInstructionTag())
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ tag = OnlyInstructionTag() and
+ opcode instanceof Opcode::NoOp and
+ resultType instanceof VoidType and
+ isGLValue = false
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ tag = OnlyInstructionTag() and
+ result = getEnclosingFunction().getReturnSuccessorInstruction() and
+ kind instanceof GotoEdge
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ none()
+ }
+}
+
+/**
+ * The IR translation of a C++ `try` statement.
+ */
+class TranslatedTryStmt extends TranslatedStmt {
+ TryStmt try;
+
+ TranslatedTryStmt() {
+ try = stmt
+ }
+
+ override TranslatedElement getChild(int id) {
+ id = 0 and result = getBody() or
+ result = getHandler(id - 1)
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ none()
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ none()
+ }
+
+ override Instruction getFirstInstruction() {
+ result = getBody().getFirstInstruction()
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ // All children go to the successor of the `try`.
+ child = getAChild() and result = getParent().getChildSuccessor(this)
+ }
+
+ final Instruction getNextHandler(TranslatedHandler handler) {
+ exists(int index |
+ handler = getHandler(index) and
+ result = getHandler(index + 1).getFirstInstruction()
+ ) or
+ (
+ // The last catch clause flows to the exception successor of the parent
+ // of the `try`, because the exception successor of the `try` itself is
+ // the first catch clause.
+ handler = getHandler(try.getNumberOfCatchClauses()) and
+ result = getParent().getExceptionSuccessorInstruction()
+ )
+ }
+
+ override final Instruction getExceptionSuccessorInstruction() {
+ result = getHandler(0).getFirstInstruction()
+ }
+
+ private TranslatedHandler getHandler(int index) {
+ result = getTranslatedStmt(try.getChild(index + 1))
+ }
+
+ private TranslatedStmt getBody() {
+ result = getTranslatedStmt(try.getStmt())
+ }
+}
+
+class TranslatedBlock extends TranslatedStmt {
+ Block block;
+
+ TranslatedBlock() {
+ block = stmt
+ }
+
+ override TranslatedElement getChild(int id) {
+ result = getStmt(id)
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ isEmpty() and
+ opcode instanceof Opcode::NoOp and
+ tag = OnlyInstructionTag() and
+ resultType instanceof VoidType and
+ isGLValue = false
+ }
+
+ override Instruction getFirstInstruction() {
+ if isEmpty() then
+ result = getInstruction(OnlyInstructionTag())
+ else
+ result = getStmt(0).getFirstInstruction()
+ }
+
+ private predicate isEmpty() {
+ not exists(block.getStmt(0))
+ }
+
+ private TranslatedStmt getStmt(int index) {
+ result = getTranslatedStmt(block.getStmt(index))
+ }
+
+ private int getStmtCount() {
+ result = block.getNumStmt()
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ tag = OnlyInstructionTag() and
+ result = getParent().getChildSuccessor(this) and
+ kind instanceof GotoEdge
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ exists(int index |
+ child = getStmt(index) and
+ if index = (getStmtCount() - 1) then
+ result = getParent().getChildSuccessor(this)
+ else
+ result = getStmt(index + 1).getFirstInstruction()
+ )
+ }
+}
+
+/**
+ * The IR translation of a C++ `catch` handler.
+ */
+abstract class TranslatedHandler extends TranslatedStmt {
+ Handler handler;
+
+ TranslatedHandler() {
+ handler = stmt
+ }
+
+ override TranslatedElement getChild(int id) {
+ id = 1 and result = getBlock()
+ }
+
+ override Instruction getFirstInstruction() {
+ result = getInstruction(CatchTag())
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ child = getBlock() and result = getParent().getChildSuccessor(this)
+ }
+
+ override Instruction getExceptionSuccessorInstruction() {
+ // A throw from within a `catch` block flows to the handler for the parent of
+ // the `try`.
+ result = getParent().getParent().getExceptionSuccessorInstruction()
+ }
+
+ TranslatedStmt getBlock() {
+ result = getTranslatedStmt(handler.getBlock())
+ }
+}
+
+/**
+ * The IR translation of a C++ `catch` block that catches an exception with a
+ * specific type (e.g. `catch (const std::exception&)`).
+ */
+class TranslatedCatchByTypeHandler extends TranslatedHandler {
+ TranslatedCatchByTypeHandler() {
+ exists(handler.getParameter())
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ tag = CatchTag() and
+ opcode instanceof Opcode::CatchByType and
+ resultType instanceof VoidType and
+ isGLValue = false
+ }
+
+ override TranslatedElement getChild(int id) {
+ result = super.getChild(id) or
+ id = 0 and result = getParameter()
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ result = super.getChildSuccessor(child) or
+ child = getParameter() and result = getBlock().getFirstInstruction()
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ tag = CatchTag() and
+ (
+ (
+ kind instanceof GotoEdge and
+ result = getParameter().getFirstInstruction()
+ ) or
+ (
+ kind instanceof ExceptionEdge and
+ result = getParent().(TranslatedTryStmt).getNextHandler(this)
+ )
+ )
+ }
+
+ override Type getInstructionExceptionType(InstructionTag tag) {
+ tag = CatchTag() and
+ result = handler.getParameter().getType()
+ }
+
+ private TranslatedParameter getParameter() {
+ result = getTranslatedParameter(handler.getParameter())
+ }
+}
+
+/**
+ * The IR translation of a C++ `catch (...)` block.
+ */
+class TranslatedCatchAnyHandler extends TranslatedHandler {
+ TranslatedCatchAnyHandler() {
+ not exists(handler.getParameter())
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ tag = CatchTag() and
+ opcode instanceof Opcode::CatchAny and
+ resultType instanceof VoidType and
+ isGLValue = false
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ tag = CatchTag() and
+ kind instanceof GotoEdge and
+ result = getBlock().getFirstInstruction()
+ }
+}
+
+class TranslatedIfStmt extends TranslatedStmt, ConditionContext {
+ IfStmt ifStmt;
+
+ TranslatedIfStmt() {
+ stmt = ifStmt
+ }
+
+ override Instruction getFirstInstruction() {
+ result = getCondition().getFirstInstruction()
+ }
+
+ override TranslatedElement getChild(int id) {
+ id = 0 and result = getCondition() or
+ id = 1 and result = getThen() or
+ id = 2 and result = getElse()
+ }
+
+ private TranslatedCondition getCondition() {
+ result = getTranslatedCondition(ifStmt.getCondition().getFullyConverted())
+ }
+
+ private TranslatedStmt getThen() {
+ result = getTranslatedStmt(ifStmt.getThen())
+ }
+
+ private TranslatedStmt getElse() {
+ result = getTranslatedStmt(ifStmt.getElse())
+ }
+
+ private predicate hasElse() {
+ exists(ifStmt.getElse())
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ none()
+ }
+
+ override Instruction getChildTrueSuccessor(TranslatedCondition child) {
+ child = getCondition() and
+ result = getThen().getFirstInstruction()
+ }
+
+ override Instruction getChildFalseSuccessor(TranslatedCondition child) {
+ child = getCondition() and
+ if hasElse() then
+ result = getElse().getFirstInstruction()
+ else
+ result = getParent().getChildSuccessor(this)
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ (child = getThen() or child = getElse()) and
+ result = getParent().getChildSuccessor(this)
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ none()
+ }
+}
+
+abstract class TranslatedLoop extends TranslatedStmt, ConditionContext {
+ Loop loop;
+
+ TranslatedLoop() {
+ loop = stmt
+ }
+
+ final TranslatedCondition getCondition() {
+ result = getTranslatedCondition(loop.getCondition().getFullyConverted())
+ }
+
+ final TranslatedStmt getBody() {
+ result = getTranslatedStmt(loop.getStmt())
+ }
+
+ final Instruction getFirstConditionInstruction() {
+ if hasCondition() then
+ result = getCondition().getFirstInstruction()
+ else
+ result = getBody().getFirstInstruction()
+ }
+
+ final predicate hasCondition() {
+ exists(loop.getCondition())
+ }
+
+ override TranslatedElement getChild(int id) {
+ id = 0 and result = getCondition() or
+ id = 1 and result = getBody()
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ none()
+ }
+
+ override final Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ none()
+ }
+
+ override final Instruction getChildTrueSuccessor(TranslatedCondition child) {
+ child = getCondition() and result = getBody().getFirstInstruction()
+ }
+
+ override final Instruction getChildFalseSuccessor(TranslatedCondition child) {
+ child = getCondition() and result = getParent().getChildSuccessor(this)
+ }
+}
+
+class TranslatedWhileStmt extends TranslatedLoop {
+ TranslatedWhileStmt() {
+ stmt instanceof WhileStmt
+ }
+
+ override Instruction getFirstInstruction() {
+ result = getFirstConditionInstruction()
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ child = getBody() and result = getFirstConditionInstruction()
+ }
+}
+
+class TranslatedDoStmt extends TranslatedLoop {
+ TranslatedDoStmt() {
+ stmt instanceof DoStmt
+ }
+
+ override Instruction getFirstInstruction() {
+ result = getBody().getFirstInstruction()
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ child = getBody() and result = getFirstConditionInstruction()
+ }
+}
+
+class TranslatedForStmt extends TranslatedLoop {
+ ForStmt forStmt;
+
+ TranslatedForStmt() {
+ forStmt = stmt
+ }
+
+ override TranslatedElement getChild(int id) {
+ id = 0 and result = getInitialization() or
+ id = 1 and result = getCondition() or
+ id = 2 and result = getUpdate() or
+ id = 3 and result = getBody()
+ }
+
+ private TranslatedStmt getInitialization() {
+ result = getTranslatedStmt(forStmt.getInitialization())
+ }
+
+ private predicate hasInitialization() {
+ exists(forStmt.getInitialization())
+ }
+
+ private TranslatedExpr getUpdate() {
+ result = getTranslatedExpr(forStmt.getUpdate().getFullyConverted())
+ }
+
+ private predicate hasUpdate() {
+ exists(forStmt.getUpdate())
+ }
+
+ override Instruction getFirstInstruction() {
+ if hasInitialization() then
+ result = getInitialization().getFirstInstruction()
+ else
+ result = getFirstConditionInstruction()
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ (
+ child = getInitialization() and
+ result = getFirstConditionInstruction()
+ ) or
+ (
+ child = getBody() and
+ if hasUpdate() then
+ result = getUpdate().getFirstInstruction()
+ else
+ result = getFirstConditionInstruction()
+ ) or
+ child = getUpdate() and result = getFirstConditionInstruction()
+ }
+}
+
+class TranslatedJumpStmt extends TranslatedStmt {
+ JumpStmt jump;
+
+ TranslatedJumpStmt() {
+ stmt = jump
+ }
+
+ override Instruction getFirstInstruction() {
+ result = getInstruction(OnlyInstructionTag())
+ }
+
+ override TranslatedElement getChild(int id) {
+ none()
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ tag = OnlyInstructionTag() and
+ opcode instanceof Opcode::NoOp and
+ resultType instanceof VoidType and
+ isGLValue = false
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ tag = OnlyInstructionTag() and
+ kind instanceof GotoEdge and
+ result = getTranslatedStmt(jump.getTarget()).getFirstInstruction()
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ none()
+ }
+}
+
+class TranslatedSwitchStmt extends TranslatedStmt {
+ SwitchStmt switchStmt;
+
+ TranslatedSwitchStmt() {
+ switchStmt = stmt
+ }
+
+ private TranslatedExpr getExpr() {
+ result = getTranslatedExpr(switchStmt.getExpr().getFullyConverted())
+ }
+
+ private TranslatedStmt getBody() {
+ result = getTranslatedStmt(switchStmt.getStmt())
+ }
+
+ override Instruction getFirstInstruction() {
+ result = getExpr().getFirstInstruction()
+ }
+
+ override TranslatedElement getChild(int id) {
+ id = 0 and result = getExpr() or
+ id = 1 and result = getBody()
+ }
+
+ override predicate hasInstruction(Opcode opcode, InstructionTag tag,
+ Type resultType, boolean isGLValue) {
+ tag = SwitchBranchTag() and
+ opcode instanceof Opcode::Switch and
+ resultType instanceof VoidType and
+ isGLValue = false
+ }
+
+ override Instruction getInstructionOperand(InstructionTag tag,
+ OperandTag operandTag) {
+ tag = SwitchBranchTag() and
+ operandTag instanceof ConditionOperand and
+ result = getExpr().getResult()
+ }
+
+ override Instruction getInstructionSuccessor(InstructionTag tag,
+ EdgeKind kind) {
+ tag = SwitchBranchTag() and
+ exists(SwitchCase switchCase |
+ switchCase = switchStmt.getASwitchCase() and
+ kind = getCaseEdge(switchCase) and
+ result = getTranslatedStmt(switchCase).getFirstInstruction()
+ )
+ }
+
+ override Instruction getChildSuccessor(TranslatedElement child) {
+ child = getExpr() and result = getInstruction(SwitchBranchTag()) or
+ child = getBody() and result = getParent().getChildSuccessor(this)
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/metrics/MetricClass.qll b/cpp/ql/src/semmle/code/cpp/metrics/MetricClass.qll
new file mode 100644
index 000000000000..18d5ade90d4c
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/metrics/MetricClass.qll
@@ -0,0 +1,525 @@
+import cpp
+
+/**
+ * A wrapper that provides metrics for a C++ class.
+ */
+class MetricClass extends Class {
+
+ /**
+ * Gets the nesting level of this class. A class that is _not_ nested
+ * directly inside another class has nesting level 0.
+ */
+ int getNestingLevel() {
+ if not this instanceof NestedClass then
+ result = 0
+ else
+ result = this.(NestedClass).getDeclaringType().(MetricClass).getNestingLevel() + 1
+ }
+
+ /**
+ * Gets the length of *some* path to a root of the hierarchy. A class with no
+ * base class has depth 0.
+ */
+ int getADepth() {
+ not this.getABaseClass+() = this and
+ if not exists(this.getABaseClass()) then
+ result = 0
+ else
+ result = this.getABaseClass().(MetricClass).getADepth() + 1
+ }
+
+ /**
+ * Gets the maximum depth of inheritance of this class. A class with no base
+ * class has depth 0.
+ */
+ int getInheritanceDepth() {
+ result = max(this.getADepth())
+ }
+
+ /** Gets the number of member functions in this class. */
+ int getNumberOfMemberFunctions() {
+ result = count(MemberFunction mf | mf.getDeclaringType() = this)
+ }
+
+ /** Gets the number of nested classes defined in this class. */
+ int getNumberOfNestedClasses() {
+ result = count(NestedClass nc | nc.getDeclaringType() = this)
+ }
+
+ /** Gets the number of non-static data members defined in this class. */
+ int getNumberOfFields() {
+ result = count(Field f | f.getDeclaringType() = this)
+ }
+
+ /** Gets the total number of members defined in this class. */
+ int getNumberOfMembers() {
+ result = count(Declaration m | m.getDeclaringType() = this)
+ }
+
+ /** Gets the number of incoming class dependencies. */
+ int getAfferentCoupling() {
+ result = count(MetricClass that | that.getAClassDependency() = this)
+ }
+
+ /** Gets the number of outgoing class dependencies. */
+ int getEfferentCoupling() {
+ result = count(MetricClass that | this.getAClassDependency() = that)
+ }
+
+ /** Gets the number of outgoing source class dependencies. */
+ int getEfferentSourceCoupling() {
+ result = count(MetricClass that | this.getAClassDependency() = that and that.fromSource())
+ }
+
+ /** Gets a class dependency of this element. */
+ Class getAClassDependency() {
+ dependsOnClassSimple(this, result)
+ }
+
+ /* -------- HENDERSON-SELLERS LACK OF COHESION IN METHODS -------- */
+
+ /* The aim of this metric is to try and determine whether a class
+ represents one abstraction (good) or multiple abstractions (bad).
+ If a class represents multiple abstractions, it should be split
+ up into multiple classes.
+
+ In the Henderson-Sellers method, this is measured as follows:
+ M = set of methods in class
+ F = set of fields in class
+ r(f) = number of methods that access field f
+ = mean of r(f) over f in F
+ The lack of cohesion is then given by
+
+ - |M|
+ ---------
+ 1 - |M|
+
+ We follow the Eclipse metrics plugin by restricting M to methods
+ that access some field in the same class, and restrict F to
+ fields that are read by methods in the same class.
+
+ Classes where the value of this metric is higher than 0.9 ought
+ to be scrutinised for possible splitting. Here is a query
+ to find such classes:
+
+ from MetricRefType t, float loc
+ where loc = t.getLackOfCohesionHS() and loc > 0.9
+ select t, loc order by loc desc
+ */
+
+ /** Holds if `func` accesses field `f` defined in the same type. */
+ predicate accessesLocalField(Function func, Field f) {
+ func.accesses(f) and
+ this.getAMemberFunction() = func and
+ f.getDeclaringType() = this
+ }
+
+ /** Gets any method that accesses some local field. */
+ Function getAccessingMethod() {
+ exists(Field f | this.accessesLocalField(result,f))
+ }
+
+ /** Gets any field that is accessed by a local method. */
+ Field getAccessedField() {
+ exists(Function func | this.accessesLocalField(func,result))
+ }
+
+ /** Gets the Henderson-Sellers lack-of-cohesion metric. */
+ float getLackOfCohesionHS() {
+ exists(int m, float r |
+ // m = number of methods that access some field
+ m = count(this.getAccessingMethod())
+ and
+ // r = average (over f) of number of methods that access field f
+ r = avg(Field f |
+ f = this.getAccessedField() |
+ count(Function x | this.accessesLocalField(x,f)))
+ and
+ // avoid division by zero
+ m != 1
+ and
+ // compute LCOM
+ result = ((r-m)/(1-m))
+ )
+ }
+
+ /* -------- CHIDAMBER AND KEMERER LACK OF COHESION IN METHODS ------------ */
+
+ /* The aim of this metric is to try and determine whether a class
+ represents one abstraction (good) or multiple abstractions (bad).
+ If a class represents multiple abstractions, it should be split
+ up into multiple classes.
+
+ In the Chidamber and Kemerer method, this is measured as follows:
+ n1 = number of pairs of distinct methods in a class that do *not*
+ have at least one commonly accessed field
+ n2 = number of pairs of distinct methods in a class that do
+ have at least one commonly accessed field
+ lcom = ((n1 - n2)/2 max 0)
+
+ We divide by 2 because each pair (m1,m2) is counted twice in n1 and n2.
+
+ */
+
+ /** Holds if `f` should be excluded from the CK cohesion computation. */
+ predicate ignoreLackOfCohesionCK(Function f) {
+ none() // by default, nothing is ignored
+ }
+
+ /** Holds if `m1` and `m2` are distinct member functions of this class. */
+ predicate distinctMembers(MemberFunction m1, MemberFunction m2) {
+ m1.getDeclaringType() = this and
+ m2.getDeclaringType() = this and
+ m1 != m2
+ }
+
+ /**
+ * Holds if `m1` and `m2` are distinct member functions of this class that
+ * both access a common field.
+ */
+ predicate shareField(MemberFunction m1, MemberFunction m2) {
+ exists(Field f |
+ m1.accesses(f) and
+ m1.getDeclaringType() = this and
+ m2.accesses(f) and
+ m2.getDeclaringType() = this) and
+ m1 != m2
+ }
+
+ /** Gets the Chidamber and Kemerer lack-of-cohesion metric. */
+ float getLackOfCohesionCK() {
+ exists(int n1, int n2, float n |
+ n1 = count(MemberFunction m1, MemberFunction m2 |
+ not this.ignoreLackOfCohesionCK(m1) and
+ not this.ignoreLackOfCohesionCK(m2) and
+ this.distinctMembers(m1,m2) and
+ not(this.shareField(m1,m2)))
+ and
+ n2 = count(MemberFunction m1, MemberFunction m2 |
+ this.shareField(m1,m2))
+ and
+ n = (n1 - n2)/2.0
+ and
+ ( (n < 0 and result = 0)
+ or
+ (n>=0 and result = n) )
+ )
+ }
+
+ /* ----------------- RESPONSE FOR A CLASS --------------------------------- */
+
+ /**
+ * Gets the _response_ for this class. This estimates the number of
+ * different functions that can be executed when a function is invoked on
+ * this class.
+ */
+ int getResponse() {
+ result = sum(MemberFunction f | f.getDeclaringType()=this | count(Call call | call.getEnclosingFunction() = f))
+ }
+
+ /* ----------------- SPECIALIZATION INDEX -------------------------------- */
+
+ /**
+ * Gets a function that should be excluded when reporting the number of
+ * overriding methods. By default, no functions are excluded.
+ */
+ predicate ignoreOverride(MemberFunction m) {
+ none()
+ }
+
+ /** Gets some method that overrides a non-abstract method in a base class. */
+ MemberFunction getOverrides() {
+ this.getAMemberFunction() = result and
+ exists(MemberFunction c | result.overrides(c) and
+ not c instanceof PureVirtualFunction) and
+ not this.ignoreOverride(result)
+ }
+
+ /** Gets the number of methods that are overridden by this class (NORM). */
+ int getNumberOverridden() {
+ result = count(this.getOverrides())
+ }
+
+ /**
+ * Gets the _specialization index_ of this class.
+ *
+ * The specialization index metric measures the extent to which derived
+ * classes override (replace) the behavior of their base classes. If they
+ * override many methods, it is an indication that the original abstraction
+ * in the base classes may have been inappropriate. On the whole, derived
+ * classes should add behavior to their base classes, but not alter that
+ * behavior dramatically.
+ */
+ float getSpecialisationIndex() {
+ this.getNumberOfMemberFunctions() != 0
+ and
+ result = (this.getNumberOverridden() * this.getInheritanceDepth())
+ /
+ this.getNumberOfMemberFunctions().(float)
+ }
+
+ /*
+ * HALSTEAD METRICS
+ */
+
+ /**
+ * Gets the Halstead "N1" metric for this class. This is the total number of
+ * operators in the class. Operators are taken to be all operators in
+ * expressions (`+`, `*`, `&`, `->`, `=`, ...) as well as most statements.
+ */
+ int getHalsteadN1() {
+ result =
+ 1 + // account for the class itself
+ sum(MetricFunction mf, int toSum | (mf.(MemberFunction).getDeclaringType() = this) and (toSum = mf.getHalsteadN1()) | toSum) +
+ // Each member variable declaration counts once as an operator
+ count(MemberVariable mv | mv.getDeclaringType() = this) +
+ // Friend declarations
+ count(FriendDecl f | f.getDeclaringClass() = this)
+ }
+
+ /**
+ * Gets the Halstead "N2" metric for this class: this is the total number of operands.
+ * An operand is either a variable, constant, type name, class name, or function name.
+ */
+ int getHalsteadN2() {
+ result =
+ 1 + // the class itself
+ sum(MetricFunction mf, int toSum | (mf.(MemberFunction).getDeclaringType() = this) and (toSum = mf.getHalsteadN2()) | toSum) +
+ // Each variable declaration that is not in a function counts once as an operand
+ count(MemberVariable mv | mv.getDeclaringType() = this)
+ }
+
+ /**
+ * Gets an expression contained anywhere in this class: member functions (including
+ * constructors, destructors and operators), initializers...
+ */
+ Expr getAnEnclosedExpression() {
+ exists(MemberFunction mf | mf.getDeclaringType() = this and
+ result.getEnclosingFunction() = mf)
+ or exists(MemberVariable mv | mv.getDeclaringType() = this and
+ mv.getInitializer().getExpr().getAChild*() = result)
+ }
+
+ /** Gets a statement in a member function of this class. */
+ Stmt getAnEnclosedStmt() {
+ result.getEnclosingFunction().(MemberFunction).getDeclaringType() = this
+ }
+
+ private string getAUsedHalsteadN1Operator() {
+ exists(CommaExpr e | e = this.getAnEnclosedExpression()) and result = "comma" or
+ exists(ReferenceToExpr e | e = this.getAnEnclosedExpression()) and result = "refTo" or
+ exists(PointerDereferenceExpr e | e = this.getAnEnclosedExpression()) and result = "dereference" or
+ exists(CStyleCast e | e = this.getAnEnclosedExpression()) and result = "cCast" or
+ exists(StaticCast e | e = this.getAnEnclosedExpression()) and result = "staticCast" or
+ exists(ConstCast e | e = this.getAnEnclosedExpression()) and result = "constCast" or
+ exists(ReinterpretCast e | e = this.getAnEnclosedExpression()) and result = "reinterpretCast" or
+ exists(DynamicCast e | e = this.getAnEnclosedExpression()) and result = "dynamicCast" or
+ exists(SizeofExprOperator e | e = this.getAnEnclosedExpression()) and result = "sizeofExpr" or
+ exists(SizeofTypeOperator e | e = this.getAnEnclosedExpression()) and result = "sizeofType" or
+ exists(IfStmt e | e = this.getAnEnclosedStmt()) and result = "ifVal" or
+ exists(SwitchStmt e | e = this.getAnEnclosedStmt()) and result = "switchVal" or
+ exists(ForStmt e | e = this.getAnEnclosedStmt()) and result = "forVal" or
+ exists(DoStmt e | e = this.getAnEnclosedStmt()) and result = "doVal" or
+ exists(WhileStmt e | e = this.getAnEnclosedStmt()) and result = "whileVal" or
+ exists(GotoStmt e | e = this.getAnEnclosedStmt()) and result = "gotoVal" or
+ exists(ContinueStmt e | e = this.getAnEnclosedStmt()) and result = "continueVal" or
+ exists(BreakStmt e | e = this.getAnEnclosedStmt()) and result = "breakVal" or
+ exists(ReturnStmt e | e = this.getAnEnclosedStmt()) and result = "returnVal" or
+ exists(SwitchCase e | e = this.getAnEnclosedStmt()) and result = "caseVal" or
+ exists(IfStmt s | s = this.getAnEnclosedStmt() and s.hasElse()) and result = "elseVal" or
+ exists(MemberFunction f | f.getDeclaringType() = this) and result = "function" or
+ exists(FriendDecl e | e.getDeclaringClass() = this) and result = "friendDecl"
+ }
+
+ /**
+ * Gets the Halstead "n1" metric: this is the total number of distinct operators
+ * in this class. Operators are defined as in the "N1" metric (`getHalsteadN1`).
+ */
+ int getHalsteadN1Distinct() {
+ result =
+ 1 + // avoid 0 values
+ count(string s | exists(Operation op | op = this.getAnEnclosedExpression() and s = op.getOperator())) +
+ count(string s | s = getAUsedHalsteadN1Operator())
+ }
+
+ /**
+ * Gets the Halstead "n2" metric: this is the number of distinct operands in this
+ * class. An operand is either a variable, constant, type name, or function name.
+ */
+ int getHalsteadN2Distinct() {
+ result =
+ 1 + // avoid 0 values
+ count(string s | exists(Access a | a = this.getAnEnclosedExpression() and s = a.getTarget().getName())) +
+ count(Function f | exists(FunctionCall fc | fc = this.getAnEnclosedExpression() and f = fc.getTarget())) +
+ // Approximate: count declarations once more to account for the type name
+ count(Declaration d | d.getParentScope*() = this)
+ }
+
+ /**
+ * Gets the Halstead length of this class. This is the sum of the N1 and N2 Halstead metrics.
+ */
+ int getHalsteadLength() {
+ result = this.getHalsteadN1() + this.getHalsteadN2()
+ }
+
+ /**
+ * Gets the Halstead vocabulary size of this class. This is the sum of the n1 and n2 Halstead metrics.
+ */
+ int getHalsteadVocabulary() {
+ result = this.getHalsteadN1Distinct() + this.getHalsteadN2Distinct()
+ }
+
+ /**
+ * Gets the Halstead volume of this class. This is the Halstead size multiplied by the log of the
+ * Halstead vocabulary. It represents the information content of the class.
+ */
+ float getHalsteadVolume() {
+ result = this.getHalsteadLength().(float) * this.getHalsteadVocabulary().log2()
+ }
+
+ /**
+ * Gets the Halstead difficulty value of this class. This is proportional to the number of unique
+ * operators, and further proportional to the ratio of total operands to unique operands.
+ */
+ float getHalsteadDifficulty() {
+ result = (float)(this.getHalsteadN1Distinct() * this.getHalsteadN2()) / (float)(2 * this.getHalsteadN2Distinct())
+ }
+
+ /**
+ * Gets the Halstead level of this class. This is the inverse of the _difficulty_ of the class.
+ */
+ float getHalsteadLevel() {
+ exists(float difficulty |
+ difficulty = this.getHalsteadDifficulty() and
+ if difficulty != 0.0 then
+ result = 1.0 / difficulty
+ else
+ result = 0.0
+ )
+ }
+
+ /**
+ * Gets the Halstead implementation effort for this class. This is the product of the volume and difficulty.
+ */
+ float getHalsteadEffort() {
+ result = this.getHalsteadVolume() * this.getHalsteadDifficulty()
+ }
+
+ /**
+ * Gets the Halstead _delivered bugs_ metric for this class. This metric correlates with the complexity of
+ * the software but is known to be an underestimate of bug counts.
+ */
+ float getHalsteadDeliveredBugs() {
+ result = this.getHalsteadEffort().pow(2.0/3.0) / 3000.0
+ }
+}
+
+private pragma[noopt]
+predicate dependsOnClassSimple(Class source, Class dest) {
+ (
+ // a class depends on the classes it inherits from
+ source.derivesFrom(dest)
+
+ // a nested class depends on its enclosing class
+ or source.getDeclaringType() = dest and source instanceof Class
+
+ // a class depends on its friend classes
+ or exists(FriendDecl fd | source.getAFriendDecl() = fd and fd.getFriend() = dest)
+ // a friend functions return type
+ or exists(FriendDecl fd, Function f, Type t | source.getAFriendDecl() = fd and fd.getFriend() = f and f.getType() = t and t.refersTo(dest))
+ // the type of the arguments to a friend function
+ or exists(FriendDecl fd, Function f, Parameter p, Type t | source.getAFriendDecl() = fd and fd.getFriend() = f and f.getAParameter() = p and p.getType() = t and t.refersTo(dest))
+
+
+ // a class depends on the types of its member variables
+ or exists(MemberVariable v, Type t | v.getDeclaringType() = source and v.getType() = t and t.refersTo(dest))
+
+ // a class depends on the return types of its member functions
+ or exists(MemberFunction f, Type t | f.getDeclaringType() = source and f instanceof MemberFunction and f.getType() = t and t.refersTo(dest))
+ // a class depends on the argument types of its member functions
+ or exists(MemberFunction f, Parameter p, Type t | f.getDeclaringType() = source and f instanceof MemberFunction and f.getAParameter() = p and p.getType() = t and t.refersTo(dest))
+
+ // a class depends on the base types of type def types nested in it
+ or exists(NestedTypedefType t, Type td | t.getDeclaringType() = source and t.getBaseType() = td and t instanceof NestedTypedefType and td.refersTo(dest))
+
+ // a class depends on the type names used in a casts in functions nested in it
+ or exists(Cast c, Function m, Type t | m.getDeclaringType() = source and m = c.getEnclosingFunction() and c instanceof Cast and c.getType() = t and t.refersTo(dest))
+ // a class depends on the type names used in casts in initialization of member variables
+ or exists(Cast c, Variable m, Type t | m.getDeclaringType() = source and m = c.getEnclosingVariable() and c instanceof Cast and c.getType() = t and t.refersTo(dest))
+
+ // a class depends on classes for which a call to its member function is done from a function
+ or exists(MemberFunction target, MemberFunction f, Locatable l |
+ f.getDeclaringType() = source
+ and f instanceof MemberFunction
+ and f.calls(target, l)
+ and target instanceof MemberFunction
+ and target.getDeclaringType() = dest)
+ // a class depends on classes for which a call to its member function is done from a member variable initializer
+ or exists(MemberFunction target, FunctionCall c, MemberVariable v |
+ v.getDeclaringType() = source
+ and v instanceof MemberVariable
+ and c.getEnclosingVariable() = v
+ and c instanceof FunctionCall
+ and c.getTarget() = target
+ and target instanceof MemberFunction
+ and target.getDeclaringType() = dest)
+
+ // a class(source) depends on classes(dest) for which its member functions(mf) are accessed(fa) from a member function(f)
+ or exists(MemberFunction f, FunctionAccess fa, MemberFunction mf |
+ f.getDeclaringType() = source
+ and f instanceof MemberFunction
+ and fa.getEnclosingFunction() = f
+ and fa.getTarget() = mf
+ and mf.getDeclaringType() = dest
+ and mf instanceof MemberFunction)
+
+ // a class depends on classes for which its member functions are accessed from a member variable initializer
+ or exists(MemberVariable v, FunctionAccess fa, MemberFunction mf |
+ v.getDeclaringType() = source
+ and v instanceof MemberVariable
+ and fa.getEnclosingVariable() = v
+ and fa.getTarget() = mf
+ and mf.getDeclaringType() = dest
+ and mf instanceof MemberFunction)
+
+ // a class depends on classes for which its member variables are accessed from a member function
+ or exists(MemberFunction f, VariableAccess va, MemberVariable mv |
+ f.getDeclaringType() = source
+ and f instanceof MemberFunction
+ and va.getEnclosingFunction() = f
+ and va instanceof VariableAccess
+ and va.getTarget() = mv
+ and mv.getDeclaringType() = dest
+ and mv instanceof MemberVariable)
+
+ // a class depends on classes for which its member variables are accessed from a member variable initializer
+ or exists(MemberVariable v, VariableAccess va, MemberVariable mv |
+ v.getDeclaringType() = source
+ and v instanceof MemberVariable
+ and va.getEnclosingVariable() = v
+ and va instanceof VariableAccess
+ and va.getTarget() = mv
+ and mv.getDeclaringType() = dest
+ and mv instanceof MemberVariable)
+
+ // a class depends on enums for which its enum constants are accessed from a member function
+ or exists(MemberFunction f, EnumConstantAccess ea, EnumConstant e |
+ f.getDeclaringType() = source
+ and f instanceof MemberFunction
+ and ea.getEnclosingFunction() = f
+ and ea.getTarget() = e
+ and e.getDeclaringEnum() = dest
+ and ea instanceof EnumConstantAccess)
+
+ // a class depends on enums for which its enum constants are accessed from a member variable initializer
+ or exists(MemberVariable v, EnumConstantAccess ea, EnumConstant e |
+ v.getDeclaringType() = source
+ and v instanceof MemberVariable
+ and ea.getEnclosingVariable() = v
+ and ea instanceof EnumConstantAccess
+ and ea.getTarget() = e
+ and e.getDeclaringEnum() = dest)
+
+ )
+ and dest instanceof Class
+}
diff --git a/cpp/ql/src/semmle/code/cpp/metrics/MetricFile.qll b/cpp/ql/src/semmle/code/cpp/metrics/MetricFile.qll
new file mode 100644
index 000000000000..12607d1a7a38
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/metrics/MetricFile.qll
@@ -0,0 +1,269 @@
+import cpp
+
+/**
+ * A wrapper that provides metrics for a C/C++ file.
+ */
+class MetricFile extends File {
+
+ /** Gets the number of functions defined in this file. */
+ int getNumberOfTopLevelFunctions() {
+ result = count(Function f | f.isTopLevel() and f.getFile() = this)
+ }
+
+ /** Gets the number of classes defined in this file. */
+ int getNumberOfClasses() {
+ result = count(Class c | c.getFile() = this)
+ }
+
+ /** Gets the number of user-defined types defined in this file. */
+ int getNumberOfUserTypes() {
+ result = count(UserType t | t.getFile() = this)
+ }
+
+ /** Gets the number of lines in this file. */
+ int getNumberOfLines() {
+ numlines(this,result,_,_)
+ }
+
+ /** Gets the number of lines of code in this file. */
+ int getNumberOfLinesOfCode() {
+ numlines(this,_,result,_)
+ }
+
+ /** Gets the number of lines of comments in this file. */
+ int getNumberOfLinesOfComments() {
+ numlines(this,_,_,result)
+ }
+
+ /** Gets the number of incoming file dependencies. */
+ int getAfferentCoupling() {
+ result = count(MetricFile that | that.getAFileDependency() = this)
+ }
+
+ /** Gets the number of outgoing file dependencies. */
+ int getEfferentCoupling() {
+ result = count(MetricFile that | this.getAFileDependency() = that)
+ }
+
+ /*
+ * HALSTEAD METRICS
+ */
+
+ /**
+ * Gets the Halstead "N1" metric for this file. This is the total number of
+ * operators in the file. Operators are taken to be all operators in
+ * expressions (`+`, `*`, `&`, `->`, `=`, ...) as well as most statements.
+ */
+ int getHalsteadN1() {
+ result =
+ sum(MetricFunction mf, int toSum | (mf.getFile() = this) and (toSum = mf.getHalsteadN1()) | toSum) +
+ count(Class c | c.getFile() = this) + // Each class counts once as an operator
+ // Each variable declaration that is not in a function counts once as an operator
+ count(GlobalVariable gv | gv.getFile() = this) +
+ count(MemberVariable mv | mv.getFile() = this) +
+ // Type declarations - to count the definition tokens
+ count(TypeDeclarationEntry decl | decl.getFile() = this) +
+ // Friend declarations
+ count(FriendDecl f | f.getFile() = this)
+ }
+
+ /**
+ * Gets the Halstead "N2" metric for this file: this is the total number of operands.
+ * An operand is either a variable, constant, type name, class name, or function name.
+ */
+ int getHalsteadN2() {
+ result =
+ sum(MetricFunction mf, int toSum | (mf.getFile() = this) and (toSum = mf.getHalsteadN2()) | toSum) +
+ count(Class c | c.getFile() = this) + // Each class counts once as an operand
+ // Each variable declaration that is not in a function counts once as an operand
+ count(GlobalVariable gv | gv.getFile() = this) +
+ count(MemberVariable mv | mv.getFile() = this) +
+ // Type declarations - to count the type names
+ count(TypeDeclarationEntry decl | decl.getFile() = this) +
+ // Enum constant declarations to count the name
+ count(EnumConstant ec | ec.getFile() = this)
+ }
+
+ private string getAUsedHalsteadN1Operator() {
+ exists(CommaExpr e | e.getFile() = this) and result = "comma" or
+ exists(ReferenceToExpr e | e.getFile() = this) and result = "refTo" or
+ exists(PointerDereferenceExpr e | e.getFile() = this) and result = "dereference" or
+ exists(CStyleCast e | e.getFile() = this) and result = "cCast" or
+ exists(StaticCast e | e.getFile() = this) and result = "staticCast" or
+ exists(ConstCast e | e.getFile() = this) and result = "constCast" or
+ exists(ReinterpretCast e | e.getFile() = this) and result = "reinterpretCast" or
+ exists(DynamicCast e | e.getFile() = this) and result = "dynamicCast" or
+ exists(SizeofExprOperator e | e.getFile() = this) and result = "sizeofExpr" or
+ exists(SizeofTypeOperator e | e.getFile() = this) and result = "sizeofType" or
+ exists(IfStmt e | e.getFile() = this) and result = "ifVal" or
+ exists(SwitchStmt e | e.getFile() = this) and result = "switchVal" or
+ exists(ForStmt e | e.getFile() = this) and result = "forVal" or
+ exists(DoStmt e | e.getFile() = this) and result = "doVal" or
+ exists(WhileStmt e | e.getFile() = this) and result = "whileVal" or
+ exists(GotoStmt e | e.getFile() = this) and result = "gotoVal" or
+ exists(ContinueStmt e | e.getFile() = this) and result = "continueVal" or
+ exists(BreakStmt e | e.getFile() = this) and result = "breakVal" or
+ exists(ReturnStmt e | e.getFile() = this) and result = "returnVal" or
+ exists(SwitchCase e | e.getFile() = this) and result = "caseVal" or
+ exists(IfStmt s | s.getFile() = this and s.hasElse()) and result = "elseVal" or
+ exists(Function f | f.getFile() = this) and result = "function" or
+ exists(Class c | c.getFile() = this) and result = "classDef" or
+ exists(TypeDeclarationEntry e | e.getFile() = this) and result = "typeDecl" or
+ exists(FriendDecl e | e.getFile() = this) and result = "friendDecl"
+ }
+
+ /**
+ * Gets the Halstead "n1" metric: this is the total number of distinct operators
+ * in this file. Operators are defined as in the "N1" metric (`getHalsteadN1`).
+ */
+ int getHalsteadN1Distinct() {
+ result =
+ 1 + // avoid 0 values
+ count(string s | exists(Operation op | op.getFile() = this and s = op.getOperator())) +
+ count(string s | s = getAUsedHalsteadN1Operator())
+ }
+
+ /**
+ * Gets the Halstead "n2" metric: this is the number of distinct operands in this
+ * file. An operand is either a variable, constant, type name, or function name.
+ */
+ int getHalsteadN2Distinct() {
+ result =
+ 1 + // avoid 0 values
+ count(string s | exists(Access a | a.getFile() = this and s = a.getTarget().getName())) +
+ count(Function f | exists(FunctionCall fc | fc.getFile() = this and f = fc.getTarget())) +
+ // Approximate: count declarations once more to account for the type name
+ count(Declaration d | d.getFile() = this)
+ }
+
+ /**
+ * Gets the Halstead length of this file. This is the sum of the N1 and N2 Halstead metrics.
+ */
+ int getHalsteadLength() {
+ result = this.getHalsteadN1() + this.getHalsteadN2()
+ }
+
+ /**
+ * Gets the Halstead vocabulary size of this file. This is the sum of the n1 and n2 Halstead metrics.
+ */
+ int getHalsteadVocabulary() {
+ result = this.getHalsteadN1Distinct() + this.getHalsteadN2Distinct()
+ }
+
+ /**
+ * Gets the Halstead volume of this file. This is the Halstead size multiplied by the log of the
+ * Halstead vocabulary. It represents the information content of the file.
+ */
+ float getHalsteadVolume() {
+ result = this.getHalsteadLength().(float) * this.getHalsteadVocabulary().log2()
+ }
+
+ /**
+ * Gets the Halstead difficulty value of this file. This is proportional to the number of unique
+ * operators, and further proportional to the ratio of total operands to unique operands.
+ */
+ float getHalsteadDifficulty() {
+ result = (float)(this.getHalsteadN1Distinct() * this.getHalsteadN2()) / (float)(2 * this.getHalsteadN2Distinct())
+ }
+
+ /**
+ * Gets the Halstead level of this file. This is the inverse of the difficulty of the file.
+ */
+ float getHalsteadLevel() {
+ exists(float difficulty |
+ difficulty = this.getHalsteadDifficulty() and
+ if difficulty != 0.0 then result = 1.0 / difficulty else result = 0.0
+ )
+ }
+
+ /**
+ * Gets the Halstead implementation effort for this file. This is the product of the volume and difficulty.
+ */
+ float getHalsteadEffort() {
+ result = this.getHalsteadVolume() * this.getHalsteadDifficulty()
+ }
+
+ /**
+ * Gets the Halstead 'delivered bugs' metric for this file. This metric correlates with the complexity of
+ * the software, but is known to be an underestimate of bug counts.
+ */
+ float getHalsteadDeliveredBugs() {
+ result = this.getHalsteadEffort().pow(2.0/3.0) / 3000.0
+ }
+
+
+ /** Gets a file dependency of this file. */
+ File getAFileDependency() {
+ dependsOnFileSimple(this, result.getMetrics())
+ }
+
+}
+
+private predicate aClassFile(Class c, File file)
+{
+ c.getDefinitionLocation().getFile() = file
+}
+
+private pragma[noopt]
+predicate dependsOnFileSimple(MetricFile source, MetricFile dest) {
+ // class derives from classs
+ exists(Class fromClass, Class toClass |
+ aClassFile(fromClass, source) and
+ fromClass.derivesFrom(toClass) and
+ aClassFile(toClass, dest)
+ )
+ or
+ // class nested in another class
+ exists(Class fromClass, Class toClass |
+ aClassFile(fromClass, source) and
+ fromClass.getDeclaringType() = toClass and
+ toClass.getFile() = dest
+ )
+ or
+ // class has friend class
+ exists(Class fromClass, Class toClass, FriendDecl fd |
+ aClassFile(fromClass, source) and
+ fromClass.getAFriendDecl() = fd and
+ fd.getFriend() = toClass and
+ toClass instanceof Class and
+ dest = toClass.getFile()
+ )
+ or exists(FunctionCall ca, Function f |
+ ca instanceof FunctionCall and
+ ca.getFile() = source and ca.getTarget() = f and f.getFile() = dest
+ and not f.isMultiplyDefined()
+ and not exists(Function ef | ef = ca.getEnclosingFunction() and ef.isMultiplyDefined())
+ )
+ or exists(Access a, Declaration d |
+ a instanceof Access and
+ a.getFile() = source and a.getTarget() = d and d.getFile() = dest
+ and not exists(Function ef | ef = a.getEnclosingFunction() and ef.isMultiplyDefined())
+ )
+ or exists(Variable v, VariableDeclarationEntry e, Type vt, UserType t |
+ e instanceof VariableDeclarationEntry and
+ e.getFile() = source and v.getADeclarationEntry() = e and vt = v.getType() and
+ vt.refersTo(t) and t instanceof UserType and t.getFile() = dest
+ )
+ or exists(Function f, FunctionDeclarationEntry e, Type ft, UserType t |
+ e instanceof FunctionDeclarationEntry and
+ e.getFile() = source and f.getADeclarationEntry() = e and ft = f.getType() and
+ ft.refersTo(t) and t instanceof UserType and t.getFile() = dest
+ )
+ or exists(MacroInvocation mi, Macro m |
+ mi instanceof MacroInvocation and
+ mi.getFile() = source and mi.getMacro() = m and
+ m.getFile() = dest
+ )
+
+ or exists(TypedefType t, TypeDeclarationEntry e, Type bt, UserType u |
+ e instanceof TypeDeclarationEntry and
+ e.getFile() = source and t.getADeclarationEntry() = e and bt = t.getBaseType() and
+ bt.refersTo(u) and u instanceof UserType and u.getFile() = dest
+ )
+ or exists(Cast c, Type t, UserType u |
+ c instanceof Cast and
+ c.getFile() = source and c.getType() = t and
+ t.refersTo(u) and u instanceof UserType and u.getFile() = dest
+ and not exists(Function ef | ef = c.getEnclosingFunction() and ef.isMultiplyDefined())
+ )
+ }
diff --git a/cpp/ql/src/semmle/code/cpp/metrics/MetricFunction.qll b/cpp/ql/src/semmle/code/cpp/metrics/MetricFunction.qll
new file mode 100644
index 000000000000..8530491980e5
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/metrics/MetricFunction.qll
@@ -0,0 +1,354 @@
+import cpp
+
+/**
+ * A wrapper that provides metrics for a C/C++ function.
+ */
+class MetricFunction extends Function {
+
+ /** Gets the number of parameters. */
+ override int getNumberOfParameters() {
+ result = count(this.getAParameter())
+ }
+
+ /** Gets the number of lines in this function. */
+ int getNumberOfLines() {
+ numlines(this,result,_,_)
+ }
+
+ /** Gets the number of lines of code in this function. */
+ int getNumberOfLinesOfCode() {
+ numlines(this,_,result,_)
+ }
+
+ /** Gets the number of lines of comments in this function. */
+ int getNumberOfLinesOfComments() {
+ numlines(this,_,_,result)
+ }
+
+ /** Gets the ratio of lines of comments to total lines in this function (between 0.0 and 1.0). */
+ float getCommentRatio() {
+ if this.getNumberOfLines() = 0 then
+ result = 0.0
+ else
+ result = this.getNumberOfLinesOfComments().(float) / this.getNumberOfLines().(float)
+ }
+
+ /** Gets the number of function calls in this function. */
+ int getNumberOfCalls() {
+ // Checking that the name of the target exists is a workaround for a DB inconsistency
+ result = count(FunctionCall c | c.getEnclosingFunction() = this and not (c.getTarget() instanceof Operator) and exists(c.getTarget().getName()))
+ }
+
+ /**
+ * Gets the cyclomatic complexity of this function. This is defined as the
+ * number of branching statements (`if`, `while`, `do`, `for`, and
+ * non-fallthrough `case`) plus the number of branching expressions (`?`,
+ * `&&`, and `||`) plus one.
+ */
+ int getCyclomaticComplexity() {
+ result = 1 + cyclomaticComplexityBranches(getBlock())
+ and not this.isMultiplyDefined()
+ }
+
+ /**
+ * Gets the branching complexity of this function. This is a measure derived
+ * from cyclomatic complexity, but it reflects only the branches that make
+ * the code difficult to read (as opposed to cyclomatic complexity, which
+ * attempts to evaluate how difficult the code is to test).
+ */
+ int getBranchingComplexity() {
+ result =
+ count(IfStmt stmt | stmt.getEnclosingFunction() = this and not stmt.isInMacroExpansion()) +
+ count(WhileStmt stmt | stmt.getEnclosingFunction() = this and not stmt.isInMacroExpansion()) +
+ count(DoStmt stmt | stmt.getEnclosingFunction() = this and not stmt.isInMacroExpansion()) +
+ count(ForStmt stmt | stmt.getEnclosingFunction() = this and not stmt.isInMacroExpansion()) +
+ count(SwitchStmt stmt | stmt.getEnclosingFunction() = this and not stmt.isInMacroExpansion()) +
+ 1
+ and not this.isMultiplyDefined()
+ }
+
+ /**
+ * Gets the number of incoming dependencies: functions that call or access
+ * this function.
+ */
+ int getAfferentCoupling() {
+ result = count(Function f |
+ exists(Locatable l |
+ f.calls(this, l) or
+ f.accesses(this, l)
+ )
+ )
+ }
+
+ /**
+ * Gets the number of outgoing dependencies: functions that are called or
+ * accessed by this function.
+ */
+ int getEfferentCoupling() {
+ result = count(Function f |
+ exists(Locatable l |
+ this.calls(f, l) or
+ this.accesses(f, l)
+ )
+ )
+ }
+
+ /*
+ * Halstead Metrics
+ */
+
+ /**
+ * Gets the Halstead "N1" metric: this is the total number of operators in
+ * this function. Operators are taken to be all operators in expressions
+ * (`+`, `*`, `&`, `->`, `=`, ...) as well as most statements.
+ */
+ int getHalsteadN1() {
+ result =
+ 1 + // account for the function itself
+ count(Operation op | op.getEnclosingFunction() = this) +
+ count(CommaExpr e | e.getEnclosingFunction() = this) +
+ count(ReferenceToExpr e | e.getEnclosingFunction() = this) +
+ count(PointerDereferenceExpr e | e.getEnclosingFunction() = this) +
+ count(Cast e | e.getEnclosingFunction() = this) +
+ count(SizeofOperator e | e.getEnclosingFunction() = this) +
+ count(TypeidOperator e | e.getEnclosingFunction() = this) +
+ count(ControlStructure s | s.getEnclosingFunction() = this) +
+ count(JumpStmt s | s.getEnclosingFunction() = this) +
+ count(ReturnStmt s | s.getEnclosingFunction() = this) +
+ count(SwitchCase c | c.getEnclosingFunction() = this) +
+ // Count the 'else' branches
+ count(IfStmt s | s.getEnclosingFunction() = this and s.hasElse())
+ }
+
+ /**
+ * Gets the Halstead "N2" metric: this is the total number of operands in this
+ * function. An operand is either a variable, constant, type name, or function name.
+ */
+ int getHalsteadN2() {
+ result =
+ 1 + // account for the function itself
+ count(Access a | a.getEnclosingFunction() = this) +
+ count(FunctionCall fc | fc.getEnclosingFunction() = this) +
+ // Approximate: count declarations twice to account for the type name
+ // and the identifier
+ 2 * count(Declaration d | d.getParentScope+() = this)
+ }
+
+ /**
+ * Gets the Halstead "n1" metric: this is the total number of distinct operators
+ * in this function. Operators (as in the N1 metric) are all operators in expressions
+ * as well as most statements.
+ */
+ int getHalsteadN1Distinct() {
+ exists(
+ int comma, int refTo, int dereference, int cCast, int staticCast, int constCast, int reinterpretCast, int dynamicCast,
+ int sizeofExpr, int sizeofType, int ifVal, int switchVal, int forVal, int doVal, int whileVal, int gotoVal, int continueVal,
+ int breakVal, int returnVal, int caseVal, int elseVal |
+
+ (if exists(CommaExpr e | e.getEnclosingFunction() = this) then comma = 1 else comma = 0) and
+ (if exists(ReferenceToExpr e | e.getEnclosingFunction() = this) then refTo = 1 else refTo = 0) and
+ (if exists(PointerDereferenceExpr e | e.getEnclosingFunction() = this) then dereference = 1 else dereference = 0) and
+ (if exists(CStyleCast e | e.getEnclosingFunction() = this) then cCast = 1 else cCast = 0) and
+ (if exists(StaticCast e | e.getEnclosingFunction() = this) then staticCast = 1 else staticCast = 0) and
+ (if exists(ConstCast e | e.getEnclosingFunction() = this) then constCast = 1 else constCast = 0) and
+ (if exists(ReinterpretCast e | e.getEnclosingFunction() = this) then reinterpretCast = 1 else reinterpretCast = 0) and
+ (if exists(DynamicCast e | e.getEnclosingFunction() = this) then dynamicCast = 1 else dynamicCast = 0) and
+ (if exists(SizeofExprOperator e | e.getEnclosingFunction() = this) then sizeofExpr = 1 else sizeofExpr = 0) and
+ (if exists(SizeofTypeOperator e | e.getEnclosingFunction() = this) then sizeofType = 1 else sizeofType = 0) and
+ (if exists(IfStmt e | e.getEnclosingFunction() = this) then ifVal = 1 else ifVal = 0) and
+ (if exists(SwitchStmt e | e.getEnclosingFunction() = this) then switchVal = 1 else switchVal = 0) and
+ (if exists(ForStmt e | e.getEnclosingFunction() = this) then forVal = 1 else forVal = 0) and
+ (if exists(DoStmt e | e.getEnclosingFunction() = this) then doVal = 1 else doVal = 0) and
+ (if exists(WhileStmt e | e.getEnclosingFunction() = this) then whileVal = 1 else whileVal = 0) and
+ (if exists(GotoStmt e | e.getEnclosingFunction() = this) then gotoVal = 1 else gotoVal = 0) and
+ (if exists(ContinueStmt e | e.getEnclosingFunction() = this) then continueVal = 1 else continueVal = 0) and
+ (if exists(BreakStmt e | e.getEnclosingFunction() = this) then breakVal = 1 else breakVal = 0) and
+ (if exists(ReturnStmt e | e.getEnclosingFunction() = this) then returnVal = 1 else returnVal = 0) and
+ (if exists(SwitchCase e | e.getEnclosingFunction() = this) then caseVal = 1 else caseVal = 0) and
+ (if exists(IfStmt s | s.getEnclosingFunction() = this and s.hasElse()) then elseVal = 1 else elseVal = 0)
+ and
+ result =
+ 1 + // account for the function itself
+ count(string s | exists(Operation op | op.getEnclosingFunction() = this and s = op.getOperator())) +
+ comma +
+ refTo +
+ dereference +
+ cCast + staticCast + constCast + reinterpretCast + dynamicCast +
+ sizeofExpr + sizeofType +
+ ifVal + switchVal + forVal + doVal + whileVal +
+ gotoVal + continueVal + breakVal +
+ returnVal +
+ caseVal +
+ elseVal
+ )
+ }
+
+ /**
+ * Gets the Halstead "n2" metric: this is the number of distinct operands in this
+ * function. An operand is either a variable, constant, type name, or function name.
+ */
+ int getHalsteadN2Distinct() {
+ result =
+ 1 + // account for the function itself
+ count(string s | exists(Access a | a.getEnclosingFunction() = this and s = a.getTarget().getName())) +
+ count(Function f | exists(FunctionCall fc | fc.getEnclosingFunction() = this and f = fc.getTarget())) +
+ // Approximate: count declarations once more to account for the type name
+ count(Declaration d | d.getParentScope+() = this)
+ }
+
+ /**
+ * Gets the Halstead length of this function. This is the sum of the N1 and N2 Halstead metrics.
+ */
+ int getHalsteadLength() {
+ result = this.getHalsteadN1() + this.getHalsteadN2()
+ }
+
+ /**
+ * Gets the Halstead vocabulary size of this function. This is the sum of the n1 and n2 Halstead metrics.
+ */
+ int getHalsteadVocabulary() {
+ result = this.getHalsteadN1Distinct() + this.getHalsteadN2Distinct()
+ }
+
+ /**
+ * Gets the Halstead volume of this function. This is the Halstead size multiplied by the log of the
+ * Halstead vocabulary. It represents the information content of the function.
+ */
+ float getHalsteadVolume() {
+ result = this.getHalsteadLength().(float) * this.getHalsteadVocabulary().log2()
+ }
+
+ /**
+ * Gets the Halstead difficulty value of this function. This is proportional to the number of unique
+ * operators, and further proportional to the ratio of total operands to unique operands.
+ */
+ float getHalsteadDifficulty() {
+ result = (float)(this.getHalsteadN1Distinct() * this.getHalsteadN2()) / (float)(2 * this.getHalsteadN2Distinct())
+ }
+
+ /**
+ * Gets the Halstead level of this function. This is the inverse of the difficulty of the function.
+ */
+ float getHalsteadLevel() {
+ exists(float difficulty |
+ difficulty = this.getHalsteadDifficulty() and
+ if difficulty != 0.0 then result = 1.0 / difficulty else result = 0.0
+ )
+ }
+
+ /**
+ * Gets the Halstead implementation effort for this function. This is the product of the volume and difficulty.
+ */
+ float getHalsteadEffort() {
+ result = this.getHalsteadVolume() * this.getHalsteadDifficulty()
+ }
+
+ /**
+ * Gets the Halstead 'delivered bugs' metric for this function. This metric correlates with the complexity of
+ * the software, but is known to be an underestimate of bug counts.
+ */
+ float getHalsteadDeliveredBugs() {
+ result = this.getHalsteadEffort().pow(2.0/3.0) / 3000.0
+ }
+
+ /**
+ * Gets the maximum nesting level of complex statements such as if, while in the function. A nesting depth of
+ * 2 would mean that there is, for example, an if statement nested in another if statement.
+ */
+ int getNestingDepth() {
+ result = max(Stmt s, int aDepth | s.getEnclosingFunction() = this and nestingDepth(s, aDepth) | aDepth)
+ and not isMultiplyDefined()
+ }
+
+}
+
+// Branching points in the sense of cyclomatic complexity are binary,
+// so there should be a branching point for each non-default switch
+// case (ignoring those that just fall through to the next case).
+private
+predicate branchingSwitchCase(SwitchCase sc) {
+ not sc.isDefault() and
+ not sc.getASuccessor() instanceof SwitchCase and
+ not defaultFallThrough(sc)
+}
+
+private
+predicate defaultFallThrough(SwitchCase sc) {
+ sc.isDefault() or
+ defaultFallThrough(sc.getAPredecessor())
+}
+
+// A branching statement used for the computation of cyclomatic complexity.
+private
+predicate branchingStmt(Stmt stmt) {
+ stmt instanceof IfStmt or
+ stmt instanceof WhileStmt or
+ stmt instanceof DoStmt or
+ stmt instanceof ForStmt or
+ branchingSwitchCase(stmt)
+}
+
+// A branching expression used for the computation of cyclomatic complexity.
+private
+predicate branchingExpr(Expr expr) {
+ expr instanceof NotExpr or
+ expr instanceof LogicalAndExpr or
+ expr instanceof LogicalOrExpr or
+ expr instanceof ConditionalExpr
+}
+
+/**
+ * Gets the number of branching statements and expressions in a block. This is
+ * for computing cyclomatic complexity.
+ */
+int cyclomaticComplexityBranches(Block b) {
+ result =
+ count(Stmt stmt |
+ branchingStmt(stmt) and b.getAChild+() = stmt
+ and not stmt.isInMacroExpansion()) +
+ count(Expr expr |
+ branchingExpr(expr) and b.getAChild+() = expr.getEnclosingStmt()
+ and not expr.isInMacroExpansion())
+}
+
+/**
+ * Gets the parent of a statement, excluding some common cases that don't really
+ * make sense for nesting depth. An example is:
+ * `if (...) { } else if (...) { }`: we don't consider the second if nested.
+ * Blocks are also skipped, as are parents that have the same location as the
+ * child (typically they come from macros).
+ * */
+private
+predicate realParent(Stmt inner, Stmt outer) {
+ if skipParent(inner) then
+ realParent(inner.getParentStmt(), outer)
+ else
+ outer = inner.getParentStmt()
+}
+
+private predicate startsAt(Stmt s, File f, int line, int col) {
+ exists(Location loc | loc = s.getLocation() |
+ f = loc.getFile() and
+ line = loc.getStartLine() and
+ col = loc.getStartColumn()
+ )
+}
+
+private
+predicate skipParent(Stmt s) {
+ exists(Stmt parent | parent = s.getParentStmt() |
+ (s instanceof IfStmt and parent.(IfStmt).getElse() = s)
+ or
+ parent instanceof Block
+ or
+ exists(File f, int startLine, int startCol |
+ startsAt(s, f, startLine, startCol) and
+ startsAt(parent, f, startLine, startCol)
+ )
+ )
+}
+
+private
+predicate nestingDepth(Stmt s, int depth) {
+ depth = count(Stmt enclosing | realParent+(s, enclosing))
+}
diff --git a/cpp/ql/src/semmle/code/cpp/metrics/MetricNamespace.qll b/cpp/ql/src/semmle/code/cpp/metrics/MetricNamespace.qll
new file mode 100644
index 000000000000..0aaa3bf18c70
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/metrics/MetricNamespace.qll
@@ -0,0 +1,83 @@
+import cpp
+
+/**
+ * A wrapper that provides metrics for a C/C++ namespace.
+ */
+class MetricNamespace extends Namespace {
+
+ /** Gets the number of incoming dependencies from other namespaces. */
+ int getAfferentCoupling() {
+ result = count(MetricNamespace that | that.getANamespaceDependency() = this)
+ }
+
+ /** Gets the number of outgoing dependencies on other namespaces. */
+ int getEfferentCoupling() {
+ result = count(MetricNamespace that | this.getANamespaceDependency() = that)
+ }
+
+ /**
+ * Gets the _instability_ of this namespace. Instability is a measure of how
+ * likely a namespace is to be influenced by changes to other namespace. If
+ * this metric value is high, it is easily influenced, if it is low, the
+ * impact is likely to be minimal. Instability is estimated as the number of
+ * outgoing dependencies relative to the total number of dependencies.
+ */
+ float getInstability() {
+ exists(int ecoupling, int sumcoupling |
+ ecoupling = this.getEfferentCoupling() and
+ sumcoupling = ecoupling + this.getAfferentCoupling() and
+ sumcoupling > 0 and
+ result = ecoupling / ((float)sumcoupling))
+ }
+
+ /**
+ * Gets the _abstractness_ of this namespace. Abstractness measures the
+ * proportion of abstract classes in a namespace relative to the total number
+ * of classes in that namespace. A highly abstract namespace (where the
+ * metric value is close 1) that is furthermore instable is likely to be
+ * useless: the class hierarchy has been over-engineered, and all those
+ * abstract classes are not heavily used.
+ */
+ float getAbstractness() {
+ exists(int i, int j | i = count(Class c | c.getNamespace()=this) and
+ j = count(Class c | c.getNamespace()=this and
+ c.isAbstract()) and
+ result = j / ((float)i) and i > 0)
+ }
+
+ /**
+ * Gets the _distance from main sequence_ of this namespace. This measure
+ * intends to capture the tradeoff between abstractness and instability: the
+ * ideal situation occurs when the sum of abstractness and instability is
+ * one. That is, a namespace is completely abstract and stable
+ * (abstractness=1 and instability=0) or it is concrete and instable
+ * (abstractness=0 and instability=1). We thus measure the distance from that
+ * ideal situation.
+ */
+ float getDistanceFromMain() {
+ exists(float r |
+ r = this.getAbstractness() + this.getInstability() - 1
+ and
+ ( (r >= 0 and result = r)
+ or
+ (r < 0 and result = -r) ) )
+ }
+
+ /** Gets a namespace dependency of this element. */
+ MetricNamespace getANamespaceDependency() {
+ exists(MetricClass c | c.getNamespace() = this
+ and c.getAClassDependency().getNamespace() = result)
+ or exists(FunctionCall c | c.getEnclosingFunction().getNamespace() = this
+ and c.getTarget().getNamespace() = result)
+ or exists(FunctionCall c | c.getEnclosingVariable().getNamespace() = this
+ and c.getTarget().getNamespace() = result)
+ or exists(Access a | a.getEnclosingFunction().getNamespace() = this
+ and a.getTarget().getNamespace() = result)
+ or exists(Access a | a.getEnclosingVariable().getNamespace() = this
+ and a.getTarget().getNamespace() = result)
+ or exists(Variable v, UserType t | v.getNamespace() = this
+ and v.getType().refersTo(t) and t.getNamespace() = result)
+ or exists(Function f, UserType t | f.getNamespace() = this
+ and f.getType().refersTo(t) and t.getNamespace() = result)
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/models/Models.qll b/cpp/ql/src/semmle/code/cpp/models/Models.qll
new file mode 100644
index 000000000000..9fefd5243f1c
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/models/Models.qll
@@ -0,0 +1,7 @@
+private import implementations.Inet
+private import implementations.Memcpy
+private import implementations.Printf
+private import implementations.Pure
+private import implementations.Strcat
+private import implementations.Strcpy
+private import implementations.Strftime
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/Inet.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/Inet.qll
new file mode 100644
index 000000000000..3d47e5c88166
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/Inet.qll
@@ -0,0 +1,187 @@
+import semmle.code.cpp.models.interfaces.Taint
+import semmle.code.cpp.models.interfaces.ArrayFunction
+
+class InetNtoa extends TaintFunction {
+ InetNtoa() {
+ hasQualifiedName("inet_ntoa")
+ }
+
+ override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+ input.isInParameter(0) and
+ output.isOutReturnPointer()
+ }
+}
+
+class InetAton extends TaintFunction, ArrayFunction {
+ InetAton() {
+ hasQualifiedName("inet_aton")
+ }
+
+ override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+ input.isInParameterPointer(0) and
+ output.isOutParameterPointer(1)
+ }
+
+ override predicate hasArrayInput(int bufParam) {
+ bufParam = 0
+ }
+
+ override predicate hasArrayOutput(int bufParam) {
+ bufParam = 1
+ }
+
+ override predicate hasArrayWithNullTerminator(int bufParam) {
+ bufParam = 0
+ }
+
+ override predicate hasArrayWithFixedSize(int bufParam, int elemCount) {
+ bufParam = 1 and
+ elemCount = 1
+ }
+}
+
+class InetAddr extends TaintFunction, ArrayFunction {
+ InetAddr() {
+ hasQualifiedName("inet_addr")
+ }
+
+ override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+ input.isInParameterPointer(0) and
+ output.isOutReturnValue()
+ }
+
+ override predicate hasArrayInput(int bufParam) {
+ bufParam = 0
+ }
+
+ override predicate hasArrayWithNullTerminator(int bufParam) {
+ bufParam = 0
+ }
+}
+
+class InetNetwork extends TaintFunction, ArrayFunction {
+ InetNetwork() {
+ hasQualifiedName("inet_network")
+ }
+
+ override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+ input.isInParameterPointer(1) and
+ output.isOutReturnValue()
+ }
+
+ override predicate hasArrayInput(int bufParam) {
+ bufParam = 0
+ }
+
+ override predicate hasArrayWithNullTerminator(int bufParam) {
+ bufParam = 0
+ }
+}
+
+class InetMakeaddr extends TaintFunction {
+ InetMakeaddr() {
+ hasQualifiedName("inet_makeaddr")
+ }
+
+ override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+ (
+ input.isInParameter(0) or
+ input.isInParameter(1)
+ ) and
+ output.isOutReturnValue()
+ }
+}
+
+class InetLnaof extends TaintFunction {
+ InetLnaof() {
+ hasQualifiedName("inet_lnaof")
+ }
+
+ override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+ input.isInParameter(0) and
+ output.isOutReturnValue()
+ }
+}
+
+class InetNetof extends TaintFunction {
+ InetNetof() {
+ hasQualifiedName("inet_netof")
+ }
+
+ override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+ input.isInParameter(0) and
+ output.isOutReturnValue()
+ }
+}
+
+class InetPton extends TaintFunction, ArrayFunction {
+ InetPton() {
+ hasQualifiedName("inet_pton")
+ }
+
+ override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+ (
+ input.isInParameter(0) or
+ input.isInParameterPointer(1)
+ ) and
+ output.isOutParameterPointer(2)
+ }
+
+ override predicate hasArrayInput(int bufParam) {
+ bufParam = 1
+ }
+
+ override predicate hasArrayOutput(int bufParam) {
+ bufParam = 2
+ }
+
+ override predicate hasArrayWithNullTerminator(int bufParam) {
+ bufParam = 1
+ }
+
+ override predicate hasArrayWithUnknownSize(int bufParam) {
+ bufParam = 2
+ }
+}
+
+class Gethostbyname extends TaintFunction, ArrayFunction {
+ Gethostbyname() {
+ hasQualifiedName("gethostbyname")
+ }
+
+ override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+ input.isInParameterPointer(0) and
+ output.isOutReturnPointer()
+ }
+
+ override predicate hasArrayInput(int bufParam) {
+ bufParam = 0
+ }
+
+ override predicate hasArrayWithNullTerminator(int bufParam) {
+ bufParam = 0
+ }
+}
+
+class Gethostbyaddr extends TaintFunction, ArrayFunction {
+ Gethostbyaddr() {
+ hasQualifiedName("gethostbyaddr")
+ }
+
+ override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+ (
+ input.isInParameterPointer(0) or
+ input.isInParameter(1) or
+ input.isInParameter(2)
+ ) and
+ output.isOutReturnPointer()
+ }
+
+ override predicate hasArrayInput(int bufParam) {
+ bufParam = 0
+ }
+
+ override predicate hasArrayWithNullTerminator(int bufParam) {
+ bufParam = 0
+ }
+}
\ No newline at end of file
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/Memcpy.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/Memcpy.qll
new file mode 100644
index 000000000000..e4cbe6cd3db7
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/Memcpy.qll
@@ -0,0 +1,55 @@
+import semmle.code.cpp.Function
+import semmle.code.cpp.models.interfaces.ArrayFunction
+import semmle.code.cpp.models.interfaces.DataFlow
+import semmle.code.cpp.models.interfaces.Taint
+
+/**
+ * The standard functions `memcpy` and `memmove`, and the gcc variant
+ * `__builtin___memcpy_chk`
+ */
+class MemcpyFunction extends ArrayFunction, DataFlowFunction, TaintFunction {
+ MemcpyFunction() {
+ this.hasName("memcpy") or
+ this.hasName("memmove") or
+ this.hasName("__builtin___memcpy_chk")
+ }
+
+ override predicate hasArrayInput(int bufParam) {
+ bufParam = 1
+ }
+
+ override predicate hasArrayOutput(int bufParam) {
+ bufParam = 0
+ }
+
+ override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
+ (
+ input.isInParameterPointer(1) and
+ output.isOutParameterPointer(0)
+ ) or (
+ input.isInParameterPointer(1) and
+ output.isOutReturnPointer()
+ ) or (
+ input.isInParameter(0) and
+ output.isOutReturnValue()
+ )
+ }
+
+ override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+ (
+ input.isInParameter(2) and
+ output.isOutParameterPointer(0)
+ ) or (
+ input.isInParameter(2) and
+ output.isOutReturnPointer()
+ )
+ }
+
+ override predicate hasArrayWithVariableSize(int bufParam, int countParam) {
+ (
+ bufParam = 0 or
+ bufParam = 1
+ ) and
+ countParam = 2
+ }
+}
\ No newline at end of file
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/Printf.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/Printf.qll
new file mode 100644
index 000000000000..06c6a86e4a10
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/Printf.qll
@@ -0,0 +1,194 @@
+import semmle.code.cpp.models.interfaces.FormattingFunction
+
+/**
+ * The standard functions `printf`, `wprintf` and their glib variants.
+ */
+class Printf extends FormattingFunction {
+ Printf() {
+ this instanceof TopLevelFunction and
+ (
+ hasGlobalName("printf") or
+ hasGlobalName("printf_s") or
+ hasGlobalName("wprintf") or
+ hasGlobalName("wprintf_s") or
+ hasGlobalName("g_printf")
+ )
+ }
+
+ override int getFormatParameterIndex() { result=0 }
+ override predicate isWideCharDefault() {
+ hasGlobalName("wprintf") or
+ hasGlobalName("wprintf_s")
+ }
+}
+
+/**
+ * The standard functions `fprintf`, `fwprintf` and their glib variants.
+ */
+class Fprintf extends FormattingFunction {
+ Fprintf() { this instanceof TopLevelFunction and (hasGlobalName("fprintf") or hasGlobalName("fwprintf") or hasGlobalName("g_fprintf"))}
+
+ override int getFormatParameterIndex() { result=1 }
+ override predicate isWideCharDefault() { hasGlobalName("fwprintf") }
+ override int getOutputParameterIndex() { result=0 }
+}
+
+/**
+ * The standard function `sprintf` and its Microsoft and glib variants.
+ */
+class Sprintf extends FormattingFunction {
+ Sprintf() {
+ this instanceof TopLevelFunction and
+ (
+ hasGlobalName("sprintf") or
+ hasGlobalName("_sprintf_l") or
+ hasGlobalName("__swprintf_l") or
+ hasGlobalName("wsprintf") or
+ hasGlobalName("g_strdup_printf") or
+ hasGlobalName("g_sprintf") or
+ hasGlobalName("__builtin___sprintf_chk")
+ )
+ }
+
+ override predicate isWideCharDefault() {
+ getParameter(getFormatParameterIndex()).getType().getUnspecifiedType().(PointerType).getBaseType().getSize() > 1
+ }
+
+ override int getFormatParameterIndex() {
+ hasGlobalName("g_strdup_printf") and result = 0
+ or
+ hasGlobalName("__builtin___sprintf_chk") and result = 3
+ or
+ getQualifiedName() != "g_strdup_printf" and
+ getQualifiedName() != "__builtin___sprintf_chk" and
+ result = 1
+ }
+ override int getOutputParameterIndex() {
+ not hasGlobalName("g_strdup_printf") and result = 0
+ }
+
+ override int getFirstFormatArgumentIndex() {
+ if hasGlobalName("__builtin___sprintf_chk") then result = 4
+ else result = getNumberOfParameters()
+ }
+}
+
+/**
+ * The standard functions `snprintf` and `swprintf`, and their
+ * Microsoft and glib variants.
+ */
+class Snprintf extends FormattingFunction {
+ Snprintf() {
+ this instanceof TopLevelFunction and (
+ hasGlobalName("snprintf") // C99 defines snprintf
+ or hasGlobalName("swprintf") // The s version of wide-char printf is also always the n version
+ // Microsoft has _snprintf as well as several other variations
+ or hasGlobalName("sprintf_s")
+ or hasGlobalName("snprintf_s")
+ or hasGlobalName("swprintf_s")
+ or hasGlobalName("_snprintf")
+ or hasGlobalName("_snprintf_s")
+ or hasGlobalName("_snprintf_l")
+ or hasGlobalName("_snprintf_s_l")
+ or hasGlobalName("_snwprintf")
+ or hasGlobalName("_snwprintf_s")
+ or hasGlobalName("_snwprintf_l")
+ or hasGlobalName("_snwprintf_s_l")
+ or hasGlobalName("_sprintf_s_l")
+ or hasGlobalName("_swprintf_l")
+ or hasGlobalName("_swprintf_s_l")
+ or hasGlobalName("g_snprintf")
+ or hasGlobalName("wnsprintf")
+ or hasGlobalName("__builtin___snprintf_chk")
+ )
+ }
+
+ override int getFormatParameterIndex() {
+ if getName().matches("%\\_l")
+ then result = getFirstFormatArgumentIndex() - 2
+ else result = getFirstFormatArgumentIndex() - 1
+ }
+
+ override predicate isWideCharDefault() {
+ getParameter(getFormatParameterIndex()).getType().getUnspecifiedType().(PointerType).getBaseType().getSize() > 1
+ }
+ override int getOutputParameterIndex() { result=0 }
+
+ override int getFirstFormatArgumentIndex() {
+ exists(string name |
+ name = getQualifiedName()
+ and (
+ name = "__builtin___snprintf_chk" and
+ result = 5
+ or
+ name != "__builtin___snprintf_chk" and
+ result = getNumberOfParameters()
+ )
+ )
+ }
+
+ /**
+ * Holds if this function returns the length of the formatted string
+ * that would have been output, regardless of the amount of space
+ * in the buffer.
+ */
+ predicate returnsFullFormatLength() {
+ hasGlobalName("snprintf") or
+ hasGlobalName("g_snprintf") or
+ hasGlobalName("__builtin___snprintf_chk") or
+ hasGlobalName("snprintf_s")
+ }
+
+ override int getSizeParameterIndex() {
+ result = 1
+ }
+}
+
+/**
+ * The Microsoft `StringCchPrintf` function and variants.
+ */
+class StringCchPrintf extends FormattingFunction {
+ StringCchPrintf() {
+ this instanceof TopLevelFunction and (
+ hasGlobalName("StringCchPrintf")
+ or hasGlobalName("StringCchPrintfEx")
+ or hasGlobalName("StringCchPrintf_l")
+ or hasGlobalName("StringCchPrintf_lEx")
+ or hasGlobalName("StringCbPrintf")
+ or hasGlobalName("StringCbPrintfEx")
+ or hasGlobalName("StringCbPrintf_l")
+ or hasGlobalName("StringCbPrintf_lEx")
+ )
+ }
+
+ override int getFormatParameterIndex() {
+ if getName().matches("%Ex")
+ then result = 5
+ else result = 2
+ }
+
+ override predicate isWideCharDefault() {
+ getParameter(getFormatParameterIndex()).getType().getUnspecifiedType().(PointerType).getBaseType().getSize() > 1
+ }
+
+ override int getOutputParameterIndex() {
+ result = 0
+ }
+
+ override int getSizeParameterIndex() {
+ result = 1
+ }
+}
+
+/**
+ * The standard function `syslog`.
+ */
+class Syslog extends FormattingFunction {
+ Syslog() {
+ this instanceof TopLevelFunction and (
+ hasGlobalName("syslog")
+ )
+ }
+
+ override int getFormatParameterIndex() { result=1 }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/Pure.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/Pure.qll
new file mode 100644
index 000000000000..7bbf09536b94
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/Pure.qll
@@ -0,0 +1,57 @@
+import semmle.code.cpp.models.interfaces.ArrayFunction
+import semmle.code.cpp.models.interfaces.Taint
+
+class PureFunction extends ArrayFunction, TaintFunction {
+ PureFunction() {
+ exists(string name |
+ hasName(name) and
+ (
+ name = "abs"
+ or name = "atof"
+ or name = "atoi"
+ or name = "atol"
+ or name = "atoll"
+ or name = "labs"
+ or name = "strcasestr"
+ or name = "strchnul"
+ or name = "strchr"
+ or name = "strchrnul"
+ or name = "strcmp"
+ or name = "strcspn"
+ or name = "strlen"
+ or name = "strncmp"
+ or name = "strnlen"
+ or name = "strrchr"
+ or name = "strspn"
+ or name = "strstr"
+ or name = "strtod"
+ or name = "strtof"
+ or name = "strtol"
+ or name = "strtoll"
+ or name = "strtoq"
+ or name = "strtoul"
+ )
+ )
+ }
+
+ override predicate hasArrayInput(int bufParam) {
+ getParameter(bufParam).getType().getUnspecifiedType() instanceof PointerType
+ }
+
+ override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+ exists (ParameterIndex i |
+ input.isInParameter(i) or
+ (
+ input.isInParameterPointer(i) and
+ getParameter(i).getType().getUnspecifiedType() instanceof PointerType
+ )
+ ) and
+ (
+ (
+ output.isOutReturnPointer() and
+ getType().getUnspecifiedType() instanceof PointerType
+ ) or
+ output.isOutReturnValue()
+ )
+ }
+}
\ No newline at end of file
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/Strcat.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/Strcat.qll
new file mode 100644
index 000000000000..5e02939dfe66
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/Strcat.qll
@@ -0,0 +1,69 @@
+
+import semmle.code.cpp.models.interfaces.ArrayFunction
+import semmle.code.cpp.models.interfaces.DataFlow
+import semmle.code.cpp.models.interfaces.Taint
+
+
+/**
+ * The standard function `strcat` and its wide, sized, and Microsoft variants.
+ */
+class StrcatFunction extends TaintFunction, DataFlowFunction, ArrayFunction {
+ StrcatFunction() {
+ exists(string name | name = getName()|
+ name = "strcat" // strcat(dst, src)
+ or name = "strncat" // strncat(dst, src, max_amount)
+ or name = "wcscat" // wcscat(dst, src)
+ or name = "_mbscat" // _mbscat(dst, src)
+ or name = "wcsncat" // wcsncat(dst, src, max_amount)
+ or name = "_mbsncat" // _mbsncat(dst, src, max_amount)
+ or name = "_mbsncat_l" // _mbsncat_l(dst, src, max_amount, locale)
+ )
+ }
+
+ override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
+ input.isInParameter(0) and
+ output.isOutReturnValue()
+ }
+
+ override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+ exists(string name | name = getName()
+ | (
+ (
+ name = "strncat" or
+ name = "wcsncat" or
+ name = "_mbsncat" or
+ name = "_mbsncat_l"
+ ) and
+ input.isInParameter(2) and
+ output.isOutParameterPointer(0)
+ ) or (
+ name = "_mbsncat_l" and
+ input.isInParameter(3) and
+ output.isOutParameterPointer(0)
+ )
+ ) or (
+ input.isInParameterPointer(0) and
+ output.isOutParameterPointer(0)
+ ) or (
+ input.isInParameter(1) and
+ output.isOutParameterPointer(0)
+ )
+ }
+
+ override predicate hasArrayInput(int param) {
+ param = 0 or
+ param = 1
+ }
+
+ override predicate hasArrayOutput(int param) {
+ param = 0
+ }
+
+ override predicate hasArrayWithNullTerminator(int param) {
+ param = 1
+ }
+
+ override predicate hasArrayWithUnknownSize(int param) {
+ param = 0
+ }
+}
\ No newline at end of file
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/Strcpy.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/Strcpy.qll
new file mode 100644
index 000000000000..11043d1fbe73
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/Strcpy.qll
@@ -0,0 +1,89 @@
+import semmle.code.cpp.models.interfaces.ArrayFunction
+import semmle.code.cpp.models.interfaces.DataFlow
+import semmle.code.cpp.models.interfaces.Taint
+
+
+/**
+ * The standard function `stract` and its wide, sized, and Microsoft variants.
+ */
+class StrcpyFunction extends ArrayFunction, DataFlowFunction, TaintFunction {
+ StrcpyFunction() {
+ this.hasName("strcpy") or
+ this.hasName("_mbscpy") or
+ this.hasName("wcscpy") or
+ this.hasName("strncpy") or
+ this.hasName("_mbsncpy") or
+ this.hasName("wcsncpy")
+ }
+
+ override predicate hasArrayInput(int bufParam) {
+ bufParam = 1
+ }
+
+ override predicate hasArrayOutput(int bufParam) {
+ bufParam = 0
+ }
+
+ override predicate hasArrayWithNullTerminator(int bufParam) {
+ bufParam = 1
+ }
+
+ override predicate hasArrayWithVariableSize(int bufParam, int countParam) {
+ (
+ this.hasName("strncpy") or
+ this.hasName("_mbsncpy") or
+ this.hasName("wcsncpy")
+ ) and
+ bufParam = 0 and
+ countParam = 2
+ }
+
+ override predicate hasArrayWithUnknownSize(int bufParam) {
+ (
+ this.hasName("strcpy") or
+ this.hasName("_mbscpy") or
+ this.hasName("wcscpy")
+ ) and
+ bufParam = 0
+ }
+
+
+ override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
+ (
+ (
+ // These always copy the full value of the input buffer to the output
+ // buffer
+ this.hasName("strcpy") or
+ this.hasName("_mbscpy") or
+ this.hasName("wcscpy")
+ ) and (
+ (
+ input.isInParameterPointer(1) and
+ output.isOutParameterPointer(0)
+ ) or (
+ input.isInParameterPointer(1) and
+ output.isOutReturnPointer()
+ )
+ )
+ ) or (
+ input.isInParameter(0) and
+ output.isOutReturnValue()
+ )
+ }
+
+ override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+ (
+ // these may do only a partial copy of the input buffer to the output
+ // buffer
+ this.hasName("strncpy") or
+ this.hasName("_mbsncpy") or
+ this.hasName("wcsncpy")
+ ) and (
+ input.isInParameter(2) or
+ input.isInParameterPointer(1)
+ ) and (
+ output.isOutParameterPointer(0) or
+ output.isOutReturnPointer()
+ )
+ }
+}
\ No newline at end of file
diff --git a/cpp/ql/src/semmle/code/cpp/models/implementations/Strftime.qll b/cpp/ql/src/semmle/code/cpp/models/implementations/Strftime.qll
new file mode 100644
index 000000000000..da64cec94db5
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/models/implementations/Strftime.qll
@@ -0,0 +1,44 @@
+import semmle.code.cpp.models.interfaces.Taint
+import semmle.code.cpp.models.interfaces.ArrayFunction
+
+class Strftime extends TaintFunction, ArrayFunction {
+ Strftime() {
+ hasQualifiedName("strftime")
+ }
+
+ override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+ (
+ input.isInParameter(1) or
+ input.isInParameterPointer(2) or
+ input.isInParameterPointer(3)
+ )
+ and
+ (
+ output.isOutParameterPointer(0) or
+ output.isOutReturnValue()
+ )
+ }
+
+ override predicate hasArrayWithNullTerminator(int bufParam) {
+ bufParam = 2
+ }
+
+ override predicate hasArrayWithFixedSize(int bufParam, int elemCount) {
+ bufParam = 3 and
+ elemCount = 1
+ }
+
+ override predicate hasArrayWithVariableSize(int bufParam, int countParam) {
+ bufParam = 0 and
+ countParam = 1
+ }
+
+ override predicate hasArrayInput(int bufParam) {
+ bufParam = 2 or
+ bufParam = 3
+ }
+
+ override predicate hasArrayOutput(int bufParam) {
+ bufParam = 0
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/models/interfaces/ArrayFunction.qll b/cpp/ql/src/semmle/code/cpp/models/interfaces/ArrayFunction.qll
new file mode 100644
index 000000000000..05dc013aaac4
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/models/interfaces/ArrayFunction.qll
@@ -0,0 +1,70 @@
+/**
+ * Provides an abstract class for accurate modeling of input and output buffers
+ * in library functions when source code is not available. To use this QL
+ * library, create a QL class extending `BufferFunction` with a characteristic
+ * predicate that selects the function or set of functions you are trying to
+ * model. Within that class, override the predicates provided by `BufferFunction`
+ * to match the flow within that function. Finally, add a private import
+ * statement to `CustomModels.qll`
+ */
+
+ import semmle.code.cpp.Function
+ import semmle.code.cpp.models.Models
+
+
+/**
+ * A library function with input and/or output buffer parameters
+ */
+abstract class ArrayFunction extends Function {
+ /**
+ * Holds if parameter `bufParam` is a null-terminated buffer and the
+ * null-terminator will not be written past.
+ */
+ predicate hasArrayWithNullTerminator(int bufParam) {
+ none()
+ }
+
+ /**
+ * Holds if parameter `bufParam` should always point to a buffer with exactly
+ * `elemCount` elements.
+ */
+ predicate hasArrayWithFixedSize(int bufParam, int elemCount) {
+ none()
+ }
+
+ /**
+ * Holds if parameter `bufParam` should always point to a buffer with the
+ * number of elements indicated by `countParam`.
+ */
+ predicate hasArrayWithVariableSize(int bufParam, int countParam) {
+ none()
+ }
+
+ /**
+ * Holds if parameter `bufParam` points to a buffer with no fixed size and no
+ * size parameter, which is not null-terminated or which is null-terminated
+ * but for which the null value may be written past. For example, the first
+ * parameters of `sprintf` and `strcat`.
+ */
+ predicate hasArrayWithUnknownSize(int bufParam) {
+ none()
+ }
+
+ /**
+ * Holds if parameter `bufParam` is used as an input buffer.
+ *
+ * Note that this is not mutually exclusive with isOutBuffer.
+ */
+ predicate hasArrayInput(int bufParam) {
+ none()
+ }
+
+ /**
+ * Holds if parameter `bufParam` is used as an output buffer.
+ *
+ * Note that this is not mutually exclusive with isInBuffer.
+ */
+ predicate hasArrayOutput(int bufParam) {
+ none()
+ }
+}
\ No newline at end of file
diff --git a/cpp/ql/src/semmle/code/cpp/models/interfaces/DataFlow.qll b/cpp/ql/src/semmle/code/cpp/models/interfaces/DataFlow.qll
new file mode 100644
index 000000000000..b7aecc8cb25e
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/models/interfaces/DataFlow.qll
@@ -0,0 +1,24 @@
+/**
+ * Provides an abstract class for accurate dataflow modeling of library
+ * functions when source code is not available. To use this QL library,
+ * create a QL class extending `DataFlowFunction` with a characteristic
+ * predicate that selects the function or set of functions you are modeling.
+ * Within that class, override the predicates provided by `DataFlowFunction`
+ * to match the flow within that function.
+ */
+
+import semmle.code.cpp.Function
+import FunctionInputsAndOutputs
+import semmle.code.cpp.models.Models
+
+
+/**
+ * A library function for which a value is copied from a parameter or qualifier
+ * to an output buffer, return value, or qualifier.
+ *
+ * Note that this does not include partial copying of values or partial writes
+ * to destinations; that is covered by `TaintModel.qll`.
+ */
+abstract class DataFlowFunction extends Function {
+ abstract predicate hasDataFlow(FunctionInput input, FunctionOutput output);
+}
\ No newline at end of file
diff --git a/cpp/ql/src/semmle/code/cpp/models/interfaces/FormattingFunction.qll b/cpp/ql/src/semmle/code/cpp/models/interfaces/FormattingFunction.qll
new file mode 100644
index 000000000000..2712348d880d
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/models/interfaces/FormattingFunction.qll
@@ -0,0 +1,38 @@
+/**
+ * Provides a class for modeling `printf`-style formatting functions. To use
+ * this QL library, create a QL class extending `DataFlowFunction` with a
+ * characteristic predicate that selects the function or set of functions you
+ * are modeling. Within that class, override the predicates provided by
+ * `FormattingFunction` to match the flow within that function.
+ */
+
+import semmle.code.cpp.Function
+/**
+ * A standard library function that uses a `printf`-like formatting string.
+ */
+abstract class FormattingFunction extends Function {
+ /** Gets the position at which the format parameter occurs. */
+ abstract int getFormatParameterIndex();
+
+ /**
+ * Holds if the default meaning of `%s` is a `wchar_t *`, rather than
+ * a `char *` (either way, `%S` will have the opposite meaning).
+ */
+ predicate isWideCharDefault() { none() }
+
+ /**
+ * Gets the position at which the output parameter, if any, occurs.
+ */
+ int getOutputParameterIndex() { none() }
+
+ /**
+ * Gets the position of the first format argument, corresponding with
+ * the first format specifier in the format string.
+ */
+ int getFirstFormatArgumentIndex() { result = getNumberOfParameters() }
+
+ /**
+ * Gets the position of the buffer size argument, if any.
+ */
+ int getSizeParameterIndex() { none() }
+}
\ No newline at end of file
diff --git a/cpp/ql/src/semmle/code/cpp/models/interfaces/FunctionInputsAndOutputs.qll b/cpp/ql/src/semmle/code/cpp/models/interfaces/FunctionInputsAndOutputs.qll
new file mode 100644
index 000000000000..db4e5a0faa01
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/models/interfaces/FunctionInputsAndOutputs.qll
@@ -0,0 +1,167 @@
+/**
+ * Provides a set of QL clcasses for indicating dataflows through a particular
+ * parameter, return value, or qualifier, as well as flows at one level of
+ * pointer indirection.
+ */
+
+import semmle.code.cpp.Parameter
+
+/**
+ * An `int` that is a parameter index for some function. This is needed for binding in certain cases.
+ */
+class ParameterIndex extends int {
+ ParameterIndex() { exists(Parameter p | this = p.getIndex()) }
+}
+
+newtype TFunctionInput =
+ TInParameter(ParameterIndex i)
+ or
+ TInParameterPointer(ParameterIndex i)
+ or
+ TInQualifier()
+
+class FunctionInput extends TFunctionInput {
+ abstract string toString();
+
+ predicate isInParameter(ParameterIndex index) {
+ none()
+ }
+
+ predicate isInParameterPointer(ParameterIndex index) {
+ none()
+ }
+
+ predicate isInQualifier() {
+ none()
+ }
+}
+
+class InParameter extends FunctionInput, TInParameter {
+ ParameterIndex index;
+
+ InParameter() {
+ this = TInParameter(index)
+ }
+
+ override string toString() {
+ result = "InParameter " + index.toString()
+ }
+
+ ParameterIndex getIndex() {
+ result = index
+ }
+
+ override predicate isInParameter(ParameterIndex i) {
+ i = index
+ }
+}
+
+class InParameterPointer extends FunctionInput, TInParameterPointer {
+ ParameterIndex index;
+
+ InParameterPointer() {
+ this = TInParameterPointer(index)
+ }
+
+ override string toString() {
+ result = "InParameterPointer " + index.toString()
+ }
+
+ ParameterIndex getIndex() {
+ result = index
+ }
+
+ override predicate isInParameterPointer(ParameterIndex i) {
+ i = index
+ }
+}
+
+class InQualifier extends FunctionInput, TInQualifier {
+ override string toString() {
+ result = "InQualifier"
+ }
+
+ override predicate isInQualifier() {
+ any()
+ }
+}
+
+newtype TFunctionOutput =
+ TOutParameterPointer(ParameterIndex i)
+ or
+ TOutQualifier()
+ or
+ TOutReturnValue()
+ or
+ TOutReturnPointer()
+
+
+class FunctionOutput extends TFunctionOutput {
+ abstract string toString();
+
+ predicate isOutParameterPointer(ParameterIndex i) {
+ none()
+ }
+
+ predicate isOutQualifier() {
+ none()
+ }
+
+ predicate isOutReturnValue() {
+ none()
+ }
+
+ predicate isOutReturnPointer() {
+ none()
+ }
+}
+
+class OutParameterPointer extends FunctionOutput, TOutParameterPointer {
+ ParameterIndex index;
+
+ OutParameterPointer() {
+ this = TOutParameterPointer(index)
+ }
+
+ override string toString() {
+ result = "OutParameterPointer " + index.toString()
+ }
+
+ ParameterIndex getIndex() {
+ result = index
+ }
+
+ override predicate isOutParameterPointer(ParameterIndex i) {
+ i = index
+ }
+}
+
+class OutQualifier extends FunctionOutput, TOutQualifier {
+ override string toString() {
+ result = "OutQualifier"
+ }
+
+ override predicate isOutQualifier() {
+ any()
+ }
+}
+
+class OutReturnValue extends FunctionOutput, TOutReturnValue {
+ override string toString() {
+ result = "OutReturnValue"
+ }
+
+ override predicate isOutReturnValue() {
+ any()
+ }
+}
+
+class OutReturnPointer extends FunctionOutput, TOutReturnPointer {
+ override string toString() {
+ result = "OutReturnPointer"
+ }
+
+ override predicate isOutReturnPointer() {
+ any()
+ }
+}
\ No newline at end of file
diff --git a/cpp/ql/src/semmle/code/cpp/models/interfaces/Taint.qll b/cpp/ql/src/semmle/code/cpp/models/interfaces/Taint.qll
new file mode 100644
index 000000000000..d70c9d707c1d
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/models/interfaces/Taint.qll
@@ -0,0 +1,23 @@
+/**
+ * Provides an abstract class for accurate taint modeling of library
+ * functions when source code is not available. To use this QL library,
+ * create a QL class extending `TaintFunction` with a characteristic predicate
+ * that selects the function or set of functions you are modeling. Within that
+ * class, override the predicates provided by `TaintFunction` to match the flow
+ * within that function.
+ */
+
+import semmle.code.cpp.Function
+import FunctionInputsAndOutputs
+import semmle.code.cpp.models.Models
+
+/**
+ * A library function for which a taint-tracking library should propagate taint
+ * from a parameter or qualifier to an output buffer, return value, or qualifier.
+ *
+ * Note that this does not include direct copying of values; that is covered by
+ * DataFlowModel.qll
+ */
+abstract class TaintFunction extends Function {
+ abstract predicate hasTaintFlow(FunctionInput input, FunctionOutput output);
+}
\ No newline at end of file
diff --git a/cpp/ql/src/semmle/code/cpp/padding/Padding.qll b/cpp/ql/src/semmle/code/cpp/padding/Padding.qll
new file mode 100644
index 000000000000..699badcbe885
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/padding/Padding.qll
@@ -0,0 +1,654 @@
+import cpp
+
+/**
+ * Align the specified offset up to the specified alignment boundary.
+ * The result is the smallest integer i such that (i % alignment) = 0
+ * and (i >= offset)
+ */
+bindingset[offset, alignment]
+private
+int alignUp(int offset, int alignment) {
+ result = (offset.(float) / alignment).ceil() * alignment
+}
+
+private
+Type stripSpecifiers(Type t) {
+ result = t.getUnspecifiedType() or
+ (result = t and not exists(t.getUnspecifiedType()))
+}
+
+/**
+ * A string that represents an architecture.
+ * An "architecture" defines the sizes of variable-sized types and
+ * the properties of alignment for fields of various
+ * types. Two are provided out-of-the-box: ILP32 and LP64,
+ * corresponding to gcc's behavior on x86 and amd64.
+ */
+abstract class Architecture extends string {
+ bindingset[this]
+ Architecture() { any() }
+
+ /** Gets the size of a pointer, in bits. */
+ abstract int pointerSize();
+ /** Gets the size of a 'long int', in bits. */
+ abstract int longSize();
+ /** Gets the size of a 'long double', in bits. */
+ abstract int longDoubleSize();
+ /** Gets the size of a 'long long', in bits. */
+ abstract int longLongSize();
+ /** Gets the size of a 'wchar_t', in bits. */
+ abstract int wideCharSize();
+
+ /** Gets the alignment boundary for doubles, in bits. */
+ abstract int doubleAlign();
+ /** Gets the alignment boundary for long doubles, in bits. */
+ abstract int longDoubleAlign();
+ /** Gets the alignment boundary for long longs, in bits. */
+ abstract int longLongAlign();
+
+ /**
+ * Holds if this architecture allow bitfields with declared types of different sizes
+ * to be packed together.
+ */
+ abstract predicate allowHeterogeneousBitfields();
+
+ /**
+ * Gets the bit size of class `cd.getBaseClass()` when used as a base class of
+ * class `cd.getDerivedClass()`.
+ */
+ abstract int baseClassSize(ClassDerivation cd);
+
+ /**
+ * Gets the bit size of type `t`. Only holds if `t` is an integral or enum type.
+ */
+ cached
+ int integralBitSize(Type t) {
+ (t instanceof BoolType and result = 8) or
+ (t instanceof CharType and result = 8) or
+ (t instanceof WideCharType and result = wideCharSize()) or
+ (t instanceof Char16Type and result = 16) or
+ (t instanceof Char32Type and result = 32) or
+ (t instanceof ShortType and result = 16) or
+ (t instanceof IntType and result = 32) or
+ (t instanceof LongType and result = longSize()) or
+ (t instanceof LongLongType and result = longLongSize()) or
+ result = enumBitSize(t.(Enum)) or
+ result = integralBitSize(t.(SpecifiedType).getBaseType()) or
+ result = integralBitSize(t.(TypedefType).getBaseType())
+ }
+
+ /**
+ * Gets the bit size of enum type `e`.
+ */
+ int enumBitSize(Enum e) {
+ result = integralBitSize(e.getExplicitUnderlyingType()) or
+ not exists(e.getExplicitUnderlyingType()) and result = 32
+ }
+
+ /**
+ * Gets the alignment of enum type `e`.
+ */
+ int enumAlignment(Enum e) {
+ result = alignment(e.getExplicitUnderlyingType()) or
+ not exists(e.getExplicitUnderlyingType()) and result = 32
+ }
+
+ /**
+ * Gets the bit size of type `t`; that is, the number of bits a value
+ * with type `t` takes up on this architecture, without any trailing
+ * padding on structs and unions.
+ */
+ cached
+ int bitSize(Type t) {
+ result = integralBitSize(t) or
+ (t instanceof FloatType and result = 32) or
+ (t instanceof DoubleType and result = 64) or
+ (t instanceof LongDoubleType and result = longDoubleSize()) or
+ (t instanceof PointerType and result = pointerSize()) or
+ (t instanceof ReferenceType and result = pointerSize()) or
+ (t instanceof FunctionPointerType and result = pointerSize()) or
+ result = bitSize(t.(SpecifiedType).getBaseType()) or
+ result = bitSize(t.(TypedefType).getBaseType()) or
+ exists(ArrayType array | array = t |
+ result = array.getArraySize() * paddedSize(array.getBaseType())) or
+ result = t.(PaddedType).typeBitSize(this)
+ }
+
+ /**
+ * Gets the desired alignment boundary of type `t` as a struct field
+ * on this architecture, in bits.
+ */
+ cached
+ int alignment(Type t) {
+ (t instanceof BoolType and result = 8) or
+ (t instanceof CharType and result = 8) or
+ (t instanceof WideCharType and result = wideCharSize()) or
+ (t instanceof Char16Type and result = 16) or
+ (t instanceof Char32Type and result = 32) or
+ (t instanceof ShortType and result = 16) or
+ (t instanceof IntType and result = 32) or
+ (t instanceof FloatType and result = 32) or
+ (t instanceof DoubleType and result = doubleAlign()) or
+ (t instanceof LongType and result = longSize()) or
+ (t instanceof LongDoubleType and result = longDoubleAlign()) or
+ (t instanceof LongLongType and result = longLongAlign()) or
+ (t instanceof PointerType and result = pointerSize()) or
+ (t instanceof FunctionPointerType and result = pointerSize()) or
+ (t instanceof ReferenceType and result = pointerSize()) or
+ result = enumAlignment(t.(Enum)) or
+ result = alignment(t.(SpecifiedType).getBaseType()) or
+ result = alignment(t.(TypedefType).getBaseType()) or
+ result = alignment(t.(ArrayType).getBaseType()) or
+ result = t.(PaddedType).typeAlignment(this)
+ }
+
+ /**
+ * Gets the padded size of type `t` on this architecture; that is,
+ * the number of bits that 'sizeof' should return, taking into account
+ * any trailing padding on top of the bit size.
+ */
+ int paddedSize(Type t) {
+ exists(Type realType | realType = stripSpecifiers(t) |
+ if realType instanceof PaddedType then
+ result = realType.(PaddedType).paddedSize(this)
+ else
+ result = bitSize(realType)
+ )
+ }
+
+ /**
+ * Gets the wasted space of type `t`; that is, the number of bits
+ * spent on padding. This is zero for primitive types, and depends on
+ * struct fields and their alignment otherwise. Trailing padding is
+ * counted.
+ */
+ int wastedSpace(Type t) {
+ if t instanceof PaddedType then
+ result = t.(PaddedType).wastedSpace(this)
+ else
+ result = 0
+ }
+}
+
+/**
+ * Gets an initial field of type `t`. If `t` is not a union, an initial field is
+ * either the first field declared in type `t`, or an initial field of the type
+ * of the first field declared in `t`. If `t` is a union, an initial field is
+ * either any field declared in type `t`, or an initial field of the type of any
+ * field declared in `t`.
+ */
+private
+Field getAnInitialField(PaddedType t) {
+ if (t instanceof Union) then (
+ // Any field of the union is an initial field
+ result = t.getAField() or
+ // Initial field of the type of a field of the union
+ result = getAnInitialField(
+ t.getAField().getType().getUnspecifiedType().(PaddedType))
+ )
+ else (
+ exists(Field firstField |
+ t.fieldIndex(firstField) = 1 |
+ // The first field of `t`
+ result = firstField or
+ // Initial field of the first field of `t`
+ result = getAnInitialField(
+ firstField.getType().getUnspecifiedType().(PaddedType))
+ )
+ )
+}
+
+/**
+ * Base class for architectures that follow the Itanium ABI. This includes
+ * pretty much everything except Windows, so we'll refer to this as
+ * "UnixArchitecture" to avoid any confusion due to the use of the name
+ * "Itanium".
+ */
+abstract class UnixArchitecture extends Architecture {
+ bindingset[this]
+ UnixArchitecture() { any() }
+
+ override int baseClassSize(ClassDerivation cd) {
+ if(not exists(cd.getBaseClass().getABaseClass*().getAField()) and
+ not exists(PaddedType fieldType |
+ fieldType = getAnInitialField(cd.getDerivedClass()).
+ getType().getUnspecifiedType() and (
+ // Check if the type of the field is a base type of the class, or
+ // vice versa. This is an approximation of the actual rule, which is
+ // that the field type and the class must not share a common
+ // ancestor. This approximation should be sufficient for the vast
+ // majority of cases.
+ (fieldType.getABaseClass*() = cd.getBaseClass()) or
+ (fieldType = cd.getBaseClass().getABaseClass*())
+ )
+ )) then (
+ // No fields in this class or any base classes.
+ result = 0
+ )
+ else (
+ result = cd.getBaseClass().(PaddedType).paddedSize(this)
+ )
+ }
+
+ override int longLongSize() { result = 64 }
+ override int wideCharSize() { result = 32 }
+
+ override predicate allowHeterogeneousBitfields() { any() }
+}
+
+/**
+ * The ILP32 architecture has ints, longs and pointers
+ * of 32 bits.
+ */
+class ILP32 extends UnixArchitecture {
+ ILP32() { this = "ILP32" }
+
+ override int pointerSize() { result = 32 }
+ override int longSize() { result = 32 }
+ override int longDoubleSize() { result = 96 }
+
+ override int doubleAlign() { result = 32 }
+ override int longLongAlign() { result = 32 }
+ override int longDoubleAlign() { result = 32 }
+}
+
+/**
+ * The LP64 architecture has longs and pointers of 64 bits.
+ */
+class LP64 extends UnixArchitecture {
+ LP64() { this = "LP64" }
+
+ override int pointerSize() { result = 64 }
+ override int longSize() { result = 64 }
+ override int longDoubleSize() { result = 128 }
+
+ override int doubleAlign() { result = 64 }
+ override int longLongAlign() { result = 64 }
+ override int longDoubleAlign() { result = 128 }
+}
+
+/**
+ * Base class for Windows architectures.
+ */
+abstract class WindowsArchitecture extends Architecture {
+ bindingset[this]
+ WindowsArchitecture() { any() }
+
+ override int baseClassSize(ClassDerivation cd) {
+ if not exists(cd.getBaseClass().getABaseClass*().getAField()) then (
+ // No fields in this class or any base classes.
+ result = 0
+ )
+ else (
+ result = cd.getBaseClass().(PaddedType).paddedSize(this)
+ )
+ }
+
+ override int longSize() { result = 32 }
+ override int longDoubleSize() { result = 64 }
+ override int longLongSize() { result = 64 }
+ override int wideCharSize() { result = 16 }
+
+ override int doubleAlign() { result = 64 }
+ override int longLongAlign() { result = 64 }
+ override int longDoubleAlign() { result = 64 }
+
+ override predicate allowHeterogeneousBitfields() { none() }
+}
+
+/**
+ * The ILP32_MS architecture is essentially the same as the
+ * ILP32 architecture, except that long doubles are 64 bits.
+ */
+class ILP32_MS extends WindowsArchitecture {
+ ILP32_MS() { this = "ILP32_MS" }
+
+ override int pointerSize() { result = 32 }
+}
+
+/**
+ * The LLP64_MS architecture has pointers of 64 bits, but both
+ * long and int are still 32 bits.
+ */
+class LLP64_MS extends WindowsArchitecture {
+ LLP64_MS() { this = "LLP64_MS" }
+
+ override int pointerSize() { result = 64 }
+}
+
+/**
+ * A class that is subject to padding by the compiler, and hence can
+ * introduce waste. Does not include types with virtual member functions,
+ * virtual base classes, or multiple base classes. These are excluded due
+ * to the complexity of the implementation.
+ */
+class PaddedType extends Class {
+ PaddedType() {
+ // We can't talk about bit size of template types.
+ not this instanceof TemplateClass and
+ // If the class has any virtual functions, the layout will be more
+ // complicated due to the presence of a virtual function table pointer.
+ not exists(MemberFunction f |
+ f = this.getAMemberFunction() and f.isVirtual()) and
+ not exists(ClassDerivation cd |
+ cd = this.getADerivation() |
+ // If the class has any virtual functions, the layout will be more
+ // complicated due to the presence of a virtual base table pointer.
+ cd.hasSpecifier("virtual") or
+ // If one of the base classes was not a PaddedType, then we should not
+ // attempt to lay out the derived class, either.
+ not (cd.getBaseClass() instanceof PaddedType)
+ ) and
+ // Support only single inheritance for now. If multiple inheritance is
+ // supported, be sure to fix up the calls to getABaseClass*() to correctly
+ // handle the presence of multiple base class subojects with the same type.
+ not exists(ClassDerivation cd | cd = this.getDerivation(1))
+ }
+
+ /**
+ * Holds if, for each architecture, a single padded size is
+ * calculated for this type.
+ * This is normally the case, but sometimes the same type can be
+ * defined in different compilations with different sizes, normally
+ * due to use of the preprocessor in its definition.
+ */
+ predicate isPrecise() {
+ forex(Architecture arch | 1 = strictcount(arch.paddedSize(this)))
+ }
+
+ /**
+ * Gets the padded size of this type on architecture `arch`, in bits.
+ * This is its `bitSize`, rounded up to the next multiple of its
+ * `alignment`.
+ */
+ int paddedSize(Architecture arch) {
+ // Struct padding is weird: It needs to be such that struct arrays
+ // can be allocated contiguously. That means that the trailing padding
+ // has to bring the alignment up to the smallest common multiple of
+ // the alignment values of all fields. In practice, since valid
+ // alignment values are 1, 2, 4, 8 and 16, this means "the largest
+ // alignment value".
+ // If the class is empty, the size is rounded up to one byte.
+ result = alignUp(arch.bitSize(this), arch.alignment(this)).maximum(8)
+ }
+
+ /**
+ * Gets the number of bits wasted by padding at the end of this
+ * struct.
+ */
+ int trailingPadding(Architecture arch) {
+ result = paddedSize(arch) - arch.bitSize(this)
+ }
+
+ /**
+ * Gets the number of bits wasted in this struct definition; that is.
+ * the waste between fields plus any waste from trailing padding.
+ * Only the space wasted directly in this type is counted, not space
+ * wasted in nested structs. Note that for unions, the wasted space
+ * is simply the amount of trailing padding, as other fields are not
+ * laid out one after another, and hence there is no padding between
+ * them.
+ */
+ int wastedSpace(Architecture arch) {
+ result = arch.paddedSize(this) - dataSize(arch)
+ }
+
+ /**
+ * Gets the total size of all fields declared in this class, not including any
+ * padding between fields.
+ */
+ private
+ int fieldDataSize(Architecture arch) {
+ if this instanceof Union then
+ result = max(Field f |
+ f = this.getAMember() |
+ fieldSize(f, arch))
+ else
+ result = sum(Field f |
+ f = this.getAMember() |
+ fieldSize(f, arch))
+ }
+
+ /**
+ * Gets the data size of this type on architecture `arch`; that is,
+ * the number of bits taken up by data, rather than any kind of
+ * padding. Padding of fields that have struct type is
+ * considered "data" for the purposes of this definition, since
+ * removing it requires reorganizing other parts of the code.
+ */
+ int dataSize(Architecture arch) {
+ result = sum(PaddedType c | c = this.getABaseClass*() | c.fieldDataSize(arch))
+ }
+
+ /**
+ * Gets the optimal size of this type on architecture `arch`, that is,
+ * the sum of the sizes of all fields, ignoring padding
+ * between them, but adding any trailing padding required to align
+ * the type properly. This is a lower bound on the actual size that
+ * can be achieved just by reordering fields, and without
+ * reorganizing member structs' field layouts.
+ */
+ int optimalSize(Architecture arch) {
+ result = alignUp(dataSize(arch), arch.alignment(this)).maximum(8)
+ }
+
+ /**
+ * Gets the bit size of this type on architecture `arch`, that is, the
+ * size its fields and required padding take up, without including
+ * any trailing padding that is necessary.
+ */
+ int typeBitSize(Architecture arch) {
+ if this instanceof Union then
+ // A correct implementation for unions would be
+ // result = max(fieldSize(_, arch))
+ // but that uses a recursive aggregate, which isn't supported in
+ // QL. We therefore use this slightly more complex implementation
+ // instead.
+ result = biggestFieldSizeUpTo(lastFieldIndex(), arch)
+ else
+ // If we're not a union type, the size is the padded
+ // sum of field sizes, padded.
+ result = fieldEnd(lastFieldIndex(), arch)
+ }
+
+ /**
+ * Gets the alignment, in bits, of the entire struct/union type for
+ * architecture `arch`.
+ */
+ language[monotonicAggregates]
+ int typeAlignment(Architecture arch) {
+ // The alignment of the type is the largest alignment of any of its fields,
+ // including fields from base class subobjects.
+ result = max(PaddedType c |
+ c = this.getABaseClass*() |
+ c.biggestAlignmentUpTo(c.lastFieldIndex(), arch)
+ )
+ }
+
+ /**
+ * Gets the largest size, in bits, of the size of a field with
+ * (1-based) index less than or equal to `index` on architecture
+ * `arch`.
+ */
+ int biggestFieldSizeUpTo(int index, Architecture arch) {
+ if index = 0 then (
+ result = 0
+ )
+ else (
+ exists(Field f, int fSize |
+ index = fieldIndex(f) and fSize = fieldSize(f, arch) |
+ result = fSize.maximum(biggestFieldSizeUpTo(index-1, arch))
+ )
+ )
+ }
+
+ /**
+ * Gets the largest alignment boundary, in bits, required by a field
+ * with (1-based) index less than or equal to `index` on architecture
+ * `arch`.
+ */
+ int biggestAlignmentUpTo(int index, Architecture arch) {
+ if index = 0 then (
+ result = 1 // Minimum possible alignment
+ )
+ else (
+ exists(Field f, int fAlign |
+ index = fieldIndex(f) and fAlign = arch.alignment(f.getType()) |
+ result = fAlign.maximum(biggestAlignmentUpTo(index-1, arch))
+ )
+ )
+ }
+
+ /**
+ * Gets the 1-based index for each field.
+ */
+ int fieldIndex(Field f) {
+ memberIndex(f) = rank[result](Field field, int index |
+ memberIndex(field) = index |
+ index
+ )
+ }
+
+ private
+ int memberIndex(Field f) {
+ result = min(int i | getCanonicalMember(i) = f)
+ }
+
+ /**
+ * Gets the 1-based index for the last field.
+ */
+ int lastFieldIndex() {
+ if exists(lastField()) then (
+ result = fieldIndex(lastField())
+ )
+ else (
+ // Field indices are 1-based, so return 0 to represent the lack of fields.
+ result = 0
+ )
+ }
+
+ /**
+ * Gets the size, in bits, of field `f` on architecture
+ * `arch`.
+ */
+ int fieldSize(Field f, Architecture arch) {
+ exists(fieldIndex(f)) and
+ if f instanceof BitField then
+ result = f.(BitField).getNumBits()
+ else
+ result = arch.paddedSize(f.getType())
+ }
+
+ /** Gets the last field of this type. */
+ Field lastField() {
+ fieldIndex(result) = max(Field other | | fieldIndex(other))
+ }
+
+ /**
+ * Gets the offset, in bits, of the end of the class' last base class
+ * subobject, or zero if the class has no base classes.
+ */
+ int baseClassEnd(Architecture arch) {
+ if exists(getABaseClass()) then (
+ result = arch.baseClassSize(getADerivation())
+ )
+ else (
+ result = 0
+ )
+ }
+
+ /** Gets the bitfield at field index `index`, if that field is a bitfield. */
+ private
+ BitField bitFieldAt(int index) {
+ fieldIndex(result) = index
+ }
+
+ /**
+ * Gets the 0-based offset, in bits, of the first free bit after
+ * field `f` (which is the `index`th field of
+ * this type), taking padding into account, on architecture `arch`.
+ */
+ int fieldEnd(int index, Architecture arch) {
+ if index = 0 then (
+ // Base case: No fields seen yet, so return the offset of the end of the
+ // base class subojects.
+ result = baseClassEnd(arch)
+ )
+ else (
+ exists(Field f | index = fieldIndex(f) |
+ exists(int fSize | fSize = fieldSize(f, arch) |
+ // Recursive case: Take previous field's end point, pad and add
+ // this field's size
+ exists(int firstFree |
+ firstFree = fieldEnd(index-1, arch) |
+ if (f instanceof BitField) then (
+ // Bitfield packing:
+ // (1) A struct containing a bitfield with declared type T (e.g. T bf : 7) will be aligned as if it
+ // contained an actual field of type T. Thus, a struct containing a bitfield 'unsigned int bf : 8'
+ // will have an alignment of at least alignof(unsigned int), even though the bitfield was only 8 bits.
+ // (2) If a bitfield with declared type T would straddle a sizeof(T) boundary, padding is inserted
+ // before the bitfield to align it on an alignof(T) boundary. Note the subtle distinction between alignof
+ // and sizeof. This matters for 32-bit Linux, where sizeof(long long) == 8, but alignof(long long) == 4.
+ // (3) [MSVC only!] If a bitfield with declared type T immediately follows another bitfield with declared type P,
+ // and sizeof(P) != sizeof(T), padding will be inserted to align the new bitfield to a boundary of
+ // max(alignof(P), alignof(T)).
+ exists(int nextSizeofBoundary, int nextAlignofBoundary |
+ (nextSizeofBoundary = alignUp(firstFree, arch.bitSize(f.getType()))) and
+ (nextAlignofBoundary = alignUp(firstFree, arch.alignment(f.getType()))) |
+ if (arch.allowHeterogeneousBitfields()) then (
+ if (nextSizeofBoundary < (firstFree + fSize)) then (
+ // Straddles a sizeof(T) boundary, so pad for alignment.
+ result = nextAlignofBoundary + fSize
+ )
+ else (
+ // No additional restrictions, so just pack it in with no padding.
+ result = firstFree + fSize
+ )
+ )
+ else (
+ if exists(bitFieldAt(index-1)) then (
+ exists (BitField previousBitField |
+ previousBitField = bitFieldAt(index-1) |
+ // Previous field was a bitfield.
+ if ((nextSizeofBoundary >= (firstFree + fSize)) and arch.integralBitSize(previousBitField.getType()) = arch.integralBitSize(f.getType())) then (
+ // The new bitfield can be stored in the same allocation unit as the previous one,
+ // so we can avoid padding.
+ result = firstFree + fSize
+ )
+ else (
+ // Either we switched types, or we would overlap a sizeof(T) boundary, so we have to insert padding.
+ // Note that we have to align to max(alignof(T), alignof(P)), where P is the type of the previous
+ // bitfield. Without the alignof(P) term, we'll get the wrong layout for:
+ // struct S {
+ // unsigned int x : 7;
+ // unsigned short y : 1;
+ // };
+ // If we only aligned to sizeof(T), we'd align 'y' to a 2-byte boundary. This is incorrect. The allocation
+ // unit that started with 'x' has to consume an entire unsigned int (4 bytes).
+ result = max(int boundary |
+ boundary = nextAlignofBoundary or
+ boundary = alignUp(firstFree,
+ arch.alignment(previousBitField.getType())) |
+ boundary
+ ) + fSize
+ )
+ )
+ )
+ else (
+ // Previous field was not a bitfield. Align up to an
+ // alignof(T) boundary.
+ result = nextSizeofBoundary + fSize
+ )
+ )
+ )
+ )
+ else (
+ // Normal case: Pad as necessary, then add the field.
+ result = alignUp(firstFree, arch.alignment(f.getType())) + fSize
+ )
+ )
+ )
+ )
+ )
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/padding/SanityCheck.ql b/cpp/ql/src/semmle/code/cpp/padding/SanityCheck.ql
new file mode 100644
index 000000000000..a4b775ccb5e3
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/padding/SanityCheck.ql
@@ -0,0 +1,31 @@
+/**
+ * @name Padding Sanity Check
+ * @description Performs sanity checks for the padding library. This query should have no results.
+ * @kind problem
+ * @id cpp/padding-sanity-check
+ */
+
+import Padding
+
+/*
+ * Sanity-check: Find discrepancies between computed and actual size on LP64.
+ *
+from Type t, LP64 a, int padded, int bit, int real, MemberVariable v
+where padded = a.paddedSize(t) and bit = a.bitSize(t)
+and real = t.getSize() * 8 and padded != real and count(t.getSize()) = 1
+select t, a.paddedSize(t) as Padded, real, v, t.(PaddedType).memberSize(v, a)
+ /** /
+
+from PaddedType t, LP64 a, MemberVariable v
+where t instanceof Union and v = t.getAMember() and not exists(t.memberSize(v, a))
+select t, v, v.getType().explain()
+/**
+from PaddedType t, LP64 a, MemberVariable v
+where not exists(a.paddedSize(t))
+select t, t.fieldIndex(v) as i, v, t.memberSize(v, a) order by t, i
+/**/
+from PaddedType t, LP64 a
+where a.wastedSpace(t) != 0
+select t, a.paddedSize(t) as size, a.wastedSpace(t) as waste order by waste desc
+/**/
+
diff --git a/cpp/ql/src/semmle/code/cpp/pointsto/CallGraph.qll b/cpp/ql/src/semmle/code/cpp/pointsto/CallGraph.qll
new file mode 100644
index 000000000000..57a718e8ae9b
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/pointsto/CallGraph.qll
@@ -0,0 +1,77 @@
+import cpp
+import semmle.code.cpp.pointsto.PointsTo
+
+// a TargetPointsToExpr has points-to information for expressions
+// that will help build an accurate call-graph (i.e. expressions
+// in function-pointer calls and qualifiers of virtual calls)
+class TargetPointsToExpr extends PointsToExpr {
+ override predicate interesting() {
+ exists(ExprCall ec | ec.getExpr() = this)
+ or
+ exists(Call c | c.getQualifier() = this)
+ or
+ exists(DeleteExpr d | d.getExpr() = this)
+ }
+
+ // resolve a virtual-call where this is the qualifier
+ VirtualFunction resolve()
+ {
+ pointstosets(this.resolveToSet(), result)
+ }
+
+ int resolveToSet()
+ {
+ exists(int cset, VirtualFunction static |
+ this.interesting() and
+ parentSetFor(cset, this) and
+ static = this.staticTarget() and
+ childrenByElement(cset, static, result)
+ )
+ }
+
+ VirtualFunction staticTarget()
+ {
+ exists(Function f, DeleteExpr d |
+ f.calls(result, d) and
+ d.getExpr() = this)
+ or
+ exists(Function f, FunctionCall c |
+ f.calls(result, c) and
+ c.getQualifier() = this)
+ }
+}
+
+predicate resolvedCall(Call call, Function called)
+{
+ call.(FunctionCall).getTarget() = called
+ or
+ call.(DestructorCall).getTarget() = called
+ or
+ exists(ExprCall ec, TargetPointsToExpr pte |
+ ec = call and ec.getExpr() = pte and pte.pointsTo() = called)
+ or
+ exists(TargetPointsToExpr pte |
+ call.getQualifier() = pte and
+ pte.resolve() = called)
+}
+
+predicate ptrCalls(Function f, Function g) {
+ exists(ExprCall ec |
+ ec.getEnclosingFunction() = f and
+ ec.getExpr().(TargetPointsToExpr).pointsTo() = g)
+}
+
+predicate virtualCalls(Function f, VirtualFunction g) {
+ exists(DeleteExpr d, TargetPointsToExpr ptexpr, VirtualFunction static |
+ f.calls(static, d) and
+ d.getExpr() = ptexpr and
+ ptexpr.resolve() = g) or
+ exists(Call c, TargetPointsToExpr ptexpr, VirtualFunction static |
+ f.calls(static, c) and
+ c.getQualifier() = ptexpr and
+ ptexpr.resolve() = g)
+}
+
+predicate allCalls(Function f, Function g) {
+ f.calls(g) or ptrCalls(f,g) or virtualCalls(f,g)
+}
diff --git a/cpp/ql/src/semmle/code/cpp/pointsto/PointsTo.qll b/cpp/ql/src/semmle/code/cpp/pointsto/PointsTo.qll
new file mode 100644
index 000000000000..83766d45ca80
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/pointsto/PointsTo.qll
@@ -0,0 +1,636 @@
+/**
+ * Provides classes and predicates implementing a points-to analysis
+ * based on Steensgaard's algorithm, extended to support fields.
+ *
+ * A pointer set can be represented in one of two ways: an expression, or
+ * the combination of an expression and a label. In the former case,
+ * the expression represents the values the expression might evaluate to.
+ * In the latter case, the (expr, label) pair is called a "compound", and it
+ * represents a field of the value with the name of the given label. The label
+ * can be either a string or another element.
+ *
+ * The various "flow" predicates (`flow`, `flowToCompound`, etc.) represent
+ * direct flow from a source set to a destination set. The various "pointer"
+ * predicates (`pointer`, `pointerFromCompound`, etc.) indicate that one set
+ * contains values pointing to the locations represented by the other set.
+ *
+ * The individual flow and pointer predicates only hold tuples describing
+ * one step of flow; they do not include transitive closures. The
+ * `pointstoinfo` predicate determines the transitively implied points-to
+ * information by collapsing pointers into equivalence classes. These
+ * equivalence classes are called "points-to sets".
+ */
+
+import semmle.code.cpp.commons.File
+import semmle.code.cpp.exprs.Expr
+
+/**
+ * Holds if `actual` is the override of `resolved` for a value of type
+ * `dynamic`.
+ */
+predicate resolve(Class dynamic, VirtualFunction resolved, VirtualFunction actual) {
+ if resolved.getAnOverridingFunction*().getDeclaringType() = dynamic
+ then (actual = resolved.getAnOverridingFunction*() and
+ dynamic = actual.getDeclaringType())
+ else resolve(dynamic.getABaseClass(), resolved, actual)
+}
+
+/**
+ * Holds if `e` is evaluated just for its location. This includes
+ * expressions that are used in a reference expression (`&foo`),
+ * expressions that are used on the left side of an assignment,
+ * and some non-expression types such as `Initializer`.
+ *
+ * For expressions, this is similar to, but different than,
+ * `e.(Expr).isLValue()`, which holds if `e` *has* an address.
+ *
+ * This relation pervasively influences the interpretation of
+ * expressions throughout this module. An element evaluated for its
+ * lvalue is treated as evaluating to its location, not its value.
+ */
+predicate lvalue(Element e) {
+ exists(AssignExpr assign | assign.getLValue().getFullyConverted() = e)
+ or
+ exists(AddressOfExpr addof | e = addof.getOperand().getFullyConverted())
+ or
+ exists(FieldAccess fa | fa.getQualifier().getFullyConverted() = e
+ and not(pointerValue(e)))
+ or
+ exists(Call c | c.getQualifier().getFullyConverted() = e
+ and not(pointerValue(e)))
+ or
+ e.(Expr).getConversion() instanceof ArrayToPointerConversion
+ or
+ exists(ParenthesisExpr paren | exprconv(e, paren) and lvalue(paren))
+ or
+ exists(Cast c | lvalue(c) and e.(Expr).getConversion() = c)
+ or
+ exists(ReferenceToExpr toref | e.(Expr).getConversion() = toref)
+ or
+ // If f is a function-pointer, then the following two
+ // calls are equivalent: f() and (*f)()
+ exists(PointerDereferenceExpr deref | e = deref and
+ deref.getUnderlyingType() instanceof FunctionPointerType)
+ or
+ exists(Variable v | e = v.getInitializer() and
+ v.getType().getUnderlyingType() instanceof Struct)
+ or
+ exists(Variable v | e = v.getInitializer() and
+ v.getType().getUnderlyingType() instanceof ArrayType)
+ or
+ e instanceof AggregateLiteral
+}
+
+/**
+ * Gets an access for the value of `p` on line `line`.
+ */
+private
+VariableAccess param_rvalue_access_line(Parameter p, int line) {
+ p.getAnAccess() = result and
+ not lvalue(result) and
+ result.getLocation().getStartLine() = line
+}
+
+/**
+ * Gets an access for the value of `p`.
+ *
+ * The choice is arbitrary, and it doesn't matter if this returns more
+ * than one access, but we try to have few results to cut down the
+ * number of flow edges.
+ */
+private
+VariableAccess pick_rvalue_access(Parameter p) {
+ result = min(int line | | param_rvalue_access_line(p, line) order by line)
+}
+
+/**
+ * Holds if there is an access for the value of `p`.
+ *
+ * Usually we can just add a flow edge from a function argument to a
+ * value access of the corresponding parameter. If all accesses to the
+ * parameter are lvalues, however, we have to add a pointer edge from
+ * the parameter to the function argument. This is less precise, because
+ * it can equate more points-to sets.
+ */
+private
+predicate has_rvalue_access(Parameter p) {
+ exists(VariableAccess a | a = p.getAnAccess() | not lvalue(a))
+}
+
+/**
+ * Holds if `e` has a pointer type.
+ */
+predicate pointerValue(Expr e) {
+ exists(Type t | t = e.getType().getUnderlyingType() and
+ (t instanceof PointerType or
+ t instanceof ArrayType or
+ t instanceof ReferenceType))
+}
+
+/**
+ * The source is a pointer to the destination.
+ */
+predicate pointer(Element src, Element dest)
+{
+ exists(Variable v | not(lvalue(dest)) and
+ src = v and (dest = v.getAnAccess() or dest = v.getInitializer()))
+ or
+ exists(AssignExpr assign | not lvalue(assign) and
+ src = assign.getLValue().getFullyConverted() and dest = assign)
+ or
+ exists(AssignExpr assign |
+ src = assign.getLValue().getFullyConverted() and
+ dest = assign.getRValue().getFullyConverted())
+ or
+ exists(FunctionCall c, Function f, Parameter p, int i |
+ p = f.getParameter(i) and not has_rvalue_access(p) and
+ dest = c.getArgument(i).getFullyConverted() and not(f.isVirtual()) and
+ src = p.getAnAccess() and c.getTarget() = f)
+ or
+ exists(PointerDereferenceExpr deref | not(lvalue(deref)) and
+ src = deref.getOperand().getFullyConverted() and dest = deref)
+ or
+ exists(ArrayExpr ae | not(lvalue(dest)) and dest = ae and
+ src = ae.getArrayBase().getFullyConverted() and pointerValue(src))
+ or
+ exists(ArrayExpr ae | not(lvalue(dest)) and dest = ae and
+ src = ae.getArrayOffset().getFullyConverted() and pointerValue(src))
+ or
+ exists(ReferenceDereferenceExpr deref | not(lvalue(deref)) and
+ dest = deref and exprconv(src, deref))
+ or
+ exists(AggregateLiteral agg | not(lvalue(dest)) and
+ agg.getType().getUnderlyingType() instanceof ArrayType and
+ src = agg and dest = agg.getAChild().getFullyConverted())
+ or
+ // field points to constructor field initializer
+ exists(ConstructorFieldInit cfi |
+ dest = cfi and
+ src = cfi.getTarget() and
+ not(lvalue(dest))
+ )
+ //
+ // add more cases here
+ //
+}
+
+/**
+ * The value held in the source flows to the value held in the destination.
+ */
+predicate flow(Element src, Element dest)
+{
+ exists(Variable v | lvalue(dest) and
+ src = v and (dest = v.getAnAccess() or dest = v.getInitializer()))
+ or
+ exists(FunctionAccess fa | src = fa.getTarget() and dest = fa)
+ or
+ exists(AssignExpr assign | lvalue(assign) and
+ src = assign.getLValue().getFullyConverted() and dest = assign)
+ or
+ exists(AddressOfExpr addof | dest = addof and
+ src = addof.getOperand().getFullyConverted())
+ or
+ exists(FunctionCall c, Function f, int i | not lvalue(dest) and
+ src = c.getArgument(i).getFullyConverted() and not(f.isVirtual()) and
+ dest = pick_rvalue_access(f.getParameter(i)) and c.getTarget() = f)
+ or
+ exists(FunctionCall c, Function f, int i |
+ src = c.getArgument(i).getFullyConverted() and not(f.isVirtual()) and
+ c.getTarget() = f and i >= f.getNumberOfParameters() and
+ varArgRead(f, dest))
+ or
+ exists(FunctionCall c, Function f, ReturnStmt r |
+ c.getTarget() = f and
+ not(f.isVirtual()) and
+ r.getEnclosingFunction() = f and
+ src = r.getExpr().getFullyConverted() and dest = c)
+ or
+ exists(PointerDereferenceExpr deref | lvalue(deref) and
+ src = deref.getAChild().getFullyConverted() and dest = deref)
+ or
+ exists(Variable v | dest = v.getInitializer() and
+ src = v.getInitializer().getExpr().getFullyConverted())
+ or
+ exists(ArrayExpr ae | lvalue(dest) and dest = ae and
+ src = ae.getArrayBase().getFullyConverted() and pointerValue(src))
+ or
+ exists(ArrayExpr ae | lvalue(dest) and dest = ae and
+ src = ae.getArrayOffset().getFullyConverted() and pointerValue(src))
+ or
+ exists(Expr arg, BinaryArithmeticOperation binop | dest = binop and src = arg and
+ pointerValue(binop) and pointerValue(arg) and
+ ( arg = binop.getLeftOperand().getFullyConverted() or
+ arg = binop.getRightOperand().getFullyConverted()))
+ or
+ exists(Cast c | src = c.getExpr() and dest = c)
+ or
+ exists(ReferenceToExpr toref | exprconv(src, toref) and dest = toref)
+ or
+ exists(ReferenceDereferenceExpr deref | lvalue(deref) and
+ dest = deref and exprconv(src, deref))
+ or
+ exists(ArrayToPointerConversion conv | exprconv(src, conv) and dest = conv)
+ or
+ exists(ParenthesisExpr paren |
+ // these can appear on the LHS of an assignment
+ (exprconv(src, paren) and dest = paren) or
+ (exprconv(dest, paren) and src = paren))
+ or
+ exists(ConditionalExpr cond | dest = cond and
+ ( src = cond.getThen().getFullyConverted() or
+ src = cond.getElse().getFullyConverted()))
+ or
+ exists(IncrementOperation inc | dest = inc and
+ src = inc.getOperand().getFullyConverted())
+ or
+ exists(IncrementOperation dec | dest = dec and
+ src = dec.getOperand().getFullyConverted())
+ or
+ exists(CommaExpr comma | dest = comma and
+ src = comma.getRightOperand().getFullyConverted())
+ or
+ exists(ParenthesisExpr paren | dest = paren and exprconv(src, paren))
+ or
+ // "vtable" for new-expressions
+ exists(NewExpr new | src = new and dest = new.getAllocatedType())
+ or
+ // "vtable" for class-typed variables
+ exists(Variable v, Class c | v.getType().getUnderlyingType() = c and src = v and dest = c)
+ or
+ exists(AggregateLiteral agg | lvalue(dest) and
+ agg.getType().getUnderlyingType() instanceof ArrayType and
+ src = agg and dest = agg.getAChild().getFullyConverted())
+ or
+ // contained expr -> constructor field initializer
+ exists(ConstructorFieldInit cfi |
+ src = cfi.getExpr().getFullyConverted() and
+ dest = cfi
+ )
+ //
+ // add more cases here
+ //
+}
+
+// Try to find the expression corresponding to the return value
+// of va_arg(...,...) - which is a macro.
+predicate varArgRead(Function f, Expr e)
+{
+ exists(Macro m, MacroInvocation mi |
+ m.getHead().matches("va\\_arg(%") and
+ mi.getMacro() = m and
+ e = mi.getAGeneratedElement() and
+ not(e.getParent() = mi.getAGeneratedElement())
+ and e.getEnclosingFunction() = f)
+}
+
+/**
+ * There is a flow from src to the compound (destParent, destLabel).
+ */
+predicate flowToCompound(Element destParent, string destLabel, Element src)
+{
+ exists(ExprCall call, int i |
+ src = call.getArgument(i).getFullyConverted() and
+ destParent = call.getExpr().getFullyConverted() and
+ if i < call.getType().(FunctionPointerType).getNumberOfParameters() then
+ destLabel = "+arg" + i.toString()
+ else
+ destLabel = "+vararg")
+ or
+ exists(Function f, ReturnStmt ret |
+ f = ret.getEnclosingFunction() and
+ src = ret.getExpr().getFullyConverted() and
+ destLabel = "+ret" and destParent = f)
+ or
+ exists(AggregateLiteral agg, Struct s, int i |
+ destParent = agg and lvalue(src) and
+ aggregateLiteralChild(agg, s, i, src) and
+ destLabel = s.getCanonicalMember(i).getName()
+ )
+ or
+ exists(FunctionCall c, Function f |
+ c.getTarget() = f and
+ not(f.isVirtual()) and
+ src = c.getQualifier().getFullyConverted() and
+ destParent = f and
+ destLabel = "+this"
+ )
+ or
+ exists(ConstructorCall c, Function f, Variable v |
+ c.getTarget() = f and
+ not(f.isVirtual()) and
+ v.getAnAssignedValue() = c and
+ src = v and
+ destParent = f and
+ destLabel = "+this"
+ )
+ or
+ exists(NewExpr ne, ConstructorCall c, Function f |
+ c.getTarget() = f and
+ not(f.isVirtual()) and
+ ne.getInitializer() = c and
+ src = ne and
+ destParent = f and
+ destLabel = "+this"
+ )
+ // in C, &s == &s.firstfield
+ // exists(FieldAccess fa, Field f |
+ // parent = fa.getQualifier().getFullyConverted() and src = parent and
+ // f = fa.getTarget() and not exists(f.previous()) and
+ // label = f.getName()
+ // )
+ //
+ // add more cases here
+ //
+}
+
+/**
+ * There is a flow from the compound (parent, label) to dest.
+ */
+predicate flowFromCompound(Element parent, string label, Element dest)
+{
+ exists(ExprCall call |
+ dest = call and label = "+ret" and parent = call.getExpr().getFullyConverted())
+ or
+ exists(Function f, int i | dest = f.getParameter(i).getAnAccess()
+ and label = "+arg" + i.toString() and parent = f)
+ or
+ exists(Function f |
+ parent = f and label = "+vararg" and varArgRead(f, dest))
+ or
+ exists(FieldAccess fa | dest = fa and parent = fa.getQualifier().getFullyConverted()
+ and label = fa.getTarget().getName() and lvalue(dest))
+ or
+ exists(ThisExpr thisexpr | dest = thisexpr and label = "+this"
+ and parent = thisexpr.getEnclosingFunction())
+ //
+ // add more cases here
+ //
+}
+
+/*
+ * The values stored in src point to the compounds (destParent, destLabel).
+ */
+predicate pointerToCompound(Element destParent, string destLabel, Element src)
+{
+ none()
+ //
+ // add more cases here
+ //
+}
+
+/**
+ * The type of agg is s, and the expression initializing the ith member
+ * of s is child.
+ */
+pragma[noopt]
+predicate aggregateLiteralChild(AggregateLiteral agg, Struct s, int i, Expr child) {
+ // s = agg.getType().getUnderlyingType()
+ exists(Type t |
+ t = agg.getType() and agg instanceof AggregateLiteral and s = t.getUnderlyingType() and s instanceof Struct
+ )
+ and
+ exists(Expr beforeConversion |
+ beforeConversion = agg.getChild(i) and
+ child = beforeConversion.getFullyConverted()
+ )
+}
+
+/**
+ * The compound (parent, label) holds pointers to dest.
+ */
+predicate pointerFromCompound(Element parent, string label, Element dest)
+{
+ exists(FieldAccess fa | dest = fa and parent = fa.getQualifier().getFullyConverted()
+ and label = fa.getTarget().getName() and not(lvalue(dest)))
+ or
+ exists(AggregateLiteral agg, Struct s, int i |
+ parent = agg and not(lvalue(dest)) and
+ aggregateLiteralChild(agg, s, i, dest) and
+ label = s.getCanonicalMember(i).getName()
+ )
+ //
+ // add more cases here
+ //
+}
+
+predicate virtualArg(Expr receiver, VirtualFunction called, string arglabel, Expr arg)
+{
+ exists(FunctionCall c, int i |
+ receiver = c.getQualifier().getFullyConverted() and called = c.getTarget() and called.isVirtual()
+ and arg = c.getArgument(i) and i >= 0 and
+ if i < called.getNumberOfParameters() then
+ arglabel = "+arg" + i.toString()
+ else
+ arglabel = "+vararg")
+}
+
+predicate virtualThis(Expr receiver, VirtualFunction called, string thislabel, Expr thisexpr)
+{
+ exists(FunctionCall c |
+ receiver = c.getQualifier().getFullyConverted() and called = c.getTarget() and thislabel = "+this"
+ and called.isVirtual() and thisexpr = receiver)
+}
+
+predicate virtualRet(Expr receiver, VirtualFunction called, string retlabel, FunctionCall c)
+{
+ receiver = c.getQualifier().getFullyConverted() and called = c.getTarget()
+ and called.isVirtual() and retlabel = "+ret"
+}
+
+/**
+ * This relation combines all pointer and flow relations that
+ * go to or from a compound set.
+ *
+ * The "kind" of each tuple determines what relation the other
+ * four elements of the tuple indicate:
+ *
+ * 0 - flow from to other
+ * 1 - flow from other to
+ * 2 - pointer from to other
+ * 3 - pointer from other to
+ *
+ * 4 - flow from to other
+ * 5 - flow from other to
+ * 6 - flow from to other
+ * 7 - flow from other to
+ *
+ * 8 - flow from <,label> to other
+ * 9 - flow from other to <,label>
+ * 10 - pointer from <,label> to other
+ * 11 - pointer from other to <,label>
+ */
+predicate compoundEdge(Element parent, Element element, string label, Element other, int kind)
+{
+ (flowFromCompound(parent, label, other) and element = parent and kind = 0)
+ or
+ (flowToCompound(parent, label, other) and element = parent and kind = 1)
+ or
+ (pointerFromCompound(parent, label, other) and element = parent and kind = 2)
+ or
+ (pointerToCompound(parent, label, other) and element = parent and kind = 3)
+ or
+ (resolve(parent, element, other) and label = "" and kind = 5)
+ or
+ (virtualRet(parent, element, label, other) and kind = 8)
+ or
+ (virtualArg(parent, element, label, other) and kind = 9)
+ or
+ (virtualThis(parent, element, label, other) and kind = 9)
+}
+
+/**
+ * A summary of the points-to information for the program, computed by
+ * collapsing the various flow and pointer relations using the Java
+ * class PointsToCalculator. This relation combines several kinds of information;
+ * the different kinds are filtered out by several relations further
+ * in the file: pointstosets, setflow, children, childrenByElement,
+ * parentSetFor.
+ *
+ * The information represented by each tuple in the relation depends on
+ * the "label" element.
+ *
+ * If the label is the empty string, then the tuple describes membership of
+ * element "elem" in points-to set "ptset", and that children of the element
+ * are children of set "parent".
+ *
+ * If the label is "--flow--", then the tuple describes flow from the "parent"
+ * points-to set to the "ptset" points-to set.
+ *
+ * If the label is "--element--", then the tuple declares that the set "ptset" is
+ * a child of "parent", where the label of the child is "elem".
+ *
+ * In any other case, the tuple declares that set "ptset" is a child of
+ * "parent", where the label is "label".
+ */
+cached
+predicate pointstoinfo(int parent, @element elem, string label, int ptset) =
+ collapse(flow/2, pointer/2, compoundEdge/5, location/1)(parent, elem, label, ptset)
+
+/**
+ * Which elements are in which points-to sets.
+ */
+cached
+predicate pointstosets(int ptset, @element elem)
+{
+ pointstoinfo(_, elem, "", ptset)
+}
+
+/**
+ * The points-to set src flows to the points-to set dest.
+ * This relation is not transitively closed.
+ */
+predicate setflow(int src, int dest)
+{
+ pointstoinfo(src, _, "--flow--", dest)
+}
+
+/**
+ * The points-to set parentset, when dereferenced using the
+ * given label, gives values in the points-to set childset.
+ */
+predicate children(int parentset, string label, int childset)
+{
+ pointstoinfo(parentset, _, label, childset)
+ and label != "" and label != "--element--" and label != "--flow--"
+}
+
+/**
+ * The same as children(), except that the label is an element.
+ */
+predicate childrenByElement(int parentset, Element label, int childset)
+{
+ pointstoinfo(parentset, label, "--element--", childset)
+}
+
+/**
+ * The ID of the parent set for the given expression. Children
+ * of the given element should be looked up with children() and
+ * childrenByElement() using this ID.
+ */
+pragma[noopt]
+predicate parentSetFor(int cset, @element expr)
+{
+ exists(string s | s = "" and pointstoinfo(cset, expr, s, _))
+}
+
+/**
+ * Things that are elements of points-to sets.
+ */
+predicate location(Element location)
+{
+ location instanceof Variable or
+ location instanceof Function or
+ isAllocationExpr(location) or
+ fopenCall(location) or
+ allocateDescriptorCall(location)
+}
+
+/**
+ * A call to the Unix system function socket(2).
+ */
+predicate allocateDescriptorCall(FunctionCall fc)
+{
+ exists(string name |
+ name = "socket" and
+ fc.getTarget().hasQualifiedName(name))
+}
+
+/**
+ * A points-to set that contains at least one interesting element, or
+ * flows to one that does.
+ */
+private int interestingSet()
+{
+ exists(PointsToExpr e |
+ e.interesting() and
+ pointstosets(result, e)
+ ) or (
+ setflow(result, interestingSet())
+ )
+}
+
+/**
+ * The elements that are either in the given points-to set, or
+ * which flow into it from another set. The results are restricted
+ * to sets which are interesting.
+ */
+cached
+predicate setlocations(int set, @element location)
+{
+ set = interestingSet() and
+ (
+ (
+ location(location) and pointstosets(set, location)
+ ) or
+ exists(int middle | setlocations(middle, location) and setflow(middle, set))
+ )
+}
+
+class PointsToExpr extends Expr
+{
+ /*
+ * This predicate is empty by default. It should be overridden and defined to
+ * include just those expressions for which points-to information is desired.
+ */
+ predicate interesting() { none() }
+
+ pragma[noopt]
+ Element pointsTo()
+ {
+ this.interesting() and exists(int set | pointstosets(set, this) and setlocations(set, result))
+ }
+
+ float confidence() { result = 1.0 / count(this.pointsTo()) }
+}
+
+/**
+ * Holds if anything points to an element, that is, is equivalent to:
+ * ```
+ * exists(PointsToExpr e | e.pointsTo() = elem)
+ * ```
+ */
+predicate anythingPointsTo(Element elem)
+{
+ location(elem) and pointstosets(interestingSet(), elem)
+}
+
diff --git a/cpp/ql/src/semmle/code/cpp/rangeanalysis/PointlessComparison.qll b/cpp/ql/src/semmle/code/cpp/rangeanalysis/PointlessComparison.qll
new file mode 100644
index 000000000000..f927beb86895
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/rangeanalysis/PointlessComparison.qll
@@ -0,0 +1,166 @@
+/**
+ * Provides utility predicates used by the pointless comparison queries.
+ */
+import cpp
+import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
+
+/** Gets the lower bound of the fully converted expression. */
+private float lowerBoundFC(Expr expr) {
+ result = lowerBound(expr.getFullyConverted())
+}
+
+/** Gets the upper bound of the fully converted expression. */
+private float upperBoundFC(Expr expr) {
+ result = upperBound(expr.getFullyConverted())
+}
+
+newtype SmallSide = LeftIsSmaller() or RightIsSmaller()
+
+/**
+ * Holds if `cmp` is a comparison operation in which the left hand
+ * argument (which is at most `left`) is always strictly less than the
+ * right hand argument (which is at least `right`), and `ss` is
+ * `LeftIsSmaller`.
+ *
+ * Note that the comparison operation could be any binary comparison
+ * operator, for example,`==`, `>`, or `<=`.
+ */
+private
+predicate alwaysLT(ComparisonOperation cmp, float left, float right, SmallSide ss) {
+ ss = LeftIsSmaller() and
+ left = upperBoundFC(cmp.getLeftOperand()) and
+ right = lowerBoundFC(cmp.getRightOperand()) and
+ left < right
+}
+
+/**
+ * Holds if `cmp` is a comparison operation in which the left hand
+ * argument (which is at most `left`) is always less than or equal to
+ * the right hand argument (which is at least `right`), and `ss` is
+ * `LeftIsSmaller`.
+ *
+ * Note that the comparison operation could be any binary comparison
+ * operator, for example,`==`, `>`, or `<=`.
+ */
+private
+predicate alwaysLE(ComparisonOperation cmp, float left, float right, SmallSide ss) {
+ ss = LeftIsSmaller() and
+ left = upperBoundFC(cmp.getLeftOperand()) and
+ right = lowerBoundFC(cmp.getRightOperand()) and
+ left <= right and
+
+ // Range analysis is not able to precisely represent large 64 bit numbers,
+ // because it stores the range as a `float`, which only has a 53 bit mantissa.
+ // For example, the number `2^64-1` is rounded to `2^64`. This means that we
+ // cannot trust the result if the numbers are large. Note: there is only
+ // a risk of a rounding error causing an incorrect result if `left == right`.
+ // If `left` is strictly less than `right` then there is enough of a gap
+ // that we don't need to worry about rounding errors.
+ left.ulp() <= 1
+}
+
+/**
+ * Holds if `cmp` is a comparison operation in which the left hand
+ * argument (which is at least `left`) is always strictly greater than
+ * the right hand argument (which is at most `right`), and `ss` is
+ * `RightIsSmaller`.
+ *
+ * Note that the comparison operation could be any binary comparison
+ * operator, for example,`==`, `>`, or `<=`.
+ */
+private
+predicate alwaysGT(ComparisonOperation cmp, float left, float right, SmallSide ss) {
+ ss = RightIsSmaller() and
+ left = lowerBoundFC(cmp.getLeftOperand()) and
+ right = upperBoundFC(cmp.getRightOperand()) and
+ left > right
+}
+
+/**
+ * Holds if `cmp` is a comparison operation in which the left hand
+ * argument (which is at least `left`) is always greater than or equal
+ * to the right hand argument (which is at most `right`), and `ss` is
+ * `RightIsSmaller`.
+ *
+ * Note that the comparison operation could be any binary comparison
+ * operator, for example,`==`, `>`, or `<=`.
+ */
+private
+predicate alwaysGE(ComparisonOperation cmp, float left, float right, SmallSide ss) {
+ ss = RightIsSmaller() and
+ left = lowerBoundFC(cmp.getLeftOperand()) and
+ right = upperBoundFC(cmp.getRightOperand()) and
+ left >= right and
+
+ // Range analysis is not able to precisely represent large 64 bit numbers,
+ // because it stores the range as a `float`, which only has a 53 bit mantissa.
+ // For example, the number 2^64-1 is rounded to 2^64. This means that we
+ // cannot trust the result if the numbers are large. Note: there is only
+ // a risk of a rounding error causing an incorrect result if `left == right`.
+ // If `left` is strictly less than `right` then there is enough of a gap
+ // that we don't need to worry about rounding errors.
+ left.ulp() <= 1
+}
+
+/**
+ * Holds if `cmp` is a comparison operation that always has the
+ * result `value`, and either
+ * * `ss` is `LeftIsSmaller`, and the left hand argument is always at
+ * most `left`, the right hand argument at least `right`, and `left`
+ * is less than or equal to `right`; or
+ * * `ss` is `RightIsSmaller`, and the left hand argument is always at
+ * least `left`, the right hand argument at most `right`, and `left`
+ * is greater than or equal to `right`.
+ *
+ * For example, if the comparison `x < y` is always true because
+ * `x <= 3` and `5 <= y` then
+ * `pointlessComparison(x < y, 3, 5, true, LeftIsSmaller)` holds.
+ *
+ * Similarly, if the comparison `x < y` is always false because `x >= 9`
+ * and `7 >= y` then
+ * `pointlessComparison(x < y, 9, 7, false, RightIsSmaller)` holds.
+ */
+predicate pointlessComparison(ComparisonOperation cmp,
+ float left, float right,
+ boolean value, SmallSide ss) {
+ (alwaysLT(cmp.(LTExpr), left, right, ss) and value = true) or
+ (alwaysLE(cmp.(LEExpr), left, right, ss) and value = true) or
+ (alwaysGT(cmp.(GTExpr), left, right, ss) and value = true) or
+ (alwaysGE(cmp.(GEExpr), left, right, ss) and value = true) or
+ (alwaysLT(cmp.(NEExpr), left, right, ss) and value = true) or
+ (alwaysGT(cmp.(NEExpr), left, right, ss) and value = true) or
+ (alwaysGE(cmp.(LTExpr), left, right, ss) and value = false) or
+ (alwaysGT(cmp.(LEExpr), left, right, ss) and value = false) or
+ (alwaysLE(cmp.(GTExpr), left, right, ss) and value = false) or
+ (alwaysLT(cmp.(GEExpr), left, right, ss) and value = false) or
+ (alwaysLT(cmp.(EQExpr), left, right, ss) and value = false) or
+ (alwaysGT(cmp.(EQExpr), left, right, ss) and value = false)
+}
+
+/**
+ * Holds if `cmp` is a pointless comparison (see `pointlessComparison`
+ * above) and `cmp` occurs in reachable code. The reason for excluding
+ * expressions that occur in unreachable code is that range analysis
+ * sometimes can deduce impossible ranges for them. For example:
+ *
+ * if (10 < x) {
+ * if (x < 5) {
+ * // Unreachable code
+ * return x; // x has an empty range: 10 < x && x < 5
+ * }
+ * }
+
+ */
+predicate reachablePointlessComparison(ComparisonOperation cmp,
+ float left, float right,
+ boolean value, SmallSide ss) {
+ pointlessComparison(cmp, left, right, value, ss)
+
+ // Reachable according to control flow analysis.
+ and
+ reachable(cmp)
+
+ // Reachable according to range analysis.
+ and
+ not (exprWithEmptyRange(cmp.getAChild+()))
+}
diff --git a/cpp/ql/src/semmle/code/cpp/rangeanalysis/RangeAnalysisUtils.qll b/cpp/ql/src/semmle/code/cpp/rangeanalysis/RangeAnalysisUtils.qll
new file mode 100644
index 000000000000..a850b20c1387
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/rangeanalysis/RangeAnalysisUtils.qll
@@ -0,0 +1,363 @@
+import cpp
+
+/**
+ * Describes whether a relation is 'strict' (that is, a `<` or `>`
+ * relation) or 'non-strict' (a `<=` or `>=` relation).
+ */
+newtype RelationStrictness = Strict() or Nonstrict()
+
+/**
+ * Describes whether a relation is 'greater' (that is, a `>` or `>=`
+ * relation) or 'lesser' (a `<` or `<=` relation).
+ */
+newtype RelationDirection = Greater() or Lesser()
+
+private
+RelationStrictness negateStrictness(RelationStrictness strict) {
+ (strict = Strict() and result = Nonstrict()) or
+ (strict = Nonstrict() and result = Strict())
+}
+
+private
+RelationDirection negateDirection(RelationDirection dir) {
+ (dir = Greater() and result = Lesser()) or
+ (dir = Lesser() and result = Greater())
+}
+
+boolean directionIsGreater(RelationDirection dir) {
+ (dir = Greater() and result = true) or
+ (dir = Lesser() and result = false)
+}
+
+boolean directionIsLesser(RelationDirection dir) {
+ (dir = Greater() and result = false) or
+ (dir = Lesser() and result = true)
+}
+
+/**
+ * Holds if `rel` is a relational operation (`<`, `>`, `<=` or `>=`)
+ * with left operand `lhs` and right operand `rhs`, described by
+ * `dir` and `strict`.
+ *
+ * For example, if `rel` is `x < 5` then
+ * `relOp(rel, x, 5, Lesser(), Strict())` holds.
+ */
+private
+predicate relOp(
+ RelationalOperation rel, Expr lhs, Expr rhs,
+ RelationDirection dir, RelationStrictness strict
+) {
+ lhs = rel.getLeftOperand() and
+ rhs = rel.getRightOperand() and
+ ((rel instanceof LTExpr and dir = Lesser() and strict = Strict()) or
+ (rel instanceof LEExpr and dir = Lesser() and strict = Nonstrict()) or
+ (rel instanceof GTExpr and dir = Greater() and strict = Strict()) or
+ (rel instanceof GEExpr and dir = Greater() and strict = Nonstrict()))
+}
+
+/**
+ * Holds if `rel` is a relational operation (`<`, `>`, `<=` or `>=`)
+ * with children `a` and `b`, described by `dir` and `strict`.
+ *
+ * This allows for the relation to be either as written, or with its
+ * arguments reversed; for example, if `rel` is `x < 5` then both
+ * `relOpWithSwap(rel, x, 5, Lesser(), Strict())` and
+ * `relOpWithSwap(rel, 5, x, Greater(), Strict())` hold.
+ */
+predicate relOpWithSwap(
+ RelationalOperation rel, Expr a, Expr b,
+ RelationDirection dir, RelationStrictness strict
+) {
+ relOp(rel, a, b, dir, strict) or
+ relOp(rel, b, a, negateDirection(dir), strict)
+}
+
+/**
+ * Holds if `rel` is a comparison operation (`<`, `>`, `<=` or `>=`)
+ * with children `a` and `b`, described by `dir` and `strict`, with
+ * result `branch`.
+ *
+ * This allows for the relation to be either as written, or with its
+ * arguments reversed; for example, if `rel` is `x < 5` then
+ * `relOpWithSwapAndNegate(rel, x, 5, Lesser(), Strict(), true)`,
+ * `relOpWithSwapAndNegate(rel, 5, x, Greater(), Strict(), true)`,
+ * `relOpWithSwapAndNegate(rel, x, 5, Greater(), Nonstrict(), false)` and
+ * `relOpWithSwapAndNegate(rel, 5, x, Lesser(), Nonstrict(), false)` hold.
+ */
+predicate relOpWithSwapAndNegate(
+ RelationalOperation rel, Expr a, Expr b,
+ RelationDirection dir, RelationStrictness strict, boolean branch
+) {
+ (relOpWithSwap(rel, a, b, dir, strict) and branch = true)
+ or
+ (relOpWithSwap(rel, a, b, negateDirection(dir), negateStrictness(strict)) and
+ branch = false)
+}
+
+/**
+ * Holds if `cmp` is an equality operation (`==` or `!=`) with left
+ * operand `lhs`, right operand `rhs`, and `isEQ` is true if `cmp` is an
+ * `==` operation and false if it is an `!=` operation.
+ *
+ * For example, if `rel` is `x == 5` then
+ * `eqOpWithSwap(cmp, x, 5, true)` holds.
+ */
+private
+predicate eqOp(EqualityOperation cmp, Expr lhs, Expr rhs, boolean isEQ) {
+ lhs = cmp.getLeftOperand() and
+ rhs = cmp.getRightOperand() and
+ ((cmp instanceof EQExpr and isEQ = true) or
+ (cmp instanceof NEExpr and isEQ = false))
+}
+
+/**
+ * Holds if `cmp` is an equality operation (`==` or `!=`) with operands
+ * `a` and `b`, and `isEQ` is true if `cmp` is an `==` operation and
+ * false if it is an `!=` operation.
+ *
+ * This allows for the equality to be either as written, or with its
+ * arguments reversed; for example, if `cmp` is `x == 5` then both
+ * `eqOpWithSwap(cmp, x, 5, true)` and
+ * `eqOpWithSwap(cmp, 5, x, true)` hold.
+ */
+private
+predicate eqOpWithSwap(EqualityOperation cmp, Expr a, Expr b, boolean isEQ) {
+ eqOp(cmp, a, b, isEQ) or
+ eqOp(cmp, b, a, isEQ)
+}
+
+/**
+ * Holds if `cmp` is an equality operation (`==` or `!=`) with operands
+ * `a` and `b`, `isEQ` is true if `cmp` is an `==` operation and
+ * false if it is an `!=` operation, and the result is `branch`.
+ *
+ * This allows for the comparison to be either as written, or with its
+ * arguments reversed; for example, if `cmp` is `x == 5` then
+ * `eqOpWithSwapAndNegate(cmp, x, 5, true, true)`,
+ * `eqOpWithSwapAndNegate(cmp, 5, x, true, true)`,
+ * `eqOpWithSwapAndNegate(cmp, x, 5, false, false)` and
+ * `eqOpWithSwapAndNegate(cmp, 5, x, false, false)` hold.
+ */
+predicate eqOpWithSwapAndNegate(
+ EqualityOperation cmp, Expr a, Expr b, boolean isEQ, boolean branch
+) {
+ (eqOpWithSwap(cmp, a, b, branch) and isEQ = true) or
+ (eqOpWithSwap(cmp, a, b, branch.booleanNot()) and isEQ = false)
+}
+
+/**
+ * Holds if `expr` is equivalent to `p*v + q`, where `p` is a non-zero
+ * number. This takes into account the associativity, commutativity and
+ * distributivity of arithmetic operations.
+ */
+predicate linearAccess(Expr expr, VariableAccess v, float p, float q) {
+ // Exclude 0 and NaN.
+ (p < 0 or p > 0) and
+ linearAccessImpl(expr, v, p, q)
+}
+
+/**
+ * Holds if `expr` is equivalent to `p*v + q`.
+ * This takes into account the associativity, commutativity and
+ * distributivity of arithmetic operations.
+ */
+private
+predicate linearAccessImpl(Expr expr, VariableAccess v, float p, float q) {
+ // Base case
+ (expr = v and p = 1.0 and q = 0.0)
+ or
+ // a+(p*v+b) == p*v + (a+b)
+ exists (AddExpr addExpr, float a, float b
+ | addExpr.getLeftOperand().isConstant() and
+ a = addExpr.getLeftOperand().getFullyConverted().getValue().toFloat() and
+ linearAccess(addExpr.getRightOperand(), v, p, b) and
+ expr = addExpr and
+ q = a+b)
+ or
+ // (p*v+a)+b == p*v + (a+b)
+ exists (AddExpr addExpr, float a, float b
+ | addExpr.getRightOperand().isConstant() and
+ b = addExpr.getRightOperand().getFullyConverted().getValue().toFloat() and
+ linearAccess(addExpr.getLeftOperand(), v, p, a) and
+ expr = addExpr and
+ q = a+b)
+ or
+ // a-(m*v+b) == -m*v + (a-b)
+ exists (SubExpr subExpr, float a, float b, float m
+ | subExpr.getLeftOperand().isConstant() and
+ a = subExpr.getLeftOperand().getFullyConverted().getValue().toFloat() and
+ linearAccess(subExpr.getRightOperand(), v, m, b) and
+ expr = subExpr and
+ p = -m and
+ q = a-b)
+ or
+ // (p*v+a)-b == p*v + (a-b)
+ exists (SubExpr subExpr, float a, float b
+ | subExpr.getRightOperand().isConstant() and
+ b = subExpr.getRightOperand().getFullyConverted().getValue().toFloat() and
+ linearAccess(subExpr.getLeftOperand(), v, p, a) and
+ expr = subExpr and
+ q = a-b)
+ or
+ // +(p*v+q) == p*v + q
+ exists (UnaryPlusExpr unaryPlusExpr
+ | linearAccess(unaryPlusExpr.getOperand(), v, p, q) and
+ expr = unaryPlusExpr)
+ or
+ // -(a*v+b) == -a*v + (-b)
+ exists (UnaryMinusExpr unaryMinusExpr, float a, float b
+ | linearAccess(unaryMinusExpr.getOperand(), v, a, b) and
+ expr = unaryMinusExpr and
+ p = -a and
+ q = -b)
+ or
+ // m*(a*v+b) == (m*a)*v + (m*b)
+ exists (MulExpr mulExpr, float a, float b, float m
+ | mulExpr.getLeftOperand().isConstant() and
+ m = mulExpr.getLeftOperand().getFullyConverted().getValue().toFloat() and
+ linearAccess(mulExpr.getRightOperand(), v, a, b) and
+ expr = mulExpr and
+ p = m*a and
+ q = m*b)
+ or
+ // (a*v+b)*m == (m*a)*v + (m*b)
+ exists (MulExpr mulExpr, float a, float b, float m
+ | mulExpr.getRightOperand().isConstant() and
+ m = mulExpr.getRightOperand().getFullyConverted().getValue().toFloat() and
+ linearAccess(mulExpr.getLeftOperand(), v, a, b) and
+ expr = mulExpr and
+ p = m*a and
+ q = m*b)
+}
+
+
+/**
+ * Holds if `guard` is a comparison operation (`<`, `<=`, `>`, `>=`,
+ * `==` or `!=`), one of its arguments is equivalent (up to
+ * associativity, commutativity and distributivity or the simple
+ * arithmetic operations) to `p*v + q` (for some `p` and `q`),
+ * `direction` describes whether `guard` give an upper or lower bound
+ * on `v`, and `branch` indicates which control-flow branch this
+ * bound is valid on.
+ *
+ * For example, if `guard` is `2*v + 3 > 10` then
+ * `cmpWithLinearBound(guard, v, Greater(), true)` and
+ * `cmpWithLinearBound(guard, v, Lesser(), false)` hold.
+ * If `guard` is `4 - v > 5` then
+ * `cmpWithLinearBound(guard, v, Lesser(), false)` and
+ * `cmpWithLinearBound(guard, v, Greater(), true)` hold.
+ *
+ * A more sophisticated predicate, such as `boundFromGuard`, is needed
+ * to compute an actual bound for `v`. This predicate can be used if
+ * you just want to check whether a variable is bounded, or to restrict
+ * a more expensive analysis to just guards that bound a variable.
+ */
+predicate cmpWithLinearBound(
+ ComparisonOperation guard, VariableAccess v,
+ RelationDirection direction, // Is this a lower or an upper bound?
+ boolean branch // Which control-flow branch is this bound valid on?
+) {
+ exists (Expr lhs, float p, RelationDirection dir
+ | linearAccess(lhs, v, p, _) and
+ relOpWithSwapAndNegate(guard, lhs, _, dir, _, branch) and
+ ((p > 0 and direction = dir) or
+ (p < 0 and direction = negateDirection(dir))))
+
+ or
+ exists (Expr lhs
+ | linearAccess(lhs, v, _, _) and
+ eqOpWithSwap(guard, lhs, _, branch))
+}
+
+/**
+ * Holds if `lb` and `ub` are the lower and upper bounds of type `t`
+ * respectively.
+ *
+ * For example, if `t` is a signed 32-bit type then holds if `lb` is
+ * `-2^31` and `ub` is `2^31 - 1`.
+ */
+private
+predicate typeBounds(Type t, float lb, float ub) {
+ exists (IntegralType integralType, float limit
+ | integralType = t and limit = 2.pow(8 * integralType.getSize())
+ | if integralType instanceof BoolType
+ then (lb = 0 and ub = 1)
+ else if integralType.isSigned()
+ then (lb = -(limit/2) and ub = (limit/2)-1)
+ else (lb = 0 and ub = limit-1))
+ or
+ // This covers all floating point types. The range is (-Inf, +Inf).
+ (t instanceof FloatingPointType and lb = -(1.0/0.0) and ub = 1.0/0.0)
+}
+
+/**
+ * Gets the lower bound for type `t`.
+ *
+ * For example, if `t` is a signed 32-bit type then the result is
+ * `-2^31`.
+ */
+float typeLowerBound(Type t) {
+ typeBounds(t, result, _)
+}
+
+/**
+ * Gets the upper bound for type `t`.
+ *
+ * For example, if `t` is a signed 32-bit type then the result is
+ * `2^31 - 1`.
+ */
+float typeUpperBound(Type t) {
+ typeBounds(t, _, result)
+}
+
+/**
+ * Gets the minimum value that this expression could represent, based on
+ * its type.
+ *
+ * For example, if `expr` has a signed 32-bit type then the result is
+ * `-2^31`.
+ *
+ * Note: Due to the way casts are represented, rather than calling
+ * `exprMinVal(expr)` you will normally want to call
+ * `exprMinVal(expr.getFullyConverted())`.
+ */
+float exprMinVal(Expr expr) {
+ result = typeLowerBound(expr.getType().getUnspecifiedType())
+}
+
+/**
+ * Gets the maximum value that this expression could represent, based on
+ * its type.
+ *
+ * For example, if `expr` has a signed 32-bit type then the result is
+ * `2^31 - 1`.
+ *
+ * Note: Due to the way casts are represented, rather than calling
+ * `exprMaxVal(expr)` you will normally want to call
+ * `exprMaxVal(expr.getFullyConverted())`.
+ */
+float exprMaxVal(Expr expr) {
+ result = typeUpperBound(expr.getType().getUnspecifiedType())
+}
+
+/**
+ * Gets the minimum value that this variable could represent, based on
+ * its type.
+ *
+ * For example, if `v` has a signed 32-bit type then the result is
+ * `-2^31`.
+ */
+float varMinVal(Variable v) {
+ result = typeLowerBound(v.getType().getUnspecifiedType())
+}
+
+/**
+ * Gets the maximum value that this variable could represent, based on
+ * its type.
+ *
+ * For example, if `v` has a signed 32-bit type then the result is
+ * `2^31 - 1`.
+ */
+float varMaxVal(Variable v) {
+ result = typeUpperBound(v.getType().getUnspecifiedType())
+}
diff --git a/cpp/ql/src/semmle/code/cpp/rangeanalysis/RangeSSA.qll b/cpp/ql/src/semmle/code/cpp/rangeanalysis/RangeSSA.qll
new file mode 100644
index 000000000000..fc39690d054c
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/rangeanalysis/RangeSSA.qll
@@ -0,0 +1,179 @@
+/**
+ * This library is a clone of semmle.code.cpp.controlflow.SSA, with
+ * only one difference: extra phi definitions are added after
+ * guards. For example:
+ *
+ * x = f();
+ * if (x < 10) {
+ * // Block 1
+ * ...
+ * } else {
+ * // Block 2
+ * ...
+ * }
+ *
+ * In standard SSA, basic blocks 1 and 2 do not need phi definitions
+ * for x, because they are dominated by the definition of x on the
+ * first line. In RangeSSA, however, we add phi definitions for x at
+ * the beginning of blocks 1 and 2. This is useful for range analysis
+ * because it enables us to deduce a more accurate range for x in the
+ * two branches of the if-statement.
+ */
+
+import cpp
+import semmle.code.cpp.controlflow.Dominance
+import semmle.code.cpp.controlflow.SSAUtils
+private import RangeAnalysisUtils
+
+library class RangeSSA extends SSAHelper {
+ RangeSSA() { this = 1 }
+
+ /**
+ * Add a phi node on the out-edge of a guard.
+ */
+ override predicate custom_phi_node(LocalScopeVariable v, BasicBlock b) { guard_defn(v.getAnAccess(),_,b,_) }
+}
+
+private predicate guard_defn(
+ VariableAccess v, ComparisonOperation guard, BasicBlock b, boolean branch
+) {
+ guardCondition(guard, v, branch)
+ and
+ guardSuccessor(guard, branch, b)
+}
+
+private predicate guardCondition(
+ ComparisonOperation guard, VariableAccess v, boolean branch
+) {
+ exists (Expr lhs
+ | linearAccess(lhs, v, _, _)
+ | relOpWithSwapAndNegate(guard, lhs, _, _, _, branch) or
+ eqOpWithSwapAndNegate(guard, lhs, _, _, branch))
+}
+
+private predicate guardSuccessor(ComparisonOperation guard, boolean branch, BasicBlock succ) {
+ (branch = true and succ = guard.getATrueSuccessor())
+ or
+ (branch = false and succ = guard.getAFalseSuccessor())
+}
+
+/**
+ * A definition of one or more SSA variables, including phi node
+ * definitions. An SSA variable is effectively the pair of a definition
+ * and the (non-SSA) variable that it defines. Note definitions and uses
+ * can be coincident, due to the presence of parameter definitions and phi
+ * nodes.
+ */
+class RangeSsaDefinition extends @cfgnode {
+
+ RangeSsaDefinition() {
+ exists(RangeSSA x | x.ssa_defn(_, (ControlFlowNode)this, _, _))
+ }
+
+ /**
+ * Gets a variable corresponding to a SSA LocalScopeVariable defined by
+ * this definition.
+ */
+ LocalScopeVariable getAVariable() {
+ exists(RangeSSA x | x.ssa_defn(result, (ControlFlowNode)this, _, _))
+ }
+
+ string toString() {
+ result = "SSA definition"
+ }
+
+ /**
+ * A string representation of the SSA variable represented by the pair
+ * (this, v).
+ */
+ string toString(LocalScopeVariable v) {
+ exists(RangeSSA x | result = x.toString((ControlFlowNode)this, v))
+ }
+
+ /** Gets a use of the SSA variable represented by the pair (this, v) */
+ VariableAccess getAUse(LocalScopeVariable v) {
+ exists(RangeSSA x | result = x.getAUse((ControlFlowNode)this, v))
+ }
+
+ /** Gets the control flow node for this definition */
+ ControlFlowNode getDefinition() {
+ result = this
+ }
+
+ BasicBlock getBasicBlock() {
+ result.contains(getDefinition())
+ }
+
+ /** Whether this definition is a phi node for variable v */
+ predicate isPhiNode(LocalScopeVariable v) {
+ exists(RangeSSA x | x.phi_node(v, (BasicBlock)this))
+ }
+
+ /**
+ * If this definition is a phi node corresponding to a guard,
+ * then return the variable and the guard.
+ */
+ predicate isGuardPhi(VariableAccess v, ComparisonOperation guard, boolean branch) {
+ guard_defn(v, guard, this, branch)
+ }
+
+ Location getLocation() {
+ result = this.(ControlFlowNode).getLocation()
+ }
+
+ /** Whether this definition is from a parameter */
+ predicate definedByParameter(Parameter p) {
+ this = p.getFunction().getEntryPoint()
+ }
+
+ RangeSsaDefinition getAPhiInput(LocalScopeVariable v) {
+ this.isPhiNode(v)
+ and
+ exists (BasicBlock pred
+ | pred = this.(BasicBlock).getAPredecessor() and
+ result.reachesEndOfBB(v, pred) and
+
+ // Suppose we have a CFG like this:
+ //
+ // 1: x_0 = ;
+ // 2: if () {
+ // 3: if (x_0 > 1) {
+ // 4: x_1 = phi(x_0);
+ // 5: }
+ // 6: }
+ // 7: x_2 = phi(x_0, x_1);
+ //
+ // The phi nodes on lines 4 and 7 are both guard phi nodes,
+ // because they have an incoming edge from the condition on
+ // line 3. Definition x_0 on line 1 should be considered a
+ // phi-input on line 7, but not on line 4. This is because
+ // the only CFG path from line 1 to line 4 goes through the
+ // condition on line 3, but there is a path from line 1 to
+ // line 7 which does not go through the condition. The logic
+ // below excludes definitions which can only reach guard phi
+ // nodes by going through the corresponding guard.
+ not exists (VariableAccess access
+ | v = access.getTarget() and
+ pred.contains(access) and
+ this.isGuardPhi(access, _, _)))
+ }
+
+ /** Gets the expression assigned to this SsaDefinition */
+ Expr getDefiningValue(LocalScopeVariable v) {
+ exists(ControlFlowNode def | def = this.getDefinition() |
+ def = v.getInitializer().getExpr() and def = result
+ or
+ exists(AssignExpr assign | def = assign and
+ assign.getLValue() = v.getAnAccess() and result = assign.getRValue()
+ )
+ or
+ exists(AssignOperation assign | def = assign and
+ assign.getLValue() = v.getAnAccess() and result = assign
+ )
+ )
+ }
+
+ predicate reachesEndOfBB(LocalScopeVariable v, BasicBlock b) {
+ exists(RangeSSA x | x.ssaDefinitionReachesEndOfBB(v, (ControlFlowNode)this, b))
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll b/cpp/ql/src/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll
new file mode 100644
index 000000000000..f1312ad8b996
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll
@@ -0,0 +1,1195 @@
+/**
+ * Simple range analysis library. Range analysis is usually done as an
+ * abstract interpretation over the lattice of range values. (A range is a
+ * pair, containing a lower and upper bound for the value.) The problem
+ * with this approach is that the lattice is very tall, which means it can
+ * take an extremely large number of iterations to find the least fixed
+ * point. This example illustrates the problem:
+ *
+ * int count = 0;
+ * for (; p; p = p->next) {
+ * count = count+1;
+ * }
+ *
+ * The range of 'count' is initially (0,0), then (0,1) on the second
+ * iteration, (0,2) on the third iteration, and so on until we eventually
+ * reach maxInt.
+ *
+ * This library uses a crude solution to the problem described above: if
+ * the upper (or lower) bound of an expression might depend recursively on
+ * itself then we round it up (down for lower bounds) to one of a fixed set
+ * of values, such as 0, 1, 2, 256, and +Inf. This limits the height of the
+ * lattice which ensures that the analysis will terminate in a reasonable
+ * amount of time. This solution is similar to the abstract interpretation
+ * technique known as 'widening', but it is less precise because we are
+ * unable to inspect the bounds from the previous iteration of the fixed
+ * point computation. For example, widening might be able to deduce that
+ * the lower bound is -11 but we would approximate it to -16.
+ *
+ * QL does not allow us to compute an aggregate over a recursive
+ * sub-expression, so we cannot compute the minimum lower bound and maximum
+ * upper bound during the recursive phase of the query. Instead, the
+ * recursive phase computes a set of lower bounds and a set of upper bounds
+ * for each expression. We compute the minimum lower bound and maximum
+ * upper bound after the recursion is finished. This is another reason why
+ * we need to limit the number of bounds per expression, because they will
+ * all be stored until the recursive phase is finished.
+ *
+ * The ranges are represented using a pair of floating point numbers. This
+ * is simpler than using integers because floating point numbers cannot
+ * overflow and wrap. It is also convenient because we can detect overflow
+ * and negative overflow by looking for bounds that are outside the range
+ * of the type.
+ */
+import cpp
+private import RangeAnalysisUtils
+import RangeSSA
+
+/**
+ * This fixed set of lower bounds is used when the lower bounds of an
+ * expression are recursively defined. The inferred lower bound is rounded
+ * down to the nearest lower bound in the fixed set. This restricts the
+ * height of the lattice, which prevents the analysis from exploding.
+ *
+ * Note: these bounds were chosen fairly arbitrarily. Feel free to add more
+ * bounds to the set if it helps on specific examples and does not make
+ * performance dramatically worse on large codebases, such as libreoffice.
+ */
+private
+float wideningLowerBounds(ArithmeticType t) {
+ result = 2.0 or
+ result = 1.0 or
+ result = 0.0 or
+ result = -1.0 or
+ result = -2.0 or
+ result = -8.0 or
+ result = -16.0 or
+ result = -128.0 or
+ result = -256.0 or
+ result = -32768.0 or
+ result = -65536.0 or
+ result = typeLowerBound(t) or
+ result = -(1.0/0.0) // -Inf
+}
+
+/** See comment for `wideningLowerBounds`, above. */
+private
+float wideningUpperBounds(ArithmeticType t) {
+ result = -2.0 or
+ result = -1.0 or
+ result = 0.0 or
+ result = 1.0 or
+ result = 2.0 or
+ result = 7.0 or
+ result = 15.0 or
+ result = 127.0 or
+ result = 255.0 or
+ result = 32767.0 or
+ result = 65535.0 or
+ result = typeUpperBound(t) or
+ result = 1.0/0.0 // +Inf
+}
+
+/** Set of expressions which we know how to analyze. */
+private
+predicate analyzableExpr(Expr e) {
+ // The type of the expression must be arithmetic. We reuse the logic in
+ // `exprMinVal` to check this.
+ exists (exprMinVal(e)) and
+ ((exists (e.getValue().toFloat())) or
+ (e instanceof UnaryPlusExpr) or
+ (e instanceof UnaryMinusExpr) or
+ (e instanceof MinExpr) or
+ (e instanceof MaxExpr) or
+ (e instanceof ConditionalExpr) or
+ (e instanceof AddExpr) or
+ (e instanceof SubExpr) or
+ (e instanceof CrementOperation) or
+ (e instanceof RemExpr) or
+ (e instanceof CommaExpr) or
+ (e instanceof StmtExpr) or
+
+ // A conversion is analyzable, provided that its child has an arithmetic
+ // type. (Sometimes the child is a reference type, and so does not get
+ // any bounds.) Rather than checking whether the type of the child is
+ // arithmetic, we reuse the logic that is already encoded in
+ // `exprMinVal`.
+ exists(exprMinVal(e.(Conversion).getExpr())) or
+
+ // Also allow variable accesses, provided that they have SSA
+ // information.
+ exists (RangeSsaDefinition def, LocalScopeVariable v | e = def.getAUse(v)))
+}
+
+/**
+ * Set of definitions that this definition depends on. The transitive
+ * closure of this relation is used to detect definitions which are
+ * recursively defined, so that we can prevent the analysis from exploding.
+ *
+ * The structure of `defDependsOnDef` and its helper predicates matches the
+ * structure of `getDefLowerBoundsImpl` and
+ * `getDefUpperBoundsImpl`. Therefore, if changes are made to the structure
+ * of the main analysis algorithm then matching changes need to be made
+ * here.
+ */
+private
+predicate defDependsOnDef(
+ RangeSsaDefinition def, LocalScopeVariable v,
+ RangeSsaDefinition srcDef, LocalScopeVariable srcVar
+) {
+ // Definitions with a defining value.
+ exists (Expr expr
+ | assignmentDef(def, v, expr)
+ | exprDependsOnDef(expr, srcDef, srcVar))
+ or
+ exists (
+ AssignAddExpr assignAdd, RangeSsaDefinition nextDef
+ | def = assignAdd and
+ assignAdd.getLValue() = nextDef.getAUse(v)
+ | defDependsOnDef(nextDef, v, srcDef, srcVar) or
+ exprDependsOnDef(assignAdd.getRValue(), srcDef, srcVar))
+ or
+ exists (
+ AssignSubExpr assignSub, RangeSsaDefinition nextDef
+ | def = assignSub and
+ assignSub.getLValue() = nextDef.getAUse(v)
+ | defDependsOnDef(nextDef, v, srcDef, srcVar) or
+ exprDependsOnDef(assignSub.getRValue(), srcDef, srcVar))
+ or
+ exists (CrementOperation crem
+ | def = crem and
+ crem.getOperand() = v.getAnAccess() and
+ exprDependsOnDef(crem.getOperand(), srcDef, srcVar))
+ or
+ // Phi nodes.
+ phiDependsOnDef(def, v, srcDef, srcVar)
+}
+
+/**
+ * Helper predicate for `defDependsOnDef`. This predicate matches
+ * the structure of `getLowerBoundsImpl` and `getUpperBoundsImpl`.
+ */
+private
+predicate exprDependsOnDef(
+ Expr e, RangeSsaDefinition srcDef, LocalScopeVariable srcVar
+) {
+ exists (UnaryMinusExpr negateExpr
+ | e = negateExpr
+ | exprDependsOnDef(negateExpr.getOperand(), srcDef, srcVar))
+ or
+ exists (UnaryPlusExpr plusExpr
+ | e = plusExpr
+ | exprDependsOnDef(plusExpr.getOperand(), srcDef, srcVar))
+ or
+ exists (MinExpr minExpr
+ | e = minExpr
+ | exprDependsOnDef(minExpr.getAnOperand(), srcDef, srcVar))
+ or
+ exists (MaxExpr maxExpr
+ | e = maxExpr
+ | exprDependsOnDef(maxExpr.getAnOperand(), srcDef, srcVar))
+ or
+ exists (ConditionalExpr condExpr
+ | e = condExpr
+ | exprDependsOnDef(condExpr.getAnOperand(), srcDef, srcVar))
+ or
+ exists (AddExpr addExpr
+ | e = addExpr
+ | exprDependsOnDef(addExpr.getAnOperand(), srcDef, srcVar))
+ or
+ exists (SubExpr subExpr
+ | e = subExpr
+ | exprDependsOnDef(subExpr.getAnOperand(), srcDef, srcVar))
+ or
+ exists (CrementOperation crementExpr
+ | e = crementExpr
+ | exprDependsOnDef(crementExpr.getOperand(), srcDef, srcVar))
+ or
+ exists (RemExpr remExpr
+ | e = remExpr
+ | exprDependsOnDef(remExpr.getAnOperand(), srcDef, srcVar))
+ or
+ exists (CommaExpr commaExpr
+ | e = commaExpr
+ | exprDependsOnDef(commaExpr.getRightOperand(), srcDef, srcVar))
+ or
+ exists (StmtExpr stmtExpr
+ | e = stmtExpr
+ | exprDependsOnDef(stmtExpr.getResultExpr(), srcDef, srcVar))
+ or
+ exists (Conversion convExpr
+ | e = convExpr
+ | exprDependsOnDef(convExpr.getExpr(), srcDef, srcVar))
+ or
+ e = srcDef.getAUse(srcVar)
+}
+
+/**
+ * Helper predicate for `defDependsOnDef`. This predicate matches
+ * the structure of `getPhiLowerBounds` and `getPhiUpperBounds`.
+ */
+private
+predicate phiDependsOnDef(
+ RangeSsaDefinition phi, LocalScopeVariable v,
+ RangeSsaDefinition srcDef, LocalScopeVariable srcVar
+) {
+ exists (VariableAccess access, ComparisonOperation guard
+ | access = v.getAnAccess() and
+ phi.isGuardPhi(access, guard, _)
+ | exprDependsOnDef(guard.getAnOperand(), srcDef, srcVar) or
+ exprDependsOnDef(access, srcDef, srcVar))
+ or
+ (srcDef = phi.getAPhiInput(v) and srcVar = v)
+}
+
+/** The transitive closure of `defDependsOnDef`. */
+private
+predicate defDependsOnDefTransitively(
+ RangeSsaDefinition def, LocalScopeVariable v,
+ RangeSsaDefinition srcDef, LocalScopeVariable srcVar
+) {
+ defDependsOnDef(def, v, srcDef, srcVar) or
+ exists (RangeSsaDefinition midDef, LocalScopeVariable midVar
+ | defDependsOnDef(def, v, midDef, midVar)
+ | defDependsOnDefTransitively(midDef, midVar, srcDef, srcVar))
+}
+
+/** The set of definitions that depend recursively on themselves. */
+private
+predicate isRecursiveDef(RangeSsaDefinition def, LocalScopeVariable v) {
+ defDependsOnDefTransitively(def, v, def, v)
+}
+
+/**
+ * We distinguish 3 kinds of RangeSsaDefinition:
+ *
+ * 1. Definitions with a defining value.
+ * For example: x = y+3 is a definition of x with defining value y+3.
+ *
+ * 2. Phi nodes: x3 = phi(x0,x1,x2)
+ *
+ * 3. Unanalyzable definitions.
+ * For example: a parameter is unanalyzable because we know nothing
+ * about its value.
+ *
+ * This predicate finds all the definitions in the first set.
+ */
+private
+predicate assignmentDef(RangeSsaDefinition def, LocalScopeVariable v, Expr expr) {
+ v.getType().getUnspecifiedType() instanceof ArithmeticType
+ and
+ ((def = v.getInitializer().getExpr() and def = expr)
+ or
+ exists(AssignExpr assign
+ | def = assign and
+ assign.getLValue() = v.getAnAccess() and
+ expr = assign.getRValue()))
+}
+
+/** See comment above sourceDef. */
+private
+predicate analyzableDef(RangeSsaDefinition def, LocalScopeVariable v) {
+ assignmentDef(def, v, _) or defDependsOnDef(def, v, _, _)
+}
+
+/**
+ * Gets the truncated lower bounds of the fully converted expression.
+ */
+private
+float getFullyConvertedLowerBounds(Expr expr) {
+ result = getTruncatedLowerBounds(expr.getFullyConverted())
+}
+
+/**
+ * Gets the lower bounds of the expression.
+ *
+ * Most of the work of computing the lower bounds is done by
+ * `getLowerBoundsImpl`. However, the lower bounds computed by
+ * `getLowerBoundsImpl` may not be representable by the result type of the
+ * expression. For example, if `x` and `y` are of type `int32` and each
+ * have lower bound -2147483648, then getLowerBoundsImpl` will compute a
+ * lower bound -4294967296 for the expression `x+y`, even though
+ * -4294967296 cannot be represented as an `int32`. Such unrepresentable
+ * bounds are replaced with `exprMinVal(expr)`. This predicate also adds
+ * `exprMinVal(expr)` as a lower bound if the expression might overflow
+ * positively, or if it is unanalyzable.
+ *
+ * Note: most callers should use `getFullyConvertedLowerBounds` rather than
+ * this predicate.
+ */
+private
+float getTruncatedLowerBounds(Expr expr) {
+ if analyzableExpr(expr)
+ then // If the expression evaluates to a constant, then there is no
+ // need to call getLowerBoundsImpl.
+ if exists(expr.getValue().toFloat())
+ then result = expr.getValue().toFloat()
+ else (// Some of the bounds computed by getLowerBoundsImpl might
+ // overflow, so we replace invalid bounds with exprMinVal.
+ exists (float newLB
+ | newLB = getLowerBoundsImpl(expr)
+ | if exprMinVal(expr) <= newLB and newLB <= exprMaxVal(expr)
+ then result = newLB
+ else result = exprMinVal(expr))
+ or
+ // The expression might overflow and wrap. If so, the
+ // lower bound is exprMinVal.
+ (exprMightOverflowPositively(expr) and
+ result = exprMinVal(expr)))
+ else // The expression is not analyzable, so its lower bound is
+ // unknown. Note that the call to exprMinVal restricts the
+ // expressions to just those with arithmetic types. There is no
+ // need to return results for non-arithmetic expressions.
+ result = exprMinVal(expr)
+}
+
+/**
+ * Gets the truncated upper bounds of the fully converted expression.
+ */
+private
+float getFullyConvertedUpperBounds(Expr expr) {
+ result = getTruncatedUpperBounds(expr.getFullyConverted())
+}
+
+/**
+ * Gets the upper bounds of the expression.
+ *
+ * Most of the work of computing the upper bounds is done by
+ * `getUpperBoundsImpl`. However, the upper bounds computed by
+ * `getUpperBoundsImpl` may not be representable by the result type of the
+ * expression. For example, if `x` and `y` are of type `int32` and each
+ * have upper bound 2147483647, then getUpperBoundsImpl` will compute an
+ * upper bound 4294967294 for the expression `x+y`, even though 4294967294
+ * cannot be represented as an `int32`. Such unrepresentable bounds are
+ * replaced with `exprMaxVal(expr)`. This predicate also adds
+ * `exprMaxVal(expr)` as an upper bound if the expression might overflow
+ * negatively, or if it is unanalyzable.
+ *
+ * Note: most callers should use `getFullyConvertedUpperBounds` rather than
+ * this predicate.
+ */
+private
+float getTruncatedUpperBounds(Expr expr) {
+ if analyzableExpr(expr)
+ then // If the expression evaluates to a constant, then there is no
+ // need to call getUpperBoundsImpl.
+ if exists(expr.getValue().toFloat())
+ then result = expr.getValue().toFloat()
+ else (// Some of the bounds computed by `getUpperBoundsImpl`
+ // might overflow, so we replace invalid bounds with
+ // `exprMaxVal`.
+ exists (float newUB
+ | newUB = getUpperBoundsImpl(expr)
+ | if exprMinVal(expr) <= newUB and newUB <= exprMaxVal(expr)
+ then result = newUB
+ else result = exprMaxVal(expr))
+ or
+ // The expression might overflow negatively and wrap. If so,
+ // the upper bound is `exprMaxVal`.
+ (exprMightOverflowNegatively(expr) and
+ result = exprMaxVal(expr)))
+ else // The expression is not analyzable, so its upper bound is
+ // unknown. Note that the call to exprMaxVal restricts the
+ // expressions to just those with arithmetic types. There is no
+ // need to return results for non-arithmetic expressions.
+ result = exprMaxVal(expr)
+}
+
+/**
+ * Holds if the expression might overflow negatively. This predicate
+ * does not consider the possibility that the expression might overflow
+ * due to a conversion.
+ *
+ * DEPRECATED: use `exprMightOverflowNegatively` instead.
+ */
+deprecated predicate negative_overflow(Expr expr) {
+ exprMightOverflowNegatively(expr)
+}
+
+/**
+ * Holds if the expression might overflow negatively. This predicate
+ * does not consider the possibility that the expression might overflow
+ * due to a conversion.
+ */
+cached
+predicate exprMightOverflowNegatively(Expr expr) {
+ getLowerBoundsImpl(expr) < exprMinVal(expr)
+}
+
+/**
+ * Holds if the expression might overflow negatively. Conversions
+ * are also taken into account. For example the expression
+ * `(int16)(x+y)` might overflow due to the `(int16)` cast, rather than
+ * due to the addition.
+ */
+cached
+predicate convertedExprMightOverflowNegatively(Expr expr) {
+ exprMightOverflowNegatively(expr) or
+ convertedExprMightOverflowNegatively(expr.getConversion())
+}
+
+/**
+ * Holds if the expression might overflow positively. This predicate
+ * does not consider the possibility that the expression might overflow
+ * due to a conversion.
+ *
+ * DEPRECATED: use `exprMightOverflowPositively` instead.
+ */
+deprecated predicate positive_overflow(Expr expr) {
+ exprMightOverflowPositively(expr)
+}
+
+/**
+ * Holds if the expression might overflow positively. This predicate
+ * does not consider the possibility that the expression might overflow
+ * due to a conversion.
+ */
+cached
+predicate exprMightOverflowPositively(Expr expr) {
+ getUpperBoundsImpl(expr) > exprMaxVal(expr)
+}
+
+/**
+ * Holds if the expression might overflow positively. Conversions
+ * are also taken into account. For example the expression
+ * `(int16)(x+y)` might overflow due to the `(int16)` cast, rather than
+ * due to the addition.
+ */
+cached
+predicate convertedExprMightOverflowPositively(Expr expr) {
+ exprMightOverflowPositively(expr) or
+ convertedExprMightOverflowPositively(expr.getConversion())
+}
+
+/**
+ * Holds if the expression might overflow (either positively or
+ * negatively). The possibility that the expression might overflow
+ * due to an implicit or explicit cast is also considered.
+ */
+cached
+predicate convertedExprMightOverflow(Expr expr) {
+ convertedExprMightOverflowNegatively(expr) or
+ convertedExprMightOverflowPositively(expr)
+}
+
+/** Only to be called by `getTruncatedLowerBounds`. */
+private
+float getLowerBoundsImpl(Expr expr) {
+ exists (UnaryPlusExpr plusExpr
+ | expr = plusExpr and
+ result = getFullyConvertedLowerBounds(plusExpr.getOperand()) )
+ or
+ exists (UnaryMinusExpr negateExpr, float xHigh
+ | expr = negateExpr and
+ xHigh = getFullyConvertedUpperBounds(negateExpr.getOperand()) and
+ result = -xHigh)
+ or
+ exists (MinExpr minExpr
+ | expr = minExpr and
+ // Return the union of the lower bounds from both children.
+ result = getFullyConvertedLowerBounds(minExpr.getAnOperand()))
+ or
+ exists (MaxExpr maxExpr
+ | expr = maxExpr and
+ // Compute the cross product of the bounds from both children. We are
+ // using this mathematical property:
+ //
+ // max (minimum{X}, minimum{Y})
+ // = minimum { max(x,y) | x in X, y in Y }
+ exists (float x, float y
+ | x = getFullyConvertedLowerBounds(maxExpr.getLeftOperand()) and
+ y = getFullyConvertedLowerBounds(maxExpr.getRightOperand()) and
+ if x >= y
+ then result = x
+ else result = y))
+ or
+ // ConditionalExpr (true branch)
+ exists (ConditionalExpr condExpr
+ | expr = condExpr and
+ // Use `boolConversionUpperBound` to determine whether the condition
+ // might evaluate to `true`.
+ boolConversionUpperBound(condExpr.getCondition().getFullyConverted()) = 1 and
+ result = getFullyConvertedLowerBounds(condExpr.getThen()))
+ or
+ // ConditionalExpr (false branch)
+ exists (ConditionalExpr condExpr
+ | expr = condExpr and
+ // Use `boolConversionLowerBound` to determine whether the condition
+ // might evaluate to `false`.
+ boolConversionLowerBound(condExpr.getCondition().getFullyConverted()) = 0 and
+ result = getFullyConvertedLowerBounds(condExpr.getElse()))
+ or
+ exists (AddExpr addExpr, float xLow, float yLow
+ | expr = addExpr and
+ xLow = getFullyConvertedLowerBounds(addExpr.getLeftOperand()) and
+ yLow = getFullyConvertedLowerBounds(addExpr.getRightOperand()) and
+ result = xLow+yLow)
+ or
+ exists (SubExpr subExpr, float xLow, float yHigh
+ | expr = subExpr and
+ xLow = getFullyConvertedLowerBounds(subExpr.getLeftOperand()) and
+ yHigh = getFullyConvertedUpperBounds(subExpr.getRightOperand()) and
+ result = xLow-yHigh)
+ or
+ exists (PrefixIncrExpr incrExpr, float xLow
+ | expr = incrExpr and
+ xLow = getFullyConvertedLowerBounds(incrExpr.getOperand()) and
+ result = xLow+1)
+ or
+ exists (PrefixDecrExpr decrExpr, float xLow
+ | expr = decrExpr and
+ xLow = getFullyConvertedLowerBounds(decrExpr.getOperand()) and
+ result = xLow-1)
+ or
+ // `PostfixIncrExpr` and `PostfixDecrExpr` return the value of their
+ // operand. The incrementing/decrementing behavior is handled in
+ // `getDefLowerBoundsImpl`.
+ exists (PostfixIncrExpr incrExpr
+ | expr = incrExpr and
+ result = getFullyConvertedLowerBounds(incrExpr.getOperand()))
+ or
+ exists (PostfixDecrExpr decrExpr
+ | expr = decrExpr and
+ result = getFullyConvertedLowerBounds(decrExpr.getOperand()))
+ or
+ exists (RemExpr remExpr
+ | expr = remExpr
+ | // If both inputs are positive then the lower bound is zero.
+ result = 0
+ or
+ // If either input could be negative then the output could be
+ // negative. If so, the lower bound of `x%y` is `-abs(y)`, which is
+ // equal to `min(-y,y)`.
+ exists(float childLB
+ | childLB = getFullyConvertedLowerBounds(remExpr.getAnOperand()) and
+ not (childLB >= 0)
+ | result = getFullyConvertedLowerBounds(remExpr.getRightOperand())
+ or
+ exists(float rhsUB
+ | rhsUB = getFullyConvertedUpperBounds(remExpr.getRightOperand())
+ | result = -rhsUB)))
+ or
+ exists (CommaExpr commaExpr
+ | expr = commaExpr and
+ result = getFullyConvertedLowerBounds(commaExpr.getRightOperand()))
+ or
+ exists (StmtExpr stmtExpr
+ | expr = stmtExpr and
+ result = getFullyConvertedLowerBounds(stmtExpr.getResultExpr()))
+ or
+ // If the conversion is to an arithmetic type then we just return the
+ // lower bound of the child. We do not need to handle truncation and
+ // overflow here, because that is done in `getTruncatedLowerBounds`.
+ // Conversions to `bool` need to be handled specially because they test
+ // whether the value of the expression is equal to 0.
+ exists (Conversion convExpr
+ | expr = convExpr
+ | if convExpr.getType().getUnspecifiedType() instanceof BoolType
+ then result = boolConversionLowerBound(convExpr.getExpr())
+ else result = getTruncatedLowerBounds(convExpr.getExpr()))
+ or
+ // Use SSA to get the lower bounds for a variable use.
+ exists (RangeSsaDefinition def, LocalScopeVariable v
+ | expr = def.getAUse(v)
+ | result = getDefLowerBounds(def, v))
+}
+
+/** Only to be called by `getTruncatedUpperBounds`. */
+private
+float getUpperBoundsImpl(Expr expr) {
+ exists (UnaryPlusExpr plusExpr
+ | expr = plusExpr and
+ result = getFullyConvertedUpperBounds(plusExpr.getOperand()))
+ or
+ exists (UnaryMinusExpr negateExpr, float xLow
+ | expr = negateExpr and
+ xLow = getFullyConvertedLowerBounds(negateExpr.getOperand()) and
+ result = -xLow)
+ or
+ exists (MaxExpr maxExpr
+ | expr = maxExpr and
+ // Return the union of the upper bounds from both children.
+ result = getFullyConvertedUpperBounds(maxExpr.getAnOperand()))
+ or
+ exists (MinExpr minExpr
+ | expr = minExpr and
+ // Compute the cross product of the bounds from both children. We are
+ // using this mathematical property:
+ //
+ // min (maximum{X}, maximum{Y})
+ // = maximum { min(x,y) | x in X, y in Y }
+ exists (float x, float y
+ | x = getFullyConvertedUpperBounds(minExpr.getLeftOperand()) and
+ y = getFullyConvertedUpperBounds(minExpr.getRightOperand()) and
+ if x <= y
+ then result = x
+ else result = y))
+ or
+ // ConditionalExpr (true branch)
+ exists (ConditionalExpr condExpr
+ | expr = condExpr and
+ // Use `boolConversionUpperBound` to determine whether the condition
+ // might evaluate to `true`.
+ boolConversionUpperBound(condExpr.getCondition().getFullyConverted()) = 1 and
+ result = getFullyConvertedUpperBounds(condExpr.getThen()))
+ or
+ // ConditionalExpr (false branch)
+ exists (ConditionalExpr condExpr
+ | expr = condExpr and
+ // Use `boolConversionLowerBound` to determine whether the condition
+ // might evaluate to `false`.
+ boolConversionLowerBound(condExpr.getCondition().getFullyConverted()) = 0 and
+ result = getFullyConvertedUpperBounds(condExpr.getElse()))
+ or
+ exists (AddExpr addExpr, float xHigh, float yHigh
+ | expr = addExpr and
+ xHigh = getFullyConvertedUpperBounds(addExpr.getLeftOperand()) and
+ yHigh = getFullyConvertedUpperBounds(addExpr.getRightOperand()) and
+ result = xHigh+yHigh)
+ or
+ exists (SubExpr subExpr, float xHigh, float yLow
+ | expr = subExpr and
+ xHigh = getFullyConvertedUpperBounds(subExpr.getLeftOperand()) and
+ yLow = getFullyConvertedLowerBounds(subExpr.getRightOperand()) and
+ result = xHigh-yLow)
+ or
+ exists (PrefixIncrExpr incrExpr, float xHigh
+ | expr = incrExpr and
+ xHigh = getFullyConvertedUpperBounds(incrExpr.getOperand()) and
+ result = xHigh+1)
+ or
+ exists (PrefixDecrExpr decrExpr, float xHigh
+ | expr = decrExpr and
+ xHigh = getFullyConvertedUpperBounds(decrExpr.getOperand()) and
+ result = xHigh-1)
+ or
+ // `PostfixIncrExpr` and `PostfixDecrExpr` return the value of their operand.
+ // The incrementing/decrementing behavior is handled in
+ // `getDefUpperBoundsImpl`.
+ exists (PostfixIncrExpr incrExpr
+ | expr = incrExpr and
+ result = getFullyConvertedUpperBounds(incrExpr.getOperand()))
+ or
+ exists (PostfixDecrExpr decrExpr
+ | expr = decrExpr and
+ result = getFullyConvertedUpperBounds(decrExpr.getOperand()))
+ or
+ exists (RemExpr remExpr, float rhsUB
+ | expr = remExpr and
+ rhsUB = getFullyConvertedUpperBounds(remExpr.getRightOperand())
+ | result = rhsUB
+ or
+ // If the right hand side could be negative then we need to take its
+ // absolute value. Since `abs(x) = max(-x,x)` this is equivalent to
+ // adding `-rhsLB` to the set of upper bounds.
+ exists(float rhsLB
+ | rhsLB = getFullyConvertedLowerBounds(remExpr.getAnOperand()) and
+ not (rhsLB >= 0)
+ | result = -rhsLB))
+ or
+ exists (CommaExpr commaExpr
+ | expr = commaExpr and
+ result = getFullyConvertedUpperBounds(commaExpr.getRightOperand()))
+ or
+ exists (StmtExpr stmtExpr
+ | expr = stmtExpr and
+ result = getFullyConvertedUpperBounds(stmtExpr.getResultExpr()))
+ or
+ // If the conversion is to an arithmetic type then we just return the
+ // upper bound of the child. We do not need to handle truncation and
+ // overflow here, because that is done in `getTruncatedUpperBounds`.
+ // Conversions to `bool` need to be handled specially because they test
+ // whether the value of the expression is equal to 0.
+ exists (Conversion convExpr
+ | expr = convExpr
+ | if convExpr.getType().getUnspecifiedType() instanceof BoolType
+ then result = boolConversionUpperBound(convExpr.getExpr())
+ else result = getTruncatedUpperBounds(convExpr.getExpr()))
+ or
+ // Use SSA to get the upper bounds for a variable use.
+ exists (RangeSsaDefinition def, LocalScopeVariable v
+ | expr = def.getAUse(v)
+ | result = getDefUpperBounds(def, v))
+}
+
+/**
+ * Holds if `expr` is converted to `bool` or if it is the child of a
+ * logical operation.
+ *
+ * The purpose of this predicate is to optimize `boolConversionLowerBound`
+ * and `boolConversionUpperBound` by preventing them from computing
+ * unnecessary results. In other words, `exprIsUsedAsBool(expr)` holds if
+ * `expr` is an expression that might be passed as an argument to
+ * `boolConversionLowerBound` or `boolConversionUpperBound`.
+ */
+private predicate exprIsUsedAsBool(Expr expr) {
+ expr = any(BinaryLogicalOperation op).getAnOperand().getFullyConverted() or
+ expr = any(UnaryLogicalOperation op).getOperand().getFullyConverted() or
+ expr = any(ConditionalExpr c).getCondition().getFullyConverted() or
+ exists (Conversion cast
+ | cast.getType().getUnspecifiedType() instanceof BoolType
+ | expr = cast.getExpr())
+}
+
+/**
+ * Gets the lower bound of the conversion `(bool)expr`. If we can prove that
+ * the value of `expr` is never 0 then `lb = 1`. Otherwise `lb = 0`.
+ */
+private float boolConversionLowerBound(Expr expr) {
+ // Case 1: if the range for `expr` includes the value 0,
+ // then `result = 0`.
+ (exprIsUsedAsBool(expr) and
+ exists (float lb | lb = getTruncatedLowerBounds(expr) and not (lb > 0)) and
+ exists (float ub | ub = getTruncatedUpperBounds(expr) and not (ub < 0)) and
+ result = 0)
+ or
+ // Case 2a: if the range for `expr` does not include the value 0,
+ // then `result = 1`.
+ (exprIsUsedAsBool(expr) and getTruncatedLowerBounds(expr) > 0 and result = 1)
+ or
+ // Case 2b: if the range for `expr` does not include the value 0,
+ // then `result = 1`.
+ (exprIsUsedAsBool(expr) and getTruncatedUpperBounds(expr) < 0 and result = 1)
+ or
+ // Case 3: the type of `expr` is not arithmetic. For example, it might
+ // be a pointer.
+ (exprIsUsedAsBool(expr) and not exists(exprMinVal(expr)) and result = 0)
+}
+
+/**
+ * Gets the upper bound of the conversion `(bool)expr`. If we can prove that
+ * the value of `expr` is always 0 then `ub = 0`. Otherwise `ub = 1`.
+ */
+private float boolConversionUpperBound(Expr expr) {
+ // Case 1a: if the upper bound of the operand is <= 0, then the upper
+ // bound might be 0.
+ (exprIsUsedAsBool(expr) and getTruncatedUpperBounds(expr) <= 0 and result = 0)
+ or
+ // Case 1b: if the upper bound of the operand is not <= 0, then the upper
+ // bound is 1.
+ (exprIsUsedAsBool(expr) and
+ exists (float ub | ub = getTruncatedUpperBounds(expr) and not (ub <= 0)) and
+ result = 1)
+ or
+ // Case 2a: if the lower bound of the operand is >= 0, then the upper
+ // bound might be 0.
+ (exprIsUsedAsBool(expr) and getTruncatedLowerBounds(expr) >= 0 and result = 0)
+ or
+ // Case 2b: if the lower bound of the operand is not >= 0, then the upper
+ // bound is 1.
+ (exprIsUsedAsBool(expr) and
+ exists (float lb | lb = getTruncatedLowerBounds(expr) and not (lb >= 0)) and
+ result = 1)
+ or
+ // Case 3: the type of `expr` is not arithmetic. For example, it might
+ // be a pointer.
+ (exprIsUsedAsBool(expr) and not exists(exprMaxVal(expr)) and result = 1)
+}
+
+/**
+ * This predicate computes the lower bounds of a phi definition. If the
+ * phi definition corresponds to a guard, then the guard is used to
+ * deduce a better lower bound.
+ * For example:
+ *
+ * def: x = y % 10;
+ * guard: if (x >= 2) {
+ * block: f(x)
+ * }
+ *
+ * In this example, the lower bound of x is 0, but we can
+ * use the guard to deduce that the lower bound is 2 inside the block.
+ */
+private
+float getPhiLowerBounds(LocalScopeVariable v, RangeSsaDefinition phi) {
+ exists (
+ VariableAccess access, ComparisonOperation guard, boolean branch,
+ float defLB, float guardLB
+ | access = v.getAnAccess() and
+ phi.isGuardPhi(access, guard, branch) and
+ lowerBoundFromGuard(guard, access, guardLB, branch) and
+ defLB = getFullyConvertedLowerBounds(access)
+ | // Compute the maximum of `guardLB` and `defLB`.
+ if guardLB > defLB
+ then result = guardLB
+ else result = defLB)
+ or
+ result = getDefLowerBounds(phi.getAPhiInput(v), v)
+}
+
+/** See comment for `getPhiLowerBounds`, above. */
+private
+float getPhiUpperBounds(LocalScopeVariable v, RangeSsaDefinition phi) {
+ exists (
+ VariableAccess access, ComparisonOperation guard, boolean branch,
+ float defUB, float guardUB
+ | access = v.getAnAccess() and
+ phi.isGuardPhi(access, guard, branch) and
+ upperBoundFromGuard(guard, access, guardUB, branch) and
+ defUB = getFullyConvertedUpperBounds(access)
+ | // Compute the minimum of `guardUB` and `defUB`.
+ if guardUB < defUB
+ then result = guardUB
+ else result = defUB)
+ or
+ result = getDefUpperBounds(phi.getAPhiInput(v), v)
+}
+
+/** Only to be called by `getDefLowerBounds`. */
+private
+float getDefLowerBoundsImpl(RangeSsaDefinition def, LocalScopeVariable v) {
+ // Definitions with a defining value.
+ exists (Expr expr
+ | assignmentDef(def, v, expr)
+ | result = getFullyConvertedLowerBounds(expr))
+ or
+ exists (
+ AssignAddExpr assignAdd, RangeSsaDefinition nextDef, float lhsLB, float rhsLB
+ | def = assignAdd and
+ assignAdd.getLValue() = nextDef.getAUse(v) and
+ lhsLB = getDefLowerBounds(nextDef, v) and
+ rhsLB = getFullyConvertedLowerBounds(assignAdd.getRValue()) and
+ result = lhsLB + rhsLB)
+ or
+ exists (
+ AssignSubExpr assignSub, RangeSsaDefinition nextDef, float lhsLB, float rhsUB
+ | def = assignSub and
+ assignSub.getLValue() = nextDef.getAUse(v) and
+ lhsLB = getDefLowerBounds(nextDef, v) and
+ rhsUB = getFullyConvertedUpperBounds(assignSub.getRValue()) and
+ result = lhsLB - rhsUB)
+ or
+ exists (IncrementOperation incr, float newLB
+ | def = incr and
+ incr.getOperand() = v.getAnAccess() and
+ newLB = getFullyConvertedLowerBounds(incr.getOperand()) and
+ result = newLB+1)
+ or
+ exists (DecrementOperation decr, float newLB
+ | def = decr and
+ decr.getOperand() = v.getAnAccess() and
+ newLB = getFullyConvertedLowerBounds(decr.getOperand()) and
+ result = newLB-1)
+ or
+ // Phi nodes.
+ result = getPhiLowerBounds(v, def)
+ or
+ // Unanalyzable definitions.
+ unanalyzableDefBounds(def, v, result, _)
+}
+
+/** Only to be called by `getDefUpperBounds`. */
+private
+float getDefUpperBoundsImpl(RangeSsaDefinition def, LocalScopeVariable v) {
+ // Definitions with a defining value.
+ exists (Expr expr
+ | assignmentDef(def, v, expr)
+ | result = getFullyConvertedUpperBounds(expr))
+ or
+ exists (
+ AssignAddExpr assignAdd, RangeSsaDefinition nextDef, float lhsUB, float rhsUB
+ | def = assignAdd and
+ assignAdd.getLValue() = nextDef.getAUse(v) and
+ lhsUB = getDefUpperBounds(nextDef, v) and
+ rhsUB = getFullyConvertedUpperBounds(assignAdd.getRValue()) and
+ result = lhsUB + rhsUB)
+ or
+ exists (
+ AssignSubExpr assignSub, RangeSsaDefinition nextDef, float lhsUB, float rhsLB
+ | def = assignSub and
+ assignSub.getLValue() = nextDef.getAUse(v) and
+ lhsUB = getDefUpperBounds(nextDef, v) and
+ rhsLB = getFullyConvertedLowerBounds(assignSub.getRValue()) and
+ result = lhsUB - rhsLB)
+ or
+ exists (IncrementOperation incr, float newUB
+ | def = incr and
+ incr.getOperand() = v.getAnAccess() and
+ newUB = getFullyConvertedUpperBounds(incr.getOperand()) and
+ result = newUB+1)
+ or
+ exists (DecrementOperation decr, float newUB
+ | def = decr and
+ decr.getOperand() = v.getAnAccess() and
+ newUB = getFullyConvertedUpperBounds(decr.getOperand()) and
+ result = newUB-1)
+ or
+ // Phi nodes.
+ result = getPhiUpperBounds(v, def)
+ or
+ // Unanalyzable definitions.
+ unanalyzableDefBounds(def, v, _, result)
+}
+
+/** Holds if the definition might overflow negatively. */
+cached
+predicate defMightOverflowNegatively(RangeSsaDefinition def, LocalScopeVariable v) {
+ getDefLowerBoundsImpl(def, v) < varMinVal(v)
+}
+
+/** Holds if the definition might overflow positively. */
+cached
+predicate defMightOverflowPositively(RangeSsaDefinition def, LocalScopeVariable v) {
+ getDefUpperBoundsImpl(def, v) > varMaxVal(v)
+}
+
+/**
+ * Holds if the definition might overflow (either positively or
+ * negatively).
+ */
+cached
+predicate defMightOverflow(RangeSsaDefinition def, LocalScopeVariable v) {
+ defMightOverflowNegatively(def, v) or
+ defMightOverflowPositively(def, v)
+}
+
+/**
+ * Get the lower bounds for a `RangeSsaDefinition`. Most of the work is
+ * done by `getDefLowerBoundsImpl`, but this is where widening is applied
+ * to prevent the analysis from exploding due to a recursive definition.
+ */
+private
+float getDefLowerBounds(RangeSsaDefinition def, LocalScopeVariable v) {
+ exists (float newLB, float truncatedLB
+ | newLB = getDefLowerBoundsImpl(def, v) and
+ if varMinVal(v) <= newLB and newLB <= varMaxVal(v)
+ then truncatedLB = newLB
+ else truncatedLB = varMinVal(v)
+ | // Widening: check whether the new lower bound is from a source which
+ // depends recursively on the current definition.
+ if isRecursiveDef(def, v)
+ then // The new lower bound is from a recursive source, so we round
+ // down to one of a limited set of values to prevent the
+ // recursion from exploding.
+ result =
+ max (float widenLB
+ | widenLB = wideningLowerBounds(v.getType().getUnspecifiedType()) and
+ not (widenLB > truncatedLB)
+ | widenLB)
+ else result = truncatedLB)
+ or
+ // The definition might overflow positively and wrap. If so, the lower
+ // bound is `typeLowerBound`.
+ (defMightOverflowPositively(def, v) and result = varMinVal(v))
+}
+
+/** See comment for `getDefLowerBounds`, above. */
+private
+float getDefUpperBounds(RangeSsaDefinition def, LocalScopeVariable v) {
+ exists (float newUB, float truncatedUB
+ | newUB = getDefUpperBoundsImpl(def, v) and
+ if varMinVal(v) <= newUB and newUB <= varMaxVal(v)
+ then truncatedUB = newUB
+ else truncatedUB = varMaxVal(v)
+ | // Widening: check whether the new upper bound is from a source which
+ // depends recursively on the current definition.
+ if isRecursiveDef(def, v)
+ then // The new upper bound is from a recursive source, so we round
+ // up to one of a fixed set of values to prevent the recursion
+ // from exploding.
+ result =
+ min (float widenUB
+ | widenUB = wideningUpperBounds(v.getType().getUnspecifiedType()) and
+ not (widenUB < truncatedUB)
+ | widenUB)
+ else result = truncatedUB)
+ or
+ // The definition might overflow negatively and wrap. If so, the upper
+ // bound is `typeUpperBound`.
+ (defMightOverflowNegatively(def, v) and result = varMaxVal(v))
+}
+
+/**
+ * Helper for `getDefLowerBounds` and `getDefUpperBounds`. Find the set of
+ * unanalyzable definitions (such as function parameters) and make their
+ * bounds unknown.
+ */
+private
+predicate unanalyzableDefBounds(
+ RangeSsaDefinition def, LocalScopeVariable v, float lb, float ub) {
+ v = def.getAVariable() and
+ not analyzableDef(def, v) and
+ lb = varMinVal(v) and
+ ub = varMaxVal(v)
+}
+
+/**
+ * If the guard is a comparison of the form `p*v + q r`, then this
+ * predicate uses the bounds information for `r` to compute a lower bound
+ * for `v`.
+ */
+private
+predicate lowerBoundFromGuard(
+ ComparisonOperation guard, VariableAccess v, float lb, boolean branch
+) {
+ exists (float childLB, RelationStrictness strictness
+ | boundFromGuard(guard, v, childLB, true, strictness, branch)
+ | if (strictness = Nonstrict() or
+ not (v.getType().getUnspecifiedType() instanceof IntegralType))
+ then lb = childLB
+ else lb = childLB+1)
+}
+
+/**
+ * If the guard is a comparison of the form `p*v + q r`, then this
+ * predicate uses the bounds information for `r` to compute a upper bound
+ * for `v`.
+ */
+private
+predicate upperBoundFromGuard(
+ ComparisonOperation guard, VariableAccess v, float ub, boolean branch
+) {
+ exists (float childUB, RelationStrictness strictness
+ | boundFromGuard(guard, v, childUB, false, strictness, branch)
+ | if (strictness = Nonstrict() or
+ not (v.getType().getUnspecifiedType() instanceof IntegralType))
+ then ub = childUB
+ else ub = childUB-1)
+}
+
+/**
+ * This predicate simplifies the results returned by
+ * `linearBoundFromGuard`.
+ */
+private
+predicate boundFromGuard(
+ ComparisonOperation guard, VariableAccess v,
+ float boundValue,
+ boolean isLowerBound, RelationStrictness strictness, boolean branch
+) {
+ exists (
+ float p, float q, float r, boolean isLB
+ | linearBoundFromGuard(
+ guard, v, p, q, r, isLB, strictness, branch) and
+ boundValue = (r - q)/p
+ | // If the multiplier is negative then the direction of the comparison
+ // needs to be flipped.
+ (p > 0 and isLowerBound = isLB) or
+ (p < 0 and isLowerBound = isLB.booleanNot()))
+}
+
+/**
+ * This predicate finds guards of the form `p*v + q < r or p*v + q == r`
+ * and decomposes them into a tuple of values which can be used to deduce a
+ * lower or upper bound for `v`.
+ */
+private
+predicate linearBoundFromGuard(
+ ComparisonOperation guard, VariableAccess v,
+ float p, float q, float boundValue,
+ boolean isLowerBound, // Is this a lower or an upper bound?
+ RelationStrictness strictness,
+ boolean branch // Which control-flow branch is this bound valid on?
+) {
+ // For the comparison x < RHS, we create two bounds:
+ //
+ // 1. x < upperbound(RHS)
+ // 2. x >= typeLowerBound(RHS.getType().getUnspecifiedType())
+ //
+ exists (Expr lhs, Expr rhs, RelationDirection dir, RelationStrictness st
+ | linearAccess(lhs, v, p, q) and
+ relOpWithSwapAndNegate(guard, lhs, rhs, dir, st, branch)
+ | (isLowerBound = directionIsGreater(dir) and
+ strictness = st and
+ getBounds(rhs, boundValue, isLowerBound))
+ or
+ (isLowerBound = directionIsLesser(dir) and
+ strictness = Nonstrict() and
+ exprTypeBounds(rhs, boundValue, isLowerBound)))
+
+ // For x == RHS, we create the following bounds:
+ //
+ // 1. x <= upperbound(RHS)
+ // 2. x >= lowerbound(RHS)
+ //
+ // For x != RHS, we create trivial bounds:
+ //
+ // 1. x <= typeUpperBound(RHS.getType().getUnspecifiedType())
+ // 2. x >= typeLowerBound(RHS.getType().getUnspecifiedType())
+ //
+ or
+ exists (Expr lhs, Expr rhs, boolean isEQ
+ | linearAccess(lhs, v, p, q) and
+ eqOpWithSwapAndNegate(guard, lhs, rhs, isEQ, branch) and
+ strictness = Nonstrict()
+ | // True branch
+ (isEQ = true and getBounds(rhs, boundValue, isLowerBound))
+ or
+ // False branch: set the bounds to the min/max for the type.
+ (isEQ = false and exprTypeBounds(rhs, boundValue, isLowerBound)))
+}
+
+/** Utility for `linearBoundFromGuard`. */
+private
+predicate getBounds(Expr expr, float boundValue, boolean isLowerBound) {
+ (isLowerBound = true and boundValue = getFullyConvertedLowerBounds(expr)) or
+ (isLowerBound = false and boundValue = getFullyConvertedUpperBounds(expr))
+}
+
+/** Utility for `linearBoundFromGuard`. */
+private
+predicate exprTypeBounds(Expr expr, float boundValue, boolean isLowerBound) {
+ (isLowerBound = true and boundValue = exprMinVal(expr.getFullyConverted())) or
+ (isLowerBound = false and boundValue = exprMaxVal(expr.getFullyConverted()))
+}
+
+/**
+ * Gets the lower bound of the expression.
+ *
+ * Note: expressions in C/C++ are often implicitly or explicitly cast to a
+ * different result type. Such casts can cause the value of the expression
+ * to overflow or to be truncated. This predicate computes the lower bound
+ * of the expression without including the effect of the casts. To compute
+ * the lower bound of the expression after all the casts have been applied,
+ * call `lowerBound` like this:
+ *
+ * `lowerBound(expr.getFullyConverted())`
+ */
+cached
+float lowerBound(Expr expr) {
+ // Combine the lower bounds returned by getTruncatedLowerBounds into a
+ // single minimum value.
+ result = min(float lb | lb = getTruncatedLowerBounds(expr) | lb)
+}
+
+/**
+ * Gets the upper bound of the expression.
+ *
+ * Note: expressions in C/C++ are often implicitly or explicitly cast to a
+ * different result type. Such casts can cause the value of the expression
+ * to overflow or to be truncated. This predicate computes the upper bound
+ * of the expression without including the effect of the casts. To compute
+ * the upper bound of the expression after all the casts have been applied,
+ * call `upperBound` like this:
+ *
+ * `upperBound(expr.getFullyConverted())`
+ */
+cached
+float upperBound(Expr expr) {
+ // Combine the upper bounds returned by getTruncatedUpperBounds into a
+ // single maximum value.
+ result = max(float ub | ub = getTruncatedUpperBounds(expr) | ub)
+}
+
+/**
+ * Holds if `expr` has a provably empty range. For example:
+ *
+ * 10 < expr and expr < 5
+ *
+ * The range of an expression can only be empty if it can never be
+ * executed. For example:
+ *
+ * if (10 < x) {
+ * if (x < 5) {
+ * // Unreachable code
+ * return x; // x has an empty range: 10 < x && x < 5
+ * }
+ * }
+ */
+cached
+predicate exprWithEmptyRange(Expr expr) {
+ analyzableExpr(expr) and
+ (not exists(lowerBound(expr)) or
+ not exists(upperBound(expr)) or
+ lowerBound(expr) > upperBound(expr))
+}
diff --git a/cpp/ql/src/semmle/code/cpp/security/BufferAccess.qll b/cpp/ql/src/semmle/code/cpp/security/BufferAccess.qll
new file mode 100644
index 000000000000..997c53fd8d0d
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/security/BufferAccess.qll
@@ -0,0 +1,333 @@
+import cpp
+
+/**
+ * Returns the size of the pointed-to type, counting void types as size 1.
+ */
+int getPointedSize(Type t)
+{
+ result = t.getUnspecifiedType().(PointerType).getBaseType().getSize().maximum(1)
+}
+
+/**
+ * An operation that reads data from or writes data to a buffer.
+ *
+ * See the BufferWrite class for an explanation of how BufferAccess and
+ * BufferWrite differ.
+ */
+abstract class BufferAccess extends Expr {
+ abstract string getName();
+ abstract Expr getBuffer(string bufferDesc, int accessType);
+ /*
+ * accessType:
+ * 1 = buffer range [0, getSize) is accessed entirely
+ * 2 = buffer range [0, getSize) may be accessed partially or entirely
+ * 3 = buffer is accessed at offset getSize - 1
+ */
+ abstract int getSize();
+}
+
+/**
+ * Calls to memcpy and similar functions.
+ * memcpy(dest, src, num)
+ * wmemcpy(dest, src, num)
+ * memmove(dest, src, num)
+ * wmemmove(dest, src, num)
+ * mempcpy(dest, src, num);
+ * wmempcpy(dest, src, num);
+ */
+class MemcpyBA extends BufferAccess {
+ MemcpyBA() {
+ this.(FunctionCall).getTarget().getName() = "memcpy" or
+ this.(FunctionCall).getTarget().getName() = "wmemcpy" or
+ this.(FunctionCall).getTarget().getName() = "memmove" or
+ this.(FunctionCall).getTarget().getName() = "wmemmove" or
+ this.(FunctionCall).getTarget().getName() = "mempcpy" or
+ this.(FunctionCall).getTarget().getName() = "wmempcpy"
+ }
+
+ override string getName() {
+ result = this.(FunctionCall).getTarget().getName()
+ }
+
+ override Expr getBuffer(string bufferDesc, int accessType) {
+ (
+ result = this.(FunctionCall).getArgument(0) and
+ bufferDesc = "destination buffer" and
+ accessType = 1
+ ) or (
+ result = this.(FunctionCall).getArgument(1) and
+ bufferDesc = "source buffer" and
+ accessType = 1
+ )
+ }
+
+ override int getSize() {
+ result =
+ this.(FunctionCall).getArgument(2).getValue().toInt() *
+ getPointedSize(this.(FunctionCall).getTarget().getParameter(0).getType())
+ }
+}
+
+/**
+ * Calls to bcopy.
+ * bcopy(src, dest, num)
+ */
+class BCopyBA extends BufferAccess {
+ BCopyBA() {
+ this.(FunctionCall).getTarget().getName() = "bcopy"
+ }
+
+ override string getName() {
+ result = this.(FunctionCall).getTarget().getName()
+ }
+
+ override Expr getBuffer(string bufferDesc, int accessType) {
+ (
+ result = this.(FunctionCall).getArgument(0) and
+ bufferDesc = "source buffer" and
+ accessType = 1
+ ) or (
+ result = this.(FunctionCall).getArgument(1) and
+ bufferDesc = "destination buffer" and
+ accessType = 1
+ )
+ }
+
+ override int getSize() {
+ result =
+ this.(FunctionCall).getArgument(2).getValue().toInt() *
+ getPointedSize(this.(FunctionCall).getTarget().getParameter(0).getType())
+ }
+}
+
+/**
+ * Calls to strncpy.
+ * strncpy(dest, src, num)
+ */
+class StrncpyBA extends BufferAccess {
+ StrncpyBA() {
+ this.(FunctionCall).getTarget().getName() = "strncpy"
+ }
+
+ override string getName() {
+ result = this.(FunctionCall).getTarget().getName()
+ }
+
+ override Expr getBuffer(string bufferDesc, int accessType) {
+ (
+ result = this.(FunctionCall).getArgument(0) and
+ bufferDesc = "destination buffer" and
+ accessType = 2
+ ) or (
+ result = this.(FunctionCall).getArgument(1) and
+ bufferDesc = "source buffer" and
+ accessType = 2
+ )
+ }
+
+ override int getSize() {
+ result =
+ this.(FunctionCall).getArgument(2).getValue().toInt() *
+ getPointedSize(this.(FunctionCall).getTarget().getParameter(0).getType())
+ }
+}
+
+/**
+ * Calls to memccpy.
+ * memccpy(dest, src, c, n)
+ */
+class MemccpyBA extends BufferAccess {
+ MemccpyBA() {
+ this.(FunctionCall).getTarget().getName() = "memccpy"
+ }
+
+ override string getName() {
+ result = this.(FunctionCall).getTarget().getName()
+ }
+
+ override Expr getBuffer(string bufferDesc, int accessType) {
+ (
+ result = this.(FunctionCall).getArgument(0) and
+ bufferDesc = "destination buffer" and
+ accessType = 2
+ ) or (
+ result = this.(FunctionCall).getArgument(1) and
+ bufferDesc = "source buffer" and
+ accessType = 2
+ )
+ }
+
+ override int getSize() {
+ result =
+ this.(FunctionCall).getArgument(3).getValue().toInt() *
+ getPointedSize(this.(FunctionCall).getTarget().getParameter(0).getType())
+ }
+}
+
+/**
+ * Calls to memcmp and similar functions.
+ * memcmp(buffer1, buffer2, num)
+ * wmemcmp(buffer1, buffer2, num)
+ * _memicmp(buffer1, buffer2, count)
+ * _memicmp_l(buffer1, buffer2, count, locale)
+ */
+class MemcmpBA extends BufferAccess {
+ MemcmpBA() {
+ this.(FunctionCall).getTarget().getName() = "memcmp" or
+ this.(FunctionCall).getTarget().getName() = "wmemcmp" or
+ this.(FunctionCall).getTarget().getName() = "_memicmp" or
+ this.(FunctionCall).getTarget().getName() = "_memicmp_l"
+ }
+
+ override string getName() {
+ result = this.(FunctionCall).getTarget().getName()
+ }
+
+ override Expr getBuffer(string bufferDesc, int accessType) {
+ (
+ result = this.(FunctionCall).getArgument(0) and
+ bufferDesc = "first buffer" and
+ accessType = 2
+ ) or (
+ result = this.(FunctionCall).getArgument(1) and
+ bufferDesc = "second buffer" and
+ accessType = 2
+ )
+ }
+
+ override int getSize() {
+ result =
+ this.(FunctionCall).getArgument(2).getValue().toInt() *
+ getPointedSize(this.(FunctionCall).getTarget().getParameter(0).getType())
+ }
+}
+
+/**
+ * Calls to swab and similar functions.
+ * swab(src, dest, num)
+ * _swab(src, dest, num)
+ */
+class SwabBA extends BufferAccess {
+ SwabBA() {
+ this.(FunctionCall).getTarget().getName() = "swab" or
+ this.(FunctionCall).getTarget().getName() = "_swab"
+ }
+
+ override string getName() {
+ result = this.(FunctionCall).getTarget().getName()
+ }
+
+ override Expr getBuffer(string bufferDesc, int accessType) {
+ (
+ result = this.(FunctionCall).getArgument(0) and
+ bufferDesc = "source buffer" and
+ accessType = 1
+ ) or (
+ result = this.(FunctionCall).getArgument(1) and
+ bufferDesc = "destination buffer" and
+ accessType = 1
+ )
+ }
+
+ override int getSize() {
+ result =
+ this.(FunctionCall).getArgument(2).getValue().toInt() *
+ getPointedSize(this.(FunctionCall).getTarget().getParameter(0).getType())
+ }
+}
+
+/**
+ * Calls to memset and similar functions.
+ * memset(dest, value, num)
+ * wmemset(dest, value, num)
+ */
+class MemsetBA extends BufferAccess {
+ MemsetBA() {
+ this.(FunctionCall).getTarget().getName() = "memset" or
+ this.(FunctionCall).getTarget().getName() = "wmemset"
+ }
+
+ override string getName() {
+ result = this.(FunctionCall).getTarget().getName()
+ }
+
+ override Expr getBuffer(string bufferDesc, int accessType) {
+ result = this.(FunctionCall).getArgument(0) and
+ bufferDesc = "destination buffer" and
+ accessType = 1
+ }
+
+ override int getSize() {
+ result =
+ this.(FunctionCall).getArgument(2).getValue().toInt() *
+ getPointedSize(this.(FunctionCall).getTarget().getParameter(0).getType())
+ }
+}
+
+/**
+ * Calls to memchr and similar functions.
+ * memchr(buffer, value, num)
+ * wmemchr(buffer, value, num)
+ */
+class MemchrBA extends BufferAccess {
+ MemchrBA() {
+ this.(FunctionCall).getTarget().getName() = "memchr" or
+ this.(FunctionCall).getTarget().getName() = "wmemchr"
+ }
+
+ override string getName() {
+ result = this.(FunctionCall).getTarget().getName()
+ }
+
+ override Expr getBuffer(string bufferDesc, int accessType) {
+ result = this.(FunctionCall).getArgument(0) and
+ bufferDesc = "source buffer" and
+ accessType = 2
+ }
+
+ override int getSize() {
+ result =
+ this.(FunctionCall).getArgument(2).getValue().toInt() *
+ getPointedSize(this.(FunctionCall).getTarget().getParameter(0).getType())
+ }
+}
+
+/**
+ * A array access on a buffer:
+ * buffer[ix]
+ * but not:
+ * &buffer[ix]
+ */
+class ArrayExprBA extends BufferAccess {
+ ArrayExprBA() {
+ exists(this.(ArrayExpr).getArrayOffset().getValue().toInt())
+ and
+ not exists(AddressOfExpr aoe | aoe.getAChild() = this)
+ and
+
+ // exclude accesses in macro implementation of `strcmp`,
+ // which are carefully controlled but can look dangerous.
+ not exists(Macro m |
+ m.getName() = "strcmp" and
+ m.getAnInvocation().getAnExpandedElement() = this
+ )
+ }
+
+ override string getName() {
+ result = "array indexing"
+ }
+
+ override Expr getBuffer(string bufferDesc, int accessType) {
+ result = this.(ArrayExpr).getArrayBase() and
+ bufferDesc = "array" and
+ accessType = 3
+ }
+
+ override int getSize() {
+ // byte size of the buffer that would be required to support this
+ // access
+ result =
+ (1 + this.(ArrayExpr).getArrayOffset().getValue().toInt()) *
+ this.(ArrayExpr).getType().getSize()
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/security/BufferWrite.qll b/cpp/ql/src/semmle/code/cpp/security/BufferWrite.qll
new file mode 100644
index 000000000000..bed73b5a49e3
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/security/BufferWrite.qll
@@ -0,0 +1,550 @@
+/**
+ * @name CWE-120
+ * @description Buffer Copy without Checking Size of Input ('Classic Buffer Overflow').
+ * @kind problem
+ * @problem.severity recommendation
+ */
+import cpp
+import semmle.code.cpp.commons.Alloc
+import semmle.code.cpp.commons.Buffer
+import semmle.code.cpp.commons.Scanf
+import semmle.code.cpp.models.implementations.Strcat
+
+// --- BufferWrite framework ---
+
+/**
+ * An operation that writes a variable amount of data to a buffer
+ * (strcpy, strncat, sprintf etc).
+ *
+ * Note that there are two related class frameworks:
+ * - BufferWrite provides detailed coverage of null-terminated
+ * buffer write operations.
+ * - BufferAccess provides general coverage of buffer read and write
+ * operations whose size is either not data-dependent, or has an upper
+ * bound which is not data-dependent.
+ * This design has some overlaps between the two classes, for example
+ * the write of a 'strncpy'.
+ */
+abstract class BufferWrite extends Expr
+{
+ // --- derived classes override these ---
+
+ /**
+ * Gets the (unspecified) type of the buffer this operation works
+ * with (for example `char *`).
+ */
+ abstract Type getBufferType();
+
+ /**
+ * Gets a data source of this operation (e.g. the source string,
+ * format string; not necessarily copied as-is).
+ */
+ Expr getASource() { none() }
+
+ /**
+ * Gets the destination buffer of this operation.
+ */
+ abstract Expr getDest();
+
+ /**
+ * Holds if the operation has an explicit parameter that limits the amount
+ * of data written (e.g. `strncpy` does, whereas `strcpy` does not); this
+ * is not the same as exists(getExplicitLimit()) because the limit may exist
+ * though it's value is unknown.
+ */
+ predicate hasExplicitLimit() { none() }
+
+ /**
+ * Gets the explicit limit of bytes copied by this operation, if it exists
+ * and it's value can be determined.
+ */
+ int getExplicitLimit() { none() }
+
+ /**
+ * Gets an upper bound to the amount of data that's being written (if one
+ * can be found).
+ */
+ int getMaxData() { none() }
+
+ /**
+ * Gets an upper bound to the amount of data that's being written (if one
+ * can be found), except that float to string conversions are assumed to be
+ * much smaller (8 bytes) than their true maximum length. This can be
+ * helpful in determining the cause of a buffer overflow issue.
+ */
+ int getMaxDataLimited() { result = getMaxData() }
+
+ /**
+ * Gets the size of a single character of the type this
+ * operation works with, in bytes.
+ */
+ int getCharSize()
+ {
+ result = getBufferType().(PointerType).getBaseType().getSize() or
+ result = getBufferType().(ArrayType).getBaseType().getSize()
+ }
+
+ /**
+ * Gets a description of this buffer write.
+ */
+ string getBWDesc()
+ {
+ result = toString()
+ }
+}
+
+/**
+ * A `BufferWrite` that is also a `FunctionCall` (most cases).
+ */
+abstract class BufferWriteCall extends BufferWrite, FunctionCall
+{
+}
+
+// --- BufferWrite classes ---
+
+/**
+ * A call to a variant of `strcpy`.
+ */
+class StrCopyBW extends BufferWriteCall
+{
+ StrCopyBW()
+ {
+ exists(TopLevelFunction fn, string name | (fn = getTarget()) and (name = fn.getName()) and (
+ (name = "strcpy") // strcpy(dst, src)
+ or (name = "wcscpy") // wcscpy(dst, src)
+ or (name = "_mbscpy") // _mbscpy(dst, src)
+ or (
+ (
+ name = "strcpy_s" or // strcpy_s(dst, max_amount, src)
+ name = "wcscpy_s" or // wcscpy_s(dst, max_amount, src)
+ name = "_mbscpy_s" // _mbscpy_s(dst, max_amount, src)
+ ) and
+ fn.getNumberOfParameters() = 3 // exclude the 2-parameter template versions
+ // that find the size of a fixed size destination buffer.
+ )
+ or (name = "strncpy") // strncpy(dst, src, max_amount)
+ or (name = "strncpy_l") // strncpy_l(dst, src, max_amount, locale)
+ or (name = "wcsncpy") // wcsncpy(dst, src, max_amount)
+ or (name = "_wcsncpy_l") // _wcsncpy_l(dst, src, max_amount, locale)
+ or (name = "_mbsncpy") // _mbsncpy(dst, src, max_amount)
+ or (name = "_mbsncpy_l") // _mbsncpy_l(dst, src, max_amount, locale)
+ ))
+ }
+
+ int getParamSize()
+ {
+ exists(TopLevelFunction fn, string name | (fn = getTarget()) and (name = fn.getName()) and (
+ if (name.suffix(name.length() - 2) = "_s") then (
+ result = 1
+ ) else if exists(name.indexOf("ncpy")) then (
+ result = 2
+ ) else (
+ none()
+ )
+ ))
+ }
+
+ int getParamSrc()
+ {
+ exists(TopLevelFunction fn, string name | (fn = getTarget()) and (name = fn.getName()) and (
+ if (name.suffix(name.length() - 2) = "_s") then (
+ result = 2
+ ) else (
+ result = 1
+ )
+ ))
+ }
+
+ override Type getBufferType()
+ {
+ result = this.getTarget().getParameter(getParamSrc()).getType().getUnspecifiedType()
+ }
+
+ override Expr getASource()
+ {
+ result = getArgument(getParamSrc())
+ }
+
+ override Expr getDest()
+ {
+ result = getArgument(0)
+ }
+
+ override predicate hasExplicitLimit()
+ {
+ exists(getParamSize())
+ }
+
+ override int getExplicitLimit()
+ {
+ result = getArgument(getParamSize()).getValue().toInt() * getCharSize()
+ }
+
+ override int getMaxData()
+ {
+ result = getArgument(getParamSrc()).(AnalysedString).getMaxLength() * getCharSize()
+ }
+}
+
+/**
+ * A call to a variant of `strcat`.
+ */
+class StrCatBW extends BufferWriteCall
+{
+ StrCatBW()
+ {
+ exists(TopLevelFunction fn | fn = getTarget() and fn instanceof StrcatFunction)
+ }
+
+ int getParamSize()
+ {
+ if exists(getArgument(2)) then (
+ result = 2
+ ) else (
+ none()
+ )
+ }
+
+ int getParamSrc()
+ {
+ result = 1
+ }
+
+ override Type getBufferType()
+ {
+ result = this.getTarget().getParameter(getParamSrc()).getType().getUnspecifiedType()
+ }
+
+ override Expr getASource()
+ {
+ result = getArgument(getParamSrc())
+ }
+
+ override Expr getDest()
+ {
+ result = getArgument(0)
+ }
+
+ override predicate hasExplicitLimit()
+ {
+ exists(getParamSize())
+ }
+
+ override int getExplicitLimit()
+ {
+ result = getArgument(getParamSize()).getValue().toInt() * getCharSize()
+ }
+
+ override int getMaxData()
+ {
+ result = getArgument(getParamSrc()).(AnalysedString).getMaxLength() * getCharSize()
+ }
+}
+
+/**
+ * A call to a variant of `sprintf`.
+ */
+class SprintfBW extends BufferWriteCall
+{
+ SprintfBW()
+ {
+ exists(TopLevelFunction fn, string name | (fn = getTarget()) and (name = fn.getName()) and (
+ // C sprintf variants
+ (name = "sprintf") // sprintf(dst, format, args...)
+ or (name = "vsprintf") // vsprintf(dst, format, va_list)
+ or (name = "wsprintf") // wsprintf(dst, format, args...)
+ or (name = "vwsprintf") // vwsprintf(dst, format, va_list)
+
+ // Microsoft sprintf variants
+ or (name.regexpMatch("_sprintf_l")) // _sprintf_l(dst, format, locale, args...)
+ or (name.regexpMatch("_vsprintf_l")) // _vsprintf_l(dst, format, locale, va_list))
+ or (name.regexpMatch("__swprintf_l")) // __swprintf_l(dst, format, locale, args...)
+ or (name.regexpMatch("__vswprintf_l")) // __vswprintf_l(dst, format, locale, va_list)
+ ))
+ }
+
+ override Type getBufferType()
+ {
+ exists(FormattingFunction f |
+ f = this.getTarget() and
+ result = f.getParameter(f.getFormatParameterIndex()).getType().getUnspecifiedType()
+ )
+ }
+
+ override Expr getASource()
+ {
+ (result = this.(FormattingFunctionCall).getFormat())
+ or
+ (result = this.(FormattingFunctionCall).getFormatArgument(_))
+ }
+
+ override Expr getDest()
+ {
+ result = getArgument(0)
+ }
+
+ override int getMaxData()
+ {
+ exists(FormatLiteral fl |
+ (fl = this.(FormattingFunctionCall).getFormat())
+ and (result = fl.getMaxConvertedLength() * getCharSize())
+ )
+ }
+
+ override int getMaxDataLimited()
+ {
+ exists(FormatLiteral fl |
+ (fl = this.(FormattingFunctionCall).getFormat())
+ and (result = fl.getMaxConvertedLengthLimited() * getCharSize())
+ )
+ }
+}
+
+/**
+ * A call to a variant of `snprintf`.
+ */
+class SnprintfBW extends BufferWriteCall
+{
+ SnprintfBW()
+ {
+ exists(TopLevelFunction fn, string name | (fn = getTarget()) and (name = fn.getName()) and (
+ // C snprintf variants
+ (name = "snprintf") // snprintf(dst, max_amount, format, args...)
+ or (name = "vsnprintf") // vsnprintf(dst, max_amount, format, va_list)
+ or (name = "swprintf") // swprintf(dst, max_amount, format, args...)
+ or (name = "vswprintf") // vswprintf(dst, max_amount, format, va_list)
+
+ // Microsoft snprintf variants
+ or (name = "sprintf_s") // sprintf_s(dst, max_amount, format, locale, args...)
+ or (name = "vsprintf_s") // vsprintf_s(dst, max_amount, format, va_list)
+ or (name = "swprintf_s") // swprintf_s(dst, max_amount, format, args...)
+ or (name = "vswprintf_s") // vswprintf_s(dst, max_amount, format, va_list)
+
+ // Microsoft snprintf variants with '_'
+ or (
+ (name.regexpMatch("_v?sn?w?printf(_s)?(_p)?(_l)?"))
+ and (not this instanceof SprintfBW)
+ )
+ // _sprintf_s_l(dst, max_amount, format, locale, args...)
+ // _swprintf_l(dst, max_amount, format, locale, args...)
+ // _swprintf_s_l(dst, max_amount, format, locale, args...)
+ // _snprintf(dst, max_amount, format, args...)
+ // _snprintf_l(dst, max_amount, format, locale, args...)
+ // _snwprintf(dst, max_amount, format, args...)
+ // _snwprintf_l(buffer, max_amount, format, locale, args...)
+ // _vsprintf_s_l(dst, max_amount, format, locale, va_list)
+ // _vsprintf_p(dst, max_amount, format, va_list)
+ // _vsprintf_p_l(dst, max_amount, format, locale, va_list)
+ // _vswprintf_l(dst, max_amount, format, locale, va_list)
+ // _vswprintf_s_l(buffer, max_amount, format, locale, va_list)
+ // _vswprintf_p(dst, max_amount, format, va_list)
+ // _vswprintf_p_l(dst, max_amount, format, locale, va_list)
+ // _vsnprintf(dst, max_amount, format, va_list)
+ // _vsnprintf_l(dst, max_amount, format, locale, va_list)
+ // _vsnwprintf(dst, max_amount, format, va_list)
+ // _vsnwprintf_l(dst, max_amount, format, locale, va_list)
+ ))
+ }
+
+ int getParamSize()
+ {
+ result = 1
+ }
+
+ override Type getBufferType()
+ {
+ exists(FormattingFunction f |
+ f = this.getTarget() and
+ result = f.getParameter(f.getFormatParameterIndex()).getType().getUnspecifiedType()
+ )
+ }
+
+ override Expr getASource()
+ {
+ (result = this.(FormattingFunctionCall).getFormat())
+ or
+ (result = this.(FormattingFunctionCall).getFormatArgument(_))
+ }
+
+ override Expr getDest()
+ {
+ result = getArgument(0)
+ }
+
+ override predicate hasExplicitLimit()
+ {
+ exists(getParamSize())
+ }
+
+ override int getExplicitLimit()
+ {
+ result = getArgument(getParamSize()).getValue().toInt() * getCharSize()
+ }
+
+ override int getMaxData()
+ {
+ exists(FormatLiteral fl |
+ (fl = this.(FormattingFunctionCall).getFormat())
+ and (result = fl.getMaxConvertedLength() * getCharSize())
+ )
+ }
+
+ override int getMaxDataLimited()
+ {
+ exists(FormatLiteral fl |
+ (fl = this.(FormattingFunctionCall).getFormat())
+ and (result = fl.getMaxConvertedLengthLimited() * getCharSize())
+ )
+ }
+}
+
+/**
+ * A call to a variant of `gets`.
+ */
+class GetsBW extends BufferWriteCall
+{
+ GetsBW()
+ {
+ exists(TopLevelFunction fn, string name | (fn = getTarget()) and (name = fn.getName()) and (
+ (name = "gets") // gets(dst)
+ or (name = "fgets") // fgets(dst, max_amount, src_stream)
+ or (name = "fgetws") // fgetws(dst, max_amount, src_stream)
+ ))
+ }
+
+ int getParamSize()
+ {
+ if exists(getArgument(1)) then (
+ result = 1
+ ) else (
+ none()
+ )
+ }
+
+ override Type getBufferType()
+ {
+ result = this.getTarget().getParameter(0).getType().getUnspecifiedType()
+ }
+
+ override Expr getASource()
+ {
+ if exists(getArgument(2)) then (
+ result = getArgument(2)
+ ) else (
+ result = this // the source is input inside the 'gets' call itself
+ )
+ }
+
+ override Expr getDest()
+ {
+ result = getArgument(0)
+ }
+
+ override predicate hasExplicitLimit()
+ {
+ exists(getParamSize())
+ }
+
+ override int getExplicitLimit()
+ {
+ result = getArgument(getParamSize()).getValue().toInt() * getCharSize()
+ }
+}
+
+/**
+ * A string that is written by a `scanf`-like function.
+ */
+class ScanfBW extends BufferWrite
+{
+ ScanfBW()
+ {
+ exists(ScanfFunctionCall fc, ScanfFormatLiteral fl, int arg, int args_pos |
+ (this = fc.getArgument(arg))
+ and (args_pos = fc.getTarget().getNumberOfParameters())
+ and (arg >= args_pos)
+ and (fl = fc.getFormat())
+ and (fl.getConversionChar(arg - args_pos) = "s")
+ )
+ }
+
+ int getParamArgs()
+ {
+ exists(FunctionCall fc | this = fc.getArgument(_)
+ and (result = fc.getTarget().getNumberOfParameters())
+ )
+ }
+
+ override Type getBufferType()
+ {
+ exists(ScanfFunction f, ScanfFunctionCall fc |
+ this = fc.getArgument(_) and
+ f = fc.getTarget() and
+ result = f.getParameter(f.getFormatParameterIndex()).getType().getUnspecifiedType()
+ )
+ }
+
+ override Expr getASource()
+ {
+ exists(ScanfFunctionCall fc |
+ (this = fc.getArgument(_)) and (
+ // inputs are: the format string, input or the argument itself (if there's no explicit input)
+ (result = fc.getFormat()) or
+ (result = fc.getArgument(fc.getInputParameterIndex())) or
+ (not exists(fc.getInputParameterIndex()) and (result = this))
+ )
+ )
+ }
+
+ override Expr getDest()
+ {
+ result = this
+ }
+
+ override int getMaxData()
+ {
+ exists(ScanfFunctionCall fc, ScanfFormatLiteral fl, int arg |
+ (this = fc.getArgument(arg))
+ and (fl = fc.getFormat())
+ and (result = (fl.getMaxConvertedLength(arg - getParamArgs()) + 1) * getCharSize()) // +1 is for the terminating null
+ )
+ }
+
+ override string getBWDesc()
+ {
+ exists(FunctionCall fc | (this = fc.getArgument(_))
+ and (result = fc.getTarget().getName() + " string argument")
+ )
+ }
+}
+
+/**
+ * A detected definition of PATH_MAX
+ */
+private int path_max() {
+ result = max(Macro macro |
+ macro.getName() = "PATH_MAX"
+ | macro.getBody().toInt())
+}
+
+/**
+ * A call to `realpath`.
+ */
+class RealpathBW extends BufferWriteCall {
+ RealpathBW() {
+ exists(path_max()) and // Ignore realpath() calls if PATH_MAX cannot be determined
+ getTarget().getQualifiedName() = "realpath" // realpath(path, resolved_path);
+ }
+
+ override Type getBufferType()
+ {
+ result = this.getTarget().getParameter(0).getType().getUnspecifiedType()
+ }
+
+ override Expr getDest() { result = getArgument(1) }
+ override Expr getASource() { result = getArgument(0) }
+
+ override int getMaxData() {
+ result = path_max()
+ and this = this // Suppress a compiler warning
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/security/CommandExecution.qll b/cpp/ql/src/semmle/code/cpp/security/CommandExecution.qll
new file mode 100644
index 000000000000..2b4eee59267a
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/security/CommandExecution.qll
@@ -0,0 +1,220 @@
+/* Definitions related to execution of commands */
+
+import cpp
+
+import semmle.code.cpp.security.FunctionWithWrappers
+
+/**
+ * A function for running a command using a command interpreter.
+ */
+class SystemFunction extends FunctionWithWrappers {
+ SystemFunction() {
+ hasQualifiedName("system")
+ or hasQualifiedName("popen")
+
+ // Windows variants
+ or hasQualifiedName("_popen")
+ or hasQualifiedName("_wpopen")
+ or hasQualifiedName("_wsystem")
+ }
+
+ override predicate interestingArg(int arg) {
+ arg = 0
+ }
+}
+
+
+/**
+ * A function for running a command via varargs. Note that, at the time
+ * of writing, FunctionWithWrappers doesn't really support varargs
+ * arguments, because it requires a finite version of interestingArg().
+ */
+class VarargsExecFunctionCall extends FunctionCall {
+ VarargsExecFunctionCall() {
+ getTarget().hasQualifiedName("execl")
+ or getTarget().hasQualifiedName("execle")
+ or getTarget().hasQualifiedName("execlp")
+
+ // Windows
+ or getTarget().hasQualifiedName("_execl")
+ or getTarget().hasQualifiedName("_execle")
+ or getTarget().hasQualifiedName("_execlp")
+ or getTarget().hasQualifiedName("_execlpe")
+ or getTarget().hasQualifiedName("_spawnl")
+ or getTarget().hasQualifiedName("_spawnle")
+ or getTarget().hasQualifiedName("_spawnlp")
+ or getTarget().hasQualifiedName("_spawnlpe")
+ or getTarget().hasQualifiedName("_wexecl")
+ or getTarget().hasQualifiedName("_wexecle")
+ or getTarget().hasQualifiedName("_wexeclp")
+ or getTarget().hasQualifiedName("_wexeclpe")
+ or getTarget().hasQualifiedName("_wspawnl")
+ or getTarget().hasQualifiedName("_wspawnle")
+ or getTarget().hasQualifiedName("_wspawnlp")
+ or getTarget().hasQualifiedName("_wspawnlpe")
+ }
+
+ /** Whether the last argument to the function is an environment pointer */
+ predicate hasEnvironmentArgument() {
+ getTarget().hasQualifiedName("execle")
+ or getTarget().hasQualifiedName("_execle")
+ or getTarget().hasQualifiedName("_execlpe")
+ or getTarget().hasQualifiedName("_wexecle")
+ or getTarget().hasQualifiedName("_wexeclpe")
+ }
+
+ /** The arguments passed to the command. The 0th such argument is conventionally
+ * the name of the command. */
+ Expr getCommandArgument(int idx) {
+ exists (int underlyingIdx |
+ result = getArgument(underlyingIdx)
+ and underlyingIdx > getCommandIdx()
+ and (
+ underlyingIdx < getNumberOfArguments() - 1
+ or not hasEnvironmentArgument()
+ )
+ and idx = underlyingIdx - getCommandIdx() - 1)
+ }
+
+ /** The expression denoting the program to execute */
+ Expr getCommand() {
+ result = getArgument(getCommandIdx())
+ }
+
+ /** The index of the command. The spawn variants start with a mode, whereas
+ * all the other ones start with the command. */
+ private int getCommandIdx() {
+ if (
+ getTarget().getQualifiedName().matches("\\_spawn%")
+ or getTarget().getQualifiedName().matches("\\_wspawn%"))
+ then result = 1
+ else result = 0
+ }
+}
+
+
+/**
+ * A function for running a command using an array of arguments. Note that
+ * FunctionWithWrappers does not support tracking multiple interesting
+ * arguments all the way to the call site.
+ */
+class ArrayExecFunctionCall extends FunctionCall {
+ ArrayExecFunctionCall() {
+ getTarget().hasQualifiedName("execv")
+ or getTarget().hasQualifiedName("execvp")
+ or getTarget().hasQualifiedName("execvpe")
+
+ // Windows variants
+ or getTarget().hasQualifiedName("_execv")
+ or getTarget().hasQualifiedName("_execve")
+ or getTarget().hasQualifiedName("_execvp")
+ or getTarget().hasQualifiedName("_execvpe")
+ or getTarget().hasQualifiedName("_spawnv")
+ or getTarget().hasQualifiedName("_spawnve")
+ or getTarget().hasQualifiedName("_spawnvp")
+ or getTarget().hasQualifiedName("_spawnvpe")
+ or getTarget().hasQualifiedName("_wexecv")
+ or getTarget().hasQualifiedName("_wexecve")
+ or getTarget().hasQualifiedName("_wexecvp")
+ or getTarget().hasQualifiedName("_wexecvpe")
+ or getTarget().hasQualifiedName("_wspawnv")
+ or getTarget().hasQualifiedName("_wspawnve")
+ or getTarget().hasQualifiedName("_wspawnvp")
+ or getTarget().hasQualifiedName("_wspawnvpe")
+ }
+
+ /** The argument with the array of command arguments */
+ Expr getArrayArgument() {
+ result = getArgument(getCommandIdx() + 1)
+ }
+
+ /** The expression denoting the program to execute */
+ Expr getCommand() {
+ result = getArgument(getCommandIdx())
+ }
+
+ /** The index of the command. The spawn variants start with a mode, whereas
+ * all the other ones start with the command. */
+ private int getCommandIdx() {
+ if (
+ getTarget().getQualifiedName().matches("\\_spawn%")
+ or getTarget().getQualifiedName().matches("\\_wspawn%"))
+ then result = 1
+ else result = 0
+ }
+}
+
+
+/** The name of a shell and the flag used to preface a command that should be parsed. Public
+ * for testing purposes. */
+predicate shellCommandPreface(string cmd, string flag) {
+ (
+ (cmd = "sh" or cmd = "/bin/sh" or cmd = "bash" or cmd = "/bin/bash")
+ and (flag = "-c")
+ ) or (
+ (cmd = "cmd" or cmd = "cmd.exe" or cmd = "CMD" or cmd = "CMD.EXE"
+ or cmd = "%WINDIR%\\system32\\cmd.exe" // used in Juliet tests
+ )
+ and (flag = "/c" or flag = "/C")
+ )
+}
+
+/**
+ * An array element. This supports multiple kinds of array syntax.
+ */
+private predicate arrayElement(Expr arrayLit, int idx, Expr element) {
+ exists (ArrayLiteral lit | lit = arrayLit |
+ lit.getElement(idx) = element)
+ or exists (MessageExpr arrayWithObjects | arrayWithObjects = arrayLit |
+ arrayWithObjects.getStaticTarget().getQualifiedName().matches("NSArray%::+arrayWithObjects:") and
+ arrayWithObjects.getArgument(idx) = element)
+}
+
+/**
+ * A command that is used as a command, or component of a command,
+ * that will be executed by a general-purpose command interpreter
+ * such as sh or cmd.exe.
+ */
+predicate shellCommand(Expr command, string callChain) {
+ // A call to a function like system()
+ exists (SystemFunction systemFunction |
+ systemFunction.outermostWrapperFunctionCall(command, callChain))
+
+ // A call to a function like execl(), passing "sh", then "-c", and then a command.
+ or exists (VarargsExecFunctionCall execCall, StringLiteral commandInterpreter, StringLiteral flag, int commandIdx |
+ callChain = execCall.getTarget().getName()
+ and execCall.getCommand() = commandInterpreter
+ and execCall.getCommandArgument(1) = flag
+ and execCall.getCommandArgument(commandIdx) = command
+ and commandIdx > 1
+ and shellCommandPreface(commandInterpreter.getValue(), flag.getValue()))
+
+ // A call to a function like execv(), where the array being passed is
+ // initialized to an array literal
+ or exists(
+ ArrayExecFunctionCall execCall, StringLiteral commandInterpreter, Variable arrayVariable,
+ AggregateLiteral arrayInitializer, StringLiteral flag, int idx
+ |
+ callChain = execCall.getTarget().getName()
+ and execCall.getCommand() = commandInterpreter
+ and execCall.getArrayArgument() = arrayVariable.getAnAccess()
+ and arrayVariable.getInitializer().getExpr() = arrayInitializer
+ and arrayInitializer.getChild(1) = flag
+ and arrayInitializer.getChild(idx) = command
+ and shellCommandPreface(commandInterpreter.getValue(), flag.getValue())
+ and idx > 1)
+
+ // Creation of NSTask
+ or exists(
+ MessageExpr launchedTaskCall, TextLiteral commandInterpreter,
+ Expr arrayLiteral, TextLiteral flag
+ |
+ launchedTaskCall.getStaticTarget().getQualifiedName().matches("NSTask%::+launchedTaskWithLaunchPath:arguments:")
+ and commandInterpreter = launchedTaskCall.getArgument(0)
+ and arrayLiteral = launchedTaskCall.getArgument(1)
+ and arrayElement(arrayLiteral, 0, flag)
+ and arrayElement(arrayLiteral, 1, command)
+ and shellCommandPreface(commandInterpreter.getValue(), flag.getValue())
+ and callChain = "NSTask")
+}
+
diff --git a/cpp/ql/src/semmle/code/cpp/security/Encryption.qll b/cpp/ql/src/semmle/code/cpp/security/Encryption.qll
new file mode 100644
index 000000000000..577a5c140b66
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/security/Encryption.qll
@@ -0,0 +1,57 @@
+// Common predicates relating to encryption in C and C++
+
+import cpp
+
+/** A blacklist of algorithms that are known to be insecure */
+string algorithmBlacklist() {
+ result = "DES" or
+ result = "RC2" or
+ result = "RC4" or
+ result = "RC5" or
+ result = "ARCFOUR" // a variant of RC4
+}
+
+// these are only bad if they're being used for encryption, and it's
+// hard to know when that's happening
+string hashAlgorithmBlacklist() {
+ result = "SHA1" or
+ result = "MD5"
+}
+
+/** A regex for matching strings that look like they contain a blacklisted algorithm */
+string algorithmBlacklistRegex() {
+ // algorithms usually appear in names surrounded by characters that are not
+ // alphabetical characters in the same case. This handles the upper and lower
+ // case cases
+ result = "(^|.*[^A-Z])" + algorithmBlacklist() + "([^A-Z].*|$)"
+ // for lowercase, we want to be careful to avoid being confused by camelCase
+ // hence we require two preceding uppercase letters to be sure of a case switch,
+ // or a preceding non-alphabetic character
+ or result = "(^|.*[A-Z]{2}|.*[^a-zA-Z])" + algorithmBlacklist().toLowerCase() + "([^a-z].*|$)"
+}
+
+/** A whitelist of algorithms that are known to be secure */
+string algorithmWhitelist() {
+ result = "RSA" or
+ result = "SHA256" or
+ result = "CCM" or
+ result = "GCM" or
+ result = "AES" or
+ result = "Blowfish" or
+ result = "ECIES"
+}
+
+/** A regex for matching strings that look like they contain a whitelisted algorithm */
+string algorithmWhitelistRegex() {
+ // The implementation of this is a duplicate of algorithmBlacklistRegex, as it isn't
+ // possible to have string -> string functions at the moment
+
+ // algorithms usually appear in names surrounded by characters that are not
+ // alphabetical characters in the same case. This handles the upper and lower
+ // case cases
+ result = "(^|.*[^A-Z])" + algorithmWhitelist() + "([^A-Z].*|$)"
+ // for lowercase, we want to be careful to avoid being confused by camelCase
+ // hence we require two preceding uppercase letters to be sure of a case switch,
+ // or a preceding non-alphabetic character
+ or result = "(^|.*[A-Z]{2}|.*[^a-zA-Z])" + algorithmWhitelist().toLowerCase() + "([^a-z].*|$)"
+}
diff --git a/cpp/ql/src/semmle/code/cpp/security/FileWrite.qll b/cpp/ql/src/semmle/code/cpp/security/FileWrite.qll
new file mode 100644
index 000000000000..85ca02aee563
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/security/FileWrite.qll
@@ -0,0 +1,184 @@
+import cpp
+
+/**
+ * A function call that writes to a file
+ */
+class FileWrite extends Expr {
+ FileWrite() {
+ fileWrite(this, _ ,_)
+ }
+
+ Expr getASource() {
+ fileWrite(this, result, _)
+ }
+
+ Expr getDest() {
+ fileWrite(this, _, result)
+ }
+}
+
+/**
+ * A `std::basic_ostream` class, or something that can be used
+ * as one.
+ */
+class BasicOStreamClass extends Type {
+ BasicOStreamClass() {
+ (
+ this.(Class).getName().matches("basic\\_ostream%")
+ ) or (
+ this.getUnspecifiedType() instanceof BasicOStreamClass
+ ) or (
+ this.(Class).getABaseClass() instanceof BasicOStreamClass
+ ) or (
+ this.(ReferenceType).getBaseType() instanceof BasicOStreamClass
+ )
+ }
+}
+
+/**
+ * A call to a member of `std::basic_ostream`, or something related,
+ * or a call with one of those objects as the first parameter.
+ */
+class BasicOStreamCall extends FunctionCall {
+ BasicOStreamCall() {
+ if (getTarget() instanceof MemberFunction) then (
+ getQualifier().getType() instanceof BasicOStreamClass
+ ) else (
+ getArgument(0).getType() instanceof BasicOStreamClass
+ )
+ }
+}
+
+/**
+ * Output by a function that can be chained, such as `operator<<`.
+ */
+abstract class ChainedOutputCall extends BasicOStreamCall {
+ /**
+ * The source expression of this output.
+ */
+ abstract Expr getSource();
+
+ /**
+ * The immediate destination expression of this output.
+ */
+ abstract Expr getDest();
+
+ /**
+ * The destination at the far left-hand end of the output chain.
+ */
+ Expr getEndDest()
+ {
+ (
+ // recurse into the destination
+ result = getDest().(ChainedOutputCall).getEndDest()
+ ) or (
+ // or return something other than a ChainedOutputCall
+ result = getDest() and
+ not result instanceof ChainedOutputCall
+ )
+ }
+}
+
+/**
+ * A call to `operator<<` on an output stream.
+ */
+class OperatorLShiftCall extends ChainedOutputCall {
+ OperatorLShiftCall() {
+ getTarget().(Operator).hasName("operator<<")
+ }
+
+ override Expr getSource() {
+ if (getTarget() instanceof MemberFunction) then (
+ result = getArgument(0)
+ ) else (
+ result = getArgument(1)
+ )
+ }
+
+ override Expr getDest() {
+ if (getTarget() instanceof MemberFunction) then (
+ result = getQualifier()
+ ) else (
+ result = getArgument(0)
+ )
+ }
+}
+
+/**
+ * A call to 'put'.
+ */
+class PutFunctionCall extends ChainedOutputCall {
+ PutFunctionCall() {
+ getTarget().(MemberFunction).hasName("put")
+ }
+
+ override Expr getSource() {
+ result = getArgument(0)
+ }
+
+ override Expr getDest() {
+ result = getQualifier()
+ }
+}
+
+/**
+ * A call to 'write'.
+ */
+class WriteFunctionCall extends ChainedOutputCall {
+ WriteFunctionCall() {
+ getTarget().(MemberFunction).hasName("write")
+ }
+
+ override Expr getSource() {
+ result = getArgument(0)
+ }
+
+ override Expr getDest() {
+ result = getQualifier()
+ }
+}
+
+/**
+ * Whether the function call is a call to << that eventually starts at the given file stream.
+ */
+private predicate fileStreamChain(ChainedOutputCall out, Expr source, Expr dest) {
+ source = out.getSource() and
+ dest = out.getEndDest() and
+ exists(string nme | nme = "basic_ofstream" or nme = "basic_fstream" |
+ dest.getUnderlyingType().(Class).getSimpleName() = nme
+ )
+}
+
+/**
+ * Whether the function call is a write to file 'dest' from 'source'.
+ */
+private predicate fileWrite(Call write, Expr source, Expr dest) {
+ exists(Function f, int s, int d | f = write.getTarget() and source = write.getArgument(s) and dest = write.getArgument(d) |
+ exists(string name | name = f.getQualifiedName() |
+ // named functions
+ name = "fwrite" and s = 0 and d = 3 or
+ (
+ name = "fputs" or
+ name = "fputws" or
+ name = "fputc" or
+ name = "fputwc" or
+ name = "putc" or
+ name = "putwc" or
+ name = "putw"
+ ) and s = 0 and d = 1 or
+ name.matches("NSFileManager%::-createFileAtPath:contents:attributes:") and s = 1 and d = 0 or
+ (
+ // methods that write into the receiver
+ dest = write.getQualifier() and
+ source = write.getArgument(0) and
+ name.matches("NSFileHandle%::-writeData:")
+ )
+ ) or (
+ // fprintf
+ s >= f.(Fprintf).getFormatParameterIndex() and
+ d = f.(Fprintf).getOutputParameterIndex()
+ )
+ ) or
+ // file stream using '<<', 'put' or 'write'
+ fileStreamChain(write, source, dest)
+}
diff --git a/cpp/ql/src/semmle/code/cpp/security/FunctionWithWrappers.qll b/cpp/ql/src/semmle/code/cpp/security/FunctionWithWrappers.qll
new file mode 100644
index 000000000000..b541658a2b42
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/security/FunctionWithWrappers.qll
@@ -0,0 +1,161 @@
+import cpp
+import PrintfLike
+private import TaintTracking
+
+private
+string toCause(Function func, int index)
+{
+ result = func.getQualifiedName() + "(" + func.getParameter(index).getName() + ")"
+}
+
+/**
+ * Whether the parameter at index 'sourceParamIndex' of function 'source' is passed
+ * (without any evident changes) to the parameter at index 'targetParamIndex' of function 'target'.
+ */
+private
+predicate wrapperFunctionStep(Function source, int sourceParamIndex, Function target, int targetParamIndex)
+{
+ not target.isVirtual() and
+ not source.isVirtual() and
+ source.isDefined() and
+
+ exists(Call call, Expr arg, Parameter sourceParam |
+ // there is a 'call' to 'target' with argument 'arg' at index 'targetParamIndex'
+ target = resolveCall(call) and
+ arg = call.getArgument(targetParamIndex) and
+
+ // 'call' is enclosed in 'source'
+ source = call.getEnclosingFunction() and
+
+ // 'arg' is an access to the parameter at index 'sourceParamIndex' of function 'source'
+ sourceParam = source.getParameter(sourceParamIndex) and
+ not exists(sourceParam.getAnAssignedValue()) and
+ arg = sourceParam.getAnAccess()
+ )
+}
+
+/**
+ * An abstract class for representing functions that may have wrapper functions.
+ * Wrapper functions propagate an argument (without any evident changes) to this function
+ * through one or more steps in a call chain.
+ *
+ * The design motivation is to report a violation at the location of the argument
+ * in a call to the wrapper function rather than the function being wrapped, since
+ * that is usually the more appropriate place to fix the violation.
+ *
+ * Subclasses should override the characteristic predicate and 'interestingArg'.
+ */
+abstract class FunctionWithWrappers extends Function {
+
+ /**
+ * Which argument indices are relevant for wrapper function detection.
+ */
+ predicate interestingArg(int arg) {
+ none()
+ }
+
+ /**
+ * Whether 'func' is a (possibly nested) wrapper function that feeds a parameter at the given index
+ * through to an interesting parameter of 'this' function at the given call chain 'depth'.
+ * The call chain depth is limited to 4.
+ */
+ private
+ predicate wrapperFunctionLimitedDepth(Function func, int paramIndex, string callChain, int depth)
+ {
+ // base case
+ (
+ func = this and
+ interestingArg(paramIndex) and
+ callChain = toCause(func, paramIndex) and
+ depth = 0
+ )
+ // recursive step
+ or
+ exists(Function target, int targetParamIndex, string targetCause, int targetDepth |
+ this.wrapperFunctionLimitedDepth(target, targetParamIndex, targetCause, targetDepth)
+ and targetDepth < 4
+ and wrapperFunctionStep(func, paramIndex, target, targetParamIndex)
+ and callChain = toCause(func, paramIndex) + ", which calls " + targetCause
+ and depth = targetDepth + 1
+ )
+ }
+
+ /**
+ * Whether 'func' is a (possibly nested) wrapper function that feeds a parameter at the given index
+ * through to an interesting parameter of 'this' function.
+ *
+ * The 'cause' gives the name of 'this' interesting function and its relevant parameter
+ * at the end of the call chain.
+ */
+ private
+ predicate wrapperFunctionAnyDepth(Function func, int paramIndex, string cause)
+ {
+ // base case
+ (
+ func = this and
+ interestingArg(paramIndex) and
+ cause = toCause(func, paramIndex)
+ )
+ // recursive step
+ or
+ exists(Function target, int targetParamIndex |
+ this.wrapperFunctionAnyDepth(target, targetParamIndex, cause)
+ and wrapperFunctionStep(func, paramIndex, target, targetParamIndex)
+ )
+ }
+
+ /**
+ * Whether 'func' is a (possibly nested) wrapper function that feeds a parameter at the given index
+ * through to an interesting parameter of 'this' function.
+ *
+ * If there exists a call chain with depth at most 4, the 'cause' reports the smallest call chain.
+ * Otherwise, the 'cause' merely reports the name of 'this' interesting function and its relevant
+ * parameter at the end of the call chain.
+ *
+ * If there is more than one possible 'cause', a unique one is picked (by lexicographic order).
+ */
+ predicate wrapperFunction(Function func, int paramIndex, string cause)
+ {
+ (
+ cause = min(string callChain, int depth |
+ this.wrapperFunctionLimitedDepth(func, paramIndex, callChain, depth) and
+ depth = min(int d | this.wrapperFunctionLimitedDepth(func, paramIndex, _, d) | d)
+ | callChain
+ )
+ )
+ or
+ (
+ not this.wrapperFunctionLimitedDepth(func, paramIndex, _, _) and
+ cause = min(string targetCause, string possibleCause |
+ this.wrapperFunctionAnyDepth(func, paramIndex, targetCause) and
+ possibleCause = toCause(func, paramIndex) + ", which ends up calling " + targetCause
+ | possibleCause
+ )
+ )
+ }
+
+ /**
+ * Whether 'arg' is an argument in a call to an outermost wrapper function of 'this' function.
+ */
+ predicate outermostWrapperFunctionCall(Expr arg, string callChain)
+ {
+ exists(Function func, Call call, int argIndex |
+ func = resolveCall(call)
+ and this.wrapperFunction(func, argIndex, callChain)
+ and not wrapperFunctionStep(call.getEnclosingFunction(), _, func, argIndex)
+ and arg = call.getArgument(argIndex)
+ )
+ }
+
+}
+
+
+class PrintfLikeFunction extends FunctionWithWrappers {
+ PrintfLikeFunction() {
+ printfLikeFunction(this, _)
+ }
+
+ override predicate interestingArg(int arg) {
+ printfLikeFunction(this, arg)
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/security/OutputWrite.qll b/cpp/ql/src/semmle/code/cpp/security/OutputWrite.qll
new file mode 100644
index 000000000000..f1a98c62be62
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/security/OutputWrite.qll
@@ -0,0 +1,88 @@
+import cpp
+import FileWrite
+
+/**
+ * A function call that writes to standard output or standard error
+ */
+class OutputWrite extends Expr {
+ OutputWrite() {
+ outputWrite(this, _)
+ }
+
+ Expr getASource() {
+ outputWrite(this, result)
+ }
+}
+
+/**
+ * A standard output or standard error variable.
+ */
+private predicate outputVariable(Variable v) {
+ // standard output
+ v.hasName("cout") or
+ v.hasName("wcout") or
+
+ // standard error
+ v.hasName("cerr") or
+ v.hasName("clog") or
+ v.hasName("wcerr") or
+ v.hasName("wclog")
+}
+
+/**
+ * An expr representing standard output or standard error.
+ */
+private predicate outputExpr(ChainedOutputCall out) {
+ // output chain ending in an access to standard output / standard error
+ outputVariable(out.getEndDest().(VariableAccess).getTarget())
+}
+
+/**
+ * A file representing standard output or standard error.
+ */
+private predicate outputFile(Expr e) {
+ exists(string name |
+ (
+ name = e.(VariableAccess).getTarget().(GlobalVariable).toString() or
+ name = e.findRootCause().(Macro).getName()
+ ) and (
+ name = "stdout" or
+ name = "stderr"
+ )
+ )
+}
+
+/**
+ * is the function call a write to standard output or standard error from 'source'
+ */
+private predicate outputWrite(Expr write, Expr source) {
+ exists(Function f, int arg | f = write.(Call).getTarget() and source = write.(Call).getArgument(arg) |
+ (
+ // printf
+ arg >= f.(Printf).getFormatParameterIndex()
+ ) or (
+ // syslog
+ arg >= f.(Syslog).getFormatParameterIndex()
+ ) or (
+ // puts, putchar
+ (
+ f.getQualifiedName() = "puts" or
+ f.getQualifiedName() = "putchar"
+ ) and arg = 0
+ ) or exists(Call wrappedCall, Expr wrappedSource |
+ // wrapped output call (recursive case)
+ outputWrite(wrappedCall, wrappedSource) and
+ wrappedCall.getEnclosingFunction() = f and
+ parameterUsePair(f.getParameter(arg), wrappedSource)
+ )
+ ) or (
+ // output to standard output / standard error using operator<<, put or write
+ outputExpr(write) and
+ source = write.(ChainedOutputCall).getSource()
+ ) or exists(FileWrite fileWrite |
+ // output to stdout, stderr as a file (using FileWrite.qll logic)
+ write = fileWrite and
+ outputFile(fileWrite.getDest()) and
+ source = fileWrite.getASource()
+ )
+}
diff --git a/cpp/ql/src/semmle/code/cpp/security/Overflow.qll b/cpp/ql/src/semmle/code/cpp/security/Overflow.qll
new file mode 100644
index 000000000000..72a9126d77fb
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/security/Overflow.qll
@@ -0,0 +1,83 @@
+import cpp
+import semmle.code.cpp.controlflow.Dominance
+
+/* Guarding */
+
+/** is the size of this use guarded using 'abs'? */
+predicate guardedAbs(BinaryArithmeticOperation e, Expr use) {
+ exists(FunctionCall fc |
+ fc.getTarget().getName() = "abs" |
+ fc.getArgument(0).getAChild*() = use
+ and guardedLesser(e, fc)
+ )
+}
+
+/** is the size of this use guarded to be less than something? */
+predicate guardedLesser(BinaryArithmeticOperation e, Expr use) {
+ exists(IfStmt c, RelationalOperation guard |
+ use = guard.getLesserOperand().getAChild*() and
+ guard = c.getControllingExpr().getAChild*() and
+ iDominates*(c.getThen(), e.getEnclosingStmt())
+ )
+ or exists(Loop c, RelationalOperation guard |
+ use = guard.getLesserOperand().getAChild*() and
+ guard = c.getControllingExpr().getAChild*() and
+ iDominates*(c.getStmt(), e.getEnclosingStmt())
+ )
+ or exists(ConditionalExpr c, RelationalOperation guard |
+ use = guard.getLesserOperand().getAChild*() and
+ guard = c.getCondition().getAChild*() and
+ c.getThen().getAChild*() = e
+ )
+ or guardedAbs(e, use)
+}
+
+/** is the size of this use guarded to be greater than something? */
+predicate guardedGreater(BinaryArithmeticOperation e, Expr use) {
+ exists(IfStmt c, RelationalOperation guard |
+ use = guard.getGreaterOperand().getAChild*() and
+ guard = c.getControllingExpr().getAChild*() and
+ iDominates*(c.getThen(), e.getEnclosingStmt())
+ )
+ or exists(Loop c, RelationalOperation guard |
+ use = guard.getGreaterOperand().getAChild*() and
+ guard = c.getControllingExpr().getAChild*() and
+ iDominates*(c.getStmt(), e.getEnclosingStmt())
+ )
+ or exists(ConditionalExpr c, RelationalOperation guard |
+ use = guard.getGreaterOperand().getAChild*() and
+ guard = c.getCondition().getAChild*() and
+ c.getThen().getAChild*() = e
+ )
+ or guardedAbs(e, use)
+}
+
+/** a use of a given variable */
+VariableAccess varUse(LocalScopeVariable v) {
+ result = v.getAnAccess()
+}
+
+/** is e not guarded against overflow by use? */
+predicate missingGuardAgainstOverflow(BinaryArithmeticOperation e, VariableAccess use) {
+ use = e.getAnOperand() and
+ exists(LocalScopeVariable v | use.getTarget() = v |
+ // overflow possible if large
+ (e instanceof AddExpr and not guardedLesser(e, varUse(v))) or
+ // overflow possible if large or small
+ (e instanceof MulExpr and
+ not (guardedLesser(e, varUse(v)) and guardedGreater(e, varUse(v))))
+ )
+}
+
+/** is e not guarded against underflow by use? */
+predicate missingGuardAgainstUnderflow(BinaryArithmeticOperation e, VariableAccess use) {
+ use = e.getAnOperand() and
+ exists(LocalScopeVariable v | use.getTarget() = v |
+ // underflow possible if use is left operand and small
+ (e instanceof SubExpr and
+ (use = e.getLeftOperand() and not guardedGreater(e, varUse(v)))) or
+ // underflow possible if large or small
+ (e instanceof MulExpr and
+ not (guardedLesser(e, varUse(v)) and guardedGreater(e, varUse(v))))
+ )
+}
diff --git a/cpp/ql/src/semmle/code/cpp/security/PrintfLike.qll b/cpp/ql/src/semmle/code/cpp/security/PrintfLike.qll
new file mode 100644
index 000000000000..daf7266092ec
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/security/PrintfLike.qll
@@ -0,0 +1,15 @@
+import semmle.code.cpp.commons.Printf
+import external.ExternalArtifact
+
+predicate printfLikeFunction(Function func, int formatArg) {
+ (formatArg = func.(FormattingFunction).getFormatParameterIndex() and not func instanceof UserDefinedFormattingFunction)
+ or
+ primitiveVariadicFormatter(func, formatArg, _)
+ or
+ exists(ExternalData data |
+ // TODO Do this \ to / conversion in the toolchain?
+ data.getDataPath().replaceAll("\\", "/") = "cert/formatingFunction.csv"
+ and func.getName() = data.getField(0)
+ and formatArg = data.getFieldAsInt(1)
+ )
+}
diff --git a/cpp/ql/src/semmle/code/cpp/security/Security.qll b/cpp/ql/src/semmle/code/cpp/security/Security.qll
new file mode 100644
index 000000000000..aad3b34e957a
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/security/Security.qll
@@ -0,0 +1,230 @@
+/**
+ * Definitions related to security queries.
+ * These can be extended for specific code bases.
+ */
+
+import semmle.code.cpp.exprs.Expr
+import semmle.code.cpp.commons.Environment
+import semmle.code.cpp.security.SecurityOptions
+
+
+/**
+ * Extend this class to customize the security queries for
+ * a particular code base. Provide no constructor in the
+ * subclass, and override any methods that need customizing.
+ */
+class SecurityOptions extends string {
+ SecurityOptions() {
+ this = "SecurityOptions"
+ }
+
+ /**
+ * This predicate should hold if the function with the given
+ * name is a pure function of its arguments.
+ */
+ predicate isPureFunction(string name) {
+ name = "abs"
+ or name = "atof"
+ or name = "atoi"
+ or name = "atol"
+ or name = "atoll"
+ or name = "labs"
+ or name = "strcasestr"
+ or name = "strcat"
+ or name = "strchnul"
+ or name = "strchr"
+ or name = "strchrnul"
+ or name = "strcmp"
+ or name = "strcpy"
+ or name = "strcspn"
+ or name = "strdup"
+ or name = "strlen"
+ or name = "strncat"
+ or name = "strncmp"
+ or name = "strncpy"
+ or name = "strndup"
+ or name = "strnlen"
+ or name = "strrchr"
+ or name = "strspn"
+ or name = "strstr"
+ or name = "strtod"
+ or name = "strtof"
+ or name = "strtol"
+ or name = "strtoll"
+ or name = "strtoq"
+ or name = "strtoul"
+ }
+
+ /**
+ * An argument to a function that is passed to a SQL server.
+ */
+ predicate sqlArgument(string function, int arg) {
+ // MySQL C API
+ (function = "mysql_query" and arg = 1) or
+ (function = "mysql_real_query" and arg = 1) or
+
+ // SQLite3 C API
+ (function = "sqlite3_exec" and arg = 1)
+ }
+
+ /**
+ * The argument of the given function is filled in from user input.
+ */
+ predicate userInputArgument(FunctionCall functionCall, int arg)
+ {
+ exists(string fname |
+ functionCall.getTarget().hasGlobalName(fname) and
+ exists(functionCall.getArgument(arg)) and
+ (
+ (fname = "read" and arg = 1) or
+ (fname = "fread" and arg = 0) or
+ (fname = "fgets" and arg = 0) or
+ (fname = "fgetws" and arg = 0) or
+ (fname = "gets" and arg = 0) or
+ (fname = "getaddrinfo" and arg = 3) or
+ (fname = "recv" and arg = 1) or
+ (fname = "recvfrom" and (arg = 1 or arg = 4 or arg = 5)) or
+ (fname = "recvmsg" and arg = 1) or
+ (fname = "scanf" and arg >= 1) or
+ (fname = "fscanf" and arg >= 2)
+ )
+ )
+ }
+
+ /**
+ * The return value of the given function is filled in from user input.
+ */
+ predicate userInputReturned(FunctionCall functionCall)
+ {
+ exists(string fname |
+ functionCall.getTarget().getName() = fname and
+ (
+ fname = "fgets" or
+ fname = "gets" or
+ userInputReturn(fname)
+ )
+ )
+ }
+
+ /**
+ * DEPRECATED: Users should override `userInputReturned()` instead.
+ *
+ * note: this function is not formally tagged as `deprecated` since the
+ * new `userInputReturned` uses it to provide compatibility with older
+ * custom SecurityOptions.qll files.
+ */
+ predicate userInputReturn(string function)
+ {
+ none()
+ }
+
+ /**
+ * The argument of the given function is used for running a process or loading
+ * a library.
+ */
+ predicate isProcessOperationArgument(string function, int arg) {
+ // POSIX
+ (function = "system" and arg = 0)
+ or (function = "popen" and arg = 0)
+ or (function = "execl" and arg = 0)
+ or (function = "execlp" and arg = 0)
+ or (function = "execle" and arg = 0)
+ or (function = "execv" and arg = 0)
+ or (function = "execvp" and arg = 0)
+ or (function = "execvpe" and arg = 0)
+ or (function = "dlopen" and arg = 0)
+
+ // Windows
+ or (function = "LoadLibrary" and arg = 0)
+ or (function = "LoadLibraryA" and arg = 0)
+ or (function = "LoadLibraryW" and arg = 0)
+ }
+
+ /**
+ * This predicate should hold if the expression is directly
+ * computed from user input. Such expressions are treated as
+ * sources of taint.
+ */
+ predicate isUserInput(Expr expr, string cause) {
+ exists(FunctionCall fc, int i |
+ this.userInputArgument(fc, i)
+ and expr = fc.getArgument(i)
+ and cause = fc.getTarget().getName())
+ or exists(FunctionCall fc |
+ this.userInputReturned(fc)
+ and expr = fc
+ and cause = fc.getTarget().getName())
+ or (commandLineArg(expr) and cause = "argv")
+ or expr.(EnvironmentRead).getSourceDescription() = cause
+ }
+
+ /**
+ * This predicate should hold if the expression raises privilege for the
+ * current session. The default definition only holds true for some
+ * example code in the test suite. This predicate must be extended for
+ * a particular code base to be useful.
+ */
+ predicate raisesPrivilege(Expr expr) {
+ exists (ReturnStmt ret | ret.getExpr() = expr |
+ ret.getEnclosingFunction().getName() = "checkPinCode"
+ and ret.getExpr().getValue() = "1")
+ or exists (AssignExpr assign, Variable adminPrivileges |
+ assign = expr
+ and adminPrivileges.hasName("adminPrivileges")
+ and assign.getLValue().(Access).getTarget() = adminPrivileges
+ and not (assign.getRValue().(Literal).getValue() = "0"))
+ }
+}
+
+/**
+ * An access to the argv argument to main().
+ */
+private predicate commandLineArg(Expr e)
+{
+ exists(Parameter argv |
+ argv(argv) and
+ argv.getAnAccess() = e)
+}
+
+/** The argv parameter to the main function */
+predicate argv(Parameter argv)
+{
+ exists(Function f |
+ f.hasGlobalName("main")
+ and f.getParameter(1) = argv)
+}
+
+/** Convenience accessor for SecurityOptions.isPureFunction */
+predicate isPureFunction(string name) {
+ exists (SecurityOptions opts | opts.isPureFunction(name))
+}
+
+/** Convenience accessor for SecurityOptions.userInputArgument */
+predicate userInputArgument(FunctionCall functionCall, int arg) {
+ exists (SecurityOptions opts | opts.userInputArgument(functionCall, arg))
+}
+
+/** Convenience accessor for SecurityOptions.userInputReturn */
+predicate userInputReturned(FunctionCall functionCall) {
+ exists (SecurityOptions opts | opts.userInputReturned(functionCall))
+}
+
+/** Convenience accessor for SecurityOptions.isUserInput */
+predicate isUserInput(Expr expr, string cause) {
+ exists (SecurityOptions opts | opts.isUserInput(expr, cause))
+}
+
+/** Convenience accessor for SecurityOptions.isProcessOperationArgument */
+predicate isProcessOperationArgument(string function, int arg) {
+ exists (SecurityOptions opts | opts.isProcessOperationArgument(function, arg))
+}
+
+/** Convenient accessor for SecurityOptions.raisesPrivilege */
+predicate raisesPrivilege(Expr expr) {
+ exists (SecurityOptions opts | opts.raisesPrivilege(expr))
+}
+
+/** Convenience accessor for SecurityOptions.sqlArgument */
+predicate sqlArgument(string function, int arg) {
+ exists (SecurityOptions opts | opts.sqlArgument(function, arg))
+}
diff --git a/cpp/ql/src/semmle/code/cpp/security/SecurityOptions.qll b/cpp/ql/src/semmle/code/cpp/security/SecurityOptions.qll
new file mode 100644
index 000000000000..47889a1f42eb
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/security/SecurityOptions.qll
@@ -0,0 +1,47 @@
+/*
+ * Security pack options.
+ *
+ * see https://semmle.com/wiki/display/SD/_Configuring+SecurityOptions+for+your+code+base
+ *
+ * Please note that functions for MySql and SQLite are included by default and do not
+ * require any customization here.
+ */
+
+import semmle.code.cpp.security.Security
+
+class CustomSecurityOptions extends SecurityOptions {
+ override predicate sqlArgument(string function, int arg) {
+ SecurityOptions.super.sqlArgument(function, arg) or
+ // --- custom functions that access SQL code via one of their arguments:
+ // 'arg' is the 0-based index of the argument that contains an SQL string
+ // for example: (function = "MySpecialSqlFunction" and arg = 0)
+ none() // rules to match custom functions replace this line
+ }
+
+ override predicate userInputArgument(FunctionCall functionCall, int arg)
+ {
+ SecurityOptions.super.userInputArgument(functionCall, arg) or
+ exists(string fname |
+ functionCall.getTarget().hasGlobalName(fname) and
+ exists(functionCall.getArgument(arg)) and (
+ // --- custom functions that return user input via one of their arguments:
+ // 'arg' is the 0-based index of the argument that is used to return user input
+ // for example: (fname = "readXmlInto" and arg = 1)
+ none() // rules to match custom functions replace this line
+ )
+ )
+ }
+
+ override predicate userInputReturned(FunctionCall functionCall)
+ {
+ SecurityOptions.super.userInputReturned(functionCall) or
+ exists(string fname |
+ functionCall.getTarget().hasGlobalName(fname) and
+ (
+ // --- custom functions that return user input via their return value:
+ // for example: fname = "xmlReadAttribute"
+ none() // rules to match custom functions replace this line
+ )
+ )
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/security/SensitiveExprs.qll b/cpp/ql/src/semmle/code/cpp/security/SensitiveExprs.qll
new file mode 100644
index 000000000000..e42f891fab48
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/security/SensitiveExprs.qll
@@ -0,0 +1,59 @@
+import cpp
+
+private string suspicious() {
+ result = "%password%" or
+ result = "%passwd%" or
+ result = "%account%" or
+ result = "%accnt%" or
+ result = "%trusted%"
+}
+
+private string nonSuspicious() {
+ result = "%hashed%" or
+ result = "%encrypted%" or
+ result = "%crypt%"
+}
+
+abstract class SensitiveExpr extends Expr {}
+
+class SensitiveVarAccess extends SensitiveExpr {
+ SensitiveVarAccess() {
+ this instanceof VariableAccess and
+ exists(string s | this.toString().toLowerCase() = s |
+ s.matches(suspicious())and
+ not s.matches(nonSuspicious())
+ )
+ }
+}
+
+class SensitiveCall extends SensitiveExpr {
+ SensitiveCall() {
+ this instanceof FunctionCall and
+ exists(string s | this.toString().toLowerCase() = s |
+ s.matches(suspicious())and
+ not s.matches(nonSuspicious())
+ )
+ }
+}
+
+class SensitivePropAccess extends SensitiveExpr {
+ SensitivePropAccess() {
+ exists (PropertyAccess acc, string name |
+ acc = this and
+ name = acc.getProperty().getName().toLowerCase() and
+ name.matches(suspicious()) and
+ not name.matches(nonSuspicious()))
+ }
+}
+
+/**
+ * A read from the value of a text widget.
+ */
+class SensitiveTextRead extends SensitiveExpr {
+ SensitiveTextRead() {
+ exists (PropertyAccess facc |
+ facc = this and
+ facc.getReceiver() instanceof SensitiveExpr and
+ facc.getProperty().getName() = "text")
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/security/TaintTracking.qll b/cpp/ql/src/semmle/code/cpp/security/TaintTracking.qll
new file mode 100644
index 000000000000..4e65172c8235
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/security/TaintTracking.qll
@@ -0,0 +1,630 @@
+/*
+ * Support for tracking tainted data through the program.
+ */
+
+import cpp
+import Security
+
+/** Expressions that change the value of a variable */
+private
+predicate valueSource(Expr expr)
+{
+ exists(AssignExpr ae | expr = ae.getLValue())
+ or
+ exists(FunctionCall fc, int i |
+ userInputArgument(fc, i)
+ and expr = fc.getArgument(i))
+ or
+ exists(FunctionCall c, int arg |
+ copyValueBetweenArguments(c.getTarget(), _, arg) and
+ expr = c.getArgument(arg))
+ or
+ exists(FunctionCall c, int arg |
+ c.getTarget().getParameter(arg).getType() instanceof ReferenceType and
+ expr = c.getArgument(arg))
+}
+
+/** Expressions that are inside an expression that changes the value of a variable */
+private
+predicate insideValueSource(Expr expr)
+{
+ valueSource(expr) or
+ (
+ insideValueSource(expr.getParent()) and
+
+ // A modification of array[offset] does not modify offset
+ not expr.getParent().(ArrayExpr).getArrayOffset() = expr
+ )
+}
+
+private
+predicate isPointer(Type type)
+{
+ type instanceof PointerType
+ or isPointer(type.(ReferenceType).getBaseType())
+}
+
+/**
+ * Tracks data flow from src to dest.
+ * If this is used in the left side of an assignment src and dest should be swapped
+ */
+private
+predicate moveToDependingOnSide(Expr src, Expr dest) {
+ exists(ParenthesisExpr e |
+ src = e.getAChild() and
+ dest = e
+ )
+ or
+ exists(ArrayExpr e |
+ src = e.getArrayBase() and
+ dest = e
+ )
+ or
+ exists(PointerDereferenceExpr e |
+ src = e.getOperand() and
+ dest = e
+ )
+ or
+ exists(AddressOfExpr e |
+ src = e.getOperand() and
+ dest = e
+ )
+ // if var+offset is tainted, then so is var
+ or exists (VariableAccess base, BinaryOperation binop |
+ dest = binop
+ and (base = binop.getLeftOperand() or base = binop.getRightOperand())
+ and isPointer(base.getType())
+ and base.getTarget() instanceof LocalScopeVariable
+ and src = base)
+ or exists (UnaryOperation unop |
+ dest = unop
+ and unop.getAnOperand() = src)
+ or (exists (BinaryOperation binop |
+ dest = binop
+ and binop.getLeftOperand() = src
+ and predictable(binop.getRightOperand())))
+ or (exists (BinaryOperation binop |
+ dest = binop
+ and binop.getRightOperand() = src
+ and predictable(binop.getLeftOperand())))
+ or exists (Cast cast |
+ dest = cast
+ and src = cast.getExpr())
+ or exists (ConditionalExpr cond |
+ cond = dest
+ and (
+ cond.getThen() = src
+ or cond.getElse() = src))
+}
+
+/**
+ * Track value flow between functions.
+ * Handles the following cases:
+ * - If an argument to a function is tainted, all the usages of the parameter inside the function are tainted
+ * - If a function obtains input from the user internally and returns it, all calls to the function are tainted
+ * - If an argument to a function is tainted and that parameter is returned, all calls to the function are not tainted
+ * (this is done to avoid false positives). Because of this we need to track if the tainted element came from an argument
+ * or not, and for that we use destFromArg
+ */
+private
+predicate betweenFunctionsValueMoveTo(Element src, Element dest, boolean destFromArg)
+{
+ not unreachable(src)
+ and not unreachable(dest)
+ and (
+ exists(Call call, Function called, int i |
+ src = call.getArgument(i)
+ and resolveCallWithParam(call, called, i, dest)
+ and destFromArg = true)
+
+ // Only move the return of the function to the function itself if the value didn't came from an
+ // argument, or else we would taint all the calls to one function if one argument is tainted
+ // somewhere
+ or exists(Function f, ReturnStmt ret |
+ ret.getEnclosingFunction() = f
+ and src = ret.getExpr()
+ and destFromArg = false
+ and dest = f)
+ or exists(Call call, Function f |
+ f = resolveCall(call)
+ and src = f
+ and dest = call
+ and destFromArg = false)
+
+ // If a parameter of type reference is tainted inside a function, taint the argument too
+ or exists(Call call, Function f, int pi, Parameter p |
+ resolveCallWithParam(call, f, pi, p)
+ and p.getType() instanceof ReferenceType
+ and src = p
+ and dest = call.getArgument(pi)
+ and destFromArg = false)
+ )
+}
+
+// predicate folding for proper join-order
+pragma [nomagic] // bad magic: pushes down predicate that ruins join-order
+private predicate resolveCallWithParam(Call call, Function called, int i, Parameter p) {
+ called = resolveCall(call)
+ and
+ p = called.getParameter(i)
+}
+
+/** A variable for which flow through is allowed. */
+library class FlowVariable extends Variable {
+ FlowVariable() {
+ (
+ this instanceof LocalScopeVariable
+ or this instanceof GlobalOrNamespaceVariable
+ )
+ and not argv(this)
+ }
+}
+
+/** A local scope variable for which flow through is allowed. */
+library class FlowLocalScopeVariable extends Variable {
+ FlowLocalScopeVariable() {
+ this instanceof LocalScopeVariable
+ }
+}
+
+private
+predicate insideFunctionValueMoveTo(Element src, Element dest)
+{
+ not unreachable(src)
+ and not unreachable(dest)
+ and (
+ // Taint all variable usages when one is tainted
+ // This function taints global variables but doesn't taint from a global variable (see globalVariableValueMoveTo)
+ exists(FlowLocalScopeVariable v |
+ src = v
+ and dest = v.getAnAccess()
+ and not insideValueSource(dest))
+ or exists(FlowVariable v |
+ src = v.getAnAccess()
+ and dest = v
+ and insideValueSource(src))
+
+ // Taint all union usages when one is tainted
+ // This function taints global variables but doesn't taint from a global variable (see globalVariableValueMoveTo)
+ or exists(FlowLocalScopeVariable v, FieldAccess a |
+ unionAccess(v, _, a)
+ and src = v
+ and dest = a
+ and not insideValueSource(dest))
+ or exists(FlowVariable v, FieldAccess a |
+ unionAccess(v, _, a)
+ and src = a
+ and dest = v
+ and insideValueSource(src))
+
+ // If a pointer is tainted, taint the original variable
+ or exists(FlowVariable p, FlowVariable v, AddressOfExpr e |
+ p.getAnAssignedValue() = e
+ and e.getOperand() = v.getAnAccess()
+ and src = p
+ and dest = v)
+ // If a reference is tainted, taint the original variable
+ or exists(FlowVariable r, FlowVariable v |
+ r.getType() instanceof ReferenceType
+ and r.getInitializer().getExpr() = v.getAnAccess()
+ and src = r
+ and dest = v)
+
+ or exists (Variable var |
+ var = dest
+ and var.getInitializer().getExpr() = src)
+ or exists(AssignExpr ae |
+ src = ae.getRValue()
+ and dest = ae.getLValue())
+ or exists (CommaExpr comma |
+ comma = dest
+ and comma.getRightOperand() = src)
+ or exists(FunctionCall c, int sourceArg, int destArg |
+ copyValueBetweenArguments(c.getTarget(), sourceArg, destArg)
+ // Only consider copies from `printf`-like functions if the format is a string
+ and (
+ exists(FormattingFunctionCall ffc, FormatLiteral format, string argFormat |
+ ffc = c
+ and format = ffc.getFormat()
+ and format.getConversionChar(sourceArg - ffc.getTarget().getNumberOfParameters()) = argFormat
+ and (argFormat = "s" or argFormat = "S")
+ )
+ or not exists(FormatLiteral fl | fl = c.(FormattingFunctionCall).getFormat())
+ or not c instanceof FormattingFunctionCall
+ )
+ and src = c.getArgument(sourceArg)
+ and dest = c.getArgument(destArg))
+ or exists(FunctionCall c, int sourceArg |
+ returnArgument(c.getTarget(), sourceArg)
+ and src = c.getArgument(sourceArg)
+ and dest = c)
+ or exists (MessageExpr send |
+ methodReturningAnyArgument(send.getStaticTarget())
+ and not send instanceof FormattingFunctionCall
+ and src = send.getAnArgument()
+ and dest = send)
+ or exists(FormattingFunctionCall formattingSend, int arg, FormatLiteral format, string argFormat |
+ dest = formattingSend
+ and formattingSend.getArgument(arg) = src
+ and format = formattingSend.getFormat()
+ and format.getConversionChar(arg - formattingSend.getTarget().getNumberOfParameters()) = argFormat
+ and (argFormat = "s" or argFormat = "S" or argFormat = "@"))
+ or exists (ExprMessageExpr send |
+ methodReturningReceiver(send.getStaticTarget())
+ and src = send.getReceiver()
+ and dest = send)
+ // Expressions computed from tainted data are also tainted
+ or (exists (FunctionCall call | dest = call and isPureFunction(call.getTarget().getName()) |
+ call.getAnArgument() = src
+ and forall(Expr arg | arg = call.getAnArgument() | arg = src or predictable(arg))))
+ or exists(Element a, Element b |
+ moveToDependingOnSide(a, b) and
+ if insideValueSource(a) then
+ (src = b and dest = a)
+ else
+ (src = a and dest = b)
+ )
+ )
+}
+
+/**
+ * Handles data flow from global variables to its usages.
+ * The tainting for the global variable itself is done at insideFunctionValueMoveTo.
+ */
+private
+predicate globalVariableValueMoveTo(GlobalOrNamespaceVariable src, Expr dest)
+{
+ not unreachable(dest)
+ and (
+ exists(GlobalOrNamespaceVariable v |
+ src = v
+ and dest = v.getAnAccess()
+ and not insideValueSource(dest))
+ or exists(GlobalOrNamespaceVariable v, FieldAccess a |
+ unionAccess(v, _, a)
+ and src = v
+ and dest = a
+ and not insideValueSource(dest))
+ )
+}
+
+private
+predicate unionAccess(Variable v, Field f, FieldAccess a)
+{
+ f.getDeclaringType() instanceof Union
+ and a.getTarget() = f
+ and a.getQualifier() = v.getAnAccess()
+}
+
+GlobalOrNamespaceVariable globalVarFromId(string id) {
+ if result instanceof NamespaceVariable then
+ id = result.getNamespace() + "::" + result.getName()
+ else
+ id = result.getName()
+}
+
+
+/**
+ * A variable that has any kind of upper-bound check anywhere in the program
+ */
+private
+predicate hasUpperBoundsCheck(Variable var) {
+ exists (BinaryOperation oper, VariableAccess access |
+ (oper.getOperator() = "<" or oper.getOperator() = "<=" or oper.getOperator() = ">" or oper.getOperator() = ">=")
+ and oper.getLeftOperand() = access
+ and access.getTarget() = var
+
+ // Comparing to 0 is not an upper bound check
+ and not oper.getRightOperand().getValue() = "0")
+}
+
+private
+cached
+predicate taintedWithArgsAndGlobalVars(Element src, Element dest, boolean destFromArg, string globalVar)
+{
+ (
+ isUserInput(src, _)
+ and not unreachable(src)
+ and dest = src
+ and destFromArg = false
+ and globalVar = ""
+ )
+ or exists (Element other, boolean otherFromArg, string otherGlobalVar | taintedWithArgsAndGlobalVars(src, other, otherFromArg, otherGlobalVar) |
+ not unreachable(dest)
+ and not hasUpperBoundsCheck(dest)
+ and (
+ // Direct flow from one expression to another.
+ (
+ betweenFunctionsValueMoveTo(other, dest, destFromArg)
+ and (destFromArg = true or otherFromArg = false)
+ and globalVar = otherGlobalVar
+ )
+ or
+ (
+ insideFunctionValueMoveTo(other, dest)
+ and destFromArg = otherFromArg
+ and globalVar = otherGlobalVar
+ )
+ or
+ exists(GlobalOrNamespaceVariable v |
+ v = other
+ and globalVariableValueMoveTo(v, dest)
+ and destFromArg = false
+ and v = globalVarFromId(globalVar)
+ )
+ )
+ )
+}
+
+/*
+ * A tainted expression is either directly user input, or is
+ * computed from user input in a way that users can probably
+ * control the exact output of the computation.
+ *
+ * This doesn't include data flow through global variables.
+ * If you need that you must call taintedIncludingGlobalVars.
+ */
+predicate tainted(Expr source, Element tainted) {
+ taintedWithArgsAndGlobalVars(source, tainted, _, "")
+}
+
+/*
+ * A tainted expression is either directly user input, or is
+ * computed from user input in a way that users can probably
+ * control the exact output of the computation.
+ *
+ * This version gives the same results as tainted but also includes
+ * data flow through global variables.
+ *
+ * @param globalVar the name of the last global variable used to move the
+ * value from source to tainted.
+ */
+predicate taintedIncludingGlobalVars(Expr source, Element tainted, string globalVar) {
+ taintedWithArgsAndGlobalVars(source, tainted, _, globalVar)
+}
+
+/*
+ * A predictable expression is one where an external user can predict
+ * the value. For example, a literal in the source code is considered
+ * predictable.
+ */
+private predicate predictable(Expr expr) {
+ (expr instanceof Literal)
+ or exists (BinaryOperation binop | binop = expr |
+ predictable(binop.getLeftOperand()) and predictable(binop.getRightOperand()))
+ or exists (UnaryOperation unop | unop = expr |
+ predictable(unop.getOperand()))
+}
+
+private int maxArgIndex(Function f)
+{
+ result = max(FunctionCall fc, int toMax | (fc.getTarget() = f) and (toMax = fc.getNumberOfArguments() - 1) | toMax)
+}
+
+/** Functions that copy the value of one argument to another */
+private predicate copyValueBetweenArguments(Function f, int sourceArg, int destArg)
+{
+ (f.hasGlobalName("memcpy") and sourceArg = 1 and destArg = 0)
+ or (f.hasGlobalName("__builtin___memcpy_chk") and sourceArg = 1 and destArg = 0)
+ or (f.hasGlobalName("memmove") and sourceArg = 1 and destArg = 0)
+ or (f.hasGlobalName("strcat") and sourceArg = 1 and destArg = 0)
+ or (f.hasGlobalName("_mbscat") and sourceArg = 1 and destArg = 0)
+ or (f.hasGlobalName("wcsncat") and sourceArg = 1 and destArg = 0)
+ or (f.hasGlobalName("strncat") and sourceArg = 1 and destArg = 0)
+ or (f.hasGlobalName("_mbsncat") and sourceArg = 1 and destArg = 0)
+ or (f.hasGlobalName("wcsncat") and sourceArg = 1 and destArg = 0)
+ or (f.hasGlobalName("strcpy") and sourceArg = 1 and destArg = 0)
+ or (f.hasGlobalName("_mbscpy") and sourceArg = 1 and destArg = 0)
+ or (f.hasGlobalName("wcscpy") and sourceArg = 1 and destArg = 0)
+ or (f.hasGlobalName("strncpy") and sourceArg = 1 and destArg = 0)
+ or (f.hasGlobalName("_mbsncpy") and sourceArg = 1 and destArg = 0)
+ or (f.hasGlobalName("wcsncpy") and sourceArg = 1 and destArg = 0)
+ or (f.hasGlobalName("inet_aton") and sourceArg = 0 and destArg = 1)
+ or (f.hasGlobalName("inet_pton") and sourceArg = 1 and destArg = 2)
+ or (f.hasGlobalName("strftime") and sourceArg in [2 .. maxArgIndex(f)] and destArg = 0)
+ or exists(FormattingFunction ff | ff = f |
+ sourceArg in [ff.getFormatParameterIndex() .. maxArgIndex(f)]
+ and destArg = ff.getOutputParameterIndex()
+ )
+}
+
+/** Functions where if one of the arguments is tainted, the result should be tainted */
+private predicate returnArgument(Function f, int sourceArg)
+{
+ (f.hasGlobalName("memcpy") and sourceArg = 0)
+ or (f.hasGlobalName("__builtin___memcpy_chk") and sourceArg = 0)
+ or (f.hasGlobalName("memmove") and sourceArg = 0)
+ or (f.hasGlobalName("strcat") and sourceArg = 0)
+ or (f.hasGlobalName("_mbscat") and sourceArg = 0)
+ or (f.hasGlobalName("wcsncat") and sourceArg = 0)
+ or (f.hasGlobalName("strncat") and sourceArg = 0)
+ or (f.hasGlobalName("_mbsncat") and sourceArg = 0)
+ or (f.hasGlobalName("wcsncat") and sourceArg = 0)
+ or (f.hasGlobalName("strcpy") and sourceArg = 0)
+ or (f.hasGlobalName("_mbscpy") and sourceArg = 0)
+ or (f.hasGlobalName("wcscpy") and sourceArg = 0)
+ or (f.hasGlobalName("strncpy") and sourceArg = 0)
+ or (f.hasGlobalName("_mbsncpy") and sourceArg = 0)
+ or (f.hasGlobalName("wcsncpy") and sourceArg = 0)
+ or (f.hasGlobalName("inet_ntoa") and sourceArg = 0)
+ or (f.hasGlobalName("inet_addr") and sourceArg = 0)
+ or (f.hasGlobalName("inet_network") and sourceArg = 0)
+ or (f.hasGlobalName("inet_ntoa") and sourceArg = 0)
+ or (f.hasGlobalName("inet_makeaddr") and (sourceArg = 0 or sourceArg = 1))
+ or (f.hasGlobalName("inet_lnaof") and sourceArg = 0)
+ or (f.hasGlobalName("inet_netof") and sourceArg = 0)
+ or (f.hasGlobalName("gethostbyname") and sourceArg = 0)
+ or (f.hasGlobalName("gethostbyaddr") and sourceArg = 0)
+}
+
+/** A method where if any argument is tainted, the return value should be, too */
+private predicate methodReturningAnyArgument(MemberFunction method) {
+ method.getQualifiedName().matches("NS%Array%::+array%") or
+ method.getQualifiedName().matches("NS%Array%::-arrayBy%") or
+ method.getQualifiedName().matches("NS%Array%::-componentsJoinedByString:") or
+ method.getQualifiedName().matches("NS%Array%::-init%") or
+ method.getQualifiedName().matches("NS%Data%::+dataWith%") or
+ method.getQualifiedName().matches("NS%Data%::-initWith%") or
+ method.getQualifiedName().matches("NS%String%::+pathWithComponents:") or
+ method.getQualifiedName().matches("NS%String%::+stringWith%") or
+ method.getQualifiedName().matches("NS%String%::-initWithCString:") or
+ method.getQualifiedName().matches("NS%String%::-initWithCString:length:") or
+ method.getQualifiedName().matches("NS%String%::-initWithCStringNoCopy:length:") or
+ method.getQualifiedName().matches("NS%String%::-initWithCharacters:length:") or
+ method.getQualifiedName().matches("NS%String%::-initWithCharactersNoCopy:length:freeWhenDone:") or
+ method.getQualifiedName().matches("NS%String%::-initWithFormat:") or
+ method.getQualifiedName().matches("NS%String%::-initWithFormat:arguments:") or
+ method.getQualifiedName().matches("NS%String%::-initWithString:") or
+ method.getQualifiedName().matches("NS%String%::-initWithUTF8String:") or
+ method.getQualifiedName().matches("NS%String%::-stringByAppendingFormat:") or
+ method.getQualifiedName().matches("NS%String%::-stringByAppendingString:") or
+ method.getQualifiedName().matches("NS%String%::-stringByPaddingToLength:withString:startingAtIndex:") or
+ method.getQualifiedName().matches("NS%String%::-stringByReplacing%") or
+ method.getQualifiedName().matches("NS%String%::-stringsByAppendingPaths:")
+}
+
+/** A method where if the receiver is tainted, the return value should be, too */
+private predicate methodReturningReceiver(MemberFunction method) {
+ method.getQualifiedName().matches("NS%Array%::-arrayBy%") or
+ method.getQualifiedName().matches("NS%Array%::-componentsJoinedByString:") or
+ method.getQualifiedName().matches("NS%Array%::-firstObject") or
+ method.getQualifiedName().matches("NS%Array%::-lastObject") or
+ method.getQualifiedName().matches("NS%Array%::-objectAt%") or
+ method.getQualifiedName().matches("NS%Array%::-pathsMatchingExtensions:") or
+ method.getQualifiedName().matches("NS%Array%::-sortedArray%") or
+ method.getQualifiedName().matches("NS%Array%::-subarrayWithRange:") or
+ method.getQualifiedName().matches("NS%Data%::-bytes") or
+ method.getQualifiedName().matches("NS%Data%::-subdataWithRange:") or
+ method.getQualifiedName().matches("NS%String%::-capitalizedString%") or
+ method.getQualifiedName().matches("NS%String%::-componentsSeparatedByCharactersInSet:") or
+ method.getQualifiedName().matches("NS%String%::-componentsSeparatedByString:") or
+ method.getQualifiedName().matches("NS%String%::-cStringUsingEncoding:") or
+ method.getQualifiedName().matches("NS%String%::-dataUsingEncoding:%") or
+ method.getQualifiedName().matches("NS%String%::-lowercaseString%") or
+ method.getQualifiedName().matches("NS%String%::-pathComponents") or
+ method.getQualifiedName().matches("NS%String%::-stringBy%") or
+ method.getQualifiedName().matches("NS%String%::-stringsByAppendingPaths:") or
+ method.getQualifiedName().matches("NS%String%::-substringFromIndex:") or
+ method.getQualifiedName().matches("NS%String%::-substringToIndex:") or
+ method.getQualifiedName().matches("NS%String%::-substringWithRange:") or
+ method.getQualifiedName().matches("NS%String%::-uppercaseString%") or
+ method.getQualifiedName().matches("NS%String%::-UTF8String")
+}
+
+/**
+ * Resolve potential target function(s) for `call`.
+ *
+ * If `call` is a call through a function pointer (`ExprCall`) or
+ * targets a virtual method, simple data flow analysis is performed
+ * in order to identify target(s).
+ */
+Function resolveCall(Call call) {
+ result = call.getTarget()
+ or
+ result = call.(DataSensitiveCallExpr).resolve()
+}
+
+/** A data sensitive call expression. */
+library abstract class DataSensitiveCallExpr extends @expr {
+ DataSensitiveCallExpr() { not unreachable(this) }
+
+ abstract Expr getSrc();
+ cached abstract Function resolve();
+ abstract string toString();
+
+ /**
+ * Whether `src` can flow to this call expression.
+ *
+ * Searches backwards from `getSrc()` to `src`.
+ */
+ predicate flowsFrom(Element src, boolean allowFromArg) {
+ src = getSrc() and allowFromArg = true
+ or
+ exists(Element other, boolean allowOtherFromArg | flowsFrom(other, allowOtherFromArg) |
+ exists(boolean otherFromArg |
+ betweenFunctionsValueMoveToStatic(src, other, otherFromArg) |
+ otherFromArg = true and allowOtherFromArg = true and allowFromArg = true
+ or
+ otherFromArg = false and allowFromArg = false
+ )
+ or
+ insideFunctionValueMoveTo(src, other) and allowFromArg = allowOtherFromArg
+ or
+ globalVariableValueMoveTo(src, other) and allowFromArg = true
+ )
+ }
+}
+
+/** Call through a function pointer. */
+library class DataSensitiveExprCall extends DataSensitiveCallExpr, ExprCall {
+ override Expr getSrc() { result = getExpr() }
+
+ override Function resolve() {
+ exists(FunctionAccess fa | flowsFrom(fa, true) | result = fa.getTarget())
+ }
+
+ override string toString() { result = ExprCall.super.toString() }
+}
+
+/** Call to a virtual function. */
+library class DataSensitiveOverriddenFunctionCall extends DataSensitiveCallExpr, FunctionCall {
+ DataSensitiveOverriddenFunctionCall() {
+ exists(getTarget().(VirtualFunction).getAnOverridingFunction())
+ }
+
+ override Expr getSrc() { result = getQualifier() }
+
+ override MemberFunction resolve() {
+ exists(NewExpr new |
+ flowsFrom(new, true)
+ and
+ memberFunctionFromNewExpr(new, result)
+ and
+ result.overrides*(getTarget().(VirtualFunction))
+ )
+ }
+
+ override string toString() { result = FunctionCall.super.toString() }
+}
+
+private predicate memberFunctionFromNewExpr(NewExpr new, MemberFunction f) {
+ f = new.getAllocatedType().(Class).getAMemberFunction()
+}
+
+/** Same as `betweenFunctionsValueMoveTo`, but calls are resolved to their static target. */
+private
+predicate betweenFunctionsValueMoveToStatic(Element src, Element dest, boolean destFromArg)
+{
+ not unreachable(src)
+ and not unreachable(dest)
+ and (
+ exists (FunctionCall call, Function called, int i |
+ src = call.getArgument(i)
+ and called = call.getTarget()
+ and dest = called.getParameter(i)
+ and destFromArg = true)
+
+ // Only move the return of the function to the function itself if the value didn't came from an
+ // argument, or else we would taint all the calls to one function if one argument is tainted
+ // somewhere
+ or exists(Function f, ReturnStmt ret |
+ ret.getEnclosingFunction() = f
+ and src = ret.getExpr()
+ and destFromArg = false
+ and dest = f)
+ or exists(FunctionCall call, Function f |
+ call.getTarget() = f
+ and src = f
+ and dest = call
+ and destFromArg = false)
+
+ // If a parameter of type reference is tainted inside a function, taint the argument too
+ or exists(FunctionCall call, Function f, int pi, Parameter p |
+ call.getTarget() = f
+ and f.getParameter(pi) = p
+ and p.getType() instanceof ReferenceType
+ and src = p
+ and dest = call.getArgument(pi)
+ and destFromArg = false)
+ )
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/AliasedSSAIR.qll b/cpp/ql/src/semmle/code/cpp/ssa/AliasedSSAIR.qll
new file mode 100644
index 000000000000..ca6ec999c6fc
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/AliasedSSAIR.qll
@@ -0,0 +1 @@
+import internal.aliased_ssa.IRImpl
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/AliasedSSAIRSanity.ql b/cpp/ql/src/semmle/code/cpp/ssa/AliasedSSAIRSanity.ql
new file mode 100644
index 000000000000..ee0e94374c62
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/AliasedSSAIRSanity.ql
@@ -0,0 +1,8 @@
+/**
+ * @name Aliased SSA IR Sanity Check
+ * @description Performs sanity checks on the Intermediate Representation. This query should have no results.
+ * @kind problem
+ * @id cpp/aliased-ssa-ir-sanity-check
+ */
+
+import internal.aliased_ssa.IRSanityImpl
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/PrintAliasedSSAIR.qll b/cpp/ql/src/semmle/code/cpp/ssa/PrintAliasedSSAIR.qll
new file mode 100644
index 000000000000..8498bff95502
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/PrintAliasedSSAIR.qll
@@ -0,0 +1 @@
+import internal.aliased_ssa.PrintIRImpl
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/PrintSSAIR.qll b/cpp/ql/src/semmle/code/cpp/ssa/PrintSSAIR.qll
new file mode 100644
index 000000000000..6389c4214981
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/PrintSSAIR.qll
@@ -0,0 +1 @@
+import internal.ssa.PrintIRImpl
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/SSAIR.qll b/cpp/ql/src/semmle/code/cpp/ssa/SSAIR.qll
new file mode 100644
index 000000000000..7ac7aea2c84b
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/SSAIR.qll
@@ -0,0 +1 @@
+import internal.ssa.IRImpl
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/SSAIRSanity.ql b/cpp/ql/src/semmle/code/cpp/ssa/SSAIRSanity.ql
new file mode 100644
index 000000000000..4f1ed9a92618
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/SSAIRSanity.ql
@@ -0,0 +1,8 @@
+/**
+ * @name SSA IR Sanity Check
+ * @description Performs sanity checks on the Intermediate Representation. This query should have no results.
+ * @kind problem
+ * @id cpp/ssa-ir-sanity-check
+ */
+
+import internal.ssa.IRSanityImpl
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/IntegerConstant.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/IntegerConstant.qll
new file mode 100644
index 000000000000..22fb8dea824a
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/IntegerConstant.qll
@@ -0,0 +1,111 @@
+import cpp
+
+class IntValue = int;
+
+/**
+ * Returns the value of the maximum representable integer.
+ */
+int maxValue() {
+ result = 2147483647
+}
+
+/**
+ * Returns the value of the minimum representable integer.
+ */
+int minValue() {
+ result = -2147483647
+}
+
+/**
+ * Returns a value representing an unknown integer.
+ */
+IntValue unknown() {
+ result = -2147483648
+}
+
+/**
+ * Holds if `n` has a known value.
+ */
+bindingset[n]
+predicate hasValue(IntValue n) {
+ n != unknown()
+}
+
+/**
+ * Holds if the value `f` is within the range of representable integers.
+ */
+pragma[inline]
+bindingset[f]
+private predicate isRepresentable(float f) {
+ (f >= minValue()) and (f <= maxValue())
+}
+
+/**
+ * Gets the value of `n`. Holds only if `n` has a known value.
+ */
+bindingset[n]
+int getValue(IntValue n) {
+ hasValue(n) and result = n
+}
+
+/**
+ * Returns `a + b`. If either input is unknown, or if the addition overflows,
+ * the result is unknown.
+ */
+bindingset[a, b]
+IntValue add(IntValue a, IntValue b) {
+ if hasValue(a) and hasValue(b) and isRepresentable((float)a + (float)b) then
+ result = a + b
+ else
+ result = unknown()
+}
+
+/**
+ * Returns `a - b`. If either input is unknown, or if the subtraction overflows,
+ * the result is unknown.
+ */
+bindingset[a, b]
+IntValue sub(IntValue a, IntValue b) {
+ if hasValue(a) and hasValue(b) and isRepresentable((float)a - (float)b) then
+ result = a - b
+ else
+ result = unknown()
+}
+
+/**
+ * Returns `a * b`. If the multiplication overflows, the result is unknown. If
+ * either input is unknown and the other input is non-zero, the result is
+ * unknown.
+ */
+bindingset[a, b]
+IntValue mul(IntValue a, IntValue b) {
+ if (a = 0) or (b = 0) then
+ result = 0
+ else if hasValue(a) and hasValue(b) and isRepresentable((float)a * (float)b) then
+ result = a * b
+ else
+ result = unknown()
+}
+
+/**
+ * Returns `a / b`. If either input is unknown, or if `b` is zero, the result is
+ * unknown.
+ */
+bindingset[a, b]
+IntValue div(IntValue a, IntValue b) {
+ // Normally, integer division has to worry about overflow for INT_MIN/-1.
+ // However, since we use INT_MIN to represent an unknown value anyway, we only
+ // have to worry about division by zero.
+ if hasValue(a) and hasValue(b) and (b != 0) then
+ result = a / b
+ else
+ result = unknown()
+}
+
+/**
+ * Return `-a`. If `a` is unknown, the result is unknown.
+ */
+bindingset[a]
+IntValue neg(IntValue a) {
+ result = -a // -INT_MIN = INT_MIN, so this preserves unknown
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/Overlap.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/Overlap.qll
new file mode 100644
index 000000000000..5786a136345b
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/Overlap.qll
@@ -0,0 +1,28 @@
+import cpp
+
+private newtype TOverlap =
+ TMayPartiallyOverlap() or
+ TMustTotallyOverlap() or
+ TMustExactlyOverlap()
+
+abstract class Overlap extends TOverlap {
+ abstract string toString();
+}
+
+class MayPartiallyOverlap extends Overlap, TMayPartiallyOverlap {
+ override final string toString() {
+ result = "MayPartiallyOverlap"
+ }
+}
+
+class MustTotallyOverlap extends Overlap, TMustTotallyOverlap {
+ override final string toString() {
+ result = "MustTotallyOverlap"
+ }
+}
+
+class MustExactlyOverlap extends Overlap, TMustExactlyOverlap {
+ override final string toString() {
+ result = "MustExactlyOverlap"
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/AliasAnalysis.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/AliasAnalysis.qll
new file mode 100644
index 000000000000..c5fd6e1d5ae6
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/AliasAnalysis.qll
@@ -0,0 +1,214 @@
+private import AliasAnalysisInternal
+import cpp
+private import IR
+private import semmle.code.cpp.ssa.internal.IntegerConstant as Ints
+
+private class IntValue = Ints::IntValue;
+
+/**
+ * Converts the bit count in `bits` to a byte count and a bit count in the form
+ * bytes:bits.
+ */
+bindingset[bits]
+string bitsToBytesAndBits(int bits) {
+ result = (bits / 8).toString() + ":" + (bits % 8).toString()
+}
+
+/**
+ * Gets a printable string for a bit offset with possibly unknown value.
+ */
+bindingset[bitOffset]
+string getBitOffsetString(IntValue bitOffset) {
+ if Ints::hasValue(bitOffset) then
+ if bitOffset >= 0 then
+ result = "+" + bitsToBytesAndBits(bitOffset)
+ else
+ result = "-" + bitsToBytesAndBits(Ints::neg(bitOffset))
+ else
+ result = "+?"
+}
+
+/**
+ * Gets the offset of field `field` in bits.
+ */
+private IntValue getFieldBitOffset(Field field) {
+ if (field instanceof BitField) then (
+ result = Ints::add(Ints::mul(field.getByteOffset(), 8),
+ field.(BitField).getBitOffset())
+ )
+ else (
+ result = Ints::mul(field.getByteOffset(), 8)
+ )
+}
+
+/**
+ * Holds if the operand `tag` of instruction `instr` is used in a way that does
+ * not result in any address held in that operand from escaping beyond the
+ * instruction.
+ */
+predicate operandIsConsumedWithoutEscaping(Instruction instr, OperandTag tag) {
+ exists(instr.getOperand(tag)) and
+ (
+ // The source/destination address of a Load/Store does not escape (but the
+ // loaded/stored value could).
+ tag instanceof LoadStoreAddressOperand or
+ // Neither operand of a Compare escapes.
+ instr instanceof CompareInstruction or
+ // Neither operand of a PointerDiff escapes.
+ instr instanceof PointerDiffInstruction or
+ // Converting an address to a `bool` does not escape the address.
+ instr.(ConvertInstruction).getResultType() instanceof BoolType
+ )
+}
+
+/**
+ * If the result of instruction `instr` is an integer constant, returns the
+ * value of that constant. Otherwise, returns unknown.
+ */
+IntValue getConstantValue(Instruction instr) {
+ if instr instanceof IntegerConstantInstruction then
+ result = instr.(IntegerConstantInstruction).getValue().toInt()
+ else
+ result = Ints::unknown()
+}
+
+/**
+ * Computes the offset, in bits, by which the result of `instr` differs from the
+ * pointer argument to `instr`, if that offset is a constant. Otherwise, returns
+ * unknown.
+ */
+IntValue getPointerBitOffset(PointerOffsetInstruction instr) {
+ exists(IntValue bitOffset |
+ (
+ bitOffset = Ints::mul(Ints::mul(getConstantValue(instr.getRightOperand()),
+ instr.getElementSize()), 8)
+ ) and
+ (
+ instr instanceof PointerAddInstruction and result = bitOffset or
+ instr instanceof PointerSubInstruction and result = Ints::neg(bitOffset)
+ )
+ )
+}
+
+/**
+ * Holds if any address held in operand `tag` of instruction `instr` is
+ * propagated to the result of `instr`, offset by the number of bits in
+ * `bitOffset`. If the address is propagated, but the offset is not known to be
+ * a constant, then `bitOffset` is unknown.
+ */
+predicate operandIsPropagated(Instruction instr, OperandTag tag,
+ IntValue bitOffset) {
+ exists(instr.getOperand(tag)) and
+ (
+ // Converting to a non-virtual base class adds the offset of the base class.
+ exists(ConvertToBaseInstruction convert |
+ convert = instr and
+ bitOffset = Ints::mul(convert.getDerivation().getByteOffset(), 8)
+ ) or
+ // Converting to a derived class subtracts the offset of the base class.
+ exists(ConvertToDerivedInstruction convert |
+ convert = instr and
+ bitOffset = Ints::neg(Ints::mul(convert.getDerivation().getByteOffset(), 8))
+ ) or
+ // Converting to a virtual base class adds an unknown offset.
+ (
+ instr instanceof ConvertToVirtualBaseInstruction and
+ bitOffset = Ints::unknown()
+ ) or
+ // Conversion to another pointer type propagates the source address.
+ exists(ConvertInstruction convert, Type resultType |
+ convert = instr and
+ resultType = convert.getResultType() and
+ (
+ resultType instanceof PointerType or
+ resultType instanceof Class //REVIEW: Remove when all glvalues are pointers
+ ) and
+ bitOffset = 0
+ ) or
+ // Adding an integer to or subtracting an integer from a pointer propagates
+ // the address with an offset.
+ bitOffset = getPointerBitOffset(instr.(PointerOffsetInstruction)) or
+ // Computing a field address from a pointer propagates the address plus the
+ // offset of the field.
+ bitOffset = getFieldBitOffset(instr.(FieldAddressInstruction).getField()) or
+ // A copy propagates the source value.
+ tag instanceof CopySourceOperand and bitOffset = 0
+ )
+}
+
+/**
+ * Holds if any address held in operand number `tag` of instruction `instr`
+ * escapes outside the domain of the analysis.
+ */
+predicate operandEscapes(Instruction instr, OperandTag tag) {
+ exists(instr.getOperand(tag)) and
+ // Conservatively assume that the address escapes unless one of the following
+ // holds:
+ not (
+ // The operand is used in a way that does not escape the instruction
+ operandIsConsumedWithoutEscaping(instr, tag) or
+ // The address is propagated to the result of the instruction, but that
+ // result does not itself escape.
+ operandIsPropagated(instr, tag, _) and not resultEscapes(instr)
+ )
+}
+
+/**
+ * Holds if any address held in the result of instruction `instr` escapes
+ * outside the domain of the analysis.
+ */
+predicate resultEscapes(Instruction instr) {
+ // The result escapes if it has at least one use that escapes.
+ exists(Instruction useInstr, OperandTag useOperandTag |
+ instr.hasUse(useInstr, useOperandTag) and
+ operandEscapes(useInstr, useOperandTag)
+ )
+}
+
+/**
+ * Holds if the address of the specified local variable or parameter escapes the
+ * domain of the analysis.
+ */
+private predicate automaticVariableAddressEscapes(IRAutomaticVariable var) {
+ exists(FunctionIR funcIR |
+ funcIR = var.getFunctionIR() and
+ // The variable's address escapes if the result of any
+ // VariableAddressInstruction that computes the variable's address escapes.
+ exists(VariableAddressInstruction instr |
+ instr.getFunctionIR() = funcIR and
+ instr.getVariable() = var and
+ resultEscapes(instr)
+ )
+ )
+}
+
+/**
+ * Holds if the address of the specified variable escapes the domain of the
+ * analysis.
+ */
+predicate variableAddressEscapes(IRVariable var) {
+ automaticVariableAddressEscapes(var.(IRAutomaticVariable)) or
+ // All variables with static storage duration have their address escape.
+ not var instanceof IRAutomaticVariable
+}
+
+/**
+ * Holds if the result of instruction `instr` points within variable `var`, at
+ * bit offset `bitOffset` within the variable. If the result points within
+ * `var`, but at an unknown or non-constant offset, then `bitOffset` is unknown.
+ */
+predicate resultPointsTo(Instruction instr, IRVariable var, IntValue bitOffset) {
+ (
+ // The address of a variable points to that variable, at offset 0.
+ instr.(VariableAddressInstruction).getVariable() = var and
+ bitOffset = 0
+ ) or
+ exists(OperandTag operandTag, IntValue originalBitOffset,
+ IntValue propagatedBitOffset |
+ // If an operand is propagated, then the result points to the same variable,
+ // offset by the bit offset from the propagation.
+ resultPointsTo(instr.getOperand(operandTag), var, originalBitOffset) and
+ operandIsPropagated(instr, operandTag, propagatedBitOffset) and
+ bitOffset = Ints::add(originalBitOffset, propagatedBitOffset)
+ )
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/AliasAnalysisInternal.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/AliasAnalysisInternal.qll
new file mode 100644
index 000000000000..13f43d1d1f4f
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/AliasAnalysisInternal.qll
@@ -0,0 +1 @@
+import semmle.code.cpp.ssa.SSAIR as IR
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/FunctionIR.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/FunctionIR.qll
new file mode 100644
index 000000000000..ba8f524f202f
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/FunctionIR.qll
@@ -0,0 +1,91 @@
+private import IRInternal
+import Instruction
+import cpp
+
+private newtype TFunctionIR =
+ MkFunctionIR(Function func) {
+ Construction::functionHasIR(func)
+ }
+
+/**
+ * Represents the IR for a function.
+ */
+class FunctionIR extends TFunctionIR {
+ Function func;
+
+ FunctionIR() {
+ this = MkFunctionIR(func)
+ }
+
+ final string toString() {
+ result = "IR: " + func.toString()
+ }
+
+ /**
+ * Gets the function whose IR is represented.
+ */
+ final Function getFunction() {
+ result = func
+ }
+
+ /**
+ * Gets the location of the function.
+ */
+ final Location getLocation() {
+ result = func.getLocation()
+ }
+
+ /**
+ * Gets the entry point for this function.
+ */
+ final EnterFunctionInstruction getEnterFunctionInstruction() {
+ result.getFunctionIR() = this
+ }
+
+ /**
+ * Gets the exit point for this function.
+ */
+ final ExitFunctionInstruction getExitFunctionInstruction() {
+ result.getFunctionIR() = this
+ }
+
+ final UnmodeledDefinitionInstruction getUnmodeledDefinitionInstruction() {
+ result.getFunctionIR() = this
+ }
+
+ /**
+ * Gets the single return instruction for this function.
+ */
+ final ReturnInstruction getReturnInstruction() {
+ result.getFunctionIR() = this
+ }
+
+ /**
+ * Gets the variable used to hold the return value of this function. If this
+ * function does not return a value, this predicate does not hold.
+ */
+ final IRReturnVariable getReturnVariable() {
+ result.getFunctionIR() = this
+ }
+
+ /**
+ * Gets the block containing the entry point of this function.
+ */
+ final IRBlock getEntryBlock() {
+ result.getFirstInstruction() = getEnterFunctionInstruction()
+ }
+
+ /**
+ * Gets all instructions in this function.
+ */
+ final Instruction getAnInstruction() {
+ result.getFunctionIR() = this
+ }
+
+ /**
+ * Gets all blocks in this function.
+ */
+ final IRBlock getABlock() {
+ result.getFunctionIR() = this
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/IRBlock.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/IRBlock.qll
new file mode 100644
index 000000000000..98ec650036db
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/IRBlock.qll
@@ -0,0 +1,131 @@
+private import IRInternal
+import Instruction
+import cpp
+import semmle.code.cpp.ir.EdgeKind
+
+private predicate startsBasicBlock(Instruction instr) {
+ not instr instanceof PhiInstruction and
+ (
+ count(Instruction predecessor |
+ instr = predecessor.getASuccessor()
+ ) != 1 or // Multiple predecessors or no predecessor
+ exists(Instruction predecessor |
+ instr = predecessor.getASuccessor() and
+ strictcount(Instruction other |
+ other = predecessor.getASuccessor()
+ ) > 1
+ ) or // Predecessor has multiple successors
+ exists(Instruction predecessor, EdgeKind kind |
+ instr = predecessor.getSuccessor(kind) and
+ not kind instanceof GotoEdge
+ ) // Incoming edge is not a GotoEdge
+ )
+}
+
+private newtype TIRBlock =
+ MkIRBlock(Instruction firstInstr) {
+ startsBasicBlock(firstInstr)
+ }
+
+cached private predicate isEntryBlock(IRBlock block) {
+ block.getFirstInstruction() instanceof EnterFunctionInstruction
+}
+
+cached private predicate blockSuccessor(IRBlock pred, IRBlock succ) {
+ succ = pred.getASuccessor()
+}
+
+private predicate blockImmediatelyDominates(IRBlock dominator, IRBlock block) =
+ idominance(isEntryBlock/1, blockSuccessor/2)(_, dominator, block)
+
+class IRBlock extends TIRBlock {
+ Instruction firstInstr;
+
+ IRBlock() {
+ this = MkIRBlock(firstInstr)
+ }
+
+ final string toString() {
+ result = firstInstr.toString()
+ }
+
+ final Location getLocation() {
+ result = getFirstInstruction().getLocation()
+ }
+
+ final string getUniqueId() {
+ result = firstInstr.getUniqueId()
+ }
+
+ final cached Instruction getInstruction(int index) {
+ index = 0 and result = firstInstr or
+ (
+ index > 0 and
+ not startsBasicBlock(result) and
+ exists(Instruction predecessor, GotoEdge edge |
+ predecessor = getInstruction(index - 1) and
+ result = predecessor.getSuccessor(edge)
+ )
+ )
+ }
+
+ final PhiInstruction getAPhiInstruction() {
+ Construction::getPhiInstructionBlockStart(result) =
+ getFirstInstruction()
+ }
+
+ final Instruction getAnInstruction() {
+ result = getInstruction(_) or
+ result = getAPhiInstruction()
+ }
+
+ final Instruction getFirstInstruction() {
+ result = firstInstr
+ }
+
+ final Instruction getLastInstruction() {
+ result = getInstruction(getInstructionCount() - 1)
+ }
+
+ final int getInstructionCount() {
+ result = strictcount(getInstruction(_))
+ }
+
+ final FunctionIR getFunctionIR() {
+ result = firstInstr.getFunctionIR()
+ }
+
+ final Function getFunction() {
+ result = firstInstr.getFunction()
+ }
+
+ final IRBlock getASuccessor() {
+ result.getFirstInstruction() = getLastInstruction().getASuccessor()
+ }
+
+ final IRBlock getAPredecessor() {
+ firstInstr = result.getLastInstruction().getASuccessor()
+ }
+
+ final IRBlock getSuccessor(EdgeKind kind) {
+ result.getFirstInstruction() = getLastInstruction().getSuccessor(kind)
+ }
+
+ final predicate immediatelyDominates(IRBlock block) {
+ blockImmediatelyDominates(this, block)
+ }
+
+ final predicate strictlyDominates(IRBlock block) {
+ blockImmediatelyDominates+(this, block)
+ }
+
+ final predicate dominates(IRBlock block) {
+ strictlyDominates(block) or this = block
+ }
+
+ pragma[noinline]
+ final IRBlock dominanceFrontier() {
+ dominates(result.getAPredecessor()) and
+ not strictlyDominates(result)
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/IRImpl.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/IRImpl.qll
new file mode 100644
index 000000000000..97c027cc1280
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/IRImpl.qll
@@ -0,0 +1,7 @@
+import FunctionIR
+import Instruction
+import IRBlock
+import IRVariable
+import OperandTag
+import semmle.code.cpp.ir.EdgeKind
+import semmle.code.cpp.ir.MemoryAccessKind
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/IRInternal.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/IRInternal.qll
new file mode 100644
index 000000000000..7517660a58f0
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/IRInternal.qll
@@ -0,0 +1 @@
+import SSAConstruction as Construction
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/IRSanityImpl.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/IRSanityImpl.qll
new file mode 100644
index 000000000000..744b28704604
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/IRSanityImpl.qll
@@ -0,0 +1,3 @@
+private import IRImpl
+import InstructionSanity
+
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/IRVariable.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/IRVariable.qll
new file mode 100644
index 000000000000..a903e227b26c
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/IRVariable.qll
@@ -0,0 +1,202 @@
+private import IRInternal
+import FunctionIR
+import cpp
+import semmle.code.cpp.ir.TempVariableTag
+private import semmle.code.cpp.ir.internal.TempVariableTag
+
+private newtype TIRVariable =
+ TIRAutomaticUserVariable(LocalScopeVariable var, FunctionIR funcIR) {
+ exists(Function func |
+ func = funcIR.getFunction() and
+ (
+ var.getFunction() = func or
+ var.(Parameter).getCatchBlock().getEnclosingFunction() = func
+ )
+ )
+ } or
+ TIRStaticUserVariable(Variable var, FunctionIR funcIR) {
+ (
+ var instanceof GlobalOrNamespaceVariable or
+ var instanceof MemberVariable and not var instanceof Field
+ ) and
+ exists(VariableAccess access |
+ access.getTarget() = var and
+ access.getEnclosingFunction() = funcIR.getFunction()
+ )
+ } or
+ TIRTempVariable(FunctionIR funcIR, Locatable ast, TempVariableTag tag,
+ Type type) {
+ Construction::hasTempVariable(funcIR.getFunction(), ast, tag, type)
+ }
+
+IRUserVariable getIRUserVariable(Function func, Variable var) {
+ result.getVariable() = var and
+ result.getFunction() = func
+}
+
+/**
+ * Represents a variable referenced by the IR for a function. The variable may
+ * be a user-declared variable (`IRUserVariable`) or a temporary variable
+ * generated by the AST-to-IR translation (`IRTempVariable`).
+ */
+abstract class IRVariable extends TIRVariable {
+ FunctionIR funcIR;
+
+ abstract string toString();
+
+ /**
+ * Gets the type of the variable.
+ */
+ abstract Type getType();
+
+ /**
+ * Gets the AST node that declared this variable, or that introduced this
+ * variable as part of the AST-to-IR translation.
+ */
+ abstract Locatable getAST();
+
+ /**
+ * Gets an identifier string for the variable. This identifier is unique
+ * within the function.
+ */
+ abstract string getUniqueId();
+
+ /**
+ * Gets the source location of this variable.
+ */
+ final Location getLocation() {
+ result = getAST().getLocation()
+ }
+
+ /**
+ * Gets the IR for the function that references this variable.
+ */
+ final FunctionIR getFunctionIR() {
+ result = funcIR
+ }
+
+ /**
+ * Gets the function that references this variable.
+ */
+ final Function getFunction() {
+ result = funcIR.getFunction()
+ }
+}
+
+/**
+ * Represents a user-declared variable referenced by the IR for a function.
+ */
+abstract class IRUserVariable extends IRVariable {
+ Variable var;
+
+ override final string toString() {
+ result = var.toString()
+ }
+
+ override final Type getType() {
+ result = var.getType().getUnspecifiedType()
+ }
+
+ override final Locatable getAST() {
+ result = var
+ }
+
+ override final string getUniqueId() {
+ result = var.toString() + " " + var.getLocation().toString()
+ }
+
+ /**
+ * Gets the original user-declared variable.
+ */
+ final Variable getVariable() {
+ result = var
+ }
+}
+
+/**
+ * Represents a variable (user-declared or temporary) that is allocated on the
+ * stack. This includes all parameters, non-static local variables, and
+ * temporary variables.
+ */
+abstract class IRAutomaticVariable extends IRVariable {
+}
+
+class IRAutomaticUserVariable extends IRUserVariable, IRAutomaticVariable,
+ TIRAutomaticUserVariable {
+ LocalScopeVariable localVar;
+
+ IRAutomaticUserVariable() {
+ this = TIRAutomaticUserVariable(localVar, funcIR) and
+ var = localVar
+ }
+
+ final LocalScopeVariable getLocalVariable() {
+ result = localVar
+ }
+}
+
+class IRStaticUserVariable extends IRUserVariable, TIRStaticUserVariable {
+ IRStaticUserVariable() {
+ this = TIRStaticUserVariable(var, funcIR)
+ }
+}
+
+IRTempVariable getIRTempVariable(Locatable ast, TempVariableTag tag) {
+ result.getAST() = ast and
+ result.getTag() = tag
+}
+
+class IRTempVariable extends IRVariable, IRAutomaticVariable, TIRTempVariable {
+ Locatable ast;
+ TempVariableTag tag;
+ Type type;
+
+ IRTempVariable() {
+ this = TIRTempVariable(funcIR, ast, tag, type)
+ }
+
+ override final Type getType() {
+ result = type
+ }
+
+ override final Locatable getAST() {
+ result = ast
+ }
+
+ override final string getUniqueId() {
+ result = "Temp: " + Construction::getTempVariableUniqueId(this)
+ }
+
+ final TempVariableTag getTag() {
+ result = tag
+ }
+
+ override string toString() {
+ result = getBaseString() + ast.getLocation().getStartLine().toString() + ":" +
+ ast.getLocation().getStartColumn().toString()
+ }
+
+ string getBaseString() {
+ result = "#temp"
+ }
+}
+
+class IRReturnVariable extends IRTempVariable {
+ IRReturnVariable() {
+ tag = ReturnValueTempVar()
+ }
+
+ override final string toString() {
+ result = "#return"
+ }
+}
+
+class IRThrowVariable extends IRTempVariable {
+ IRThrowVariable() {
+ tag = ThrowTempVar()
+ }
+
+ override string getBaseString() {
+ result = "#throw"
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/Instruction.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/Instruction.qll
new file mode 100644
index 000000000000..d00999f894aa
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/Instruction.qll
@@ -0,0 +1,978 @@
+private import IRInternal
+import FunctionIR
+import IRBlock
+import IRVariable
+import OperandTag
+import cpp
+import semmle.code.cpp.ir.EdgeKind
+import semmle.code.cpp.ir.MemoryAccessKind
+import semmle.code.cpp.ir.Opcode
+private import semmle.code.cpp.ir.internal.Opcode
+
+class InstructionTag = Construction::InstructionTagType;
+
+module InstructionSanity {
+ /**
+ * Holds if the instruction `instr` should be expected to have an operand
+ * with operand tag `tag`. Only holds for singleton operand tags. Tags with
+ * parameters, such as `PhiOperand` and `PositionalArgumentOperand` are handled
+ * separately in `unexpectedOperand`.
+ */
+ private predicate expectsOperand(Instruction instr, OperandTag tag) {
+ exists(Opcode opcode |
+ opcode = instr.getOpcode() and
+ (
+ opcode instanceof UnaryOpcode and tag instanceof UnaryOperand or
+ (
+ opcode instanceof BinaryOpcode and
+ (
+ tag instanceof LeftOperand or
+ tag instanceof RightOperand
+ )
+ ) or
+ opcode instanceof CopyOpcode and tag instanceof CopySourceOperand or
+ opcode instanceof MemoryAccessOpcode and tag instanceof LoadStoreAddressOperand or
+ opcode instanceof OpcodeWithCondition and tag instanceof ConditionOperand or
+ opcode instanceof Opcode::ReturnValue and tag instanceof ReturnValueOperand or
+ opcode instanceof Opcode::ThrowValue and tag instanceof ExceptionOperand or
+ opcode instanceof Opcode::UnmodeledUse and tag instanceof UnmodeledUseOperand or
+ opcode instanceof Opcode::Invoke and tag instanceof CallTargetOperand
+ )
+ )
+ }
+
+ /**
+ * Holds if instruction `instr` is missing an expected operand with tag `tag`.
+ */
+ query predicate missingOperand(Instruction instr, OperandTag tag) {
+ expectsOperand(instr, tag) and not exists(instr.getOperand(tag))
+ }
+
+ /**
+ * Holds if instruction `instr` has an unexpected operand with tag `tag`.
+ */
+ query predicate unexpectedOperand(Instruction instr, OperandTag tag) {
+ exists(instr.getOperand(tag)) and
+ not expectsOperand(instr, tag) and
+ not (instr instanceof InvokeInstruction and tag instanceof ArgumentOperand) and
+ not (instr instanceof BuiltInInstruction and tag instanceof PositionalArgumentOperand) and
+ not (instr instanceof PhiInstruction and tag instanceof PhiOperand)
+ }
+
+ /**
+ * Holds if instruction `instr` has multiple operands with tag `tag`.
+ */
+ query predicate duplicateOperand(Instruction instr, OperandTag tag) {
+ count(instr.getOperand(tag)) > 1 and
+ not tag instanceof UnmodeledUseOperand
+ }
+}
+
+/**
+ * Represents a single operation in the IR.
+ */
+class Instruction extends Construction::TInstruction {
+ Opcode opcode;
+ Locatable ast;
+ InstructionTag instructionTag;
+ Type resultType;
+ FunctionIR funcIR;
+ boolean glvalue;
+
+ Instruction() {
+ this = Construction::MkInstruction(funcIR, opcode, ast, instructionTag, resultType, glvalue)
+ }
+
+ string toString() {
+ result = opcode.toString()
+ }
+
+ /**
+ * Gets a string identifier for this function that is unique among all
+ * instructions in the same function.
+ *
+ * This is used for sorting IR output for tests, and is likely to be
+ * inefficient for any other use.
+ */
+ final string getUniqueId() {
+ result = Construction::getInstructionUniqueId(this)
+ }
+
+ /**
+ * Gets the basic block that contains this instruction.
+ */
+ final IRBlock getBlock() {
+ result.getAnInstruction() = this
+ }
+
+ /**
+ * Gets the function that contains this instruction.
+ */
+ final Function getFunction() {
+ result = funcIR.getFunction()
+ }
+
+ /**
+ * Gets the FunctionIR object that contains the IR for this instruction.
+ */
+ final FunctionIR getFunctionIR() {
+ result = funcIR
+ }
+
+ /**
+ * Gets the AST that caused this instruction to be generated.
+ */
+ final Locatable getAST() {
+ result = ast
+ }
+
+ /**
+ * Gets the location of the source code for this instruction.
+ */
+ final Location getLocation() {
+ result = ast.getLocation()
+ }
+
+ /**
+ * Gets the type of the result produced by this instruction. If the
+ * instruction does not produce a result, its result type will be `VoidType`.
+ */
+ final Type getResultType() {
+ result = resultType
+ }
+
+ /**
+ * Holds if the result produced by this instruction is a glvalue. If this
+ * holds, the result of the instruction represents the address of a location,
+ * and the type of the location is given by `getResultType()`. If this does
+ * not hold, the result of the instruction represents a value whose type is
+ * given by `getResultType()`.
+ *
+ * For example, the statement `y = x;` generates the following IR:
+ * r1_0(glval: int) = VariableAddress[x]
+ * r1_1(int) = Load r1_0, mu0_1
+ * r1_2(glval: int) = VariableAddress[y]
+ * mu1_3(int) = Store r1_2, r1_1
+ *
+ * The result of each `VariableAddress` instruction is a glvalue of type
+ * `int`, representing the address of the corresponding integer variable. The
+ * result of the `Load` instruction is a prvalue of type `int`, representing
+ * the integer value loaded from variable `x`.
+ */
+ final predicate isGLValue() {
+ glvalue = true
+ }
+
+ /**
+ * Gets the size of the result produced by this instruction, in bytes. If the
+ * instruction does not produce a result, or if the result does not have a
+ * known constant size, this predicate does not hold.
+ *
+ * If `this.isGLValue()` holds for this instruction, the value of
+ * `getResultSize()` will always be the size of a pointer.
+ */
+ final int getResultSize() {
+ if isGLValue() then (
+ // a glvalue is always pointer-sized.
+ exists(NullPointerType nullptr |
+ result = nullptr.getSize()
+ )
+ )
+ else if resultType instanceof UnknownType then
+ result = Construction::getInstructionResultSize(this)
+ else (
+ not resultType instanceof VoidType and
+ result = resultType.getSize()
+ )
+ }
+
+ /**
+ * Gets the opcode that specifies the operation performed by this instruction.
+ */
+ final Opcode getOpcode() {
+ result = opcode
+ }
+
+ final InstructionTag getTag() {
+ result = instructionTag
+ }
+
+ /**
+ * Gets the instruction that produced the value of the specified source
+ * operand.
+ */
+ final Instruction getOperand(OperandTag tag) {
+ result = Construction::getInstructionOperand(this, tag)
+ }
+
+ /**
+ * Gets all instructions consumed by this instruction's operands.
+ */
+ final Instruction getAnOperand() {
+ result = getOperand(_)
+ }
+
+ /**
+ * Holds if this instruction has a memory operand with the specified tag.
+ */
+ final predicate isMemoryOperand(OperandTag tag) {
+ exists(getOperandMemoryAccess(tag))
+ }
+
+ /**
+ * Gets the kind of memory access performed by the specified operand. Holds
+ * only for memory operands.
+ */
+ MemoryAccessKind getOperandMemoryAccess(OperandTag tag) {
+ none()
+ }
+
+ /**
+ * Holds if this instruction produces a memory result.
+ */
+ final predicate hasMemoryResult() {
+ exists(getResultMemoryAccess())
+ }
+
+ /**
+ * Gets the kind of memory access performed by this instruction's result.
+ * Holds only for instructions with a memory result.
+ */
+ MemoryAccessKind getResultMemoryAccess() {
+ none()
+ }
+
+ /**
+ * Holds if the result of this instruction is precisely modeled in SSA. Always
+ * holds for a register result. For a memory result, a modeled result is
+ * connected to its actual uses. An unmodeled result is connected to the
+ * `UnmodeledUse` instruction.
+ *
+ * For example:
+ * ```
+ * int x = 1;
+ * int *p = &x;
+ * int y = *p;
+ * ```
+ * In non-aliased SSA, `x` will not be modeled because it has its address
+ * taken. In that case, `isResultModeled()` would not hold for the result of
+ * the `Store` to `x`.
+ */
+ final predicate isResultModeled() {
+ // Register results are always in SSA form.
+ not hasMemoryResult() or
+ // An unmodeled result will have a use on the `UnmodeledUse` instruction.
+ not exists(UnmodeledUseOperand useTag |
+ hasUse(_, useTag)
+ )
+ }
+
+ /**
+ * Gets the successor of this instruction along the control flow edge
+ * specified by `kind`.
+ */
+ final Instruction getSuccessor(EdgeKind kind) {
+ result = Construction::getInstructionSuccessor(this, kind)
+ }
+
+ /**
+ * Gets all direct successors of this instruction.
+ */
+ final Instruction getASuccessor() {
+ result = getSuccessor(_)
+ }
+
+ /**
+ * Gets a predecessor of this instruction such that the predecessor reaches
+ * this instruction along the control flow edge specified by `kind`.
+ */
+ final Instruction getPredecessor(EdgeKind kind) {
+ result.getSuccessor(kind) = this
+ }
+
+ /**
+ * Gets all direct predecessors of this instruction.
+ */
+ final Instruction getAPredecessor() {
+ result = getPredecessor(_)
+ }
+
+ /**
+ * Holds if the result of this instruction is consumed by `useInstruction` as
+ * an operand with tag `useTag`.
+ */
+ final predicate hasUse(Instruction useInstruction, OperandTag useTag) {
+ useInstruction.getFunctionIR() = funcIR and
+ this = useInstruction.getOperand(useTag)
+ }
+}
+
+class VariableInstruction extends Instruction {
+ IRVariable var;
+
+ VariableInstruction() {
+ var = Construction::getInstructionVariable(this)
+ }
+
+ override final string toString() {
+ result = super.toString() + "[" + var.toString() + "]"
+ }
+
+ final IRVariable getVariable() {
+ result = var
+ }
+}
+
+class FieldInstruction extends Instruction {
+ Field field;
+
+ FieldInstruction() {
+ field = Construction::getInstructionField(this)
+ }
+
+ override final string toString() {
+ result = super.toString() + "[" + field.toString() + "]"
+ }
+
+ final Field getField() {
+ result = field
+ }
+}
+
+class FunctionInstruction extends Instruction {
+ Function funcSymbol;
+
+ FunctionInstruction() {
+ funcSymbol = Construction::getInstructionFunction(this)
+ }
+
+ override final string toString() {
+ result = super.toString() + "[" + funcSymbol.toString() + "]"
+ }
+
+ final Function getFunctionSymbol() {
+ result = funcSymbol
+ }
+}
+
+class ConstantValueInstruction extends Instruction {
+ string value;
+
+ ConstantValueInstruction() {
+ value = Construction::getInstructionConstantValue(this)
+ }
+
+ override final string toString() {
+ result = super.toString() + "[" + value + "]"
+ }
+
+ final string getValue() {
+ result = value
+ }
+}
+
+class EnterFunctionInstruction extends Instruction {
+ EnterFunctionInstruction() {
+ opcode instanceof Opcode::EnterFunction
+ }
+}
+
+class VariableAddressInstruction extends VariableInstruction {
+ VariableAddressInstruction() {
+ opcode instanceof Opcode::VariableAddress
+ }
+}
+
+class InitializeParameterInstruction extends VariableInstruction {
+ InitializeParameterInstruction() {
+ opcode instanceof Opcode::InitializeParameter
+ }
+
+ final Parameter getParameter() {
+ result = var.(IRUserVariable).getVariable()
+ }
+}
+
+class FieldAddressInstruction extends FieldInstruction {
+ FieldAddressInstruction() {
+ opcode instanceof Opcode::FieldAddress
+ }
+
+ final Instruction getObjectAddress() {
+ result = getOperand(unaryOperand())
+ }
+}
+
+class UninitializedInstruction extends Instruction {
+ UninitializedInstruction() {
+ opcode instanceof Opcode::Uninitialized
+ }
+}
+
+class NoOpInstruction extends Instruction {
+ NoOpInstruction() {
+ opcode instanceof Opcode::NoOp
+ }
+}
+
+class ReturnInstruction extends Instruction {
+ ReturnInstruction() {
+ opcode instanceof ReturnOpcode
+ }
+}
+
+class ReturnVoidInstruction extends ReturnInstruction {
+ ReturnVoidInstruction() {
+ opcode instanceof Opcode::ReturnVoid
+ }
+}
+
+class ReturnValueInstruction extends ReturnInstruction {
+ ReturnValueInstruction() {
+ opcode instanceof Opcode::ReturnValue
+ }
+
+ final Instruction getReturnValue() {
+ result = getOperand(returnValueOperand())
+ }
+
+ override final MemoryAccessKind getOperandMemoryAccess(OperandTag tag) {
+ tag instanceof ReturnValueOperand and
+ result instanceof IndirectMemoryAccess
+ }
+}
+
+class CopyInstruction extends Instruction {
+ CopyInstruction() {
+ opcode instanceof CopyOpcode
+ }
+
+ final Instruction getSourceValue() {
+ result = getOperand(copySourceOperand())
+ }
+}
+
+class CopyValueInstruction extends CopyInstruction {
+ CopyValueInstruction() {
+ opcode instanceof Opcode::CopyValue
+ }
+}
+
+class LoadInstruction extends CopyInstruction {
+ LoadInstruction() {
+ opcode instanceof Opcode::Load
+ }
+
+ override final MemoryAccessKind getOperandMemoryAccess(OperandTag tag) {
+ tag instanceof CopySourceOperand and
+ result instanceof IndirectMemoryAccess
+ }
+
+ final Instruction getSourceAddress() {
+ result = getOperand(loadStoreAddressOperand())
+ }
+}
+
+class StoreInstruction extends CopyInstruction {
+ StoreInstruction() {
+ opcode instanceof Opcode::Store
+ }
+
+ override final MemoryAccessKind getResultMemoryAccess() {
+ result instanceof IndirectMemoryAccess
+ }
+
+ final Instruction getDestinationAddress() {
+ result = getOperand(loadStoreAddressOperand())
+ }
+}
+
+class ConditionalBranchInstruction extends Instruction {
+ ConditionalBranchInstruction() {
+ opcode instanceof Opcode::ConditionalBranch
+ }
+
+ final Instruction getCondition() {
+ result = getOperand(conditionOperand())
+ }
+
+ final Instruction getTrueSuccessor() {
+ result = getSuccessor(trueEdge())
+ }
+
+ final Instruction getFalseSuccessor() {
+ result = getSuccessor(falseEdge())
+ }
+}
+
+class ExitFunctionInstruction extends Instruction {
+ ExitFunctionInstruction() {
+ opcode instanceof Opcode::ExitFunction
+ }
+}
+
+class ConstantInstruction extends ConstantValueInstruction {
+ ConstantInstruction() {
+ opcode instanceof Opcode::Constant
+ }
+}
+
+class IntegerConstantInstruction extends ConstantInstruction {
+ IntegerConstantInstruction() {
+ resultType instanceof IntegralType
+ }
+}
+
+class FloatConstantInstruction extends ConstantInstruction {
+ FloatConstantInstruction() {
+ resultType instanceof FloatingPointType
+ }
+}
+
+class StringConstantInstruction extends Instruction {
+ StringLiteral value;
+
+ StringConstantInstruction() {
+ value = Construction::getInstructionStringLiteral(this)
+ }
+
+ override final string toString() {
+ result = super.toString() + "[" +
+ value.getValueText().replaceAll("\n", " ").replaceAll("\r", "").replaceAll("\t", " ") +
+ "]"
+ }
+
+ final StringLiteral getValue() {
+ result = value
+ }
+}
+
+class BinaryInstruction extends Instruction {
+ BinaryInstruction() {
+ opcode instanceof BinaryOpcode
+ }
+
+ final Instruction getLeftOperand() {
+ result = getOperand(leftOperand())
+ }
+
+ final Instruction getRightOperand() {
+ result = getOperand(rightOperand())
+ }
+}
+
+class AddInstruction extends BinaryInstruction {
+ AddInstruction() {
+ opcode instanceof Opcode::Add
+ }
+}
+
+class SubInstruction extends BinaryInstruction {
+ SubInstruction() {
+ opcode instanceof Opcode::Sub
+ }
+}
+
+class MulInstruction extends BinaryInstruction {
+ MulInstruction() {
+ opcode instanceof Opcode::Mul
+ }
+}
+
+class DivInstruction extends BinaryInstruction {
+ DivInstruction() {
+ opcode instanceof Opcode::Div
+ }
+}
+
+class RemInstruction extends BinaryInstruction {
+ RemInstruction() {
+ opcode instanceof Opcode::Rem
+ }
+}
+
+class BitAndInstruction extends BinaryInstruction {
+ BitAndInstruction() {
+ opcode instanceof Opcode::BitAnd
+ }
+}
+
+class BitOrInstruction extends BinaryInstruction {
+ BitOrInstruction() {
+ opcode instanceof Opcode::BitOr
+ }
+}
+
+class BitXorInstruction extends BinaryInstruction {
+ BitXorInstruction() {
+ opcode instanceof Opcode::BitXor
+ }
+}
+
+class ShiftLeftInstruction extends BinaryInstruction {
+ ShiftLeftInstruction() {
+ opcode instanceof Opcode::ShiftLeft
+ }
+}
+
+class ShiftRightInstruction extends BinaryInstruction {
+ ShiftRightInstruction() {
+ opcode instanceof Opcode::ShiftRight
+ }
+}
+
+class PointerArithmeticInstruction extends BinaryInstruction {
+ int elementSize;
+
+ PointerArithmeticInstruction() {
+ opcode instanceof PointerArithmeticOpcode and
+ elementSize = Construction::getInstructionElementSize(this)
+ }
+
+ override final string toString() {
+ result = super.toString() + "[" + elementSize.toString() + "]"
+ }
+
+ final int getElementSize() {
+ result = elementSize
+ }
+}
+
+class PointerOffsetInstruction extends PointerArithmeticInstruction {
+ PointerOffsetInstruction() {
+ opcode instanceof PointerOffsetOpcode
+ }
+}
+
+class PointerAddInstruction extends PointerOffsetInstruction {
+ PointerAddInstruction() {
+ opcode instanceof Opcode::PointerAdd
+ }
+}
+
+class PointerSubInstruction extends PointerOffsetInstruction {
+ PointerSubInstruction() {
+ opcode instanceof Opcode::PointerSub
+ }
+}
+
+class PointerDiffInstruction extends PointerArithmeticInstruction {
+ PointerDiffInstruction() {
+ opcode instanceof Opcode::PointerDiff
+ }
+}
+
+class UnaryInstruction extends Instruction {
+ UnaryInstruction() {
+ opcode instanceof UnaryOpcode
+ }
+
+ final Instruction getOperand() {
+ result = getOperand(unaryOperand())
+ }
+}
+
+class ConvertInstruction extends UnaryInstruction {
+ ConvertInstruction() {
+ opcode instanceof Opcode::Convert
+ }
+}
+
+/**
+ * Represents an instruction that converts between two addresses
+ * related by inheritance.
+ */
+class InheritanceConversionInstruction extends UnaryInstruction {
+ Class baseClass;
+ Class derivedClass;
+
+ InheritanceConversionInstruction() {
+ Construction::getInstructionInheritance(this, baseClass, derivedClass)
+ }
+
+ override final string toString() {
+ result = super.toString() + "[" + derivedClass.toString() + " : " + baseClass.toString() + "]"
+ }
+
+ /**
+ * Gets the `ClassDerivation` for the inheritance relationship between
+ * the base and derived classes. This predicate does not hold if the
+ * conversion is to an indirect virtual base class.
+ */
+ final ClassDerivation getDerivation() {
+ result.getBaseClass() = baseClass and result.getDerivedClass() = derivedClass
+ }
+
+ /**
+ * Gets the base class of the conversion. This will be either a direct
+ * base class of the derived class, or a virtual base class of the
+ * derived class.
+ */
+ final Class getBaseClass() {
+ result = baseClass
+ }
+
+ /**
+ * Gets the derived class of the conversion.
+ */
+ final Class getDerivedClass() {
+ result = derivedClass
+ }
+}
+
+/**
+ * Represents an instruction that converts from the address of a derived class
+ * to the address of a direct non-virtual base class.
+ */
+class ConvertToBaseInstruction extends InheritanceConversionInstruction {
+ ConvertToBaseInstruction() {
+ opcode instanceof Opcode::ConvertToBase
+ }
+}
+
+/**
+ * Represents an instruction that converts from the address of a derived class
+ * to the address of a virtual base class.
+ */
+class ConvertToVirtualBaseInstruction extends InheritanceConversionInstruction {
+ ConvertToVirtualBaseInstruction() {
+ opcode instanceof Opcode::ConvertToVirtualBase
+ }
+}
+
+/**
+ * Represents an instruction that converts from the address of a base class
+ * to the address of a direct non-virtual derived class.
+ */
+class ConvertToDerivedInstruction extends InheritanceConversionInstruction {
+ ConvertToDerivedInstruction() {
+ opcode instanceof Opcode::ConvertToDerived
+ }
+}
+
+class BitComplementInstruction extends UnaryInstruction {
+ BitComplementInstruction() {
+ opcode instanceof Opcode::BitComplement
+ }
+}
+
+class LogicalNotInstruction extends UnaryInstruction {
+ LogicalNotInstruction() {
+ opcode instanceof Opcode::LogicalNot
+ }
+}
+
+class CompareInstruction extends BinaryInstruction {
+ CompareInstruction() {
+ opcode instanceof CompareOpcode
+ }
+}
+
+class CompareEQInstruction extends CompareInstruction {
+ CompareEQInstruction() {
+ opcode instanceof Opcode::CompareEQ
+ }
+}
+
+class CompareNEInstruction extends CompareInstruction {
+ CompareNEInstruction() {
+ opcode instanceof Opcode::CompareNE
+ }
+}
+
+class CompareLTInstruction extends CompareInstruction {
+ CompareLTInstruction() {
+ opcode instanceof Opcode::CompareLT
+ }
+}
+
+class CompareGTInstruction extends CompareInstruction {
+ CompareGTInstruction() {
+ opcode instanceof Opcode::CompareGT
+ }
+}
+
+class CompareLEInstruction extends CompareInstruction {
+ CompareLEInstruction() {
+ opcode instanceof Opcode::CompareLE
+ }
+}
+
+class CompareGEInstruction extends CompareInstruction {
+ CompareGEInstruction() {
+ opcode instanceof Opcode::CompareGE
+ }
+}
+
+class SwitchInstruction extends Instruction {
+ SwitchInstruction() {
+ opcode instanceof Opcode::Switch
+ }
+
+ final Instruction getExpression() {
+ result = getOperand(conditionOperand())
+ }
+
+ final Instruction getACaseSuccessor() {
+ exists(CaseEdge edge |
+ result = getSuccessor(edge)
+ )
+ }
+
+ final Instruction getDefaultSuccessor() {
+ result = getSuccessor(defaultEdge())
+ }
+}
+
+class InvokeInstruction extends Instruction {
+ InvokeInstruction() {
+ opcode instanceof Opcode::Invoke
+ }
+
+ final Instruction getCallTarget() {
+ result = getOperand(callTargetOperand())
+ }
+}
+
+/**
+ * An instruction that throws an exception.
+ */
+class ThrowInstruction extends Instruction {
+ ThrowInstruction() {
+ opcode instanceof ThrowOpcode
+ }
+}
+
+/**
+ * An instruction that throws a new exception.
+ */
+class ThrowValueInstruction extends ThrowInstruction {
+ ThrowValueInstruction() {
+ opcode instanceof Opcode::ThrowValue
+ }
+
+ override final MemoryAccessKind getOperandMemoryAccess(OperandTag tag) {
+ tag instanceof ExceptionOperand and
+ result instanceof IndirectMemoryAccess
+ }
+
+
+ /**
+ * Gets the address of the exception thrown by this instruction.
+ */
+ final Instruction getExceptionAddress() {
+ result = getOperand(loadStoreAddressOperand())
+ }
+
+ /**
+ * Gets the exception thrown by this instruction.
+ */
+ final Instruction getException() {
+ result = getOperand(exceptionOperand())
+ }
+}
+
+/**
+ * An instruction that re-throws the current exception.
+ */
+class ReThrowInstruction extends ThrowInstruction {
+ ReThrowInstruction() {
+ opcode instanceof Opcode::ReThrow
+ }
+}
+
+/**
+ * An instruction that exits the current function by propagating an exception.
+ */
+class UnwindInstruction extends Instruction {
+ UnwindInstruction() {
+ opcode instanceof Opcode::Unwind
+ }
+}
+
+/**
+ * An instruction that starts a `catch` handler.
+ */
+class CatchInstruction extends Instruction {
+ CatchInstruction() {
+ opcode instanceof CatchOpcode
+ }
+}
+
+/**
+ * An instruction that catches an exception of a specific type.
+ */
+class CatchByTypeInstruction extends CatchInstruction {
+ Type exceptionType;
+
+ CatchByTypeInstruction() {
+ opcode instanceof Opcode::CatchByType and
+ exceptionType = Construction::getInstructionExceptionType(this)
+ }
+
+ final override string toString() {
+ result = super.toString() + "[" + exceptionType.toString() + "]"
+ }
+
+ /**
+ * Gets the type of exception to be caught.
+ */
+ final Type getExceptionType() {
+ result = exceptionType
+ }
+}
+
+/**
+ * An instruction that catches any exception.
+ */
+class CatchAnyInstruction extends CatchInstruction {
+ CatchAnyInstruction() {
+ opcode instanceof Opcode::CatchAny
+ }
+}
+
+class UnmodeledDefinitionInstruction extends Instruction {
+ UnmodeledDefinitionInstruction() {
+ opcode instanceof Opcode::UnmodeledDefinition
+ }
+
+ override final MemoryAccessKind getResultMemoryAccess() {
+ result instanceof UnmodeledMemoryAccess
+ }
+}
+
+class UnmodeledUseInstruction extends Instruction {
+ UnmodeledUseInstruction() {
+ opcode instanceof Opcode::UnmodeledUse
+ }
+
+ override final MemoryAccessKind getOperandMemoryAccess(OperandTag tag) {
+ tag instanceof UnmodeledUseOperand and
+ result instanceof UnmodeledMemoryAccess
+ }
+}
+
+class PhiInstruction extends Instruction {
+ PhiInstruction() {
+ opcode instanceof Opcode::Phi
+ }
+
+ override final MemoryAccessKind getOperandMemoryAccess(OperandTag tag) {
+ tag instanceof PhiOperand and
+ result instanceof PhiMemoryAccess
+ }
+
+ override final MemoryAccessKind getResultMemoryAccess() {
+ result instanceof PhiMemoryAccess
+ }
+}
+
+/**
+ * An instruction representing a built-in operation. This is used to represent
+ * operations such as access to variable argument lists.
+ */
+class BuiltInInstruction extends Instruction {
+ BuiltInInstruction() {
+ opcode instanceof BuiltInOpcode
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/OperandTag.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/OperandTag.qll
new file mode 100644
index 000000000000..ece7fb5bd15b
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/OperandTag.qll
@@ -0,0 +1,299 @@
+private import IRInternal
+import Instruction
+import IRBlock
+import cpp
+
+private newtype TOperandTag =
+ TLoadStoreAddressOperand() or
+ TCopySourceOperand() or
+ TUnaryOperand() or
+ TLeftOperand() or
+ TRightOperand() or
+ TReturnValueOperand() or
+ TExceptionOperand() or
+ TConditionOperand() or
+ TUnmodeledUseOperand() or
+ TCallTargetOperand() or
+ TThisArgumentOperand() or
+ TPositionalArgumentOperand(int argIndex) {
+ argIndex in [0..Construction::getMaxCallArgIndex()] or
+ exists(BuiltInOperation op |
+ exists(op.getChild(argIndex))
+ )
+ } or
+ TPhiOperand(IRBlock predecessorBlock) {
+ exists(PhiInstruction phi |
+ predecessorBlock = Construction::getPhiInstructionBlockStart(phi).getBlock().getAPredecessor()
+ )
+ }
+
+/**
+ * Identifies the kind of operand on an instruction. Each `Instruction` has at
+ * most one operand of any single `OperandTag`. The set of `OperandTag`s used by
+ * an `Instruction` is determined by the instruction's opcode.
+ */
+abstract class OperandTag extends TOperandTag {
+ abstract string toString();
+ abstract int getSortOrder();
+}
+
+// Note: individual subtypes are listed in the order that the operands should
+// appear in the operand list of the instruction when printing.
+
+/**
+ * The address operand of an instruction that loads or stores a value from
+ * memory (e.g. `Load`, `Store`).
+ */
+class LoadStoreAddressOperand extends OperandTag, TLoadStoreAddressOperand {
+ override final string toString() {
+ result = "LoadStoreAddress"
+ }
+
+ override final int getSortOrder() {
+ result = 0
+ }
+}
+
+LoadStoreAddressOperand loadStoreAddressOperand() {
+ result = TLoadStoreAddressOperand()
+}
+
+/**
+ * The source value operand of an instruction that copies this value to its
+ * result (e.g. `Copy`, `Load`, `Store`).
+ */
+class CopySourceOperand extends OperandTag, TCopySourceOperand {
+ override final string toString() {
+ result = "CopySource"
+ }
+
+ override final int getSortOrder() {
+ result = 1
+ }
+}
+
+CopySourceOperand copySourceOperand() {
+ result = TCopySourceOperand()
+}
+
+/**
+ * The sole operand of a unary instruction (e.g. `Convert`, `Negate`).
+ */
+class UnaryOperand extends OperandTag, TUnaryOperand {
+ override final string toString() {
+ result = "Unary"
+ }
+
+ override final int getSortOrder() {
+ result = 2
+ }
+}
+
+UnaryOperand unaryOperand() {
+ result = TUnaryOperand()
+}
+
+/**
+ * The left operand of a binary instruction (e.g. `Add`, `CompareEQ`).
+ */
+class LeftOperand extends OperandTag, TLeftOperand {
+ override final string toString() {
+ result = "Left"
+ }
+
+ override final int getSortOrder() {
+ result = 3
+ }
+}
+
+LeftOperand leftOperand() {
+ result = TLeftOperand()
+}
+
+/**
+ * The right operand of a binary instruction (e.g. `Add`, `CompareEQ`).
+ */
+class RightOperand extends OperandTag, TRightOperand {
+ override final string toString() {
+ result = "Right"
+ }
+
+ override final int getSortOrder() {
+ result = 4
+ }
+}
+
+RightOperand rightOperand() {
+ result = TRightOperand()
+}
+
+/**
+ * The return value operand of a `ReturnValue` instruction.
+ */
+class ReturnValueOperand extends OperandTag, TReturnValueOperand {
+ override final string toString() {
+ result = "ReturnValue"
+ }
+
+ override final int getSortOrder() {
+ result = 5
+ }
+}
+
+ReturnValueOperand returnValueOperand() {
+ result = TReturnValueOperand()
+}
+
+/**
+ * The exception thrown by a `ThrowValue` instruction.
+ */
+class ExceptionOperand extends OperandTag, TExceptionOperand {
+ override final string toString() {
+ result = "Exception"
+ }
+
+ override final int getSortOrder() {
+ result = 6
+ }
+}
+
+ExceptionOperand exceptionOperand() {
+ result = TExceptionOperand()
+}
+
+/**
+ * The condition operand of a `ConditionalBranch` or `Switch` instruction.
+ */
+class ConditionOperand extends OperandTag, TConditionOperand {
+ override final string toString() {
+ result = "Condition"
+ }
+
+ override final int getSortOrder() {
+ result = 7
+ }
+}
+
+ConditionOperand conditionOperand() {
+ result = TConditionOperand()
+}
+
+/**
+ * An operand of the special `UnmodeledUse` instruction, representing a value
+ * whose set of uses is unknown.
+ */
+class UnmodeledUseOperand extends OperandTag, TUnmodeledUseOperand {
+ override final string toString() {
+ result = "UnmodeledUse"
+ }
+
+ override final int getSortOrder() {
+ result = 8
+ }
+}
+
+UnmodeledUseOperand unmodeledUseOperand() {
+ result = TUnmodeledUseOperand()
+}
+
+/**
+ * The operand representing the target function of an `Invoke` instruction.
+ */
+class CallTargetOperand extends OperandTag, TCallTargetOperand {
+ override final string toString() {
+ result = "CallTarget"
+ }
+
+ override final int getSortOrder() {
+ result = 9
+ }
+}
+
+CallTargetOperand callTargetOperand() {
+ result = TCallTargetOperand()
+}
+
+/**
+ * An operand representing an argument to a function call. This includes both
+ * positional arguments (represented by `PositionalArgumentOperand`) and the
+ * implicit `this` argument, if any (represented by `ThisArgumentOperand`).
+ */
+abstract class ArgumentOperand extends OperandTag {
+}
+
+/**
+ * An operand representing the implicit 'this' argument to a member function
+ * call.
+ */
+class ThisArgumentOperand extends ArgumentOperand, TThisArgumentOperand {
+ ThisArgumentOperand() {
+ this = TThisArgumentOperand()
+ }
+
+ override final string toString() {
+ result = "Arg(this)"
+ }
+
+ override final int getSortOrder() {
+ result = 10
+ }
+}
+
+ThisArgumentOperand thisArgumentOperand() {
+ result = TThisArgumentOperand()
+}
+
+/**
+ * An operand representing an argument to a function call.
+ */
+class PositionalArgumentOperand extends ArgumentOperand,
+ TPositionalArgumentOperand {
+ int argIndex;
+
+ PositionalArgumentOperand() {
+ this = TPositionalArgumentOperand(argIndex)
+ }
+
+ override final string toString() {
+ result = "Arg(" + argIndex + ")"
+ }
+
+ override final int getSortOrder() {
+ result = 11 + argIndex
+ }
+
+ final int getArgIndex() {
+ result = argIndex
+ }
+}
+
+PositionalArgumentOperand positionalArgumentOperand(int argIndex) {
+ result = TPositionalArgumentOperand(argIndex)
+}
+
+/**
+ * An operand of an SSA `Phi` instruction.
+ */
+class PhiOperand extends OperandTag, TPhiOperand {
+ IRBlock predecessorBlock;
+
+ PhiOperand() {
+ this = TPhiOperand(predecessorBlock)
+ }
+
+ override final string toString() {
+ result = "Phi"
+ }
+
+ override final int getSortOrder() {
+ result = 11
+ }
+
+ final IRBlock getPredecessorBlock() {
+ result = predecessorBlock
+ }
+}
+
+PhiOperand phiOperand(IRBlock predecessorBlock) {
+ result = TPhiOperand(predecessorBlock)
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/PrintIRImpl.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/PrintIRImpl.qll
new file mode 100644
index 000000000000..9cf77f21c04a
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/PrintIRImpl.qll
@@ -0,0 +1,175 @@
+private import IRImpl
+import cpp
+
+private int getInstructionIndexInBlock(Instruction instr) {
+ exists(IRBlock block |
+ block = instr.getBlock() and
+ (
+ exists(int index, int phiCount |
+ phiCount = count(block.getAPhiInstruction()) and
+ instr = block.getInstruction(index) and
+ result = index + phiCount
+ ) or
+ (
+ instr instanceof PhiInstruction and
+ instr = rank[result + 1](PhiInstruction phiInstr |
+ phiInstr = block.getAPhiInstruction() |
+ phiInstr order by phiInstr.getUniqueId()
+ )
+ )
+ )
+ )
+}
+
+private string getInstructionResultId(Instruction instr) {
+ result = getResultPrefix(instr) + getBlockId(instr.getBlock()) + "_" +
+ getInstructionIndexInBlock(instr).toString()
+}
+
+private string getResultPrefix(Instruction instr) {
+ if instr.hasMemoryResult() then
+ if instr.isResultModeled() then
+ result = "@m"
+ else
+ result = "@mu"
+ else
+ result = "@r"
+}
+
+/**
+ * Gets the identifier of the specified function scope.
+ * Currently just returns the signature of the function.
+ */
+private string getScopeId(Function func) {
+ result = func.getFullSignature()
+}
+
+/**
+ * Gets the unique identifier of the block within its function.
+ * Currently returns a string representation of an integer in the range
+ * [0..numBlocks - 1].
+ */
+private string getBlockId(IRBlock block) {
+ exists(int rankIndex |
+ block = rank[rankIndex + 1](IRBlock funcBlock |
+ funcBlock.getFunction() = block.getFunction() |
+ funcBlock order by funcBlock.getUniqueId()
+ ) and
+ result = rankIndex.toString()
+ )
+}
+
+/**
+ * Prints the full signature and qualified name for each scope. This is primarily
+ * so that post-processing tools can identify function overloads, which will have
+ * different signatures but the same qualified name.
+ */
+query predicate printIRGraphScopes(string scopeId, string qualifiedName) {
+ exists(FunctionIR ir, Function func |
+ func = ir.getFunction() and
+ scopeId = getScopeId(func) and
+ qualifiedName = func.getQualifiedName()
+ )
+}
+
+query predicate printIRGraphNodes(string scopeId, string blockId, string label, string location) {
+ exists(IRBlock block |
+ scopeId = getScopeId(block.getFunction()) and
+ blockId = getBlockId(block) and
+ label = "" and
+ location = ""
+ )
+}
+
+query predicate printIRGraphInstructions(string scopeId, string blockId,
+ string id, string label, string location) {
+ exists(IRBlock block, Instruction instr |
+ instr = block.getAnInstruction() and
+ label = instr.toString() and
+ location = instr.getLocation().toString() and
+ scopeId = getScopeId(block.getFunction()) and
+ blockId = getBlockId(block) and
+ id = getInstructionIndexInBlock(instr).toString()
+ )
+}
+
+query predicate printIRGraphEdges(string scopeId,
+ string predecessorId, string successorId, string label) {
+ exists(IRBlock predecessor, IRBlock successor, EdgeKind kind |
+ scopeId = getScopeId(predecessor.getFunction()) and
+ predecessor.getSuccessor(kind) = successor and
+ predecessorId = getBlockId(predecessor) and
+ successorId = getBlockId(successor) and
+ label = kind.toString()
+ )
+}
+
+private string getValueCategoryString(Instruction instr) {
+ if instr.isGLValue() then
+ result = "glval:"
+ else
+ result = ""
+}
+
+private string getResultTypeString(Instruction instr) {
+ exists(Type resultType, string valcat |
+ resultType = instr.getResultType() and
+ valcat = getValueCategoryString(instr) and
+ if resultType instanceof UnknownType and exists(instr.getResultSize()) then
+ result = valcat + resultType.toString() + "[" + instr.getResultSize().toString() + "]"
+ else
+ result = valcat + resultType.toString()
+ )
+}
+
+query predicate printIRGraphDestinationOperands(string scopeId, string blockId,
+ string instructionId, int operandId, string label) {
+ exists(IRBlock block, Instruction instr |
+ block.getAnInstruction() = instr and
+ scopeId = getScopeId(block.getFunction()) and
+ blockId = getBlockId(block) and
+ instructionId = getInstructionIndexInBlock(instr).toString() and
+ not instr.getResultType() instanceof VoidType and
+ operandId = 0 and
+ label = getInstructionResultId(instr) +
+ "(" + getResultTypeString(instr) + ")"
+ )
+}
+
+private string getOperandTagLabel(OperandTag tag) {
+ (
+ tag instanceof PhiOperand and
+ result = "from " + getBlockId(tag.(PhiOperand).getPredecessorBlock()) + ": "
+ )
+ or (
+ tag instanceof ThisArgumentOperand and
+ result = "this:"
+ )
+ or (
+ not tag instanceof PhiOperand and
+ not tag instanceof ThisArgumentOperand and
+ result = ""
+ )
+}
+
+query predicate printIRGraphSourceOperands(string scopeId, string blockId,
+ string instructionId, int operandId, string label) {
+ exists(IRBlock block, Instruction instr |
+ block.getAnInstruction() = instr and
+ blockId = getBlockId(block) and
+ scopeId = getScopeId(block.getFunction()) and
+ instructionId = getInstructionIndexInBlock(instr).toString() and
+ if (instr instanceof UnmodeledUseInstruction) then (
+ operandId = 0 and
+ label = "@mu*"
+ )
+ else (
+ exists(OperandTag tag, Instruction operandInstr |
+ operandInstr = instr.getOperand(tag) and
+ operandId = tag.getSortOrder() and
+ label = getOperandTagLabel(tag) +
+ getInstructionResultId(operandInstr)
+ )
+ )
+ )
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/SSAConstruction.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/SSAConstruction.qll
new file mode 100644
index 000000000000..cfc220ba368e
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/SSAConstruction.qll
@@ -0,0 +1,424 @@
+import SSAConstructionInternal
+import cpp
+private import semmle.code.cpp.ir.internal.Opcode
+import NewIR
+
+import Cached
+cached private module Cached {
+
+ private OldIR::OperandTag getOldOperandTag(OperandTag newTag) {
+ newTag instanceof LoadStoreAddressOperand and result instanceof OldIR::LoadStoreAddressOperand or
+ newTag instanceof CopySourceOperand and result instanceof OldIR::CopySourceOperand or
+ newTag instanceof UnaryOperand and result instanceof OldIR::UnaryOperand or
+ newTag instanceof LeftOperand and result instanceof OldIR::LeftOperand or
+ newTag instanceof RightOperand and result instanceof OldIR::RightOperand or
+ newTag instanceof ReturnValueOperand and result instanceof OldIR::ReturnValueOperand or
+ newTag instanceof ExceptionOperand and result instanceof OldIR::ExceptionOperand or
+ newTag instanceof ConditionOperand and result instanceof OldIR::ConditionOperand or
+ newTag instanceof UnmodeledUseOperand and result instanceof OldIR::UnmodeledUseOperand or
+ newTag instanceof CallTargetOperand and result instanceof OldIR::CallTargetOperand or
+ newTag instanceof ThisArgumentOperand and result instanceof OldIR::ThisArgumentOperand or
+ exists(PositionalArgumentOperand newArg |
+ newArg = newTag and
+ result.(OldIR::PositionalArgumentOperand).getArgIndex() = newArg.getArgIndex()
+ )
+ }
+
+ private IRBlock getNewBlock(OldIR::IRBlock oldBlock) {
+ result.getFirstInstruction() = getNewInstruction(oldBlock.getFirstInstruction())
+ }
+
+ cached newtype TInstructionTag =
+ WrappedInstructionTag(OldIR::Instruction oldInstruction) or
+ PhiTag(Alias::VirtualVariable vvar, OldIR::IRBlock block) {
+ hasPhiNode(vvar, block)
+ }
+
+ cached class InstructionTagType extends TInstructionTag {
+ cached final string toString() {
+ result = "Tag"
+ }
+ }
+
+ cached predicate functionHasIR(Function func) {
+ exists(OldIR::FunctionIR funcIR |
+ funcIR.getFunction() = func
+ )
+ }
+
+ cached int getMaxCallArgIndex() {
+ result = max(int argIndex |
+ exists(OldIR::PositionalArgumentOperand oldOperand |
+ argIndex = oldOperand.getArgIndex()
+ )
+ )
+ }
+
+ cached OldIR::Instruction getOldInstruction(Instruction instr) {
+ instr.getTag() = WrappedInstructionTag(result)
+ }
+
+ private Instruction getNewInstruction(OldIR::Instruction instr) {
+ result.getTag() = WrappedInstructionTag(instr)
+ }
+
+ private PhiInstruction getPhiInstruction(Function func, OldIR::IRBlock oldBlock,
+ Alias::VirtualVariable vvar) {
+ result.getFunction() = func and
+ result.getAST() = oldBlock.getFirstInstruction().getAST() and
+ result.getTag() = PhiTag(vvar, oldBlock)
+ }
+
+ private IRVariable getNewIRVariable(OldIR::IRVariable var) {
+ result.getFunction() = var.getFunction() and
+ (
+ exists(OldIR::IRUserVariable userVar, IRUserVariable newUserVar |
+ userVar = var and
+ newUserVar.getVariable() = userVar.getVariable() and
+ result = newUserVar
+ ) or
+ exists(OldIR::IRTempVariable tempVar, IRTempVariable newTempVar |
+ tempVar = var and
+ newTempVar.getAST() = tempVar.getAST() and
+ newTempVar.getTag() = tempVar.getTag() and
+ result = newTempVar
+ )
+ )
+ }
+
+ cached newtype TInstruction =
+ MkInstruction(FunctionIR funcIR, Opcode opcode, Locatable ast,
+ InstructionTag tag, Type resultType, boolean isGLValue) {
+ hasInstruction(funcIR.getFunction(), opcode, ast, tag,
+ resultType, isGLValue)
+ }
+
+ private predicate hasInstruction(Function func, Opcode opcode, Locatable ast,
+ InstructionTag tag, Type resultType, boolean isGLValue) {
+ exists(OldIR::Instruction instr |
+ instr.getFunction() = func and
+ instr.getOpcode() = opcode and
+ instr.getAST() = ast and
+ WrappedInstructionTag(instr) = tag and
+ instr.getResultType() = resultType and
+ if instr.isGLValue() then
+ isGLValue = true
+ else
+ isGLValue = false
+ ) or
+ exists(OldIR::IRBlock block, Alias::VirtualVariable vvar |
+ hasPhiNode(vvar, block) and
+ block.getFunction() = func and
+ opcode instanceof Opcode::Phi and
+ ast = block.getFirstInstruction().getAST() and
+ tag = PhiTag(vvar, block) and
+ resultType = vvar.getType() and
+ isGLValue = false
+ )
+ }
+
+ cached predicate hasTempVariable(Function func, Locatable ast, TempVariableTag tag,
+ Type type) {
+ exists(OldIR::IRTempVariable var |
+ var.getFunction() = func and
+ var.getAST() = ast and
+ var.getTag() = tag and
+ var.getType() = type
+ )
+ }
+
+ cached predicate hasModeledMemoryResult(Instruction instruction) {
+ exists(Alias::getResultMemoryAccess(getOldInstruction(instruction))) or
+ instruction instanceof PhiInstruction // Phis always have modeled results
+ }
+
+ cached Instruction getInstructionOperand(Instruction instruction, OperandTag tag) {
+ exists(OldIR::Instruction oldUse, OldIR::OperandTag oldTag |
+ oldUse = getOldInstruction(instruction) and
+ oldTag = getOldOperandTag(tag) and
+ if oldUse.isMemoryOperand(oldTag) then (
+ (
+ if exists(Alias::getOperandMemoryAccess(oldUse, oldTag)) then (
+ exists(OldIR::IRBlock useBlock, int useRank, Alias::VirtualVariable vvar,
+ OldIR::IRBlock defBlock, int defRank, int defIndex |
+ vvar = Alias::getOperandMemoryAccess(oldUse, oldTag).getVirtualVariable() and
+ hasDefinitionAtRank(vvar, defBlock, defRank, defIndex) and
+ hasUseAtRank(vvar, useBlock, useRank, oldUse) and
+ definitionReachesUse(vvar, defBlock, defRank, useBlock, useRank) and
+ if defIndex >= 0 then
+ result = getNewInstruction(defBlock.getInstruction(defIndex))
+ else
+ result = getPhiInstruction(instruction.getFunction(), defBlock, vvar)
+ )
+ )
+ else (
+ result = instruction.getFunctionIR().getUnmodeledDefinitionInstruction()
+ )
+ ) or
+ // Connect any definitions that are not being modeled in SSA to the
+ // `UnmodeledUse` instruction.
+ exists(OldIR::Instruction oldDefinition |
+ instruction instanceof UnmodeledUseInstruction and
+ tag instanceof UnmodeledUseOperand and
+ oldDefinition = oldUse.getOperand(oldTag) and
+ not exists(Alias::getResultMemoryAccess(oldDefinition)) and
+ result = getNewInstruction(oldDefinition)
+ )
+ )
+ else
+ result = getNewInstruction(oldUse.getOperand(oldTag))
+ ) or
+ result = getPhiInstructionOperand(instruction.(PhiInstruction), tag.(PhiOperand))
+ }
+
+ cached Instruction getPhiInstructionOperand(PhiInstruction instr, PhiOperand tag) {
+ exists(Alias::VirtualVariable vvar, OldIR::IRBlock phiBlock,
+ OldIR::IRBlock defBlock, int defRank, int defIndex, OldIR::IRBlock predBlock |
+ hasPhiNode(vvar, phiBlock) and
+ predBlock = phiBlock.getAPredecessor() and
+ instr.getTag() = PhiTag(vvar, phiBlock) and
+ tag.getPredecessorBlock() = getNewBlock(predBlock) and
+ hasDefinitionAtRank(vvar, defBlock, defRank, defIndex) and
+ definitionReachesEndOfBlock(vvar, defBlock, defRank, predBlock) and
+ if defIndex >= 0 then
+ result = getNewInstruction(defBlock.getInstruction(defIndex))
+ else
+ result = getPhiInstruction(instr.getFunction(), defBlock, vvar)
+ )
+ }
+
+ cached Instruction getPhiInstructionBlockStart(PhiInstruction instr) {
+ exists(OldIR::IRBlock oldBlock |
+ instr.getTag() = PhiTag(_, oldBlock) and
+ result = getNewInstruction(oldBlock.getFirstInstruction())
+ )
+ }
+
+ cached Instruction getInstructionSuccessor(Instruction instruction, EdgeKind kind) {
+ result = getNewInstruction(getOldInstruction(instruction).getSuccessor(kind))
+ }
+
+ cached IRVariable getInstructionVariable(Instruction instruction) {
+ result = getNewIRVariable(getOldInstruction(instruction).(OldIR::VariableInstruction).getVariable())
+ }
+
+ cached Field getInstructionField(Instruction instruction) {
+ result = getOldInstruction(instruction).(OldIR::FieldInstruction).getField()
+ }
+
+ cached Function getInstructionFunction(Instruction instruction) {
+ result = getOldInstruction(instruction).(OldIR::FunctionInstruction).getFunctionSymbol()
+ }
+
+ cached string getInstructionConstantValue(Instruction instruction) {
+ result = getOldInstruction(instruction).(OldIR::ConstantValueInstruction).getValue()
+ }
+
+ cached StringLiteral getInstructionStringLiteral(Instruction instruction) {
+ result = getOldInstruction(instruction).(OldIR::StringConstantInstruction).getValue()
+ }
+
+ cached Type getInstructionExceptionType(Instruction instruction) {
+ result = getOldInstruction(instruction).(OldIR::CatchByTypeInstruction).getExceptionType()
+ }
+
+ cached int getInstructionElementSize(Instruction instruction) {
+ result = getOldInstruction(instruction).(OldIR::PointerArithmeticInstruction).getElementSize()
+ }
+
+ cached int getInstructionResultSize(Instruction instruction) {
+ // Only return a result for instructions that needed an explicit result size.
+ instruction.getResultType() instanceof UnknownType and
+ result = getOldInstruction(instruction).getResultSize()
+ }
+
+ cached predicate getInstructionInheritance(Instruction instruction, Class baseClass,
+ Class derivedClass) {
+ exists(OldIR::InheritanceConversionInstruction oldInstr |
+ oldInstr = getOldInstruction(instruction) and
+ baseClass = oldInstr.getBaseClass() and
+ derivedClass = oldInstr.getDerivedClass()
+ )
+ }
+
+ private predicate ssa_variableUpdate(Alias::VirtualVariable vvar,
+ OldIR::Instruction instr, OldIR::IRBlock block, int index) {
+ block.getInstruction(index) = instr and
+ Alias::getResultMemoryAccess(instr).getVirtualVariable() = vvar
+ }
+
+ private predicate hasDefinition(Alias::VirtualVariable vvar, OldIR::IRBlock block, int index) {
+ (
+ hasPhiNode(vvar, block) and
+ index = -1
+ ) or
+ exists(Alias::MemoryAccess access, OldIR::Instruction def |
+ access = Alias::getResultMemoryAccess(def) and
+ block.getInstruction(index) = def and
+ vvar = access.getVirtualVariable()
+ )
+ }
+
+ private predicate defUseRank(Alias::VirtualVariable vvar, OldIR::IRBlock block, int rankIndex, int index) {
+ index = rank[rankIndex](int j | hasDefinition(vvar, block, j) or hasUse(vvar, _, block, j))
+ }
+
+ private predicate hasUse(Alias::VirtualVariable vvar,
+ OldIR::Instruction use, OldIR::IRBlock block, int index) {
+ exists(Alias::MemoryAccess access |
+ access = Alias::getOperandMemoryAccess(use, _) and
+ block.getInstruction(index) = use and
+ vvar = access.getVirtualVariable()
+ )
+ }
+
+ private predicate variableLiveOnEntryToBlock(Alias::VirtualVariable vvar, OldIR::IRBlock block) {
+ exists (int index | hasUse(vvar, _, block, index) |
+ not exists (int j | ssa_variableUpdate(vvar, _, block, j) | j < index)
+ ) or
+ (variableLiveOnExitFromBlock(vvar, block) and not ssa_variableUpdate(vvar, _, block, _))
+ }
+
+ pragma[noinline]
+ private predicate variableLiveOnExitFromBlock(Alias::VirtualVariable vvar, OldIR::IRBlock block) {
+ variableLiveOnEntryToBlock(vvar, block.getASuccessor())
+ }
+
+ /**
+ * Gets the rank index of a hyphothetical use one instruction past the end of
+ * the block. This index can be used to determine if a definition reaches the
+ * end of the block, even if the definition is the last instruction in the
+ * block.
+ */
+ private int exitRank(Alias::VirtualVariable vvar, OldIR::IRBlock block) {
+ result = max(int rankIndex | defUseRank(vvar, block, rankIndex, _)) + 1
+ }
+
+ private predicate hasDefinitionAtRank(Alias::VirtualVariable vvar,
+ OldIR::IRBlock block, int rankIndex, int instructionIndex) {
+ hasDefinition(vvar, block, instructionIndex) and
+ defUseRank(vvar, block, rankIndex, instructionIndex)
+ }
+
+ private predicate hasUseAtRank(Alias::VirtualVariable vvar, OldIR::IRBlock block,
+ int rankIndex, OldIR::Instruction use) {
+ exists(int index |
+ hasUse(vvar, use, block, index) and
+ defUseRank(vvar, block, rankIndex, index)
+ )
+ }
+
+ /**
+ * Holds if the definition of `vvar` at `(block, defRank)` reaches the rank
+ * index `reachesRank` in block `block`.
+ */
+ private predicate definitionReachesRank(Alias::VirtualVariable vvar,
+ OldIR::IRBlock block, int defRank, int reachesRank) {
+ hasDefinitionAtRank(vvar, block, defRank, _) and
+ reachesRank <= exitRank(vvar, block) and // Without this, the predicate would be infinite.
+ (
+ // The def always reaches the next use, even if there is also a def on the
+ // use instruction.
+ reachesRank = defRank + 1 or
+ (
+ // If the def reached the previous rank, it also reaches the current rank,
+ // unless there was another def at the previous rank.
+ definitionReachesRank(vvar, block, defRank, reachesRank - 1) and
+ not hasDefinitionAtRank(vvar, block, reachesRank - 1, _)
+ )
+ )
+ }
+
+ /**
+ * Holds if the definition of `vvar` at `(defBlock, defRank)` reaches the end of
+ * block `block`.
+ */
+ private predicate definitionReachesEndOfBlock(Alias::VirtualVariable vvar,
+ OldIR::IRBlock defBlock, int defRank, OldIR::IRBlock block) {
+ hasDefinitionAtRank(vvar, defBlock, defRank, _) and
+ (
+ (
+ // If we're looking at the def's own block, just see if it reaches the exit
+ // rank of the block.
+ block = defBlock and
+ variableLiveOnExitFromBlock(vvar, defBlock) and
+ definitionReachesRank(vvar, defBlock, defRank, exitRank(vvar, defBlock))
+ ) or
+ exists(OldIR::IRBlock idom |
+ definitionReachesEndOfBlock(vvar, defBlock, defRank, idom) and
+ noDefinitionsSinceIDominator(vvar, idom, block)
+ )
+ )
+ }
+
+ pragma[noinline]
+ private predicate noDefinitionsSinceIDominator(Alias::VirtualVariable vvar,
+ OldIR::IRBlock idom, OldIR::IRBlock block) {
+ idom.immediatelyDominates(block) and // It is sufficient to traverse the dominator graph, cf. discussion above.
+ variableLiveOnExitFromBlock(vvar, block) and
+ not hasDefinition(vvar, block, _)
+ }
+
+ private predicate definitionReachesUseWithinBlock(
+ Alias::VirtualVariable vvar, OldIR::IRBlock defBlock, int defRank,
+ OldIR::IRBlock useBlock, int useRank) {
+ defBlock = useBlock and
+ hasDefinitionAtRank(vvar, defBlock, defRank, _) and
+ hasUseAtRank(vvar, useBlock, useRank, _) and
+ definitionReachesRank(vvar, defBlock, defRank, useRank)
+ }
+
+ private predicate definitionReachesUse(Alias::VirtualVariable vvar,
+ OldIR::IRBlock defBlock, int defRank, OldIR::IRBlock useBlock, int useRank) {
+ hasUseAtRank(vvar, useBlock, useRank, _) and
+ (
+ definitionReachesUseWithinBlock(vvar, defBlock, defRank, useBlock,
+ useRank) or
+ (
+ definitionReachesEndOfBlock(vvar, defBlock, defRank,
+ useBlock.getAPredecessor()) and
+ not definitionReachesUseWithinBlock(vvar, useBlock, _, useBlock, useRank)
+ )
+ )
+ }
+
+ private predicate hasFrontierPhiNode(Alias::VirtualVariable vvar,
+ OldIR::IRBlock phiBlock) {
+ exists(OldIR::IRBlock defBlock |
+ phiBlock = defBlock.dominanceFrontier() and
+ hasDefinition(vvar, defBlock, _) and
+ /* We can also eliminate those nodes where the variable is not live on any incoming edge */
+ variableLiveOnEntryToBlock(vvar, phiBlock)
+ )
+ }
+
+ private predicate hasPhiNode(Alias::VirtualVariable vvar,
+ OldIR::IRBlock phiBlock) {
+ hasFrontierPhiNode(vvar, phiBlock)
+ //or ssa_sanitized_custom_phi_node(vvar, block)
+ }
+}
+
+import CachedForDebugging
+cached private module CachedForDebugging {
+ cached string getTempVariableUniqueId(IRTempVariable var) {
+ result = getOldTempVariable(var).getUniqueId()
+ }
+
+ cached string getInstructionUniqueId(Instruction instr) {
+ exists(OldIR::Instruction oldInstr |
+ oldInstr = getOldInstruction(instr) and
+ result = "NonSSA: " + oldInstr.getUniqueId()
+ ) or
+ exists(Alias::VirtualVariable vvar, OldIR::IRBlock phiBlock |
+ instr.getTag() = PhiTag(vvar, phiBlock) and
+ result = "Phi Block(" + phiBlock.getUniqueId() + "): " + vvar.getUniqueId()
+ )
+ }
+
+ private OldIR::IRTempVariable getOldTempVariable(IRTempVariable var) {
+ result.getFunction() = var.getFunction() and
+ result.getAST() = var.getAST() and
+ result.getTag() = var.getTag()
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/SSAConstructionInternal.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/SSAConstructionInternal.qll
new file mode 100644
index 000000000000..32b79304b11b
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/SSAConstructionInternal.qll
@@ -0,0 +1,3 @@
+import semmle.code.cpp.ssa.SSAIR as OldIR
+import semmle.code.cpp.ssa.AliasedSSAIR as NewIR
+import SimpleSSA as Alias
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/SimpleSSA.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/SimpleSSA.qll
new file mode 100644
index 000000000000..27287312f16a
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/SimpleSSA.qll
@@ -0,0 +1,83 @@
+import SimpleSSAInternal
+import cpp
+import Alias
+import IR
+import semmle.code.cpp.ssa.internal.Overlap
+
+private newtype TVirtualVariable =
+ MkVirtualVariable(IRVariable var) {
+ not variableAddressEscapes(var)
+ }
+
+private VirtualVariable getVirtualVariable(IRVariable var) {
+ result.getIRVariable() = var
+}
+
+class VirtualVariable extends TVirtualVariable {
+ IRVariable var;
+
+ VirtualVariable() {
+ this = MkVirtualVariable(var)
+ }
+
+ final string toString() {
+ result = var.toString()
+ }
+
+ final IRVariable getIRVariable() {
+ result = var
+ }
+
+ // REVIEW: This should just be on MemoryAccess
+ final Type getType() {
+ result = var.getType()
+ }
+
+ final string getUniqueId() {
+ result = var.getUniqueId()
+ }
+}
+
+private newtype TMemoryAccess =
+ MkMemoryAccess(VirtualVariable vvar)
+
+private MemoryAccess getMemoryAccess(IRVariable var) {
+ result.getVirtualVariable() = getVirtualVariable(var)
+}
+
+class MemoryAccess extends TMemoryAccess {
+ VirtualVariable vvar;
+
+ MemoryAccess() {
+ this = MkMemoryAccess(vvar)
+ }
+
+ string toString() {
+ result = vvar.toString()
+ }
+
+ VirtualVariable getVirtualVariable() {
+ result = vvar
+ }
+}
+
+Overlap getOverlap(MemoryAccess def, MemoryAccess use) {
+ def.getVirtualVariable() = use.getVirtualVariable() and
+ result instanceof MustExactlyOverlap
+}
+
+MemoryAccess getResultMemoryAccess(Instruction instr) {
+ exists(IRVariable var |
+ instr.getResultMemoryAccess() instanceof IndirectMemoryAccess and
+ resultPointsTo(instr.getOperand(loadStoreAddressOperand()), var, 0) and
+ result = getMemoryAccess(var)
+ )
+}
+
+MemoryAccess getOperandMemoryAccess(Instruction instr, OperandTag tag) {
+ exists(IRVariable var |
+ instr.getOperandMemoryAccess(tag) instanceof IndirectMemoryAccess and
+ resultPointsTo(instr.getOperand(loadStoreAddressOperand()), var, 0) and
+ result = getMemoryAccess(var)
+ )
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/SimpleSSAInternal.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/SimpleSSAInternal.qll
new file mode 100644
index 000000000000..c3dfbc26594c
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/aliased_ssa/SimpleSSAInternal.qll
@@ -0,0 +1,3 @@
+import AliasAnalysis as Alias
+import semmle.code.cpp.ssa.SSAIR as IR
+
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/AliasAnalysis.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/AliasAnalysis.qll
new file mode 100644
index 000000000000..c5fd6e1d5ae6
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/AliasAnalysis.qll
@@ -0,0 +1,214 @@
+private import AliasAnalysisInternal
+import cpp
+private import IR
+private import semmle.code.cpp.ssa.internal.IntegerConstant as Ints
+
+private class IntValue = Ints::IntValue;
+
+/**
+ * Converts the bit count in `bits` to a byte count and a bit count in the form
+ * bytes:bits.
+ */
+bindingset[bits]
+string bitsToBytesAndBits(int bits) {
+ result = (bits / 8).toString() + ":" + (bits % 8).toString()
+}
+
+/**
+ * Gets a printable string for a bit offset with possibly unknown value.
+ */
+bindingset[bitOffset]
+string getBitOffsetString(IntValue bitOffset) {
+ if Ints::hasValue(bitOffset) then
+ if bitOffset >= 0 then
+ result = "+" + bitsToBytesAndBits(bitOffset)
+ else
+ result = "-" + bitsToBytesAndBits(Ints::neg(bitOffset))
+ else
+ result = "+?"
+}
+
+/**
+ * Gets the offset of field `field` in bits.
+ */
+private IntValue getFieldBitOffset(Field field) {
+ if (field instanceof BitField) then (
+ result = Ints::add(Ints::mul(field.getByteOffset(), 8),
+ field.(BitField).getBitOffset())
+ )
+ else (
+ result = Ints::mul(field.getByteOffset(), 8)
+ )
+}
+
+/**
+ * Holds if the operand `tag` of instruction `instr` is used in a way that does
+ * not result in any address held in that operand from escaping beyond the
+ * instruction.
+ */
+predicate operandIsConsumedWithoutEscaping(Instruction instr, OperandTag tag) {
+ exists(instr.getOperand(tag)) and
+ (
+ // The source/destination address of a Load/Store does not escape (but the
+ // loaded/stored value could).
+ tag instanceof LoadStoreAddressOperand or
+ // Neither operand of a Compare escapes.
+ instr instanceof CompareInstruction or
+ // Neither operand of a PointerDiff escapes.
+ instr instanceof PointerDiffInstruction or
+ // Converting an address to a `bool` does not escape the address.
+ instr.(ConvertInstruction).getResultType() instanceof BoolType
+ )
+}
+
+/**
+ * If the result of instruction `instr` is an integer constant, returns the
+ * value of that constant. Otherwise, returns unknown.
+ */
+IntValue getConstantValue(Instruction instr) {
+ if instr instanceof IntegerConstantInstruction then
+ result = instr.(IntegerConstantInstruction).getValue().toInt()
+ else
+ result = Ints::unknown()
+}
+
+/**
+ * Computes the offset, in bits, by which the result of `instr` differs from the
+ * pointer argument to `instr`, if that offset is a constant. Otherwise, returns
+ * unknown.
+ */
+IntValue getPointerBitOffset(PointerOffsetInstruction instr) {
+ exists(IntValue bitOffset |
+ (
+ bitOffset = Ints::mul(Ints::mul(getConstantValue(instr.getRightOperand()),
+ instr.getElementSize()), 8)
+ ) and
+ (
+ instr instanceof PointerAddInstruction and result = bitOffset or
+ instr instanceof PointerSubInstruction and result = Ints::neg(bitOffset)
+ )
+ )
+}
+
+/**
+ * Holds if any address held in operand `tag` of instruction `instr` is
+ * propagated to the result of `instr`, offset by the number of bits in
+ * `bitOffset`. If the address is propagated, but the offset is not known to be
+ * a constant, then `bitOffset` is unknown.
+ */
+predicate operandIsPropagated(Instruction instr, OperandTag tag,
+ IntValue bitOffset) {
+ exists(instr.getOperand(tag)) and
+ (
+ // Converting to a non-virtual base class adds the offset of the base class.
+ exists(ConvertToBaseInstruction convert |
+ convert = instr and
+ bitOffset = Ints::mul(convert.getDerivation().getByteOffset(), 8)
+ ) or
+ // Converting to a derived class subtracts the offset of the base class.
+ exists(ConvertToDerivedInstruction convert |
+ convert = instr and
+ bitOffset = Ints::neg(Ints::mul(convert.getDerivation().getByteOffset(), 8))
+ ) or
+ // Converting to a virtual base class adds an unknown offset.
+ (
+ instr instanceof ConvertToVirtualBaseInstruction and
+ bitOffset = Ints::unknown()
+ ) or
+ // Conversion to another pointer type propagates the source address.
+ exists(ConvertInstruction convert, Type resultType |
+ convert = instr and
+ resultType = convert.getResultType() and
+ (
+ resultType instanceof PointerType or
+ resultType instanceof Class //REVIEW: Remove when all glvalues are pointers
+ ) and
+ bitOffset = 0
+ ) or
+ // Adding an integer to or subtracting an integer from a pointer propagates
+ // the address with an offset.
+ bitOffset = getPointerBitOffset(instr.(PointerOffsetInstruction)) or
+ // Computing a field address from a pointer propagates the address plus the
+ // offset of the field.
+ bitOffset = getFieldBitOffset(instr.(FieldAddressInstruction).getField()) or
+ // A copy propagates the source value.
+ tag instanceof CopySourceOperand and bitOffset = 0
+ )
+}
+
+/**
+ * Holds if any address held in operand number `tag` of instruction `instr`
+ * escapes outside the domain of the analysis.
+ */
+predicate operandEscapes(Instruction instr, OperandTag tag) {
+ exists(instr.getOperand(tag)) and
+ // Conservatively assume that the address escapes unless one of the following
+ // holds:
+ not (
+ // The operand is used in a way that does not escape the instruction
+ operandIsConsumedWithoutEscaping(instr, tag) or
+ // The address is propagated to the result of the instruction, but that
+ // result does not itself escape.
+ operandIsPropagated(instr, tag, _) and not resultEscapes(instr)
+ )
+}
+
+/**
+ * Holds if any address held in the result of instruction `instr` escapes
+ * outside the domain of the analysis.
+ */
+predicate resultEscapes(Instruction instr) {
+ // The result escapes if it has at least one use that escapes.
+ exists(Instruction useInstr, OperandTag useOperandTag |
+ instr.hasUse(useInstr, useOperandTag) and
+ operandEscapes(useInstr, useOperandTag)
+ )
+}
+
+/**
+ * Holds if the address of the specified local variable or parameter escapes the
+ * domain of the analysis.
+ */
+private predicate automaticVariableAddressEscapes(IRAutomaticVariable var) {
+ exists(FunctionIR funcIR |
+ funcIR = var.getFunctionIR() and
+ // The variable's address escapes if the result of any
+ // VariableAddressInstruction that computes the variable's address escapes.
+ exists(VariableAddressInstruction instr |
+ instr.getFunctionIR() = funcIR and
+ instr.getVariable() = var and
+ resultEscapes(instr)
+ )
+ )
+}
+
+/**
+ * Holds if the address of the specified variable escapes the domain of the
+ * analysis.
+ */
+predicate variableAddressEscapes(IRVariable var) {
+ automaticVariableAddressEscapes(var.(IRAutomaticVariable)) or
+ // All variables with static storage duration have their address escape.
+ not var instanceof IRAutomaticVariable
+}
+
+/**
+ * Holds if the result of instruction `instr` points within variable `var`, at
+ * bit offset `bitOffset` within the variable. If the result points within
+ * `var`, but at an unknown or non-constant offset, then `bitOffset` is unknown.
+ */
+predicate resultPointsTo(Instruction instr, IRVariable var, IntValue bitOffset) {
+ (
+ // The address of a variable points to that variable, at offset 0.
+ instr.(VariableAddressInstruction).getVariable() = var and
+ bitOffset = 0
+ ) or
+ exists(OperandTag operandTag, IntValue originalBitOffset,
+ IntValue propagatedBitOffset |
+ // If an operand is propagated, then the result points to the same variable,
+ // offset by the bit offset from the propagation.
+ resultPointsTo(instr.getOperand(operandTag), var, originalBitOffset) and
+ operandIsPropagated(instr, operandTag, propagatedBitOffset) and
+ bitOffset = Ints::add(originalBitOffset, propagatedBitOffset)
+ )
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/AliasAnalysisInternal.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/AliasAnalysisInternal.qll
new file mode 100644
index 000000000000..b7541fac50ee
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/AliasAnalysisInternal.qll
@@ -0,0 +1 @@
+import semmle.code.cpp.ir.IR as IR
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/FunctionIR.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/FunctionIR.qll
new file mode 100644
index 000000000000..ba8f524f202f
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/FunctionIR.qll
@@ -0,0 +1,91 @@
+private import IRInternal
+import Instruction
+import cpp
+
+private newtype TFunctionIR =
+ MkFunctionIR(Function func) {
+ Construction::functionHasIR(func)
+ }
+
+/**
+ * Represents the IR for a function.
+ */
+class FunctionIR extends TFunctionIR {
+ Function func;
+
+ FunctionIR() {
+ this = MkFunctionIR(func)
+ }
+
+ final string toString() {
+ result = "IR: " + func.toString()
+ }
+
+ /**
+ * Gets the function whose IR is represented.
+ */
+ final Function getFunction() {
+ result = func
+ }
+
+ /**
+ * Gets the location of the function.
+ */
+ final Location getLocation() {
+ result = func.getLocation()
+ }
+
+ /**
+ * Gets the entry point for this function.
+ */
+ final EnterFunctionInstruction getEnterFunctionInstruction() {
+ result.getFunctionIR() = this
+ }
+
+ /**
+ * Gets the exit point for this function.
+ */
+ final ExitFunctionInstruction getExitFunctionInstruction() {
+ result.getFunctionIR() = this
+ }
+
+ final UnmodeledDefinitionInstruction getUnmodeledDefinitionInstruction() {
+ result.getFunctionIR() = this
+ }
+
+ /**
+ * Gets the single return instruction for this function.
+ */
+ final ReturnInstruction getReturnInstruction() {
+ result.getFunctionIR() = this
+ }
+
+ /**
+ * Gets the variable used to hold the return value of this function. If this
+ * function does not return a value, this predicate does not hold.
+ */
+ final IRReturnVariable getReturnVariable() {
+ result.getFunctionIR() = this
+ }
+
+ /**
+ * Gets the block containing the entry point of this function.
+ */
+ final IRBlock getEntryBlock() {
+ result.getFirstInstruction() = getEnterFunctionInstruction()
+ }
+
+ /**
+ * Gets all instructions in this function.
+ */
+ final Instruction getAnInstruction() {
+ result.getFunctionIR() = this
+ }
+
+ /**
+ * Gets all blocks in this function.
+ */
+ final IRBlock getABlock() {
+ result.getFunctionIR() = this
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/IRBlock.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/IRBlock.qll
new file mode 100644
index 000000000000..98ec650036db
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/IRBlock.qll
@@ -0,0 +1,131 @@
+private import IRInternal
+import Instruction
+import cpp
+import semmle.code.cpp.ir.EdgeKind
+
+private predicate startsBasicBlock(Instruction instr) {
+ not instr instanceof PhiInstruction and
+ (
+ count(Instruction predecessor |
+ instr = predecessor.getASuccessor()
+ ) != 1 or // Multiple predecessors or no predecessor
+ exists(Instruction predecessor |
+ instr = predecessor.getASuccessor() and
+ strictcount(Instruction other |
+ other = predecessor.getASuccessor()
+ ) > 1
+ ) or // Predecessor has multiple successors
+ exists(Instruction predecessor, EdgeKind kind |
+ instr = predecessor.getSuccessor(kind) and
+ not kind instanceof GotoEdge
+ ) // Incoming edge is not a GotoEdge
+ )
+}
+
+private newtype TIRBlock =
+ MkIRBlock(Instruction firstInstr) {
+ startsBasicBlock(firstInstr)
+ }
+
+cached private predicate isEntryBlock(IRBlock block) {
+ block.getFirstInstruction() instanceof EnterFunctionInstruction
+}
+
+cached private predicate blockSuccessor(IRBlock pred, IRBlock succ) {
+ succ = pred.getASuccessor()
+}
+
+private predicate blockImmediatelyDominates(IRBlock dominator, IRBlock block) =
+ idominance(isEntryBlock/1, blockSuccessor/2)(_, dominator, block)
+
+class IRBlock extends TIRBlock {
+ Instruction firstInstr;
+
+ IRBlock() {
+ this = MkIRBlock(firstInstr)
+ }
+
+ final string toString() {
+ result = firstInstr.toString()
+ }
+
+ final Location getLocation() {
+ result = getFirstInstruction().getLocation()
+ }
+
+ final string getUniqueId() {
+ result = firstInstr.getUniqueId()
+ }
+
+ final cached Instruction getInstruction(int index) {
+ index = 0 and result = firstInstr or
+ (
+ index > 0 and
+ not startsBasicBlock(result) and
+ exists(Instruction predecessor, GotoEdge edge |
+ predecessor = getInstruction(index - 1) and
+ result = predecessor.getSuccessor(edge)
+ )
+ )
+ }
+
+ final PhiInstruction getAPhiInstruction() {
+ Construction::getPhiInstructionBlockStart(result) =
+ getFirstInstruction()
+ }
+
+ final Instruction getAnInstruction() {
+ result = getInstruction(_) or
+ result = getAPhiInstruction()
+ }
+
+ final Instruction getFirstInstruction() {
+ result = firstInstr
+ }
+
+ final Instruction getLastInstruction() {
+ result = getInstruction(getInstructionCount() - 1)
+ }
+
+ final int getInstructionCount() {
+ result = strictcount(getInstruction(_))
+ }
+
+ final FunctionIR getFunctionIR() {
+ result = firstInstr.getFunctionIR()
+ }
+
+ final Function getFunction() {
+ result = firstInstr.getFunction()
+ }
+
+ final IRBlock getASuccessor() {
+ result.getFirstInstruction() = getLastInstruction().getASuccessor()
+ }
+
+ final IRBlock getAPredecessor() {
+ firstInstr = result.getLastInstruction().getASuccessor()
+ }
+
+ final IRBlock getSuccessor(EdgeKind kind) {
+ result.getFirstInstruction() = getLastInstruction().getSuccessor(kind)
+ }
+
+ final predicate immediatelyDominates(IRBlock block) {
+ blockImmediatelyDominates(this, block)
+ }
+
+ final predicate strictlyDominates(IRBlock block) {
+ blockImmediatelyDominates+(this, block)
+ }
+
+ final predicate dominates(IRBlock block) {
+ strictlyDominates(block) or this = block
+ }
+
+ pragma[noinline]
+ final IRBlock dominanceFrontier() {
+ dominates(result.getAPredecessor()) and
+ not strictlyDominates(result)
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/IRImpl.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/IRImpl.qll
new file mode 100644
index 000000000000..97c027cc1280
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/IRImpl.qll
@@ -0,0 +1,7 @@
+import FunctionIR
+import Instruction
+import IRBlock
+import IRVariable
+import OperandTag
+import semmle.code.cpp.ir.EdgeKind
+import semmle.code.cpp.ir.MemoryAccessKind
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/IRInternal.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/IRInternal.qll
new file mode 100644
index 000000000000..7517660a58f0
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/IRInternal.qll
@@ -0,0 +1 @@
+import SSAConstruction as Construction
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/IRSanityImpl.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/IRSanityImpl.qll
new file mode 100644
index 000000000000..744b28704604
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/IRSanityImpl.qll
@@ -0,0 +1,3 @@
+private import IRImpl
+import InstructionSanity
+
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/IRVariable.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/IRVariable.qll
new file mode 100644
index 000000000000..a903e227b26c
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/IRVariable.qll
@@ -0,0 +1,202 @@
+private import IRInternal
+import FunctionIR
+import cpp
+import semmle.code.cpp.ir.TempVariableTag
+private import semmle.code.cpp.ir.internal.TempVariableTag
+
+private newtype TIRVariable =
+ TIRAutomaticUserVariable(LocalScopeVariable var, FunctionIR funcIR) {
+ exists(Function func |
+ func = funcIR.getFunction() and
+ (
+ var.getFunction() = func or
+ var.(Parameter).getCatchBlock().getEnclosingFunction() = func
+ )
+ )
+ } or
+ TIRStaticUserVariable(Variable var, FunctionIR funcIR) {
+ (
+ var instanceof GlobalOrNamespaceVariable or
+ var instanceof MemberVariable and not var instanceof Field
+ ) and
+ exists(VariableAccess access |
+ access.getTarget() = var and
+ access.getEnclosingFunction() = funcIR.getFunction()
+ )
+ } or
+ TIRTempVariable(FunctionIR funcIR, Locatable ast, TempVariableTag tag,
+ Type type) {
+ Construction::hasTempVariable(funcIR.getFunction(), ast, tag, type)
+ }
+
+IRUserVariable getIRUserVariable(Function func, Variable var) {
+ result.getVariable() = var and
+ result.getFunction() = func
+}
+
+/**
+ * Represents a variable referenced by the IR for a function. The variable may
+ * be a user-declared variable (`IRUserVariable`) or a temporary variable
+ * generated by the AST-to-IR translation (`IRTempVariable`).
+ */
+abstract class IRVariable extends TIRVariable {
+ FunctionIR funcIR;
+
+ abstract string toString();
+
+ /**
+ * Gets the type of the variable.
+ */
+ abstract Type getType();
+
+ /**
+ * Gets the AST node that declared this variable, or that introduced this
+ * variable as part of the AST-to-IR translation.
+ */
+ abstract Locatable getAST();
+
+ /**
+ * Gets an identifier string for the variable. This identifier is unique
+ * within the function.
+ */
+ abstract string getUniqueId();
+
+ /**
+ * Gets the source location of this variable.
+ */
+ final Location getLocation() {
+ result = getAST().getLocation()
+ }
+
+ /**
+ * Gets the IR for the function that references this variable.
+ */
+ final FunctionIR getFunctionIR() {
+ result = funcIR
+ }
+
+ /**
+ * Gets the function that references this variable.
+ */
+ final Function getFunction() {
+ result = funcIR.getFunction()
+ }
+}
+
+/**
+ * Represents a user-declared variable referenced by the IR for a function.
+ */
+abstract class IRUserVariable extends IRVariable {
+ Variable var;
+
+ override final string toString() {
+ result = var.toString()
+ }
+
+ override final Type getType() {
+ result = var.getType().getUnspecifiedType()
+ }
+
+ override final Locatable getAST() {
+ result = var
+ }
+
+ override final string getUniqueId() {
+ result = var.toString() + " " + var.getLocation().toString()
+ }
+
+ /**
+ * Gets the original user-declared variable.
+ */
+ final Variable getVariable() {
+ result = var
+ }
+}
+
+/**
+ * Represents a variable (user-declared or temporary) that is allocated on the
+ * stack. This includes all parameters, non-static local variables, and
+ * temporary variables.
+ */
+abstract class IRAutomaticVariable extends IRVariable {
+}
+
+class IRAutomaticUserVariable extends IRUserVariable, IRAutomaticVariable,
+ TIRAutomaticUserVariable {
+ LocalScopeVariable localVar;
+
+ IRAutomaticUserVariable() {
+ this = TIRAutomaticUserVariable(localVar, funcIR) and
+ var = localVar
+ }
+
+ final LocalScopeVariable getLocalVariable() {
+ result = localVar
+ }
+}
+
+class IRStaticUserVariable extends IRUserVariable, TIRStaticUserVariable {
+ IRStaticUserVariable() {
+ this = TIRStaticUserVariable(var, funcIR)
+ }
+}
+
+IRTempVariable getIRTempVariable(Locatable ast, TempVariableTag tag) {
+ result.getAST() = ast and
+ result.getTag() = tag
+}
+
+class IRTempVariable extends IRVariable, IRAutomaticVariable, TIRTempVariable {
+ Locatable ast;
+ TempVariableTag tag;
+ Type type;
+
+ IRTempVariable() {
+ this = TIRTempVariable(funcIR, ast, tag, type)
+ }
+
+ override final Type getType() {
+ result = type
+ }
+
+ override final Locatable getAST() {
+ result = ast
+ }
+
+ override final string getUniqueId() {
+ result = "Temp: " + Construction::getTempVariableUniqueId(this)
+ }
+
+ final TempVariableTag getTag() {
+ result = tag
+ }
+
+ override string toString() {
+ result = getBaseString() + ast.getLocation().getStartLine().toString() + ":" +
+ ast.getLocation().getStartColumn().toString()
+ }
+
+ string getBaseString() {
+ result = "#temp"
+ }
+}
+
+class IRReturnVariable extends IRTempVariable {
+ IRReturnVariable() {
+ tag = ReturnValueTempVar()
+ }
+
+ override final string toString() {
+ result = "#return"
+ }
+}
+
+class IRThrowVariable extends IRTempVariable {
+ IRThrowVariable() {
+ tag = ThrowTempVar()
+ }
+
+ override string getBaseString() {
+ result = "#throw"
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/Instruction.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/Instruction.qll
new file mode 100644
index 000000000000..d00999f894aa
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/Instruction.qll
@@ -0,0 +1,978 @@
+private import IRInternal
+import FunctionIR
+import IRBlock
+import IRVariable
+import OperandTag
+import cpp
+import semmle.code.cpp.ir.EdgeKind
+import semmle.code.cpp.ir.MemoryAccessKind
+import semmle.code.cpp.ir.Opcode
+private import semmle.code.cpp.ir.internal.Opcode
+
+class InstructionTag = Construction::InstructionTagType;
+
+module InstructionSanity {
+ /**
+ * Holds if the instruction `instr` should be expected to have an operand
+ * with operand tag `tag`. Only holds for singleton operand tags. Tags with
+ * parameters, such as `PhiOperand` and `PositionalArgumentOperand` are handled
+ * separately in `unexpectedOperand`.
+ */
+ private predicate expectsOperand(Instruction instr, OperandTag tag) {
+ exists(Opcode opcode |
+ opcode = instr.getOpcode() and
+ (
+ opcode instanceof UnaryOpcode and tag instanceof UnaryOperand or
+ (
+ opcode instanceof BinaryOpcode and
+ (
+ tag instanceof LeftOperand or
+ tag instanceof RightOperand
+ )
+ ) or
+ opcode instanceof CopyOpcode and tag instanceof CopySourceOperand or
+ opcode instanceof MemoryAccessOpcode and tag instanceof LoadStoreAddressOperand or
+ opcode instanceof OpcodeWithCondition and tag instanceof ConditionOperand or
+ opcode instanceof Opcode::ReturnValue and tag instanceof ReturnValueOperand or
+ opcode instanceof Opcode::ThrowValue and tag instanceof ExceptionOperand or
+ opcode instanceof Opcode::UnmodeledUse and tag instanceof UnmodeledUseOperand or
+ opcode instanceof Opcode::Invoke and tag instanceof CallTargetOperand
+ )
+ )
+ }
+
+ /**
+ * Holds if instruction `instr` is missing an expected operand with tag `tag`.
+ */
+ query predicate missingOperand(Instruction instr, OperandTag tag) {
+ expectsOperand(instr, tag) and not exists(instr.getOperand(tag))
+ }
+
+ /**
+ * Holds if instruction `instr` has an unexpected operand with tag `tag`.
+ */
+ query predicate unexpectedOperand(Instruction instr, OperandTag tag) {
+ exists(instr.getOperand(tag)) and
+ not expectsOperand(instr, tag) and
+ not (instr instanceof InvokeInstruction and tag instanceof ArgumentOperand) and
+ not (instr instanceof BuiltInInstruction and tag instanceof PositionalArgumentOperand) and
+ not (instr instanceof PhiInstruction and tag instanceof PhiOperand)
+ }
+
+ /**
+ * Holds if instruction `instr` has multiple operands with tag `tag`.
+ */
+ query predicate duplicateOperand(Instruction instr, OperandTag tag) {
+ count(instr.getOperand(tag)) > 1 and
+ not tag instanceof UnmodeledUseOperand
+ }
+}
+
+/**
+ * Represents a single operation in the IR.
+ */
+class Instruction extends Construction::TInstruction {
+ Opcode opcode;
+ Locatable ast;
+ InstructionTag instructionTag;
+ Type resultType;
+ FunctionIR funcIR;
+ boolean glvalue;
+
+ Instruction() {
+ this = Construction::MkInstruction(funcIR, opcode, ast, instructionTag, resultType, glvalue)
+ }
+
+ string toString() {
+ result = opcode.toString()
+ }
+
+ /**
+ * Gets a string identifier for this function that is unique among all
+ * instructions in the same function.
+ *
+ * This is used for sorting IR output for tests, and is likely to be
+ * inefficient for any other use.
+ */
+ final string getUniqueId() {
+ result = Construction::getInstructionUniqueId(this)
+ }
+
+ /**
+ * Gets the basic block that contains this instruction.
+ */
+ final IRBlock getBlock() {
+ result.getAnInstruction() = this
+ }
+
+ /**
+ * Gets the function that contains this instruction.
+ */
+ final Function getFunction() {
+ result = funcIR.getFunction()
+ }
+
+ /**
+ * Gets the FunctionIR object that contains the IR for this instruction.
+ */
+ final FunctionIR getFunctionIR() {
+ result = funcIR
+ }
+
+ /**
+ * Gets the AST that caused this instruction to be generated.
+ */
+ final Locatable getAST() {
+ result = ast
+ }
+
+ /**
+ * Gets the location of the source code for this instruction.
+ */
+ final Location getLocation() {
+ result = ast.getLocation()
+ }
+
+ /**
+ * Gets the type of the result produced by this instruction. If the
+ * instruction does not produce a result, its result type will be `VoidType`.
+ */
+ final Type getResultType() {
+ result = resultType
+ }
+
+ /**
+ * Holds if the result produced by this instruction is a glvalue. If this
+ * holds, the result of the instruction represents the address of a location,
+ * and the type of the location is given by `getResultType()`. If this does
+ * not hold, the result of the instruction represents a value whose type is
+ * given by `getResultType()`.
+ *
+ * For example, the statement `y = x;` generates the following IR:
+ * r1_0(glval: int) = VariableAddress[x]
+ * r1_1(int) = Load r1_0, mu0_1
+ * r1_2(glval: int) = VariableAddress[y]
+ * mu1_3(int) = Store r1_2, r1_1
+ *
+ * The result of each `VariableAddress` instruction is a glvalue of type
+ * `int`, representing the address of the corresponding integer variable. The
+ * result of the `Load` instruction is a prvalue of type `int`, representing
+ * the integer value loaded from variable `x`.
+ */
+ final predicate isGLValue() {
+ glvalue = true
+ }
+
+ /**
+ * Gets the size of the result produced by this instruction, in bytes. If the
+ * instruction does not produce a result, or if the result does not have a
+ * known constant size, this predicate does not hold.
+ *
+ * If `this.isGLValue()` holds for this instruction, the value of
+ * `getResultSize()` will always be the size of a pointer.
+ */
+ final int getResultSize() {
+ if isGLValue() then (
+ // a glvalue is always pointer-sized.
+ exists(NullPointerType nullptr |
+ result = nullptr.getSize()
+ )
+ )
+ else if resultType instanceof UnknownType then
+ result = Construction::getInstructionResultSize(this)
+ else (
+ not resultType instanceof VoidType and
+ result = resultType.getSize()
+ )
+ }
+
+ /**
+ * Gets the opcode that specifies the operation performed by this instruction.
+ */
+ final Opcode getOpcode() {
+ result = opcode
+ }
+
+ final InstructionTag getTag() {
+ result = instructionTag
+ }
+
+ /**
+ * Gets the instruction that produced the value of the specified source
+ * operand.
+ */
+ final Instruction getOperand(OperandTag tag) {
+ result = Construction::getInstructionOperand(this, tag)
+ }
+
+ /**
+ * Gets all instructions consumed by this instruction's operands.
+ */
+ final Instruction getAnOperand() {
+ result = getOperand(_)
+ }
+
+ /**
+ * Holds if this instruction has a memory operand with the specified tag.
+ */
+ final predicate isMemoryOperand(OperandTag tag) {
+ exists(getOperandMemoryAccess(tag))
+ }
+
+ /**
+ * Gets the kind of memory access performed by the specified operand. Holds
+ * only for memory operands.
+ */
+ MemoryAccessKind getOperandMemoryAccess(OperandTag tag) {
+ none()
+ }
+
+ /**
+ * Holds if this instruction produces a memory result.
+ */
+ final predicate hasMemoryResult() {
+ exists(getResultMemoryAccess())
+ }
+
+ /**
+ * Gets the kind of memory access performed by this instruction's result.
+ * Holds only for instructions with a memory result.
+ */
+ MemoryAccessKind getResultMemoryAccess() {
+ none()
+ }
+
+ /**
+ * Holds if the result of this instruction is precisely modeled in SSA. Always
+ * holds for a register result. For a memory result, a modeled result is
+ * connected to its actual uses. An unmodeled result is connected to the
+ * `UnmodeledUse` instruction.
+ *
+ * For example:
+ * ```
+ * int x = 1;
+ * int *p = &x;
+ * int y = *p;
+ * ```
+ * In non-aliased SSA, `x` will not be modeled because it has its address
+ * taken. In that case, `isResultModeled()` would not hold for the result of
+ * the `Store` to `x`.
+ */
+ final predicate isResultModeled() {
+ // Register results are always in SSA form.
+ not hasMemoryResult() or
+ // An unmodeled result will have a use on the `UnmodeledUse` instruction.
+ not exists(UnmodeledUseOperand useTag |
+ hasUse(_, useTag)
+ )
+ }
+
+ /**
+ * Gets the successor of this instruction along the control flow edge
+ * specified by `kind`.
+ */
+ final Instruction getSuccessor(EdgeKind kind) {
+ result = Construction::getInstructionSuccessor(this, kind)
+ }
+
+ /**
+ * Gets all direct successors of this instruction.
+ */
+ final Instruction getASuccessor() {
+ result = getSuccessor(_)
+ }
+
+ /**
+ * Gets a predecessor of this instruction such that the predecessor reaches
+ * this instruction along the control flow edge specified by `kind`.
+ */
+ final Instruction getPredecessor(EdgeKind kind) {
+ result.getSuccessor(kind) = this
+ }
+
+ /**
+ * Gets all direct predecessors of this instruction.
+ */
+ final Instruction getAPredecessor() {
+ result = getPredecessor(_)
+ }
+
+ /**
+ * Holds if the result of this instruction is consumed by `useInstruction` as
+ * an operand with tag `useTag`.
+ */
+ final predicate hasUse(Instruction useInstruction, OperandTag useTag) {
+ useInstruction.getFunctionIR() = funcIR and
+ this = useInstruction.getOperand(useTag)
+ }
+}
+
+class VariableInstruction extends Instruction {
+ IRVariable var;
+
+ VariableInstruction() {
+ var = Construction::getInstructionVariable(this)
+ }
+
+ override final string toString() {
+ result = super.toString() + "[" + var.toString() + "]"
+ }
+
+ final IRVariable getVariable() {
+ result = var
+ }
+}
+
+class FieldInstruction extends Instruction {
+ Field field;
+
+ FieldInstruction() {
+ field = Construction::getInstructionField(this)
+ }
+
+ override final string toString() {
+ result = super.toString() + "[" + field.toString() + "]"
+ }
+
+ final Field getField() {
+ result = field
+ }
+}
+
+class FunctionInstruction extends Instruction {
+ Function funcSymbol;
+
+ FunctionInstruction() {
+ funcSymbol = Construction::getInstructionFunction(this)
+ }
+
+ override final string toString() {
+ result = super.toString() + "[" + funcSymbol.toString() + "]"
+ }
+
+ final Function getFunctionSymbol() {
+ result = funcSymbol
+ }
+}
+
+class ConstantValueInstruction extends Instruction {
+ string value;
+
+ ConstantValueInstruction() {
+ value = Construction::getInstructionConstantValue(this)
+ }
+
+ override final string toString() {
+ result = super.toString() + "[" + value + "]"
+ }
+
+ final string getValue() {
+ result = value
+ }
+}
+
+class EnterFunctionInstruction extends Instruction {
+ EnterFunctionInstruction() {
+ opcode instanceof Opcode::EnterFunction
+ }
+}
+
+class VariableAddressInstruction extends VariableInstruction {
+ VariableAddressInstruction() {
+ opcode instanceof Opcode::VariableAddress
+ }
+}
+
+class InitializeParameterInstruction extends VariableInstruction {
+ InitializeParameterInstruction() {
+ opcode instanceof Opcode::InitializeParameter
+ }
+
+ final Parameter getParameter() {
+ result = var.(IRUserVariable).getVariable()
+ }
+}
+
+class FieldAddressInstruction extends FieldInstruction {
+ FieldAddressInstruction() {
+ opcode instanceof Opcode::FieldAddress
+ }
+
+ final Instruction getObjectAddress() {
+ result = getOperand(unaryOperand())
+ }
+}
+
+class UninitializedInstruction extends Instruction {
+ UninitializedInstruction() {
+ opcode instanceof Opcode::Uninitialized
+ }
+}
+
+class NoOpInstruction extends Instruction {
+ NoOpInstruction() {
+ opcode instanceof Opcode::NoOp
+ }
+}
+
+class ReturnInstruction extends Instruction {
+ ReturnInstruction() {
+ opcode instanceof ReturnOpcode
+ }
+}
+
+class ReturnVoidInstruction extends ReturnInstruction {
+ ReturnVoidInstruction() {
+ opcode instanceof Opcode::ReturnVoid
+ }
+}
+
+class ReturnValueInstruction extends ReturnInstruction {
+ ReturnValueInstruction() {
+ opcode instanceof Opcode::ReturnValue
+ }
+
+ final Instruction getReturnValue() {
+ result = getOperand(returnValueOperand())
+ }
+
+ override final MemoryAccessKind getOperandMemoryAccess(OperandTag tag) {
+ tag instanceof ReturnValueOperand and
+ result instanceof IndirectMemoryAccess
+ }
+}
+
+class CopyInstruction extends Instruction {
+ CopyInstruction() {
+ opcode instanceof CopyOpcode
+ }
+
+ final Instruction getSourceValue() {
+ result = getOperand(copySourceOperand())
+ }
+}
+
+class CopyValueInstruction extends CopyInstruction {
+ CopyValueInstruction() {
+ opcode instanceof Opcode::CopyValue
+ }
+}
+
+class LoadInstruction extends CopyInstruction {
+ LoadInstruction() {
+ opcode instanceof Opcode::Load
+ }
+
+ override final MemoryAccessKind getOperandMemoryAccess(OperandTag tag) {
+ tag instanceof CopySourceOperand and
+ result instanceof IndirectMemoryAccess
+ }
+
+ final Instruction getSourceAddress() {
+ result = getOperand(loadStoreAddressOperand())
+ }
+}
+
+class StoreInstruction extends CopyInstruction {
+ StoreInstruction() {
+ opcode instanceof Opcode::Store
+ }
+
+ override final MemoryAccessKind getResultMemoryAccess() {
+ result instanceof IndirectMemoryAccess
+ }
+
+ final Instruction getDestinationAddress() {
+ result = getOperand(loadStoreAddressOperand())
+ }
+}
+
+class ConditionalBranchInstruction extends Instruction {
+ ConditionalBranchInstruction() {
+ opcode instanceof Opcode::ConditionalBranch
+ }
+
+ final Instruction getCondition() {
+ result = getOperand(conditionOperand())
+ }
+
+ final Instruction getTrueSuccessor() {
+ result = getSuccessor(trueEdge())
+ }
+
+ final Instruction getFalseSuccessor() {
+ result = getSuccessor(falseEdge())
+ }
+}
+
+class ExitFunctionInstruction extends Instruction {
+ ExitFunctionInstruction() {
+ opcode instanceof Opcode::ExitFunction
+ }
+}
+
+class ConstantInstruction extends ConstantValueInstruction {
+ ConstantInstruction() {
+ opcode instanceof Opcode::Constant
+ }
+}
+
+class IntegerConstantInstruction extends ConstantInstruction {
+ IntegerConstantInstruction() {
+ resultType instanceof IntegralType
+ }
+}
+
+class FloatConstantInstruction extends ConstantInstruction {
+ FloatConstantInstruction() {
+ resultType instanceof FloatingPointType
+ }
+}
+
+class StringConstantInstruction extends Instruction {
+ StringLiteral value;
+
+ StringConstantInstruction() {
+ value = Construction::getInstructionStringLiteral(this)
+ }
+
+ override final string toString() {
+ result = super.toString() + "[" +
+ value.getValueText().replaceAll("\n", " ").replaceAll("\r", "").replaceAll("\t", " ") +
+ "]"
+ }
+
+ final StringLiteral getValue() {
+ result = value
+ }
+}
+
+class BinaryInstruction extends Instruction {
+ BinaryInstruction() {
+ opcode instanceof BinaryOpcode
+ }
+
+ final Instruction getLeftOperand() {
+ result = getOperand(leftOperand())
+ }
+
+ final Instruction getRightOperand() {
+ result = getOperand(rightOperand())
+ }
+}
+
+class AddInstruction extends BinaryInstruction {
+ AddInstruction() {
+ opcode instanceof Opcode::Add
+ }
+}
+
+class SubInstruction extends BinaryInstruction {
+ SubInstruction() {
+ opcode instanceof Opcode::Sub
+ }
+}
+
+class MulInstruction extends BinaryInstruction {
+ MulInstruction() {
+ opcode instanceof Opcode::Mul
+ }
+}
+
+class DivInstruction extends BinaryInstruction {
+ DivInstruction() {
+ opcode instanceof Opcode::Div
+ }
+}
+
+class RemInstruction extends BinaryInstruction {
+ RemInstruction() {
+ opcode instanceof Opcode::Rem
+ }
+}
+
+class BitAndInstruction extends BinaryInstruction {
+ BitAndInstruction() {
+ opcode instanceof Opcode::BitAnd
+ }
+}
+
+class BitOrInstruction extends BinaryInstruction {
+ BitOrInstruction() {
+ opcode instanceof Opcode::BitOr
+ }
+}
+
+class BitXorInstruction extends BinaryInstruction {
+ BitXorInstruction() {
+ opcode instanceof Opcode::BitXor
+ }
+}
+
+class ShiftLeftInstruction extends BinaryInstruction {
+ ShiftLeftInstruction() {
+ opcode instanceof Opcode::ShiftLeft
+ }
+}
+
+class ShiftRightInstruction extends BinaryInstruction {
+ ShiftRightInstruction() {
+ opcode instanceof Opcode::ShiftRight
+ }
+}
+
+class PointerArithmeticInstruction extends BinaryInstruction {
+ int elementSize;
+
+ PointerArithmeticInstruction() {
+ opcode instanceof PointerArithmeticOpcode and
+ elementSize = Construction::getInstructionElementSize(this)
+ }
+
+ override final string toString() {
+ result = super.toString() + "[" + elementSize.toString() + "]"
+ }
+
+ final int getElementSize() {
+ result = elementSize
+ }
+}
+
+class PointerOffsetInstruction extends PointerArithmeticInstruction {
+ PointerOffsetInstruction() {
+ opcode instanceof PointerOffsetOpcode
+ }
+}
+
+class PointerAddInstruction extends PointerOffsetInstruction {
+ PointerAddInstruction() {
+ opcode instanceof Opcode::PointerAdd
+ }
+}
+
+class PointerSubInstruction extends PointerOffsetInstruction {
+ PointerSubInstruction() {
+ opcode instanceof Opcode::PointerSub
+ }
+}
+
+class PointerDiffInstruction extends PointerArithmeticInstruction {
+ PointerDiffInstruction() {
+ opcode instanceof Opcode::PointerDiff
+ }
+}
+
+class UnaryInstruction extends Instruction {
+ UnaryInstruction() {
+ opcode instanceof UnaryOpcode
+ }
+
+ final Instruction getOperand() {
+ result = getOperand(unaryOperand())
+ }
+}
+
+class ConvertInstruction extends UnaryInstruction {
+ ConvertInstruction() {
+ opcode instanceof Opcode::Convert
+ }
+}
+
+/**
+ * Represents an instruction that converts between two addresses
+ * related by inheritance.
+ */
+class InheritanceConversionInstruction extends UnaryInstruction {
+ Class baseClass;
+ Class derivedClass;
+
+ InheritanceConversionInstruction() {
+ Construction::getInstructionInheritance(this, baseClass, derivedClass)
+ }
+
+ override final string toString() {
+ result = super.toString() + "[" + derivedClass.toString() + " : " + baseClass.toString() + "]"
+ }
+
+ /**
+ * Gets the `ClassDerivation` for the inheritance relationship between
+ * the base and derived classes. This predicate does not hold if the
+ * conversion is to an indirect virtual base class.
+ */
+ final ClassDerivation getDerivation() {
+ result.getBaseClass() = baseClass and result.getDerivedClass() = derivedClass
+ }
+
+ /**
+ * Gets the base class of the conversion. This will be either a direct
+ * base class of the derived class, or a virtual base class of the
+ * derived class.
+ */
+ final Class getBaseClass() {
+ result = baseClass
+ }
+
+ /**
+ * Gets the derived class of the conversion.
+ */
+ final Class getDerivedClass() {
+ result = derivedClass
+ }
+}
+
+/**
+ * Represents an instruction that converts from the address of a derived class
+ * to the address of a direct non-virtual base class.
+ */
+class ConvertToBaseInstruction extends InheritanceConversionInstruction {
+ ConvertToBaseInstruction() {
+ opcode instanceof Opcode::ConvertToBase
+ }
+}
+
+/**
+ * Represents an instruction that converts from the address of a derived class
+ * to the address of a virtual base class.
+ */
+class ConvertToVirtualBaseInstruction extends InheritanceConversionInstruction {
+ ConvertToVirtualBaseInstruction() {
+ opcode instanceof Opcode::ConvertToVirtualBase
+ }
+}
+
+/**
+ * Represents an instruction that converts from the address of a base class
+ * to the address of a direct non-virtual derived class.
+ */
+class ConvertToDerivedInstruction extends InheritanceConversionInstruction {
+ ConvertToDerivedInstruction() {
+ opcode instanceof Opcode::ConvertToDerived
+ }
+}
+
+class BitComplementInstruction extends UnaryInstruction {
+ BitComplementInstruction() {
+ opcode instanceof Opcode::BitComplement
+ }
+}
+
+class LogicalNotInstruction extends UnaryInstruction {
+ LogicalNotInstruction() {
+ opcode instanceof Opcode::LogicalNot
+ }
+}
+
+class CompareInstruction extends BinaryInstruction {
+ CompareInstruction() {
+ opcode instanceof CompareOpcode
+ }
+}
+
+class CompareEQInstruction extends CompareInstruction {
+ CompareEQInstruction() {
+ opcode instanceof Opcode::CompareEQ
+ }
+}
+
+class CompareNEInstruction extends CompareInstruction {
+ CompareNEInstruction() {
+ opcode instanceof Opcode::CompareNE
+ }
+}
+
+class CompareLTInstruction extends CompareInstruction {
+ CompareLTInstruction() {
+ opcode instanceof Opcode::CompareLT
+ }
+}
+
+class CompareGTInstruction extends CompareInstruction {
+ CompareGTInstruction() {
+ opcode instanceof Opcode::CompareGT
+ }
+}
+
+class CompareLEInstruction extends CompareInstruction {
+ CompareLEInstruction() {
+ opcode instanceof Opcode::CompareLE
+ }
+}
+
+class CompareGEInstruction extends CompareInstruction {
+ CompareGEInstruction() {
+ opcode instanceof Opcode::CompareGE
+ }
+}
+
+class SwitchInstruction extends Instruction {
+ SwitchInstruction() {
+ opcode instanceof Opcode::Switch
+ }
+
+ final Instruction getExpression() {
+ result = getOperand(conditionOperand())
+ }
+
+ final Instruction getACaseSuccessor() {
+ exists(CaseEdge edge |
+ result = getSuccessor(edge)
+ )
+ }
+
+ final Instruction getDefaultSuccessor() {
+ result = getSuccessor(defaultEdge())
+ }
+}
+
+class InvokeInstruction extends Instruction {
+ InvokeInstruction() {
+ opcode instanceof Opcode::Invoke
+ }
+
+ final Instruction getCallTarget() {
+ result = getOperand(callTargetOperand())
+ }
+}
+
+/**
+ * An instruction that throws an exception.
+ */
+class ThrowInstruction extends Instruction {
+ ThrowInstruction() {
+ opcode instanceof ThrowOpcode
+ }
+}
+
+/**
+ * An instruction that throws a new exception.
+ */
+class ThrowValueInstruction extends ThrowInstruction {
+ ThrowValueInstruction() {
+ opcode instanceof Opcode::ThrowValue
+ }
+
+ override final MemoryAccessKind getOperandMemoryAccess(OperandTag tag) {
+ tag instanceof ExceptionOperand and
+ result instanceof IndirectMemoryAccess
+ }
+
+
+ /**
+ * Gets the address of the exception thrown by this instruction.
+ */
+ final Instruction getExceptionAddress() {
+ result = getOperand(loadStoreAddressOperand())
+ }
+
+ /**
+ * Gets the exception thrown by this instruction.
+ */
+ final Instruction getException() {
+ result = getOperand(exceptionOperand())
+ }
+}
+
+/**
+ * An instruction that re-throws the current exception.
+ */
+class ReThrowInstruction extends ThrowInstruction {
+ ReThrowInstruction() {
+ opcode instanceof Opcode::ReThrow
+ }
+}
+
+/**
+ * An instruction that exits the current function by propagating an exception.
+ */
+class UnwindInstruction extends Instruction {
+ UnwindInstruction() {
+ opcode instanceof Opcode::Unwind
+ }
+}
+
+/**
+ * An instruction that starts a `catch` handler.
+ */
+class CatchInstruction extends Instruction {
+ CatchInstruction() {
+ opcode instanceof CatchOpcode
+ }
+}
+
+/**
+ * An instruction that catches an exception of a specific type.
+ */
+class CatchByTypeInstruction extends CatchInstruction {
+ Type exceptionType;
+
+ CatchByTypeInstruction() {
+ opcode instanceof Opcode::CatchByType and
+ exceptionType = Construction::getInstructionExceptionType(this)
+ }
+
+ final override string toString() {
+ result = super.toString() + "[" + exceptionType.toString() + "]"
+ }
+
+ /**
+ * Gets the type of exception to be caught.
+ */
+ final Type getExceptionType() {
+ result = exceptionType
+ }
+}
+
+/**
+ * An instruction that catches any exception.
+ */
+class CatchAnyInstruction extends CatchInstruction {
+ CatchAnyInstruction() {
+ opcode instanceof Opcode::CatchAny
+ }
+}
+
+class UnmodeledDefinitionInstruction extends Instruction {
+ UnmodeledDefinitionInstruction() {
+ opcode instanceof Opcode::UnmodeledDefinition
+ }
+
+ override final MemoryAccessKind getResultMemoryAccess() {
+ result instanceof UnmodeledMemoryAccess
+ }
+}
+
+class UnmodeledUseInstruction extends Instruction {
+ UnmodeledUseInstruction() {
+ opcode instanceof Opcode::UnmodeledUse
+ }
+
+ override final MemoryAccessKind getOperandMemoryAccess(OperandTag tag) {
+ tag instanceof UnmodeledUseOperand and
+ result instanceof UnmodeledMemoryAccess
+ }
+}
+
+class PhiInstruction extends Instruction {
+ PhiInstruction() {
+ opcode instanceof Opcode::Phi
+ }
+
+ override final MemoryAccessKind getOperandMemoryAccess(OperandTag tag) {
+ tag instanceof PhiOperand and
+ result instanceof PhiMemoryAccess
+ }
+
+ override final MemoryAccessKind getResultMemoryAccess() {
+ result instanceof PhiMemoryAccess
+ }
+}
+
+/**
+ * An instruction representing a built-in operation. This is used to represent
+ * operations such as access to variable argument lists.
+ */
+class BuiltInInstruction extends Instruction {
+ BuiltInInstruction() {
+ opcode instanceof BuiltInOpcode
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/OperandTag.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/OperandTag.qll
new file mode 100644
index 000000000000..ece7fb5bd15b
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/OperandTag.qll
@@ -0,0 +1,299 @@
+private import IRInternal
+import Instruction
+import IRBlock
+import cpp
+
+private newtype TOperandTag =
+ TLoadStoreAddressOperand() or
+ TCopySourceOperand() or
+ TUnaryOperand() or
+ TLeftOperand() or
+ TRightOperand() or
+ TReturnValueOperand() or
+ TExceptionOperand() or
+ TConditionOperand() or
+ TUnmodeledUseOperand() or
+ TCallTargetOperand() or
+ TThisArgumentOperand() or
+ TPositionalArgumentOperand(int argIndex) {
+ argIndex in [0..Construction::getMaxCallArgIndex()] or
+ exists(BuiltInOperation op |
+ exists(op.getChild(argIndex))
+ )
+ } or
+ TPhiOperand(IRBlock predecessorBlock) {
+ exists(PhiInstruction phi |
+ predecessorBlock = Construction::getPhiInstructionBlockStart(phi).getBlock().getAPredecessor()
+ )
+ }
+
+/**
+ * Identifies the kind of operand on an instruction. Each `Instruction` has at
+ * most one operand of any single `OperandTag`. The set of `OperandTag`s used by
+ * an `Instruction` is determined by the instruction's opcode.
+ */
+abstract class OperandTag extends TOperandTag {
+ abstract string toString();
+ abstract int getSortOrder();
+}
+
+// Note: individual subtypes are listed in the order that the operands should
+// appear in the operand list of the instruction when printing.
+
+/**
+ * The address operand of an instruction that loads or stores a value from
+ * memory (e.g. `Load`, `Store`).
+ */
+class LoadStoreAddressOperand extends OperandTag, TLoadStoreAddressOperand {
+ override final string toString() {
+ result = "LoadStoreAddress"
+ }
+
+ override final int getSortOrder() {
+ result = 0
+ }
+}
+
+LoadStoreAddressOperand loadStoreAddressOperand() {
+ result = TLoadStoreAddressOperand()
+}
+
+/**
+ * The source value operand of an instruction that copies this value to its
+ * result (e.g. `Copy`, `Load`, `Store`).
+ */
+class CopySourceOperand extends OperandTag, TCopySourceOperand {
+ override final string toString() {
+ result = "CopySource"
+ }
+
+ override final int getSortOrder() {
+ result = 1
+ }
+}
+
+CopySourceOperand copySourceOperand() {
+ result = TCopySourceOperand()
+}
+
+/**
+ * The sole operand of a unary instruction (e.g. `Convert`, `Negate`).
+ */
+class UnaryOperand extends OperandTag, TUnaryOperand {
+ override final string toString() {
+ result = "Unary"
+ }
+
+ override final int getSortOrder() {
+ result = 2
+ }
+}
+
+UnaryOperand unaryOperand() {
+ result = TUnaryOperand()
+}
+
+/**
+ * The left operand of a binary instruction (e.g. `Add`, `CompareEQ`).
+ */
+class LeftOperand extends OperandTag, TLeftOperand {
+ override final string toString() {
+ result = "Left"
+ }
+
+ override final int getSortOrder() {
+ result = 3
+ }
+}
+
+LeftOperand leftOperand() {
+ result = TLeftOperand()
+}
+
+/**
+ * The right operand of a binary instruction (e.g. `Add`, `CompareEQ`).
+ */
+class RightOperand extends OperandTag, TRightOperand {
+ override final string toString() {
+ result = "Right"
+ }
+
+ override final int getSortOrder() {
+ result = 4
+ }
+}
+
+RightOperand rightOperand() {
+ result = TRightOperand()
+}
+
+/**
+ * The return value operand of a `ReturnValue` instruction.
+ */
+class ReturnValueOperand extends OperandTag, TReturnValueOperand {
+ override final string toString() {
+ result = "ReturnValue"
+ }
+
+ override final int getSortOrder() {
+ result = 5
+ }
+}
+
+ReturnValueOperand returnValueOperand() {
+ result = TReturnValueOperand()
+}
+
+/**
+ * The exception thrown by a `ThrowValue` instruction.
+ */
+class ExceptionOperand extends OperandTag, TExceptionOperand {
+ override final string toString() {
+ result = "Exception"
+ }
+
+ override final int getSortOrder() {
+ result = 6
+ }
+}
+
+ExceptionOperand exceptionOperand() {
+ result = TExceptionOperand()
+}
+
+/**
+ * The condition operand of a `ConditionalBranch` or `Switch` instruction.
+ */
+class ConditionOperand extends OperandTag, TConditionOperand {
+ override final string toString() {
+ result = "Condition"
+ }
+
+ override final int getSortOrder() {
+ result = 7
+ }
+}
+
+ConditionOperand conditionOperand() {
+ result = TConditionOperand()
+}
+
+/**
+ * An operand of the special `UnmodeledUse` instruction, representing a value
+ * whose set of uses is unknown.
+ */
+class UnmodeledUseOperand extends OperandTag, TUnmodeledUseOperand {
+ override final string toString() {
+ result = "UnmodeledUse"
+ }
+
+ override final int getSortOrder() {
+ result = 8
+ }
+}
+
+UnmodeledUseOperand unmodeledUseOperand() {
+ result = TUnmodeledUseOperand()
+}
+
+/**
+ * The operand representing the target function of an `Invoke` instruction.
+ */
+class CallTargetOperand extends OperandTag, TCallTargetOperand {
+ override final string toString() {
+ result = "CallTarget"
+ }
+
+ override final int getSortOrder() {
+ result = 9
+ }
+}
+
+CallTargetOperand callTargetOperand() {
+ result = TCallTargetOperand()
+}
+
+/**
+ * An operand representing an argument to a function call. This includes both
+ * positional arguments (represented by `PositionalArgumentOperand`) and the
+ * implicit `this` argument, if any (represented by `ThisArgumentOperand`).
+ */
+abstract class ArgumentOperand extends OperandTag {
+}
+
+/**
+ * An operand representing the implicit 'this' argument to a member function
+ * call.
+ */
+class ThisArgumentOperand extends ArgumentOperand, TThisArgumentOperand {
+ ThisArgumentOperand() {
+ this = TThisArgumentOperand()
+ }
+
+ override final string toString() {
+ result = "Arg(this)"
+ }
+
+ override final int getSortOrder() {
+ result = 10
+ }
+}
+
+ThisArgumentOperand thisArgumentOperand() {
+ result = TThisArgumentOperand()
+}
+
+/**
+ * An operand representing an argument to a function call.
+ */
+class PositionalArgumentOperand extends ArgumentOperand,
+ TPositionalArgumentOperand {
+ int argIndex;
+
+ PositionalArgumentOperand() {
+ this = TPositionalArgumentOperand(argIndex)
+ }
+
+ override final string toString() {
+ result = "Arg(" + argIndex + ")"
+ }
+
+ override final int getSortOrder() {
+ result = 11 + argIndex
+ }
+
+ final int getArgIndex() {
+ result = argIndex
+ }
+}
+
+PositionalArgumentOperand positionalArgumentOperand(int argIndex) {
+ result = TPositionalArgumentOperand(argIndex)
+}
+
+/**
+ * An operand of an SSA `Phi` instruction.
+ */
+class PhiOperand extends OperandTag, TPhiOperand {
+ IRBlock predecessorBlock;
+
+ PhiOperand() {
+ this = TPhiOperand(predecessorBlock)
+ }
+
+ override final string toString() {
+ result = "Phi"
+ }
+
+ override final int getSortOrder() {
+ result = 11
+ }
+
+ final IRBlock getPredecessorBlock() {
+ result = predecessorBlock
+ }
+}
+
+PhiOperand phiOperand(IRBlock predecessorBlock) {
+ result = TPhiOperand(predecessorBlock)
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/PrintIRImpl.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/PrintIRImpl.qll
new file mode 100644
index 000000000000..9cf77f21c04a
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/PrintIRImpl.qll
@@ -0,0 +1,175 @@
+private import IRImpl
+import cpp
+
+private int getInstructionIndexInBlock(Instruction instr) {
+ exists(IRBlock block |
+ block = instr.getBlock() and
+ (
+ exists(int index, int phiCount |
+ phiCount = count(block.getAPhiInstruction()) and
+ instr = block.getInstruction(index) and
+ result = index + phiCount
+ ) or
+ (
+ instr instanceof PhiInstruction and
+ instr = rank[result + 1](PhiInstruction phiInstr |
+ phiInstr = block.getAPhiInstruction() |
+ phiInstr order by phiInstr.getUniqueId()
+ )
+ )
+ )
+ )
+}
+
+private string getInstructionResultId(Instruction instr) {
+ result = getResultPrefix(instr) + getBlockId(instr.getBlock()) + "_" +
+ getInstructionIndexInBlock(instr).toString()
+}
+
+private string getResultPrefix(Instruction instr) {
+ if instr.hasMemoryResult() then
+ if instr.isResultModeled() then
+ result = "@m"
+ else
+ result = "@mu"
+ else
+ result = "@r"
+}
+
+/**
+ * Gets the identifier of the specified function scope.
+ * Currently just returns the signature of the function.
+ */
+private string getScopeId(Function func) {
+ result = func.getFullSignature()
+}
+
+/**
+ * Gets the unique identifier of the block within its function.
+ * Currently returns a string representation of an integer in the range
+ * [0..numBlocks - 1].
+ */
+private string getBlockId(IRBlock block) {
+ exists(int rankIndex |
+ block = rank[rankIndex + 1](IRBlock funcBlock |
+ funcBlock.getFunction() = block.getFunction() |
+ funcBlock order by funcBlock.getUniqueId()
+ ) and
+ result = rankIndex.toString()
+ )
+}
+
+/**
+ * Prints the full signature and qualified name for each scope. This is primarily
+ * so that post-processing tools can identify function overloads, which will have
+ * different signatures but the same qualified name.
+ */
+query predicate printIRGraphScopes(string scopeId, string qualifiedName) {
+ exists(FunctionIR ir, Function func |
+ func = ir.getFunction() and
+ scopeId = getScopeId(func) and
+ qualifiedName = func.getQualifiedName()
+ )
+}
+
+query predicate printIRGraphNodes(string scopeId, string blockId, string label, string location) {
+ exists(IRBlock block |
+ scopeId = getScopeId(block.getFunction()) and
+ blockId = getBlockId(block) and
+ label = "" and
+ location = ""
+ )
+}
+
+query predicate printIRGraphInstructions(string scopeId, string blockId,
+ string id, string label, string location) {
+ exists(IRBlock block, Instruction instr |
+ instr = block.getAnInstruction() and
+ label = instr.toString() and
+ location = instr.getLocation().toString() and
+ scopeId = getScopeId(block.getFunction()) and
+ blockId = getBlockId(block) and
+ id = getInstructionIndexInBlock(instr).toString()
+ )
+}
+
+query predicate printIRGraphEdges(string scopeId,
+ string predecessorId, string successorId, string label) {
+ exists(IRBlock predecessor, IRBlock successor, EdgeKind kind |
+ scopeId = getScopeId(predecessor.getFunction()) and
+ predecessor.getSuccessor(kind) = successor and
+ predecessorId = getBlockId(predecessor) and
+ successorId = getBlockId(successor) and
+ label = kind.toString()
+ )
+}
+
+private string getValueCategoryString(Instruction instr) {
+ if instr.isGLValue() then
+ result = "glval:"
+ else
+ result = ""
+}
+
+private string getResultTypeString(Instruction instr) {
+ exists(Type resultType, string valcat |
+ resultType = instr.getResultType() and
+ valcat = getValueCategoryString(instr) and
+ if resultType instanceof UnknownType and exists(instr.getResultSize()) then
+ result = valcat + resultType.toString() + "[" + instr.getResultSize().toString() + "]"
+ else
+ result = valcat + resultType.toString()
+ )
+}
+
+query predicate printIRGraphDestinationOperands(string scopeId, string blockId,
+ string instructionId, int operandId, string label) {
+ exists(IRBlock block, Instruction instr |
+ block.getAnInstruction() = instr and
+ scopeId = getScopeId(block.getFunction()) and
+ blockId = getBlockId(block) and
+ instructionId = getInstructionIndexInBlock(instr).toString() and
+ not instr.getResultType() instanceof VoidType and
+ operandId = 0 and
+ label = getInstructionResultId(instr) +
+ "(" + getResultTypeString(instr) + ")"
+ )
+}
+
+private string getOperandTagLabel(OperandTag tag) {
+ (
+ tag instanceof PhiOperand and
+ result = "from " + getBlockId(tag.(PhiOperand).getPredecessorBlock()) + ": "
+ )
+ or (
+ tag instanceof ThisArgumentOperand and
+ result = "this:"
+ )
+ or (
+ not tag instanceof PhiOperand and
+ not tag instanceof ThisArgumentOperand and
+ result = ""
+ )
+}
+
+query predicate printIRGraphSourceOperands(string scopeId, string blockId,
+ string instructionId, int operandId, string label) {
+ exists(IRBlock block, Instruction instr |
+ block.getAnInstruction() = instr and
+ blockId = getBlockId(block) and
+ scopeId = getScopeId(block.getFunction()) and
+ instructionId = getInstructionIndexInBlock(instr).toString() and
+ if (instr instanceof UnmodeledUseInstruction) then (
+ operandId = 0 and
+ label = "@mu*"
+ )
+ else (
+ exists(OperandTag tag, Instruction operandInstr |
+ operandInstr = instr.getOperand(tag) and
+ operandId = tag.getSortOrder() and
+ label = getOperandTagLabel(tag) +
+ getInstructionResultId(operandInstr)
+ )
+ )
+ )
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/SSAConstruction.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/SSAConstruction.qll
new file mode 100644
index 000000000000..cfc220ba368e
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/SSAConstruction.qll
@@ -0,0 +1,424 @@
+import SSAConstructionInternal
+import cpp
+private import semmle.code.cpp.ir.internal.Opcode
+import NewIR
+
+import Cached
+cached private module Cached {
+
+ private OldIR::OperandTag getOldOperandTag(OperandTag newTag) {
+ newTag instanceof LoadStoreAddressOperand and result instanceof OldIR::LoadStoreAddressOperand or
+ newTag instanceof CopySourceOperand and result instanceof OldIR::CopySourceOperand or
+ newTag instanceof UnaryOperand and result instanceof OldIR::UnaryOperand or
+ newTag instanceof LeftOperand and result instanceof OldIR::LeftOperand or
+ newTag instanceof RightOperand and result instanceof OldIR::RightOperand or
+ newTag instanceof ReturnValueOperand and result instanceof OldIR::ReturnValueOperand or
+ newTag instanceof ExceptionOperand and result instanceof OldIR::ExceptionOperand or
+ newTag instanceof ConditionOperand and result instanceof OldIR::ConditionOperand or
+ newTag instanceof UnmodeledUseOperand and result instanceof OldIR::UnmodeledUseOperand or
+ newTag instanceof CallTargetOperand and result instanceof OldIR::CallTargetOperand or
+ newTag instanceof ThisArgumentOperand and result instanceof OldIR::ThisArgumentOperand or
+ exists(PositionalArgumentOperand newArg |
+ newArg = newTag and
+ result.(OldIR::PositionalArgumentOperand).getArgIndex() = newArg.getArgIndex()
+ )
+ }
+
+ private IRBlock getNewBlock(OldIR::IRBlock oldBlock) {
+ result.getFirstInstruction() = getNewInstruction(oldBlock.getFirstInstruction())
+ }
+
+ cached newtype TInstructionTag =
+ WrappedInstructionTag(OldIR::Instruction oldInstruction) or
+ PhiTag(Alias::VirtualVariable vvar, OldIR::IRBlock block) {
+ hasPhiNode(vvar, block)
+ }
+
+ cached class InstructionTagType extends TInstructionTag {
+ cached final string toString() {
+ result = "Tag"
+ }
+ }
+
+ cached predicate functionHasIR(Function func) {
+ exists(OldIR::FunctionIR funcIR |
+ funcIR.getFunction() = func
+ )
+ }
+
+ cached int getMaxCallArgIndex() {
+ result = max(int argIndex |
+ exists(OldIR::PositionalArgumentOperand oldOperand |
+ argIndex = oldOperand.getArgIndex()
+ )
+ )
+ }
+
+ cached OldIR::Instruction getOldInstruction(Instruction instr) {
+ instr.getTag() = WrappedInstructionTag(result)
+ }
+
+ private Instruction getNewInstruction(OldIR::Instruction instr) {
+ result.getTag() = WrappedInstructionTag(instr)
+ }
+
+ private PhiInstruction getPhiInstruction(Function func, OldIR::IRBlock oldBlock,
+ Alias::VirtualVariable vvar) {
+ result.getFunction() = func and
+ result.getAST() = oldBlock.getFirstInstruction().getAST() and
+ result.getTag() = PhiTag(vvar, oldBlock)
+ }
+
+ private IRVariable getNewIRVariable(OldIR::IRVariable var) {
+ result.getFunction() = var.getFunction() and
+ (
+ exists(OldIR::IRUserVariable userVar, IRUserVariable newUserVar |
+ userVar = var and
+ newUserVar.getVariable() = userVar.getVariable() and
+ result = newUserVar
+ ) or
+ exists(OldIR::IRTempVariable tempVar, IRTempVariable newTempVar |
+ tempVar = var and
+ newTempVar.getAST() = tempVar.getAST() and
+ newTempVar.getTag() = tempVar.getTag() and
+ result = newTempVar
+ )
+ )
+ }
+
+ cached newtype TInstruction =
+ MkInstruction(FunctionIR funcIR, Opcode opcode, Locatable ast,
+ InstructionTag tag, Type resultType, boolean isGLValue) {
+ hasInstruction(funcIR.getFunction(), opcode, ast, tag,
+ resultType, isGLValue)
+ }
+
+ private predicate hasInstruction(Function func, Opcode opcode, Locatable ast,
+ InstructionTag tag, Type resultType, boolean isGLValue) {
+ exists(OldIR::Instruction instr |
+ instr.getFunction() = func and
+ instr.getOpcode() = opcode and
+ instr.getAST() = ast and
+ WrappedInstructionTag(instr) = tag and
+ instr.getResultType() = resultType and
+ if instr.isGLValue() then
+ isGLValue = true
+ else
+ isGLValue = false
+ ) or
+ exists(OldIR::IRBlock block, Alias::VirtualVariable vvar |
+ hasPhiNode(vvar, block) and
+ block.getFunction() = func and
+ opcode instanceof Opcode::Phi and
+ ast = block.getFirstInstruction().getAST() and
+ tag = PhiTag(vvar, block) and
+ resultType = vvar.getType() and
+ isGLValue = false
+ )
+ }
+
+ cached predicate hasTempVariable(Function func, Locatable ast, TempVariableTag tag,
+ Type type) {
+ exists(OldIR::IRTempVariable var |
+ var.getFunction() = func and
+ var.getAST() = ast and
+ var.getTag() = tag and
+ var.getType() = type
+ )
+ }
+
+ cached predicate hasModeledMemoryResult(Instruction instruction) {
+ exists(Alias::getResultMemoryAccess(getOldInstruction(instruction))) or
+ instruction instanceof PhiInstruction // Phis always have modeled results
+ }
+
+ cached Instruction getInstructionOperand(Instruction instruction, OperandTag tag) {
+ exists(OldIR::Instruction oldUse, OldIR::OperandTag oldTag |
+ oldUse = getOldInstruction(instruction) and
+ oldTag = getOldOperandTag(tag) and
+ if oldUse.isMemoryOperand(oldTag) then (
+ (
+ if exists(Alias::getOperandMemoryAccess(oldUse, oldTag)) then (
+ exists(OldIR::IRBlock useBlock, int useRank, Alias::VirtualVariable vvar,
+ OldIR::IRBlock defBlock, int defRank, int defIndex |
+ vvar = Alias::getOperandMemoryAccess(oldUse, oldTag).getVirtualVariable() and
+ hasDefinitionAtRank(vvar, defBlock, defRank, defIndex) and
+ hasUseAtRank(vvar, useBlock, useRank, oldUse) and
+ definitionReachesUse(vvar, defBlock, defRank, useBlock, useRank) and
+ if defIndex >= 0 then
+ result = getNewInstruction(defBlock.getInstruction(defIndex))
+ else
+ result = getPhiInstruction(instruction.getFunction(), defBlock, vvar)
+ )
+ )
+ else (
+ result = instruction.getFunctionIR().getUnmodeledDefinitionInstruction()
+ )
+ ) or
+ // Connect any definitions that are not being modeled in SSA to the
+ // `UnmodeledUse` instruction.
+ exists(OldIR::Instruction oldDefinition |
+ instruction instanceof UnmodeledUseInstruction and
+ tag instanceof UnmodeledUseOperand and
+ oldDefinition = oldUse.getOperand(oldTag) and
+ not exists(Alias::getResultMemoryAccess(oldDefinition)) and
+ result = getNewInstruction(oldDefinition)
+ )
+ )
+ else
+ result = getNewInstruction(oldUse.getOperand(oldTag))
+ ) or
+ result = getPhiInstructionOperand(instruction.(PhiInstruction), tag.(PhiOperand))
+ }
+
+ cached Instruction getPhiInstructionOperand(PhiInstruction instr, PhiOperand tag) {
+ exists(Alias::VirtualVariable vvar, OldIR::IRBlock phiBlock,
+ OldIR::IRBlock defBlock, int defRank, int defIndex, OldIR::IRBlock predBlock |
+ hasPhiNode(vvar, phiBlock) and
+ predBlock = phiBlock.getAPredecessor() and
+ instr.getTag() = PhiTag(vvar, phiBlock) and
+ tag.getPredecessorBlock() = getNewBlock(predBlock) and
+ hasDefinitionAtRank(vvar, defBlock, defRank, defIndex) and
+ definitionReachesEndOfBlock(vvar, defBlock, defRank, predBlock) and
+ if defIndex >= 0 then
+ result = getNewInstruction(defBlock.getInstruction(defIndex))
+ else
+ result = getPhiInstruction(instr.getFunction(), defBlock, vvar)
+ )
+ }
+
+ cached Instruction getPhiInstructionBlockStart(PhiInstruction instr) {
+ exists(OldIR::IRBlock oldBlock |
+ instr.getTag() = PhiTag(_, oldBlock) and
+ result = getNewInstruction(oldBlock.getFirstInstruction())
+ )
+ }
+
+ cached Instruction getInstructionSuccessor(Instruction instruction, EdgeKind kind) {
+ result = getNewInstruction(getOldInstruction(instruction).getSuccessor(kind))
+ }
+
+ cached IRVariable getInstructionVariable(Instruction instruction) {
+ result = getNewIRVariable(getOldInstruction(instruction).(OldIR::VariableInstruction).getVariable())
+ }
+
+ cached Field getInstructionField(Instruction instruction) {
+ result = getOldInstruction(instruction).(OldIR::FieldInstruction).getField()
+ }
+
+ cached Function getInstructionFunction(Instruction instruction) {
+ result = getOldInstruction(instruction).(OldIR::FunctionInstruction).getFunctionSymbol()
+ }
+
+ cached string getInstructionConstantValue(Instruction instruction) {
+ result = getOldInstruction(instruction).(OldIR::ConstantValueInstruction).getValue()
+ }
+
+ cached StringLiteral getInstructionStringLiteral(Instruction instruction) {
+ result = getOldInstruction(instruction).(OldIR::StringConstantInstruction).getValue()
+ }
+
+ cached Type getInstructionExceptionType(Instruction instruction) {
+ result = getOldInstruction(instruction).(OldIR::CatchByTypeInstruction).getExceptionType()
+ }
+
+ cached int getInstructionElementSize(Instruction instruction) {
+ result = getOldInstruction(instruction).(OldIR::PointerArithmeticInstruction).getElementSize()
+ }
+
+ cached int getInstructionResultSize(Instruction instruction) {
+ // Only return a result for instructions that needed an explicit result size.
+ instruction.getResultType() instanceof UnknownType and
+ result = getOldInstruction(instruction).getResultSize()
+ }
+
+ cached predicate getInstructionInheritance(Instruction instruction, Class baseClass,
+ Class derivedClass) {
+ exists(OldIR::InheritanceConversionInstruction oldInstr |
+ oldInstr = getOldInstruction(instruction) and
+ baseClass = oldInstr.getBaseClass() and
+ derivedClass = oldInstr.getDerivedClass()
+ )
+ }
+
+ private predicate ssa_variableUpdate(Alias::VirtualVariable vvar,
+ OldIR::Instruction instr, OldIR::IRBlock block, int index) {
+ block.getInstruction(index) = instr and
+ Alias::getResultMemoryAccess(instr).getVirtualVariable() = vvar
+ }
+
+ private predicate hasDefinition(Alias::VirtualVariable vvar, OldIR::IRBlock block, int index) {
+ (
+ hasPhiNode(vvar, block) and
+ index = -1
+ ) or
+ exists(Alias::MemoryAccess access, OldIR::Instruction def |
+ access = Alias::getResultMemoryAccess(def) and
+ block.getInstruction(index) = def and
+ vvar = access.getVirtualVariable()
+ )
+ }
+
+ private predicate defUseRank(Alias::VirtualVariable vvar, OldIR::IRBlock block, int rankIndex, int index) {
+ index = rank[rankIndex](int j | hasDefinition(vvar, block, j) or hasUse(vvar, _, block, j))
+ }
+
+ private predicate hasUse(Alias::VirtualVariable vvar,
+ OldIR::Instruction use, OldIR::IRBlock block, int index) {
+ exists(Alias::MemoryAccess access |
+ access = Alias::getOperandMemoryAccess(use, _) and
+ block.getInstruction(index) = use and
+ vvar = access.getVirtualVariable()
+ )
+ }
+
+ private predicate variableLiveOnEntryToBlock(Alias::VirtualVariable vvar, OldIR::IRBlock block) {
+ exists (int index | hasUse(vvar, _, block, index) |
+ not exists (int j | ssa_variableUpdate(vvar, _, block, j) | j < index)
+ ) or
+ (variableLiveOnExitFromBlock(vvar, block) and not ssa_variableUpdate(vvar, _, block, _))
+ }
+
+ pragma[noinline]
+ private predicate variableLiveOnExitFromBlock(Alias::VirtualVariable vvar, OldIR::IRBlock block) {
+ variableLiveOnEntryToBlock(vvar, block.getASuccessor())
+ }
+
+ /**
+ * Gets the rank index of a hyphothetical use one instruction past the end of
+ * the block. This index can be used to determine if a definition reaches the
+ * end of the block, even if the definition is the last instruction in the
+ * block.
+ */
+ private int exitRank(Alias::VirtualVariable vvar, OldIR::IRBlock block) {
+ result = max(int rankIndex | defUseRank(vvar, block, rankIndex, _)) + 1
+ }
+
+ private predicate hasDefinitionAtRank(Alias::VirtualVariable vvar,
+ OldIR::IRBlock block, int rankIndex, int instructionIndex) {
+ hasDefinition(vvar, block, instructionIndex) and
+ defUseRank(vvar, block, rankIndex, instructionIndex)
+ }
+
+ private predicate hasUseAtRank(Alias::VirtualVariable vvar, OldIR::IRBlock block,
+ int rankIndex, OldIR::Instruction use) {
+ exists(int index |
+ hasUse(vvar, use, block, index) and
+ defUseRank(vvar, block, rankIndex, index)
+ )
+ }
+
+ /**
+ * Holds if the definition of `vvar` at `(block, defRank)` reaches the rank
+ * index `reachesRank` in block `block`.
+ */
+ private predicate definitionReachesRank(Alias::VirtualVariable vvar,
+ OldIR::IRBlock block, int defRank, int reachesRank) {
+ hasDefinitionAtRank(vvar, block, defRank, _) and
+ reachesRank <= exitRank(vvar, block) and // Without this, the predicate would be infinite.
+ (
+ // The def always reaches the next use, even if there is also a def on the
+ // use instruction.
+ reachesRank = defRank + 1 or
+ (
+ // If the def reached the previous rank, it also reaches the current rank,
+ // unless there was another def at the previous rank.
+ definitionReachesRank(vvar, block, defRank, reachesRank - 1) and
+ not hasDefinitionAtRank(vvar, block, reachesRank - 1, _)
+ )
+ )
+ }
+
+ /**
+ * Holds if the definition of `vvar` at `(defBlock, defRank)` reaches the end of
+ * block `block`.
+ */
+ private predicate definitionReachesEndOfBlock(Alias::VirtualVariable vvar,
+ OldIR::IRBlock defBlock, int defRank, OldIR::IRBlock block) {
+ hasDefinitionAtRank(vvar, defBlock, defRank, _) and
+ (
+ (
+ // If we're looking at the def's own block, just see if it reaches the exit
+ // rank of the block.
+ block = defBlock and
+ variableLiveOnExitFromBlock(vvar, defBlock) and
+ definitionReachesRank(vvar, defBlock, defRank, exitRank(vvar, defBlock))
+ ) or
+ exists(OldIR::IRBlock idom |
+ definitionReachesEndOfBlock(vvar, defBlock, defRank, idom) and
+ noDefinitionsSinceIDominator(vvar, idom, block)
+ )
+ )
+ }
+
+ pragma[noinline]
+ private predicate noDefinitionsSinceIDominator(Alias::VirtualVariable vvar,
+ OldIR::IRBlock idom, OldIR::IRBlock block) {
+ idom.immediatelyDominates(block) and // It is sufficient to traverse the dominator graph, cf. discussion above.
+ variableLiveOnExitFromBlock(vvar, block) and
+ not hasDefinition(vvar, block, _)
+ }
+
+ private predicate definitionReachesUseWithinBlock(
+ Alias::VirtualVariable vvar, OldIR::IRBlock defBlock, int defRank,
+ OldIR::IRBlock useBlock, int useRank) {
+ defBlock = useBlock and
+ hasDefinitionAtRank(vvar, defBlock, defRank, _) and
+ hasUseAtRank(vvar, useBlock, useRank, _) and
+ definitionReachesRank(vvar, defBlock, defRank, useRank)
+ }
+
+ private predicate definitionReachesUse(Alias::VirtualVariable vvar,
+ OldIR::IRBlock defBlock, int defRank, OldIR::IRBlock useBlock, int useRank) {
+ hasUseAtRank(vvar, useBlock, useRank, _) and
+ (
+ definitionReachesUseWithinBlock(vvar, defBlock, defRank, useBlock,
+ useRank) or
+ (
+ definitionReachesEndOfBlock(vvar, defBlock, defRank,
+ useBlock.getAPredecessor()) and
+ not definitionReachesUseWithinBlock(vvar, useBlock, _, useBlock, useRank)
+ )
+ )
+ }
+
+ private predicate hasFrontierPhiNode(Alias::VirtualVariable vvar,
+ OldIR::IRBlock phiBlock) {
+ exists(OldIR::IRBlock defBlock |
+ phiBlock = defBlock.dominanceFrontier() and
+ hasDefinition(vvar, defBlock, _) and
+ /* We can also eliminate those nodes where the variable is not live on any incoming edge */
+ variableLiveOnEntryToBlock(vvar, phiBlock)
+ )
+ }
+
+ private predicate hasPhiNode(Alias::VirtualVariable vvar,
+ OldIR::IRBlock phiBlock) {
+ hasFrontierPhiNode(vvar, phiBlock)
+ //or ssa_sanitized_custom_phi_node(vvar, block)
+ }
+}
+
+import CachedForDebugging
+cached private module CachedForDebugging {
+ cached string getTempVariableUniqueId(IRTempVariable var) {
+ result = getOldTempVariable(var).getUniqueId()
+ }
+
+ cached string getInstructionUniqueId(Instruction instr) {
+ exists(OldIR::Instruction oldInstr |
+ oldInstr = getOldInstruction(instr) and
+ result = "NonSSA: " + oldInstr.getUniqueId()
+ ) or
+ exists(Alias::VirtualVariable vvar, OldIR::IRBlock phiBlock |
+ instr.getTag() = PhiTag(vvar, phiBlock) and
+ result = "Phi Block(" + phiBlock.getUniqueId() + "): " + vvar.getUniqueId()
+ )
+ }
+
+ private OldIR::IRTempVariable getOldTempVariable(IRTempVariable var) {
+ result.getFunction() = var.getFunction() and
+ result.getAST() = var.getAST() and
+ result.getTag() = var.getTag()
+ }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/SSAConstructionInternal.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/SSAConstructionInternal.qll
new file mode 100644
index 000000000000..4bdc7fb0461c
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/SSAConstructionInternal.qll
@@ -0,0 +1,3 @@
+import semmle.code.cpp.ir.IR as OldIR
+import semmle.code.cpp.ssa.SSAIR as NewIR
+import SimpleSSA as Alias
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/SimpleSSA.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/SimpleSSA.qll
new file mode 100644
index 000000000000..27287312f16a
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/SimpleSSA.qll
@@ -0,0 +1,83 @@
+import SimpleSSAInternal
+import cpp
+import Alias
+import IR
+import semmle.code.cpp.ssa.internal.Overlap
+
+private newtype TVirtualVariable =
+ MkVirtualVariable(IRVariable var) {
+ not variableAddressEscapes(var)
+ }
+
+private VirtualVariable getVirtualVariable(IRVariable var) {
+ result.getIRVariable() = var
+}
+
+class VirtualVariable extends TVirtualVariable {
+ IRVariable var;
+
+ VirtualVariable() {
+ this = MkVirtualVariable(var)
+ }
+
+ final string toString() {
+ result = var.toString()
+ }
+
+ final IRVariable getIRVariable() {
+ result = var
+ }
+
+ // REVIEW: This should just be on MemoryAccess
+ final Type getType() {
+ result = var.getType()
+ }
+
+ final string getUniqueId() {
+ result = var.getUniqueId()
+ }
+}
+
+private newtype TMemoryAccess =
+ MkMemoryAccess(VirtualVariable vvar)
+
+private MemoryAccess getMemoryAccess(IRVariable var) {
+ result.getVirtualVariable() = getVirtualVariable(var)
+}
+
+class MemoryAccess extends TMemoryAccess {
+ VirtualVariable vvar;
+
+ MemoryAccess() {
+ this = MkMemoryAccess(vvar)
+ }
+
+ string toString() {
+ result = vvar.toString()
+ }
+
+ VirtualVariable getVirtualVariable() {
+ result = vvar
+ }
+}
+
+Overlap getOverlap(MemoryAccess def, MemoryAccess use) {
+ def.getVirtualVariable() = use.getVirtualVariable() and
+ result instanceof MustExactlyOverlap
+}
+
+MemoryAccess getResultMemoryAccess(Instruction instr) {
+ exists(IRVariable var |
+ instr.getResultMemoryAccess() instanceof IndirectMemoryAccess and
+ resultPointsTo(instr.getOperand(loadStoreAddressOperand()), var, 0) and
+ result = getMemoryAccess(var)
+ )
+}
+
+MemoryAccess getOperandMemoryAccess(Instruction instr, OperandTag tag) {
+ exists(IRVariable var |
+ instr.getOperandMemoryAccess(tag) instanceof IndirectMemoryAccess and
+ resultPointsTo(instr.getOperand(loadStoreAddressOperand()), var, 0) and
+ result = getMemoryAccess(var)
+ )
+}
diff --git a/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/SimpleSSAInternal.qll b/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/SimpleSSAInternal.qll
new file mode 100644
index 000000000000..c71f5acdf79e
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/ssa/internal/ssa/SimpleSSAInternal.qll
@@ -0,0 +1,3 @@
+import AliasAnalysis as Alias
+import semmle.code.cpp.ir.IR as IR
+
diff --git a/cpp/ql/src/semmle/code/cpp/stmts/Block.qll b/cpp/ql/src/semmle/code/cpp/stmts/Block.qll
new file mode 100644
index 000000000000..fb08d740671d
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/stmts/Block.qll
@@ -0,0 +1,128 @@
+import semmle.code.cpp.Element
+import semmle.code.cpp.stmts.Stmt
+
+/**
+ * A C/C++ block statement.
+ *
+ * For example,
+ * ```
+ * { int a; int b = 1; a = b; }
+ * ```
+ */
+class Block extends Stmt, @stmt_block {
+
+ /**
+ * Gets a child declaration of this block.
+ *
+ * For example, for the block
+ * ```
+ * { int a; int b = 1; a = b; }
+ * ```
+ * it would have 2 results, for the declarations of `a` and `b`.
+ */
+ Declaration getADeclaration() {
+ result = this.getAStmt().(DeclStmt).getADeclaration()
+ }
+
+ /**
+ * Gets a body statement of this block.
+ *
+ * For example, for the block
+ * ```
+ * { int a; int b = 1; a = b; }
+ * ```
+ * it would have 3 results, for the declarations of `a` and `b` and
+ * for the expression statement `a = b`.
+ */
+ Stmt getAStmt() { result = this.getAChild() }
+
+ /**
+ * Gets the `n`th body statement of this block, indexed from 0.
+ *
+ * For example, for the block
+ * ```
+ * { int a; int b = 1; a = b; }
+ * ```
+ * `getStmt(2)`'s result is the expression statement `a = b`.
+ */
+ Stmt getStmt(int n) { result = this.getChild(n) }
+
+ /**
+ * Gets the last body statement of this block.
+ *
+ * For example, for the block
+ * ```
+ * { int a; int b = 1; a = b; }
+ * ```
+ * the result is the expression statement `a = b`.
+ */
+ Stmt getLastStmt() { result = this.getStmt(this.getNumStmt()-1) }
+
+ /**
+ * Gets the last body statement of this block. If this last statement
+ * is itself a block, returns the last statement of that block, and so on.
+ *
+ * For example, for the block
+ * ```
+ * { int a; int b = 1; { a = b; } }
+ * ```
+ * the result is the expression statement `a = b`.
+ */
+ Stmt getLastStmtIn() {
+ if getLastStmt() instanceof Block then (
+ result = getLastStmt().(Block).getLastStmtIn()
+ ) else (
+ result = getLastStmt()
+ )
+ }
+
+ /**
+ * Gets the number of body statements in this block.
+ *
+ * For example, for the block
+ * ```
+ * { int a; int b = 1; a = b; }
+ * ```
+ * the result is 3.
+ */
+ int getNumStmt() { result = count(this.getAStmt()) }
+
+ /**
+ * Holds if the block has no statements.
+ *
+ * For example, the block
+ * ```
+ * { }
+ * ```
+ * is empty, as is the block
+ * ```
+ * {
+ * // a comment
+ * }
+ * ```
+ */
+ predicate isEmpty() { this.getNumStmt() = 0 }
+
+ /**
+ * Gets the index of the given statement within this block, indexed from 0.
+ *
+ * For example, for the block
+ * ```
+ * { int a; int b = 1; a = b; }
+ * ```
+ * if `s` is the expression statement `a = b` then `getIndexOfStmt(s)`
+ * has result 2.
+ */
+ int getIndexOfStmt(Stmt s) { this.getStmt(result) = s }
+
+ override string toString() { result = "{ ... }" }
+
+ override predicate mayBeImpure() {
+ this.getAStmt().mayBeImpure()
+ }
+
+ override predicate mayBeGloballyImpure() {
+ this.getAStmt().mayBeGloballyImpure()
+ }
+
+}
diff --git a/cpp/ql/src/semmle/code/cpp/stmts/Stmt.qll b/cpp/ql/src/semmle/code/cpp/stmts/Stmt.qll
new file mode 100644
index 000000000000..82065f121668
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/stmts/Stmt.qll
@@ -0,0 +1,1901 @@
+import semmle.code.cpp.Element
+private import semmle.code.cpp.Enclosing
+private import semmle.code.cpp.internal.Type
+
+/**
+ * A C/C++ statement.
+ */
+class Stmt extends StmtParent, @stmt {
+
+ /** Gets the `n`th child of this statement. */
+ Element getChild(int n) {
+ stmtparents(result,n,this) or
+ exprparents(result,n,this)
+ }
+
+ /** Holds if `e` is the `n`th child of this statement. */
+ predicate hasChild(Element e, int n) { this.getChild(n) = e }
+
+ /** Gets the enclosing function of this statement, if any. */
+ Function getEnclosingFunction() { result = stmtEnclosingElement(this) }
+
+ /**
+ * Gets the nearest enclosing block of this statement in the source, if any.
+ */
+ Block getEnclosingBlock() {
+ if getParentStmt() instanceof Block and
+ not (getParentStmt().(Block).getLocation() instanceof UnknownLocation)
+ then
+ result = getParentStmt()
+ else
+ result = getParentStmt().getEnclosingBlock()
+ }
+
+ /** Gets a child of this statement. */
+ Element getAChild() { exists (int n | result = this.getChild(n)) }
+
+ /** Gets the parent of this statement, if any. */
+ StmtParent getParent() { stmtparents(this,_,result) }
+
+ /** Gets the parent statement of this statement, if any. */
+ Stmt getParentStmt() { stmtparents(this,_,result) }
+
+ /** Gets a child statement of this statement. */
+ Stmt getChildStmt() { result.getParentStmt() = this }
+
+ /**
+ * Gets the statement following this statement in the same block, if any.
+ */
+ Stmt getFollowingStmt() {
+ exists(Block b, int i | this = b.getStmt(i) and
+ result = b.getStmt(i+1))
+ }
+
+ override Location getLocation() { stmts(this,_,result) }
+
+ /** Gets an int indicating the type of statement that this represents. */
+ int getKind() { stmts(this,result,_) }
+
+ override string toString() { none() }
+
+ override Function getControlFlowScope() {
+ result = this.getEnclosingFunction()
+ }
+
+ override Stmt getEnclosingStmt() {
+ result = this
+ }
+
+ /**
+ * Holds if this statement is side-effect free (a conservative
+ * approximation; that is, it may be side-effect free even if this
+ * predicate doesn't hold).
+ *
+ * This predicate cannot be overridden; override `mayBeImpure()`
+ * instead.
+ *
+ * Note that this predicate only considers whether the statement has
+ * any side-effects, such as writing to a file. Even if it holds, the
+ * statement may be impure in the sense that its behavior is affected
+ * by external factors, such as the contents of global variables.
+ */
+ final predicate isPure() {
+ not this.mayBeImpure()
+ }
+ /**
+ * Holds if it is possible that this statement is impure. If we are not
+ * sure, then it holds.
+ */
+ predicate mayBeImpure() {
+ any()
+ }
+ /**
+ * Holds if it is possible that this statement is globally impure.
+ *
+ * Similar to `mayBeImpure()`, except that `mayBeGloballyImpure()`
+ * does not consider modifications to temporary local variables to be
+ * impure. That is, if you call a function in which
+ * `mayBeGloballyImpure()` doesn't hold for any statement, then the
+ * function as a whole will have no side-effects, even if it mutates
+ * its own fresh stack variables.
+ */
+ predicate mayBeGloballyImpure() {
+ any()
+ }
+
+ /**
+ * Gets an attribute of this statement, for example
+ * `[[clang::fallthrough]]`.
+ */
+ Attribute getAnAttribute() {
+ stmtattributes(this, result)
+ }
+
+ /**
+ * Gets a macro invocation that generates this entire statement.
+ *
+ * For example, given
+ * ```
+ * #define SOMEFUN a()
+ * #define FOO do { SOMEFUN; b(); } while (0)
+ * void f(void) {
+ * FOO;
+ * }
+ * ```
+ * this predicate would have results of `SOMEFUN` and `FOO` for the
+ * function call `a()`, and just `FOO` for the function call `b()`,
+ * the block within the 'do' statement, and the entire 'do' statement.
+ *
+ * Note that, unlike `isInMacroExpansion()` it is not necessary for
+ * the macro to generate the terminating semi-colon.
+ */
+ MacroInvocation getGeneratingMacro() {
+ result.getAnExpandedElement() = this
+ }
+
+ /** Holds if this statement was generated by the compiler. */
+ predicate isCompilerGenerated() {
+ compgenerated(this)
+ }
+
+}
+
+/**
+ * An element that is the parent of a statement in the C/C++ AST.
+ *
+ * This is normally a statement, but may be a `StmtExpr`.
+ */
+abstract class StmtParent extends ControlFlowNode {
+}
+
+/**
+ * A C/C++ 'expression' statement.
+ *
+ * For example,
+ * ```
+ * x = 1;
+ * ```
+ * is an assignment expression inside an 'expression' statement.
+ */
+class ExprStmt extends Stmt, @stmt_expr {
+
+ /**
+ * Gets the expression of this 'expression' statement.
+ *
+ * For example, for
+ * ```
+ * x = 1;
+ * ```
+ * the result would be an `AssignExpr`.
+ */
+ Expr getExpr() { result = this.getChild(0) }
+
+ override string toString() { result = "ExprStmt" }
+
+ override predicate mayBeImpure() { this.getExpr().mayBeImpure() }
+ override predicate mayBeGloballyImpure() {
+ this.getExpr().mayBeGloballyImpure()
+ }
+
+ override MacroInvocation getGeneratingMacro() {
+ // We only need the expression to be in the macro, not the semicolon.
+ result.getAnExpandedElement() = this.getExpr()
+ }
+}
+
+/**
+ * A C/C++ control structure, that is, either a conditional statement or
+ * a loop.
+ */
+abstract class ControlStructure extends Stmt {
+ /**
+ * Gets the controlling expression of this control structure.
+ *
+ * This is the condition of 'if' statements and loops, and the
+ * switched expression for 'switch' statements. */
+ abstract Expr getControllingExpr();
+
+ /** Gets a child declaration of this scope. */
+ Declaration getADeclaration() { none() }
+}
+
+/**
+ * A C/C++ conditional statement, that is, either an 'if' statement or a
+ * 'switch' statement.
+ */
+abstract class ConditionalStmt extends ControlStructure {
+}
+
+/**
+ * A C/C++ 'if' statement.
+ */
+class IfStmt extends ConditionalStmt, @stmt_if {
+
+ /**
+ * Gets the condition expression of this 'if' statement.
+ *
+ * For example, for
+ * ```
+ * if (b) { x = 1; }
+ * ```
+ * the result is `b`.
+ */
+ Expr getCondition() { result = this.getChild(0) }
+
+ override Expr getControllingExpr() { result = this.getCondition() }
+
+ /**
+ * Gets the 'then' statement of this 'if' statement.
+ *
+ * For example, for
+ * ```
+ * if (b) { x = 1; }
+ * ```
+ * the result is the `Block` `{ x = 1; }`.
+ */
+ Stmt getThen() { if_then(this, result) }
+
+ /**
+ * Gets the 'else' statement of this 'if' statement, if any.
+ *
+ * For example, for
+ * ```
+ * if (b) { x = 1; } else { x = 2; }
+ * ```
+ * the result is the `Block` `{ x = 2; }`, and for
+ * ```
+ * if (b) { x = 1; }
+ * ```
+ * there is no result.
+ */
+ Stmt getElse() { if_else(this, result) }
+
+ /**
+ * Holds if this 'if' statement has an 'else' statement.
+ *
+ * For example, this holds for
+ * ```
+ * if (b) { x = 1; } else { x = 2; }
+ * ```
+ * but not for
+ * ```
+ * if (b) { x = 1; }
+ * ```
+ */
+ predicate hasElse() { exists(Stmt s | this.getElse() = s) }
+
+ override string toString() { result = "if (...) ... " }
+
+ override predicate mayBeImpure() {
+ this.getCondition().mayBeImpure() or
+ this.getThen().mayBeImpure() or
+ this.getElse().mayBeImpure()
+ }
+ override predicate mayBeGloballyImpure() {
+ this.getCondition().mayBeGloballyImpure() or
+ this.getThen().mayBeGloballyImpure() or
+ this.getElse().mayBeGloballyImpure()
+ }
+
+ override MacroInvocation getGeneratingMacro() {
+ result.getAnExpandedElement() = this.getCondition() and
+ this.getThen().getGeneratingMacro() = result and
+ (this.hasElse() implies this.getElse().getGeneratingMacro() = result)
+ }
+}
+
+/**
+ * A C/C++ loop, that is, either a 'while' loop, a 'for' loop, or a
+ * 'do' loop.
+ */
+abstract class Loop extends ControlStructure {
+ /** Gets the condition expression of this loop. */
+ abstract Expr getCondition();
+ /** Gets the body statement of this loop. */
+ abstract Stmt getStmt();
+}
+
+/**
+ * A C/C++ 'while' statement.
+ *
+ * For example,
+ * ```
+ * while (b) { f(); }
+ * ```
+ */
+class WhileStmt extends Loop, @stmt_while {
+ override Expr getCondition() { result = this.getChild(0) }
+ override Expr getControllingExpr() { result = this.getCondition() }
+ override Stmt getStmt() { while_body(this, result) }
+
+ override string toString() { result = "while (...) ..." }
+
+ override predicate mayBeImpure() {
+ this.getCondition().mayBeImpure() or
+ this.getStmt().mayBeImpure()
+ }
+ override predicate mayBeGloballyImpure() {
+ this.getCondition().mayBeGloballyImpure() or
+ this.getStmt().mayBeGloballyImpure()
+ }
+
+ override MacroInvocation getGeneratingMacro() {
+ result.getAnExpandedElement() = this.getCondition() and
+ this.getStmt().getGeneratingMacro() = result
+ }
+
+ /**
+ * Holds if the loop condition is provably `true`.
+ *
+ * For example, this holds for
+ * ```
+ * while(1) { ...; if(b) break; ...; }
+ * ```
+ */
+ predicate conditionAlwaysTrue() {
+ conditionAlwaysTrue(getCondition())
+ }
+
+ /** Holds if the loop condition is provably `false`.
+ *
+ * For example, this holds for
+ * ```
+ * while(0) { ...; }
+ * ```
+ */
+ predicate conditionAlwaysFalse() {
+ conditionAlwaysFalse(getCondition())
+ }
+
+ /**
+ * Holds if the loop condition is provably `true` upon entry,
+ * that is, at least one iteration of the loop is guaranteed.
+ *
+ * For example, with
+ * ```
+ * bool done = false;
+ * while (!done) { ... done = true; ... }
+ * ```
+ * the condition `!done` always evaluates to `true` upon entry since
+ * `done = false`, but the condition may evaluate to `false` after
+ * some iterations.
+ */
+ predicate conditionAlwaysTrueUponEntry() {
+ loopConditionAlwaysTrueUponEntry(this, _)
+ }
+}
+
+/**
+ * A C/C++ jump statement.
+ */
+abstract class JumpStmt extends Stmt, @jump {
+
+ /** Gets the target of this jump statement. */
+ Stmt getTarget() { jumpinfo(this,_,result) }
+}
+
+/**
+ * A C/C++ 'goto' statement which jumps to a label.
+ *
+ * For example,
+ * ```
+ * goto someLabel;
+ * ```
+ */
+class GotoStmt extends JumpStmt, @stmt_goto {
+
+ /**
+ * Gets the name of the label this 'goto' statement refers to.
+ *
+ * For example, for
+ * ```
+ * goto someLabel;
+ * ```
+ * the result is `"someLabel"`.
+ */
+ string getName() { jumpinfo(this,result,_) and result != "" }
+
+ /** Holds if this 'goto' statement refers to a label. */
+ predicate hasName() { exists(string s | jumpinfo(this,s,_) and s != "") }
+
+ override string toString() { result = "goto ..." }
+
+ /**
+ * Holds if this 'goto' statement breaks out of two or more nested
+ * loops.
+ *
+ * For example, for
+ * ```
+ * while(b) {
+ * while(b) {
+ * if(b) goto middle;
+ * if(b) goto end;
+ * }
+ * if(b) goto end;
+ * middle:
+ * }
+ * end:
+ * ```
+ * this holds for the second `goto`, but not the first or third.
+ */
+ predicate breaksFromNestedLoops() {
+ exists(Loop l1, Loop l2 |
+ this.getParentStmt+() = l1 and
+ l1.getParentStmt+() = l2 and
+ l2.getParentStmt+() = this.getASuccessor().(Stmt).getParentStmt())
+ }
+
+ override predicate mayBeImpure() { none() }
+ override predicate mayBeGloballyImpure() { none() }
+}
+
+/**
+ * A 'goto' statement whose target is computed by a non-constant
+ * expression (a non-standard extension to C/C++).
+ *
+ * For example,
+ * ```
+ * goto *ptr;
+ * ```
+ */
+class ComputedGotoStmt extends Stmt, @stmt_assigned_goto {
+
+ /**
+ * Gets the expression used to compute the target of this 'goto'
+ * statement.
+ *
+ * For example, for
+ * ```
+ * goto *ptr;
+ * ```
+ * the result is `ptr`.
+ */
+ Expr getExpr() { result = this.getChild(0) }
+
+ override string toString() { result = "computed goto ..." }
+
+ override predicate mayBeImpure() { this.getExpr().mayBeImpure() }
+ override predicate mayBeGloballyImpure() {
+ this.getExpr().mayBeGloballyImpure()
+ }
+
+ override MacroInvocation getGeneratingMacro() {
+ // We only need the expression to be in the macro, not the semicolon.
+ result.getAnExpandedElement() = this.getExpr()
+ }
+}
+
+/**
+ * A C/C++ 'continue' statement.
+ *
+ * For example,
+ * ```
+ * continue;
+ * ```
+ */
+class ContinueStmt extends JumpStmt, @stmt_continue {
+
+ override string toString() { result = "continue;" }
+
+ override predicate mayBeImpure() { none() }
+ override predicate mayBeGloballyImpure() { none() }
+
+ /**
+ * Gets the loop that this continue statement will jump to the beginning of.
+ */
+ Stmt getContinuable() {
+ result = getEnclosingContinuable(this)
+ }
+}
+
+private Stmt getEnclosingContinuable(Stmt s) {
+ if s.getParent().getEnclosingStmt() instanceof Loop
+ then result = s.getParent().getEnclosingStmt()
+ else result = getEnclosingContinuable(s.getParent().getEnclosingStmt())
+}
+
+/**
+ * A C/C++ 'break' statement.
+ *
+ * For example,
+ * ```
+ * break;
+ * ```
+ */
+class BreakStmt extends JumpStmt, @stmt_break {
+
+ override string toString() { result = "break;" }
+
+ override predicate mayBeImpure() { none() }
+ override predicate mayBeGloballyImpure() { none() }
+
+ /**
+ * Gets the loop or switch statement that this break statement will exit.
+ */
+ Stmt getBreakable() {
+ result = getEnclosingBreakable(this)
+ }
+}
+
+private Stmt getEnclosingBreakable(Stmt s) {
+ if s.getParent().getEnclosingStmt() instanceof Loop or s.getParent().getEnclosingStmt() instanceof SwitchStmt
+ then result = s.getParent().getEnclosingStmt()
+ else result = getEnclosingBreakable(s.getParent().getEnclosingStmt())
+}
+
+/**
+ * A C/C++ 'label' statement.
+ *
+ * For example,
+ * ```
+ * someLabel:
+ * ```
+ */
+class LabelStmt extends Stmt, @stmt_label {
+
+ /** Gets the name of this 'label' statement. */
+ string getName() { jumpinfo(this,result,_) and result != "" }
+
+ /** Holds if this 'label' statement is named. */
+ predicate isNamed() { exists(this.getName()) }
+
+ override string toString() { result = "label ...:" }
+
+ override predicate mayBeImpure() { none() }
+ override predicate mayBeGloballyImpure() { none() }
+}
+
+/**
+ * A C/C++ 'return' statement.
+ *
+ * For example,
+ * ```
+ * return 1+2;
+ * ```
+ * or
+ * ```
+ * return;
+ * ```
+ */
+class ReturnStmt extends Stmt, @stmt_return {
+
+ /**
+ * Gets the expression of this 'return' statement.
+ *
+ * For example, for
+ * ```
+ * return 1+2;
+ * ```
+ * the result is `1+2`, and there is no result for
+ * ```
+ * return;
+ * ```
+ */
+ Expr getExpr() { result = this.getChild(0) }
+
+ /**
+ * Holds if this 'return' statement has an expression.
+ *
+ * For example, this holds for
+ * ```
+ * return 1+2;
+ * ```
+ * but not for
+ * ```
+ * return;
+ * ```
+ */
+ predicate hasExpr() { exists(this.getExpr()) }
+
+ override string toString() { result = "return ..." }
+
+ override predicate mayBeImpure() {
+ this.getExpr().mayBeImpure()
+ }
+ override predicate mayBeGloballyImpure() {
+ this.getExpr().mayBeGloballyImpure()
+ }
+}
+
+/**
+ * A C/C++ 'do' statement.
+ *
+ * For example,
+ * ```
+ * do {
+ * x = x + 1;
+ * } while (x < 10);
+ * ```
+ */
+class DoStmt extends Loop, @stmt_end_test_while {
+
+ override Expr getCondition() { result = this.getChild(0) }
+ override Expr getControllingExpr() { result = this.getCondition() }
+ override Stmt getStmt() { do_body(this, result) }
+
+ override string toString() { result = "do (...) ..." }
+
+ override predicate mayBeImpure() {
+ this.getCondition().mayBeImpure() or
+ this.getStmt().mayBeImpure()
+ }
+ override predicate mayBeGloballyImpure() {
+ this.getCondition().mayBeGloballyImpure() or
+ this.getStmt().mayBeGloballyImpure()
+ }
+
+ override MacroInvocation getGeneratingMacro() {
+ result.getAnExpandedElement() = this.getCondition() and
+ this.getStmt().getGeneratingMacro() = result
+ }
+}
+
+/**
+ * A C++11 range-based 'for' statement.
+ *
+ * For example,
+ * ```
+ * for (int x : xs) { y += x; }
+ * ```
+ *
+ * This example would be desugared to
+ * ```
+ * {
+ * auto && __range = xs;
+ * for (auto __begin = begin_expr, __end = end_expr;
+ * __begin != __end;
+ * ++__begin) {
+ * int x = *__begin;
+ * y += x;
+ * }
+ * }
+ * ```
+ * where `begin_expr` and `end_expr` depend on the type of `xs`.
+ */
+class RangeBasedForStmt extends Loop, @stmt_range_based_for {
+ /**
+ * Gets the 'body' statement of this range-based 'for' statement.
+ *
+ * For example, for
+ * ```
+ * for (int x : xs) { y += x; }
+ * ```
+ * the result is the `Block` `{ y += x; }`.
+ */
+ override Stmt getStmt() { result = this.getChild(5) }
+
+ override string toString() { result = "for(...:...) ..." }
+
+ /**
+ * Gets the variable introduced by the for-range-declaration.
+ *
+ * For example, for
+ * ```
+ * for (int x : xs) { y += x; }
+ * ```
+ * the result is `int x`.
+ */
+ Variable getVariable() { result = getChild(4).(DeclStmt).getADeclaration() }
+
+ /**
+ * Gets the expression giving the range to iterate over.
+ *
+ * For example, for
+ * ```
+ * for (int x : xs) { y += x; }
+ * ```
+ * the result is `xs`.
+ */
+ Expr getRange() { result = getRangeVariable().getInitializer().getExpr() }
+
+ /** Gets the compiler-generated `__range` variable after desugaring. */
+ Variable getRangeVariable() {
+ result = getChild(0).(DeclStmt).getADeclaration()
+ }
+
+ /**
+ * Gets the compiler-generated `__begin != __end` which is the
+ * condition expression of this for statement after desugaring.
+ * It will be either an `NEExpr` or a call to a user-defined
+ * `operator!=`.
+ */
+ override Expr getCondition() { result = this.getChild(2) }
+ override Expr getControllingExpr() { result = this.getCondition() }
+
+ /**
+ * Gets the compiler-generated `++__begin` which is the update
+ * expression of this for statement after desugaring. It will
+ * be either a `PrefixIncrExpr` or a call to a user-defined
+ * `operator++`.
+ */
+ Expr getUpdate() { result = this.getChild(3) }
+
+ /** Gets the compiler-generated `__begin` variable after desugaring. */
+ Variable getAnIterationVariable() {
+ result = getUpdate().getAChild().(VariableAccess).getTarget()
+ }
+}
+
+/**
+ * A C/C++ 'for' statement.
+ *
+ * This only represents "traditional" 'for' statements and not C++11
+ * range-based 'for' statements or Objective C 'for-in' statements.
+ *
+ * For example,
+ * ```
+ * for (i = 0; i < 10; i++) { j++; }
+ * ```
+ */
+class ForStmt extends Loop, @stmt_for {
+
+ /**
+ * Gets the initialization statement of this 'for' statement.
+ *
+ * For example, for
+ * ```
+ * for (i = 0; i < 10; i++) { j++; }
+ * ```
+ * the result is `i = 0;`.
+ *
+ * Does not hold if the initialization statement is an empty statement, as in
+ * ```
+ * for (; i < 10; i++) { j++ }
+ * ```
+ */
+ Stmt getInitialization() { for_initialization(this, result) }
+
+ /**
+ * Gets the condition expression of this 'for' statement.
+ *
+ * For example, for
+ * ```
+ * for (i = 0; i < 10; i++) { j++; }
+ * ```
+ * the result is `i < 10`.
+ *
+ * Does not hold if the condition expression is omitted, as in
+ * ```
+ * for (i = 0;; i++) { if (i >= 10) break; }
+ * ```
+ */
+ override Expr getCondition() { for_condition(this, result) }
+ override Expr getControllingExpr() { result = this.getCondition() }
+
+ /**
+ * Gets the update expression of this 'for' statement.
+ *
+ * For example, for
+ * ```
+ * for (i = 0; i < 10; i++) { j++; }
+ * ```
+ * the result is `i++`.
+ *
+ * Does not hold if the update expression is omitted, as in
+ * ```
+ * for (i = 0; i < 10;) { i++; }
+ * ```
+ */
+ Expr getUpdate() { for_update(this, result) }
+
+ override Stmt getStmt() { for_body(this, result) }
+
+ override string toString() { result = "for(...;...;...) ..." }
+
+ /**
+ * Gets a variable that is used as an iteration variable. That is, a
+ * variables that is defined, updated or tested in the head of this
+ * for statement.
+ *
+ * This only has results that are quite certainly loop variables: for
+ * complex iterations, it may not return anything.
+ *
+ * For example, for
+ * ```
+ * for (i = 0; i < 10; i++) { j++; }
+ * ```
+ * the result is `i`.
+ */
+ pragma[noopt]
+ Variable getAnIterationVariable() {
+ this instanceof ForStmt and
+
+ // check that it is assigned to, incremented or decremented in the update
+ exists(Expr updateOpRoot, Expr updateOp |
+ updateOpRoot = this.getUpdate() and
+ inForUpdate(updateOpRoot, updateOp) |
+ exists(CrementOperation op, VariableAccess va |
+ op = updateOp and
+ op instanceof CrementOperation and
+ op.getOperand() = va and
+ va = result.getAnAccess()
+ )
+ or
+ updateOp = result.getAnAssignedValue()
+ )
+ and
+ result instanceof Variable
+ and
+ // checked or used in the condition
+ exists(Expr e, VariableAccess va |
+ va = result.getAnAccess() and
+ inForCondition(e, va) and
+ e = this.getCondition()
+ )
+ }
+
+ /**
+ * Gets a declaration from the initialization statement of this 'for'
+ * statement.
+ *
+ * For example, for
+ * ```
+ * for(int x = 0, y = 10; x != y; ++x) { sum += x; }
+ * ```
+ * the results are `x` and `y`, while for
+ * ```
+ * for (i = 0; i < 10; i++) { j++; }
+ * ```
+ * there are no results.
+ */
+ override Declaration getADeclaration() {
+ result = this.getInitialization().(DeclStmt).getADeclaration()
+ }
+
+ override predicate mayBeImpure() {
+ this.getInitialization().mayBeImpure() or
+ this.getCondition().mayBeImpure() or
+ this.getUpdate().mayBeImpure() or
+ this.getStmt().mayBeImpure()
+ }
+ override predicate mayBeGloballyImpure() {
+ this.getInitialization().mayBeGloballyImpure() or
+ this.getCondition().mayBeGloballyImpure() or
+ this.getUpdate().mayBeGloballyImpure() or
+ this.getStmt().mayBeGloballyImpure()
+ }
+
+ override MacroInvocation getGeneratingMacro() {
+ (exists(this.getInitialization()) implies result = this.getInitialization().getGeneratingMacro()) and
+ (exists(this.getCondition()) implies this.getCondition() = result.getAnExpandedElement()) and
+ (exists(this.getUpdate()) implies this.getUpdate() = result.getAnExpandedElement()) and
+ this.getStmt().getGeneratingMacro() = result
+ }
+
+ /**
+ * Holds if the loop condition is provably `true`.
+ *
+ * For example, this holds for
+ * ```
+ * for(x = 0; 1; ++x) { sum += x; }
+ * ```
+ */
+ predicate conditionAlwaysTrue() {
+ conditionAlwaysTrue(getCondition())
+ }
+
+ /**
+ * Holds if the loop condition is provably `false`.
+ *
+ * For example, this holds for
+ * ```
+ * for(x = 0; 0; ++x) { sum += x; }
+ * ```
+ */
+ predicate conditionAlwaysFalse() {
+ conditionAlwaysFalse(getCondition())
+ }
+
+ /**
+ * Holds if the loop condition is provably `true` upon entry,
+ * that is, at least one iteration of the loop is guaranteed.
+ *
+ * For example, with
+ * ```
+ * for (int i = 0; i < 10; i++) { ... }
+ * ```
+ * the condition `i < 10` always evaluates to `true` upon entry since
+ * `i = 0`, but the condition will evaluate to `false` after 10
+ * iterations.
+ */
+ predicate conditionAlwaysTrueUponEntry() {
+ loopConditionAlwaysTrueUponEntry(this, _)
+ }
+}
+
+/**
+ * Holds if `child` is in the condition `forCondition` of a 'for'
+ * statement.
+ *
+ * For example, if a program includes
+ * ```
+ * for (i = 0; i < 10; i++) { j++; }
+ * ```
+ * then this predicate will hold with `forCondition` as `i < 10`,
+ * and `child` as any of `i`, `10` and `i < 10`.
+ */
+pragma[noopt]
+private predicate inForCondition(Expr forCondition, Expr child) {
+ exists (ForStmt for | forCondition = for.getCondition() and
+ child = forCondition and
+ for instanceof ForStmt)
+ or
+ exists (Expr mid | inForCondition(forCondition, mid) and
+ child.getParent() = mid)
+}
+
+/**
+ * Holds if `child` is in the update `forUpdate` of a 'for' statement.
+ *
+ * For example, if a program includes
+ * ```
+ * for (i = 0; i < 10; i += 1) { j++; }
+ * ```
+ * then this predicate will hold with `forUpdate` as `i += 1`,
+ * and `child` as any of `i`, `1` and `i += 1`.
+ */
+pragma[noopt]
+private predicate inForUpdate(Expr forUpdate, Expr child) {
+ exists (ForStmt for | forUpdate = for.getUpdate() and child = forUpdate)
+ or
+ exists (Expr mid | inForUpdate(forUpdate, mid) and child.getParent() = mid)
+}
+
+/**
+ * A C/C++ 'switch case' statement.
+ *
+ * For example,
+ * ```
+ * case 5:
+ * ```
+ * or
+ * ```
+ * default:
+ * ```
+ */
+class SwitchCase extends Stmt, @stmt_switch_case {
+
+ /**
+ * Gets the expression of this 'switch case' statement (or the start of
+ * the range if there is a GNU case range). Does not exist for a
+ * `DefaultCase`.
+ *
+ * For example, for
+ * ```
+ * case 5:
+ * ```
+ * the result is `5`, for
+ * ```
+ * case 6 ... 7:
+ * ```
+ * the result is 6, and there is no result for
+ * ```
+ * default:
+ * ```
+ */
+ Expr getExpr() { result = this.getChild(0) }
+
+ /**
+ * Gets the end of the range, if this is a GNU case range. Otherwise
+ * has no result.
+ *
+ * For example, for
+ * ```
+ * case 6 ... 7:
+ * ```
+ * the result is `7`, while for
+ * ```
+ * case 5:
+ * ```
+ * and
+ * ```
+ * default:
+ * ```
+ * there is no result.
+ */
+ Expr getEndExpr() { result = this.getChild(1) }
+
+ /**
+ * Gets the 'switch' statement of this 'switch case' statement.
+ *
+ * For example, with
+ * ```
+ * switch(i) {
+ * case 5:
+ * x = 1;
+ * }
+ * ```
+ * the result of this predicate on `case 5:` is the whole
+ * `switch(i) { ... }` statement.
+ */
+ SwitchStmt getSwitchStmt() { result.getASwitchCase() = this }
+
+ /**
+ * Gets the 0-based index of this 'switch case' statement within its
+ * 'switch' statement.
+ *
+ * For example, for
+ * ```
+ * switch(i) {
+ * case 5:
+ * case 6:
+ * default:
+ * }
+ * ```
+ * the `case 5:` has result 0, `case 6:` has result 1, and `default:`
+ * has result 2.
+ */
+ int getChildNum() {
+ switch_case(_, result, this)
+ }
+
+ /**
+ * DEPRECATED: use `SwitchCase.getAStmt` or `ControlFlowNode.getASuccessor`
+ * rather than this predicate.
+ *
+ * Gets the `Block` statement immediately following this 'switch case'
+ * statement, if any.
+ *
+ * For example, for
+ * ```
+ * switch (i) {
+ * case 5:
+ * x = 1;
+ * break;
+ * case 6:
+ * case 7:
+ * { x = 2; break; }
+ * default:
+ * { x = 3; }
+ * x = 4;
+ * break;
+ * }
+ * ```
+ * the `case 7:` has result `{ x = 2; break; }`, `default:` has result
+ * `{ x = 3; }`, and the others have no result.
+ */
+ deprecated Block getLabelledStmt() {
+ exists(int i, Stmt parent |
+ this = parent.getChild(i) and
+ result = parent.getChild(i+1))
+ }
+
+ /**
+ * Gets the next `SwitchCase` belonging to the same 'switch'
+ * statement, if any.
+ *
+ * For example, for
+ * ```
+ * switch (i) {
+ * case 5:
+ * x = 1;
+ * break;
+ * case 6:
+ * case 7:
+ * { x = 2; break; }
+ * default:
+ * { x = 3; }
+ * x = 4;
+ * break;
+ * }
+ * ```
+ * the `case 5:` has result `case 6:`, which has result `case 7:`,
+ * which has result `default:`, which has no result.
+ */
+ SwitchCase getNextSwitchCase() {
+ result.getSwitchStmt() = this.getSwitchStmt() and
+ result.getChildNum() = this.getChildNum() + 1
+ }
+
+ /**
+ * Gets the previous `SwitchCase` belonging to the same 'switch'
+ * statement, if any.
+ *
+ * For example, for
+ * ```
+ * switch (i) {
+ * case 5:
+ * x = 1;
+ * break;
+ * case 6:
+ * case 7:
+ * { x = 2; break; }
+ * default:
+ * { x = 3; }
+ * x = 4;
+ * break;
+ * }
+ * ```
+ * the `default:` has result `case 7:`, which has result `case 6:`,
+ * which has result `case 5:`, which has no result.
+ */
+ SwitchCase getPreviousSwitchCase() {
+ result.getNextSwitchCase() = this
+ }
+
+ /**
+ * Gets a statement belonging under this 'switch case' statement.
+ *
+ * For example, for
+ * ```
+ * switch (i) {
+ * case 5:
+ * x = 1;
+ * break;
+ * case 6:
+ * case 7:
+ * { x = 2; break; }
+ * default:
+ * { x = 3; }
+ * x = 4;
+ * break;
+ * }
+ * ```
+ * the `case 5:` has results `x = 1;` and `break;`, `case 6:` has no
+ * results, `case 7:` has a single result `{ x = 2; break; }`, and
+ * `default:` has results `{ x = 3; }, `x = 4;` and `break;`.
+ */
+ Stmt getAStmt() {
+ exists(Block b, int i, int j |
+ b.getStmt(i) = this and
+ b.getStmt(j) = result and
+ i < j and
+ not result instanceof SwitchCase and
+ not exists(SwitchCase sc, int k |
+ b.getStmt(k) = sc and
+ i < k and
+ j > k))
+ }
+
+ /**
+ * Gets the last statement under this 'switch case' statement. If the
+ * last statement is wrapped in one or more blocks then the result is
+ * the last statement in those blocks instead.
+ *
+ * For example, for
+ * ```
+ * switch (i) {
+ * case 5:
+ * x = 1;
+ * break;
+ * case 6:
+ * case 7:
+ * { x = 2; break; }
+ * default:
+ * { x = 3; { x = 4; break; } }
+ * }
+ * ```
+ * the `case 5:` has result `break;`, the `case 6:` has no result,
+ * the `case 7:` has results `break;`, and the `default:` has result
+ * `break;`.
+ */
+ Stmt getLastStmt() {
+ exists(Stmt lastStmt |
+ lastStmt = this.getAStmt() and
+ not lastStmt.getFollowingStmt() = this.getAStmt() and
+ if lastStmt instanceof Block then
+ result = lastStmt.(Block).getLastStmtIn()
+ else
+ result = lastStmt
+ )
+ }
+
+ /**
+ * Holds if the last statement, as determined by `getLastStmt`, under
+ * this 'switch case' statement is a 'break' statement.
+ *
+ * For example, for
+ * ```
+ * switch (i) {
+ * case 5:
+ * x = 1;
+ * break;
+ * case 6:
+ * case 7:
+ * { x = 2; break; }
+ * default:
+ * { x = 3; { x = 4; break; } }
+ * }
+ * ```
+ * this holds for `case 5:`, `case 7:` and `default:`, but not for `case 6:`.
+ */
+ predicate terminatesInBreakStmt() {
+ this.getLastStmt() instanceof BreakStmt
+ }
+
+ /**
+ * Holds if the last statement, as determined by `getLastStmt`, under
+ * this 'switch case' statement is a 'return' statement.
+ *
+ * For example, for
+ * ```
+ * switch (i) {
+ * case 5:
+ * x = 1;
+ * return;
+ * case 6:
+ * case 7:
+ * { x = 2; return; }
+ * default:
+ * { x = 3; { x = 4; return; } }
+ * }
+ * ```
+ * this holds for `case 5:`, `case 7:` and `default:`, but not for `case 6:`.
+ */
+ predicate terminatesInReturnStmt() {
+ this.getLastStmt() instanceof ReturnStmt
+ }
+
+ /**
+ * Holds if the last statement, as determined by `getLastStmt`, under
+ * this 'switch case' statement is a 'throw' statement.
+ *
+ * For example, for
+ * ```
+ * switch (i) {
+ * case 5:
+ * x = 1;
+ * throw 1;
+ * case 6:
+ * case 7:
+ * { x = 2; throw 2; }
+ * default:
+ * { x = 3; { x = 4; throw 3; } }
+ * }
+ * ```
+ * this holds for `case 5:`, `case 7:` and `default:`, but not for `case 6:`.
+ */
+ predicate terminatesInThrowStmt() {
+ exists(ThrowExpr t | t.getEnclosingStmt() = this.getLastStmt())
+ }
+
+ /**
+ * Holds if this 'switch case' statement is a 'default' statement.
+ *
+ * For example, for
+ * ```
+ * switch (i) {
+ * case 5:
+ * case 6:
+ * case 7:
+ * default:
+ * }
+ * ```
+ * this holds for `default:`, but not for `case 5:`, `case 6:`,
+ * or `case 7:`.
+ */
+ predicate isDefault() {
+ this instanceof DefaultCase
+ }
+
+ override string toString() { result = "case ...:" }
+
+ override predicate mayBeImpure() {
+ this.getExpr().mayBeImpure()
+ }
+ override predicate mayBeGloballyImpure() {
+ this.getExpr().mayBeGloballyImpure()
+ }
+}
+
+/**
+ * A C/C++ 'default case' statement.
+ *
+ * For example,
+ * ```
+ * default:
+ * ```
+ */
+class DefaultCase extends SwitchCase {
+
+ DefaultCase() { not exists(this.getExpr()) }
+
+ override string toString() { result = "default: " }
+
+ override predicate mayBeImpure() {
+ none()
+ }
+ override predicate mayBeGloballyImpure() {
+ none()
+ }
+}
+
+/**
+ * A C/C++ 'switch' statement.
+ *
+ * For example,
+ * ```
+ * switch(i) {
+ * case 1:
+ * case 2:
+ * break;
+ * default:
+ * break;
+ * }
+ * ```
+ */
+class SwitchStmt extends ConditionalStmt, @stmt_switch {
+ /**
+ * Gets the expression that this 'switch' statement switches on.
+ *
+ * For example, for
+ * ```
+ * switch(i) {
+ * case 1:
+ * case 2:
+ * break;
+ * default:
+ * break;
+ * }
+ * ```
+ * the result is `i`.
+ */
+ Expr getExpr() { result = this.getChild(0) }
+ override Expr getControllingExpr() { result = this.getExpr() }
+
+ /**
+ * Gets the body statement of this 'switch' statement.
+ *
+ * In almost all cases the result will be a `BlockStmt`, but there are
+ * other syntactically valid constructions.
+ *
+ * For example, for
+ * ```
+ * switch(i) {
+ * case 1:
+ * case 2:
+ * break;
+ * default:
+ * break;
+ * }
+ * ```
+ * the result is
+ * ```
+ * {
+ * case 1:
+ * case 2:
+ * break;
+ * default:
+ * break;
+ * }
+ * ```
+ */
+ Stmt getStmt() { switch_body(this, result) }
+
+ /**
+ * Gets a 'switch case' statement of this 'switch' statement.
+ *
+ * For example, for
+ * ```
+ * switch(i) {
+ * case 1:
+ * case 2:
+ * break;
+ * default:
+ * break;
+ * }
+ * ```
+ * the results are `case 1:`, `case 2:` and `default:`.
+ */
+ SwitchCase getASwitchCase() { switch_case(this, _, result) }
+
+ /**
+ * Gets the 'default case' statement of this 'switch' statement,
+ * if any.
+ *
+ * For example, for
+ * ```
+ * switch(i) {
+ * case 1:
+ * case 2:
+ * break;
+ * default:
+ * break;
+ * }
+ * ```
+ * the result is `default:`, but there is no result for
+ * ```
+ * switch(i) {
+ * case 1:
+ * case 2:
+ * break;
+ * }
+ * ```
+ */
+ DefaultCase getDefaultCase() { result = this.getASwitchCase() }
+
+ /**
+ * Holds if this 'switch' statement has a 'default case' statement.
+ *
+ * For example, this holds for
+ * ```
+ * switch(i) {
+ * case 1:
+ * case 2:
+ * break;
+ * default:
+ * break;
+ * }
+ * ```
+ * but not for
+ * ```
+ * switch(i) {
+ * case 1:
+ * case 2:
+ * break;
+ * }
+ * ```
+ */
+ predicate hasDefaultCase() { exists(this.getDefaultCase()) }
+
+ override string toString() { result = "switch (...) ... " }
+
+ override predicate mayBeImpure() {
+ this.getExpr().mayBeImpure() or
+ this.getStmt().mayBeImpure()
+ }
+ override predicate mayBeGloballyImpure() {
+ this.getExpr().mayBeGloballyImpure() or
+ this.getStmt().mayBeGloballyImpure()
+ }
+
+ override MacroInvocation getGeneratingMacro() {
+ result.getAnExpandedElement() = this.getExpr() and
+ forall(SwitchCase c | c = this.getASwitchCase()
+ | exists(c.getGeneratingMacro()))
+ }
+}
+
+/**
+ * A C/C++ 'switch' statement where the controlling expression has an
+ * enum type.
+ *
+ * For example, given
+ * ```
+ * enum color { RED, GREEN, BLUE };
+ * enum color c;
+ * ```
+ * the 'switch' statement
+ * ```
+ * switch (c) {
+ * case RED:
+ * return 1;
+ * default:
+ * return 2;
+ * }
+ * ```
+ */
+class EnumSwitch extends SwitchStmt {
+ EnumSwitch() {
+ this.getExpr().getType().getUnderlyingType() instanceof Enum
+ }
+
+ /**
+ * Gets a constant from the enum type that does not have a case in this
+ * 'switch' statement.
+ *
+ * For example, with
+ * ```
+ * enum color { RED, GREEN, BLUE };
+ * enum color c;
+ * switch (c) {
+ * case RED:
+ * return 1;
+ * default:
+ * return 2;
+ * }
+ * ```
+ * there are results `GREEN` and `BLUE`.
+ */
+ pragma[noopt]
+ EnumConstant getAMissingCase() {
+ exists(Enum et |
+ exists(Expr e, Type t |
+ e = this.getExpr() and
+ this instanceof EnumSwitch and
+ t = e.getType() and
+ et = t.getUnderlyingType()
+ ) and
+ result = et.getAnEnumConstant() and
+ not exists(string value |
+ exists(SwitchCase sc, Expr e | sc = this.getASwitchCase() and
+ e = sc.getExpr() and
+ value = e.getValue())
+ and
+ exists(Initializer init, Expr e | init = result.getInitializer() and
+ e = init.getExpr() and
+ e.getValue() = value)
+ )
+ )
+ }
+}
+
+/**
+ * A handler for a 'try' statement.
+ *
+ * This corresponds to a 'catch block' in the source. If the exception
+ * is of a type that can be handled by this 'catch block', then
+ * execution continues with the associated `CatchBlock`. Otherwise,
+ * execution continues with the next `Handler`.
+ *
+ * This has no concrete representation in the source, but makes the
+ * control flow graph easier to use.
+ */
+class Handler extends Stmt, @stmt_handler {
+
+ override string toString() { result = "" }
+
+ /**
+ * Gets the block containing the implementation of this handler.
+ */
+ CatchBlock getBlock() { result = getChild(0) }
+
+ /** Gets the 'try' statement corresponding to this 'catch block'. */
+ TryStmt getTryStmt() { result = getParent() }
+
+ /**
+ * Gets the parameter introduced by this 'catch block', if any.
+ *
+ * For example, `catch(std::exception& e)` introduces a
+ * parameter `e`, whereas `catch(...)` does not introduce a parameter.
+ */
+ Parameter getParameter() { result = getBlock().getParameter() }
+
+ override predicate mayBeImpure() {
+ none()
+ }
+ override predicate mayBeGloballyImpure() {
+ none()
+ }
+}
+
+/**
+ * DEPRECATED: Objective-C is no longer supported.
+ * The end of a 'finally' clause.
+ *
+ * This has no concrete representation in the source, but makes the
+ * control flow graph easier to use.
+ */
+deprecated class FinallyEnd extends Stmt {
+ FinallyEnd() { none() }
+
+ override string toString() { result = "" }
+
+ override predicate mayBeImpure() {
+ none()
+ }
+ override predicate mayBeGloballyImpure() {
+ none()
+ }
+}
+
+/**
+ * A C/C++ 'try' statement.
+ *
+ * For example,
+ * ```
+ * try { f(); } catch (...) { g(); }
+ * ```
+ */
+class TryStmt extends Stmt, @stmt_try_block {
+
+ override string toString() { result = "try { ... }" }
+
+ /**
+ * Gets the 'body' statement of this 'try' statement.
+ *
+ * For example, for
+ * ```
+ * try { f(); } catch (...) { g(); }
+ * ```
+ * the result is `{ f(); }`.
+ */
+ Stmt getStmt() { result = this.getChild(0) }
+
+ /**
+ * Gets the `n`th 'catch block' of this 'try' statement.
+ *
+ * For example, for
+ * ```
+ * try { f(); } catch (...) { g(); }
+ * ```
+ * the result of `getCatchClause(0)` is `{ g(); }`.
+ */
+ CatchBlock getCatchClause(int n) {
+ result = this.getChild(n + 1).(Handler).getBlock()
+ }
+
+ /**
+ * Gets a 'catch block' of this 'try' statement.
+ *
+ * For example, for
+ * ```
+ * try { f(); } catch (...) { g(); }
+ * ```
+ * the result is `{ g(); }`.
+ */
+ CatchBlock getACatchClause() { result = this.getCatchClause(_) }
+
+ /**
+ * Gets the number of 'catch block's of this 'try' statement.
+ *
+ * For example, for
+ * ```
+ * try { f(); } catch (...) { g(); }
+ * ```
+ * the result is 1.
+ */
+ int getNumberOfCatchClauses() {
+ result = count(this.getACatchClause())
+ }
+
+ override predicate mayBeImpure() {
+ this.getStmt().mayBeImpure() or
+ this.getACatchClause().mayBeImpure()
+ }
+ override predicate mayBeGloballyImpure() {
+ this.getStmt().mayBeGloballyImpure() or
+ this.getACatchClause().mayBeGloballyImpure()
+ }
+}
+
+/**
+ * A C++ 'function try' statement.
+ *
+ * This is a 'try' statement wrapped around an entire function body,
+ * for example:
+ * ```
+ * void foo() try {
+ * f();
+ * } catch(...) {
+ * g();
+ * }
+ * ```
+ */
+class FunctionTryStmt extends TryStmt {
+ FunctionTryStmt() {
+ not exists(this.getEnclosingBlock())
+ }
+}
+
+/**
+ * A 'catch block', from either C++'s `catch` or Objective C's `@catch`.
+ */
+class CatchBlock extends Block {
+ CatchBlock() { ishandler(this) }
+
+ /**
+ * Gets the parameter introduced by this 'catch block', if any.
+ *
+ * For example, `catch(std::exception& e)` introduces a parameter
+ * `e`, whereas `catch(...)` does not introduce a parameter.
+ */
+ Parameter getParameter() { result.getCatchBlock() = this }
+
+ /** Gets the try statement corresponding to this 'catch block'. */
+ TryStmt getTryStmt() {
+ result.getACatchClause() = this
+ }
+}
+
+/**
+ * A C++ 'catch-any block', that is, `catch(...) {stmts}`.
+ */
+class CatchAnyBlock extends CatchBlock {
+ CatchAnyBlock() {
+ not exists(this.getParameter())
+ }
+}
+
+/**
+ * A structured exception handling 'try' statement, that is, a
+ * `__try __except` or `__try __finally` statement. This is a Microsoft
+ * C/C++ extension.
+ */
+class MicrosoftTryStmt extends Stmt, @stmt_microsoft_try {
+ /** Gets the body statement of this __try statement. */
+ Stmt getStmt() { result = this.getChild(0) }
+}
+
+/**
+ * A structured exception handling 'try except' statement, that is,
+ * a `__try __except` statement. This is a Microsoft C/C++ extension.
+ */
+class MicrosoftTryExceptStmt extends MicrosoftTryStmt {
+ MicrosoftTryExceptStmt() {
+ getChild(1) instanceof Expr
+ }
+
+ override string toString() {
+ result = "__try { ... } __except( ... ) { ... }"
+ }
+
+ /** Gets the expression guarding the `__except` statement. */
+ Expr getCondition() { result = getChild(1) }
+
+ /** Gets the `__except` statement (usually a `Block`). */
+ Stmt getExcept() { result = getChild(2) }
+}
+
+/**
+ * A structured exception handling 'try finally' statement, that is,
+ * a `__try __finally` statement. This is a Microsoft C/C++ extension.
+ */
+class MicrosoftTryFinallyStmt extends MicrosoftTryStmt {
+ MicrosoftTryFinallyStmt() {
+ not getChild(1) instanceof Expr
+ }
+
+ override string toString() { result = "__try { ... } __finally { ... }" }
+
+ /** Gets the `__finally` statement (usually a `Block`). */
+ Stmt getFinally() { result = getChild(1) }
+}
+
+/**
+ * A C/C++ 'declaration' statement.
+ *
+ * For example,
+ * ```
+ * int i, j;
+ * ```
+ */
+class DeclStmt extends Stmt, @stmt_decl {
+
+ /**
+ * Gets the `i`th declaration entry declared by this 'declaration' statement.
+ *
+ * For example, for
+ * ```
+ * int i, j;
+ * ```
+ * the result of `getDeclarationEntry(0)` is `i`.
+ */
+ DeclarationEntry getDeclarationEntry(int i) {
+ stmt_decl_entry_bind(this, i, result)
+ }
+
+ /**
+ * Gets a declaration entry declared by this 'declaration' statement.
+ *
+ * For example, for
+ * ```
+ * int i, j;
+ * ```
+ * the results are `i` and `j`.
+ */
+ DeclarationEntry getADeclarationEntry() {
+ result = this.getDeclarationEntry(_)
+ }
+
+ /**
+ * Gets the number of declarations declared by this 'declaration' statement.
+ *
+ * For example, for
+ * ```
+ * int i, j;
+ * ```
+ * the result of `getNumDeclarations()` is `2`.
+ */
+ int getNumDeclarations() { result = count(this.getADeclaration()) }
+
+ /**
+ * Gets the `i`th declaration declared by this 'declaration' statement.
+ *
+ * For example, for
+ * ```
+ * int i, j;
+ * ```
+ * the result of `getDeclaration(0)` is `i`.
+ */
+ Declaration getDeclaration(int i) { stmt_decl_bind(this, i, result) }
+
+ /**
+ * Gets a declaration declared by this 'declaration' statement.
+ *
+ * For example, for
+ * ```
+ * int i, j;
+ * ```
+ * the results are `i` and `j`.
+ */
+ Declaration getADeclaration() { result = this.getDeclaration(_) }
+
+ override string toString() { result = "declaration" }
+
+ override predicate mayBeImpure() {
+ this.getADeclaration().(LocalVariable).getInitializer().getExpr().mayBeImpure()
+ }
+ override predicate mayBeGloballyImpure() {
+ this.getADeclaration().(LocalVariable).getInitializer().getExpr().mayBeGloballyImpure()
+ }
+}
+
+/**
+ * A C/C++ 'empty' statement.
+ *
+ * For example,
+ * ```
+ * ;
+ * ```
+ */
+class EmptyStmt extends Stmt, @stmt_empty {
+
+ override string toString() { result = ";" }
+
+ override predicate mayBeImpure() { none() }
+ override predicate mayBeGloballyImpure() { none() }
+}
+
+/**
+ * A C/C++ 'asm' statement.
+ *
+ * For example,
+ * ```
+ * __asm__("movb %bh (%eax)");
+ * ```
+ */
+class AsmStmt extends Stmt, @stmt_asm {
+ override string toString() {
+ result = "asm statement"
+ }
+}
+
+/**
+ * A C99 statement which computes the size of a single dimension of
+ * a variable length array.
+ *
+ * Each `VlaDeclStmt` is preceded by one `VlaDimensionStmt` for each
+ * variable length dimension of the array.
+ */
+class VlaDimensionStmt extends Stmt, @stmt_set_vla_size {
+ override string toString() { result = "VLA dimension size" }
+
+ /** Gets the expression which gives the size. */
+ Expr getDimensionExpr() { result = this.getChild(0) }
+}
+
+/**
+ * A C99 statement which declares a variable length array.
+ *
+ * Each `VlaDeclStmt` is preceded by one `VlaDimensionStmt` for each
+ * variable length dimension of the array.
+ */
+class VlaDeclStmt extends Stmt, @stmt_vla_decl {
+ override string toString() { result = "VLA declaration" }
+
+ /**
+ * Gets the number of VLA dimension statements in this VLA
+ * declaration statement.
+ */
+ int getNumberOfVlaDimensionStmts() {
+ exists(Block b, int j |
+ this = b.getStmt(j) and
+ result = j - 1 - max(int i |
+ i in [0 .. j - 1] and
+ not b.getStmt(i) instanceof VlaDimensionStmt))
+ }
+
+ /**
+ * Gets the `i`th VLA dimension statement in this VLA
+ * declaration statement.
+ */
+ VlaDimensionStmt getVlaDimensionStmt(int i) {
+ i in [0 .. this.getNumberOfVlaDimensionStmts() - 1] and
+ exists(Block b, int j |
+ this = b.getStmt(j) and
+ result = b.getStmt(j - this.getNumberOfVlaDimensionStmts() + i))
+ }
+
+ /**
+ * Gets the type that this VLA declaration statement relates to,
+ * if any.
+ */
+ Type getType() { type_vla(unresolve(result), this) }
+
+ /**
+ * Gets the variable that this VLA declaration statement relates to,
+ * if any.
+ */
+ Variable getVariable() { variable_vla(result, this) }
+}
diff --git a/cpp/ql/src/semmle/code/cpp/valuenumbering/GlobalValueNumbering.qll b/cpp/ql/src/semmle/code/cpp/valuenumbering/GlobalValueNumbering.qll
new file mode 100644
index 000000000000..1a3ac62e84bf
--- /dev/null
+++ b/cpp/ql/src/semmle/code/cpp/valuenumbering/GlobalValueNumbering.qll
@@ -0,0 +1,593 @@
+/**
+ * Provides an implementation of Global Value Numbering.
+ * See https://en.wikipedia.org/wiki/Global_value_numbering
+ *
+ * The predicate `globalValueNumber` converts an expression into a `GVN`,
+ * which is an abstract type presenting the value of the expression. If
+ * two expressions have the `GVN` then they compute the same value.
+ * For example:
+ *
+ * ```
+ * void f(int x, int y) {
+ * g(x+y, x+y);
+ * }
+ * ```
+ *
+ * In this example, both arguments in the call to `g` compute the same value,
+ * so both arguments have the same `GVN`. In other words, we can find
+ * this call with the following query:
+ *
+ * ```
+ * from FunctionCall call, GVN v
+ * where v = globalValueNumber(call.getArgument(0))
+ * and v = globalValueNumber(call.getArgument(1))
+ * select call
+ * ```
+ *
+ * The analysis is conservative, so two expressions might have different
+ * `GVN`s even though the actually always compute the same value. The most
+ * common reason for this is that the analysis cannot prove that there
+ * are no side-effects that might cause the computed value to change.
+ */
+
+/*
+ * Note to developers: the correctness of this module depends on the
+ * definitions of GVN, globalValueNumber, and analyzableExpr being kept in
+ * sync with each other. If you change this module then make sure that the
+ * change is symmetric across all three.
+ */
+
+import cpp
+private import semmle.code.cpp.controlflow.SSA
+
+/**
+ * Holds if the result is a control flow node that might change the
+ * value of any global variable. This is used in the implementation
+ * of `GVN_OtherVariable`, because we need to be quite conservative when
+ * we assign a value number to a global variable. For example:
+ *
+ * ```
+ * x = g+1;
+ * dosomething();
+ * y = g+1;
+ * ```
+ *
+ * It is not safe to assign the same value number to both instances
+ * of `g+1` in this example, because the call to `dosomething` might
+ * change the value of `g`.
+ */
+private ControlFlowNode nodeWithPossibleSideEffect() {
+ result instanceof Call
+ or
+ // If the lhs of an assignment is not analyzable by SSA, then
+ // we need to treat the assignment as having a possible side-effect.
+ (result instanceof Assignment and not result instanceof SsaDefinition)
+ or
+ (result instanceof CrementOperation and not result instanceof SsaDefinition)
+ or
+ exists (LocalVariable v
+ | result = v.getInitializer().getExpr() and not result instanceof SsaDefinition)
+ or
+ result instanceof AsmStmt
+}
+
+/**
+ * Gets the entry node of the control flow graph of which `node` is a
+ * member.
+ */
+private cached ControlFlowNode getControlFlowEntry(ControlFlowNode node) {
+ result = node.getControlFlowScope().getEntryPoint() and
+ result.getASuccessor*() = node
+}
+
+/**
+ * Holds if there is a control flow edge from `src` to `dst` or
+ * if `dst` is an expression with a possible side-effect. The idea
+ * is to treat side effects as entry points in the control flow
+ * graph so that we can use the dominator tree to find the most recent
+ * side-effect.
+ */
+private predicate sideEffectCFG(ControlFlowNode src, ControlFlowNode dst) {
+ src.getASuccessor() = dst
+ or
+ // Add an edge from the entry point to any node that might have a side
+ // effect.
+ (dst = nodeWithPossibleSideEffect() and
+ src = getControlFlowEntry(dst))
+}
+
+/**
+ * Holds if `dominator` is the immediate dominator of `node` in
+ * the side-effect CFG.
+ */
+private predicate iDomEffect(ControlFlowNode dominator, ControlFlowNode node) =
+ idominance(functionEntry/1,sideEffectCFG/2)(_, dominator, node)
+
+/**
+ * Gets the most recent side effect. To be more precise, `result` is a
+ * dominator of `node` and no side-effects can occur between `result` and
+ * `node`.
+ *
+ * `sideEffectCFG` has an edge from the function entry to every node with a
+ * side-effect. This means that every node with a side-effect has the
+ * function entry as its immediate dominator. So if node `x` dominates node
+ * `y` then there can be no side effects between `x` and `y` unless `x` is
+ * the function entry. So the optimal choice for `result` has the function
+ * entry as its immediate dominator.
+ *
+ * Example:
+ *
+ * ```
+ * 000: int f(int a, int b, int *p) {
+ * 001: int r = 0;
+ * 002: if (a) {
+ * 003: if (b) {
+ * 004: sideEffect1();
+ * 005: }
+ * 006: } else {
+ * 007: sideEffect2();
+ * 008: }
+ * 009: if (a) {
+ * 010: r++; // Not a side-effect, because r is an SSA variable.
+ * 011: }
+ * 012: if (b) {
+ * 013: r++; // Not a side-effect, because r is an SSA variable.
+ * 014: }
+ * 015: return *p;
+ * 016: }
+ * ```
+ *
+ * Suppose we want to find the most recent side-effect for the dereference
+ * of `p` on line 015. The `sideEffectCFG` has an edge from the function
+ * entry (line 000) to the side effects at lines 004 and 007. Therefore,
+ * the immediate dominator tree looks like this:
+ *
+ * 000 - 001 - 002 - 003
+ * - 004
+ * - 007
+ * - 009 - 010
+ * - 012 - 013
+ * - 015
+ *
+ * The immediate dominator path to line 015 is 000 - 009 - 012 - 015.
+ * Therefore, the most recent side effect for line 015 is line 009.
+ */
+private cached ControlFlowNode mostRecentSideEffect(ControlFlowNode node) {
+ exists (ControlFlowNode entry
+ | functionEntry(entry) and
+ iDomEffect(entry, result) and
+ iDomEffect*(result, node))
+}
+
+/** Used to represent the "global value number" of an expression. */
+private cached newtype GVNBase =
+ GVN_IntConst(int val, Type t) { mk_IntConst(val,t,_) }
+ or
+ GVN_FloatConst(float val, Type t) { mk_FloatConst(val,t,_) }
+ or
+ // If the local variable does not have a defining value, then
+ // we use the SsaDefinition as its global value number.
+ GVN_UndefinedLocalScopeVariable(LocalScopeVariable x, SsaDefinition def) {
+ mk_UndefinedLocalScopeVariable(x, def, _)
+ }
+ or
+ // Variables with no SSA information. As a crude (but safe)
+ // approximation, we use `mostRecentSideEffect` to compute a definition
+ // location for the variable. This ensures that two instances of the same
+ // global variable will only get the same value number if they are
+ // guaranteed to have the same value.
+ GVN_OtherVariable(Variable x, ControlFlowNode dominator) {
+ mk_OtherVariable(x, dominator, _)
+ }
+ or
+ GVN_FieldAccess(GVN s, Field f) {
+ mk_DotFieldAccess(s,f,_) or
+ mk_PointerFieldAccess_with_deref(s,f,_) or
+ mk_ImplicitThisFieldAccess_with_deref(s,f,_)
+ }
+ or
+ // Dereference a pointer. The value might have changed since the last
+ // time the pointer was dereferenced, so we need to include a definition
+ // location. As a crude (but safe) approximation, we use
+ // `mostRecentSideEffect` to compute a definition location.
+ GVN_Deref(GVN p, ControlFlowNode dominator) {
+ mk_Deref(p,dominator,_) or
+ mk_PointerFieldAccess(p,_,dominator,_) or
+ mk_ImplicitThisFieldAccess_with_qualifier(p,_,dominator,_)
+ }
+ or
+ GVN_ThisExpr(Function fcn) {
+ mk_ThisExpr(fcn,_) or
+ mk_ImplicitThisFieldAccess(fcn,_,_,_)
+ }
+ or
+ GVN_Conversion(Type t, GVN child) { mk_Conversion(t, child, _) }
+ or
+ GVN_BinaryOp(GVN lhs, GVN rhs, string opname) {
+ mk_BinaryOp(lhs, rhs, opname, _)
+ }
+ or
+ GVN_UnaryOp(GVN child, string opname) { mk_UnaryOp(child, opname, _) }
+ or
+ GVN_ArrayAccess(GVN x, GVN i, ControlFlowNode dominator) {
+ mk_ArrayAccess(x,i,dominator,_)
+ }
+ or
+ // Any expression that is not handled by the cases above is
+ // given a unique number based on the expression itself.
+ GVN_Unanalyzable(Expr e) { not analyzableExpr(e) }
+
+/**
+ * A Global Value Number. A GVN is an abstract representation of the value
+ * computed by an expression. The relationship between `Expr` and `GVN` is
+ * many-to-one: every `Expr` has exactly one `GVN`, but multiple
+ * expressions can have the same `GVN`. If two expressions have the same
+ * `GVN`, it means that they compute the same value at run time. The `GVN`
+ * is an opaque value, so you cannot deduce what the run-time value of an
+ * expression will be from its `GVN`. The only use for the `GVN` of an
+ * expression is to find other expressions that compute the same value.
+ * Use the predicate `globalValueNumber` to get the `GVN` for an `Expr`.
+ *
+ * Note: `GVN` has `toString` and `getLocation` methods, so that it can be
+ * displayed in a results list. These work by picking an arbitrary
+ * expression with this `GVN` and using its `toString` and `getLocation`
+ * methods.
+ */
+class GVN extends GVNBase {
+ GVN() { this instanceof GVNBase }
+
+ /** Gets an expression that has this GVN. */
+ Expr getAnExpr() {
+ this = globalValueNumber(result)
+ }
+
+ /** Gets the kind of the GVN. This can be useful for debugging. */
+ string getKind() {
+ if this instanceof GVN_IntConst then result = "IntConst" else
+ if this instanceof GVN_FloatConst then result = "FloatConst" else
+ if this instanceof GVN_UndefinedLocalScopeVariable then
+ result = "UndefinedLocalScopeVariable" else
+ if this instanceof GVN_OtherVariable then result = "OtherVariable" else
+ if this instanceof GVN_FieldAccess then result = "FieldAccess" else
+ if this instanceof GVN_Deref then result = "Deref" else
+ if this instanceof GVN_ThisExpr then result = "ThisExpr" else
+ if this instanceof GVN_Conversion then result = "Conversion" else
+ if this instanceof GVN_BinaryOp then result = "BinaryOp" else
+ if this instanceof GVN_UnaryOp then result = "UnaryOp" else
+ if this instanceof GVN_ArrayAccess then result = "ArrayAccess" else
+ if this instanceof GVN_Unanalyzable then result = "Unanalyzable" else
+ result = "error"
+ }
+
+ /**
+ * Gets an example of an expression with this GVN.
+ * This is useful for things like implementing toString().
+ */
+ private Expr exampleExpr() {
+ // Pick the expression with the minimum source location string. This is
+ // just an arbitrary way to pick an expression with this `GVN`.
+ result =
+ min(Expr e
+ | this = globalValueNumber(e)
+ | e order by e.getLocation().toString())
+ }
+
+ /** Gets a textual representation of this element. */
+ string toString() {
+ result = exampleExpr().toString()
+ }
+
+ /** Gets the primary location of this element. */
+ Location getLocation() {
+ result = exampleExpr().getLocation()
+ }
+}
+
+private predicate analyzableIntConst(Expr e) {
+ strictcount (e.getValue().toInt()) = 1 and
+ strictcount (e.getType().getUnspecifiedType()) = 1
+}
+
+private predicate mk_IntConst(int val, Type t, Expr e) {
+ analyzableIntConst(e) and
+ val = e.getValue().toInt() and
+ t = e.getType().getUnspecifiedType()
+}
+
+private predicate analyzableFloatConst(Expr e) {
+ strictcount (e.getValue().toFloat()) = 1 and
+ strictcount (e.getType().getUnspecifiedType()) = 1 and
+ not analyzableIntConst(e)
+}
+
+private predicate mk_FloatConst(float val, Type t, Expr e) {
+ analyzableFloatConst(e) and
+ val = e.getValue().toFloat() and
+ t = e.getType().getUnspecifiedType()
+}
+
+
+private predicate analyzableLocalScopeVariable(VariableAccess access) {
+ strictcount (SsaDefinition def | def.getAUse(_) = access | def) = 1 and
+ strictcount (SsaDefinition def, Variable v | def.getAUse(v) = access | v) = 1 and
+ count (SsaDefinition def, Variable v
+ | def.getAUse(v) = access
+ | def.getDefiningValue(v)) <= 1 and
+ not analyzableConst(access)
+}
+
+// Note: this predicate only has a result if the access has no
+// defining value. If there is a defining value, then there is no
+// need to generate a fresh `GVN` for the access because `globalValueNumber`
+// will follow the chain and use the GVN of the defining value.
+private predicate mk_UndefinedLocalScopeVariable(
+ LocalScopeVariable x, SsaDefinition def, VariableAccess access) {
+ analyzableLocalScopeVariable(access) and
+ access = def.getAUse(x) and
+ not exists (def.getDefiningValue(x))
+}
+
+private predicate analyzableDotFieldAccess(DotFieldAccess access) {
+ strictcount (access.getTarget()) = 1 and
+ strictcount (access.getQualifier().getFullyConverted()) = 1 and
+ not analyzableConst(access)
+}
+
+private predicate mk_DotFieldAccess(
+ GVN qualifier, Field target, DotFieldAccess access) {
+ analyzableDotFieldAccess(access) and
+ target = access.getTarget() and
+ qualifier = globalValueNumber(access.getQualifier().getFullyConverted())
+}
+
+private predicate analyzablePointerFieldAccess(PointerFieldAccess access) {
+ strictcount (mostRecentSideEffect(access)) = 1 and
+ strictcount (access.getTarget()) = 1 and
+ strictcount (access.getQualifier().getFullyConverted()) = 1 and
+ not analyzableConst(access)
+}
+
+private predicate mk_PointerFieldAccess(
+ GVN qualifier, Field target, ControlFlowNode dominator,
+ PointerFieldAccess access) {
+ analyzablePointerFieldAccess(access) and
+ dominator = mostRecentSideEffect(access) and
+ target = access.getTarget() and
+ qualifier = globalValueNumber(access.getQualifier().getFullyConverted())
+}
+
+/*
+ * `obj->field` is equivalent to `(*obj).field`, so we need to wrap an
+ * extra `GVN_Deref` around the qualifier.
+ */
+private predicate mk_PointerFieldAccess_with_deref(
+ GVN new_qualifier, Field target, PointerFieldAccess access) {
+ exists (GVN qualifier, ControlFlowNode dominator
+ | mk_PointerFieldAccess(qualifier, target, dominator, access) and
+ new_qualifier = GVN_Deref(qualifier, dominator))
+}
+
+private predicate analyzableImplicitThisFieldAccess(
+ ImplicitThisFieldAccess access) {
+ strictcount (mostRecentSideEffect(access)) = 1 and
+ strictcount (access.getTarget()) = 1 and
+ strictcount (access.getEnclosingFunction()) = 1 and
+ not analyzableConst(access)
+}
+
+private predicate mk_ImplicitThisFieldAccess(
+ Function fcn, Field target, ControlFlowNode dominator,
+ ImplicitThisFieldAccess access) {
+ analyzableImplicitThisFieldAccess(access) and
+ dominator = mostRecentSideEffect(access) and
+ target = access.getTarget() and
+ fcn = access.getEnclosingFunction()
+}
+
+private predicate mk_ImplicitThisFieldAccess_with_qualifier(
+ GVN qualifier, Field target, ControlFlowNode dominator,
+ ImplicitThisFieldAccess access) {
+ exists (Function fcn
+ | mk_ImplicitThisFieldAccess(fcn, target, dominator, access) and
+ qualifier = GVN_ThisExpr(fcn))
+}
+
+private predicate mk_ImplicitThisFieldAccess_with_deref(
+ GVN new_qualifier, Field target, ImplicitThisFieldAccess access) {
+ exists (GVN qualifier, ControlFlowNode dominator
+ | mk_ImplicitThisFieldAccess_with_qualifier(
+ qualifier, target, dominator, access) and
+ new_qualifier = GVN_Deref(qualifier, dominator))
+}
+
+/**
+ * Holds if `access` is an access of a variable that does
+ * not have SSA information. (For example, because the variable
+ * is global.)
+ */
+private predicate analyzableOtherVariable(VariableAccess access) {
+ not (access instanceof FieldAccess) and
+ not exists (SsaDefinition def | access = def.getAUse(_)) and
+ strictcount (access.getTarget()) = 1 and
+ strictcount (mostRecentSideEffect(access)) = 1 and
+ not analyzableConst(access)
+}
+
+private predicate mk_OtherVariable(
+ Variable x, ControlFlowNode dominator, VariableAccess access) {
+ analyzableOtherVariable(access) and
+ x = access.getTarget() and
+ dominator = mostRecentSideEffect(access)
+}
+
+private predicate analyzableConversion(Conversion conv) {
+ strictcount (conv.getType().getUnspecifiedType()) = 1 and
+ strictcount (conv.getExpr()) = 1 and
+ not analyzableConst(conv)
+}
+
+private predicate mk_Conversion(Type t, GVN child, Conversion conv) {
+ analyzableConversion(conv) and
+ t = conv.getType().getUnspecifiedType() and
+ child = globalValueNumber(conv.getExpr())
+}
+
+private predicate analyzableBinaryOp(BinaryOperation op) {
+ op.isPure() and
+ strictcount (op.getLeftOperand().getFullyConverted()) = 1 and
+ strictcount (op.getRightOperand().getFullyConverted()) = 1 and
+ strictcount (op.getOperator()) = 1 and
+ not analyzableConst(op)
+}
+
+private predicate mk_BinaryOp(
+ GVN lhs, GVN rhs, string opname, BinaryOperation op) {
+ analyzableBinaryOp(op) and
+ lhs = globalValueNumber(op.getLeftOperand().getFullyConverted()) and
+ rhs = globalValueNumber(op.getRightOperand().getFullyConverted()) and
+ opname = op.getOperator()
+}
+
+private predicate analyzableUnaryOp(UnaryOperation op) {
+ not (op instanceof PointerDereferenceExpr) and
+ op.isPure() and
+ strictcount (op.getOperand().getFullyConverted()) = 1 and
+ strictcount (op.getOperator()) = 1 and
+ not analyzableConst(op)
+}
+
+private predicate mk_UnaryOp(GVN child, string opname, UnaryOperation op) {
+ analyzableUnaryOp(op) and
+ child = globalValueNumber(op.getOperand().getFullyConverted()) and
+ opname = op.getOperator()
+}
+
+private predicate analyzableThisExpr(ThisExpr thisExpr) {
+ strictcount(thisExpr.getEnclosingFunction()) = 1 and
+ not analyzableConst(thisExpr)
+}
+
+private predicate mk_ThisExpr(Function fcn, ThisExpr thisExpr) {
+ analyzableThisExpr(thisExpr) and
+ fcn = thisExpr.getEnclosingFunction()
+}
+
+private predicate analyzableArrayAccess(ArrayExpr ae) {
+ strictcount (ae.getArrayBase().getFullyConverted()) = 1 and
+ strictcount (ae.getArrayOffset().getFullyConverted()) = 1 and
+ strictcount (mostRecentSideEffect(ae)) = 1 and
+ not analyzableConst(ae)
+}
+
+private predicate mk_ArrayAccess(
+ GVN base, GVN offset, ControlFlowNode dominator, ArrayExpr ae) {
+ analyzableArrayAccess(ae) and
+ base = globalValueNumber(ae.getArrayBase().getFullyConverted()) and
+ offset = globalValueNumber(ae.getArrayOffset().getFullyConverted()) and
+ dominator = mostRecentSideEffect(ae)
+}
+
+private predicate analyzablePointerDereferenceExpr(
+ PointerDereferenceExpr deref) {
+ strictcount (deref.getOperand().getFullyConverted()) = 1 and
+ strictcount (mostRecentSideEffect(deref)) = 1 and
+ not analyzableConst(deref)
+}
+
+private predicate mk_Deref(
+ GVN p, ControlFlowNode dominator, PointerDereferenceExpr deref) {
+ analyzablePointerDereferenceExpr(deref) and
+ p = globalValueNumber(deref.getOperand().getFullyConverted()) and
+ dominator = mostRecentSideEffect(deref)
+}
+
+/** Gets the global value number of expression `e`. */
+cached GVN globalValueNumber(Expr e) {
+ exists (int val, Type t
+ | mk_IntConst(val, t, e) and
+ result = GVN_IntConst(val, t))
+ or
+ exists (float val, Type t
+ | mk_FloatConst(val, t, e) and
+ result = GVN_FloatConst(val, t))
+ or
+ // Local variable with a defining value.
+ exists (LocalScopeVariable x, SsaDefinition def
+ | analyzableLocalScopeVariable(e) and
+ e = def.getAUse(x) and
+ result = globalValueNumber(def.getDefiningValue(x).getFullyConverted()))
+ or
+ // Local variable without a defining value.
+ exists (LocalScopeVariable x, SsaDefinition def
+ | mk_UndefinedLocalScopeVariable(x, def, e) and
+ result = GVN_UndefinedLocalScopeVariable(x, def))
+ or
+ // Variable with no SSA information.
+ exists (Variable x, ControlFlowNode dominator
+ | mk_OtherVariable(x, dominator, e) and
+ result = GVN_OtherVariable(x, dominator))
+ or
+ exists (GVN qualifier, Field target
+ | mk_DotFieldAccess(qualifier, target, e) and
+ result = GVN_FieldAccess(qualifier, target))
+ or
+ exists (GVN qualifier, Field target
+ | mk_PointerFieldAccess_with_deref(qualifier, target, e) and
+ result = GVN_FieldAccess(qualifier, target))
+ or
+ exists (GVN qualifier, Field target
+ | mk_ImplicitThisFieldAccess_with_deref(qualifier, target, e) and
+ result = GVN_FieldAccess(qualifier, target))
+ or
+ exists (Function fcn
+ | mk_ThisExpr(fcn, e) and
+ result = GVN_ThisExpr(fcn))
+ or
+ exists (Type t, GVN child
+ | mk_Conversion(t, child, e) and
+ result = GVN_Conversion(t, child))
+ or
+ exists (GVN lhs, GVN rhs, string opname
+ | mk_BinaryOp(lhs, rhs, opname, e) and
+ result = GVN_BinaryOp(lhs, rhs, opname))
+ or
+ exists (GVN child, string opname
+ | mk_UnaryOp(child, opname, e) and
+ result = GVN_UnaryOp(child, opname))
+ or
+ exists (GVN x, GVN i, ControlFlowNode dominator
+ | mk_ArrayAccess(x, i, dominator, e) and
+ result = GVN_ArrayAccess(x, i, dominator))
+ or
+ exists (GVN p, ControlFlowNode dominator
+ | mk_Deref(p, dominator, e) and
+ result = GVN_Deref(p, dominator))
+ or
+ (not analyzableExpr(e) and result = GVN_Unanalyzable(e))
+}
+
+private predicate analyzableConst(Expr e) {
+ analyzableIntConst(e) or
+ analyzableFloatConst(e)
+}
+
+/**
+ * Holds if the expression is explicitly handled by `globalValueNumber`.
+ * Unanalyzable expressions still need to be given a global value number,
+ * but it will be a unique number that is not shared with any other
+ * expression.
+ */
+private predicate analyzableExpr(Expr e) {
+ analyzableConst(e) or
+ analyzableLocalScopeVariable(e) or
+ analyzableDotFieldAccess(e) or
+ analyzablePointerFieldAccess(e) or
+ analyzableImplicitThisFieldAccess(e) or
+ analyzableOtherVariable(e) or
+ analyzableConversion(e) or
+ analyzableBinaryOp(e) or
+ analyzableUnaryOp(e) or
+ analyzableThisExpr(e) or
+ analyzableArrayAccess(e) or
+ analyzablePointerDereferenceExpr(e)
+}
diff --git a/cpp/ql/src/semmle/files/FileSystem.qll b/cpp/ql/src/semmle/files/FileSystem.qll
new file mode 100644
index 000000000000..4dfb0ae670a6
--- /dev/null
+++ b/cpp/ql/src/semmle/files/FileSystem.qll
@@ -0,0 +1,3 @@
+/** Provides classes for working with files and folders. */
+
+import semmle.code.cpp.File
diff --git a/cpp/ql/src/semmle/uml/MagicDraw.qll b/cpp/ql/src/semmle/uml/MagicDraw.qll
new file mode 100644
index 000000000000..9dcd497d9f38
--- /dev/null
+++ b/cpp/ql/src/semmle/uml/MagicDraw.qll
@@ -0,0 +1,344 @@
+/**
+ * Provides classes for working with UML diagrams generated by MagicDraw.
+ *
+ * Diagrams need to be saved in the `.mdxml` or `.xml` format.
+ *
+ * See [the MagicDraw website](http://www.nomagic.com/products/magicdraw.html)
+ * for more information.
+ */
+
+import cpp
+
+/**
+ * An element of the UML diagram.
+ *
+ * Includes any XML element that is in a document whose root has namespace
+ * `http://schema.omg.org/spec/XMI/2.1`.
+ */
+class UMLElement extends XMLElement {
+ UMLElement() {
+ this.getFile().getARootElement().getNamespace().getURI() = "http://schema.omg.org/spec/XMI/2.1"
+ }
+
+ /**
+ * Gets a UML element that refers to this element, that is, which has an
+ * `idref` attribute whose value is the same as the value of this
+ * element's `id` attribute.
+ */
+ UMLElement getUMLReference() {
+ result.getAttributeValue("idref") = this.getAttributeValue("id")
+ }
+
+ /**
+ * Gets the name of a stereotype that applies to this element.
+ */
+ string getAStereotype() {
+ exists(UMLElement stereotype |
+ stereotype.getName() = "Stereotype" and
+ stereotype.getAttribute("name").getValue() = result and
+ stereotype.getAChild().getAChild() = this.getUMLReference()
+ )
+ }
+
+ /**
+ * Gets the name of a constraint that applies to this element.
+ */
+ string getAConstraint() {
+ exists(UMLElement constraint, UMLElement constrained |
+ constraint.getName() = "Constraint" and
+ constrained.getName() = "Constraint.constrainedElement" and
+ constraint.getAChild() = constrained and
+ constrained.getAChild() = this.getUMLReference() and
+ constraint.getAttribute("name").getValue() = result)
+ }
+
+ /**
+ * Gets the name of this element, that is, the value of its `name` attribute.
+ */
+ string getUMLName() {
+ result = this.getAttribute("name").getValue()
+ }
+}
+
+/**
+ * A UML element representing a type.
+ *
+ * In other words, a `packagedElement` whose `type` attribute has value
+ * `uml:Class`, `uml:Interface` or `uml:PrimitiveType`.
+ */
+class UMLType extends UMLElement {
+ UMLType() {
+ exists(string type |
+ this.getName() = "packagedElement" and
+ this.getAttribute("type").getValue() = type and
+ (type = "uml:Class" or
+ type = "uml:Interface" or
+ type = "uml:PrimitiveType"))
+ }
+
+ /**
+ * Gets the package that contains this type.
+ */
+ UMLPackage getUMLPackage() {
+ result.getAClass() = this
+ }
+
+ /**
+ * Gets a property directly contained in this type.
+ */
+ UMLProperty getUMLProperty() {
+ this.getAChild() = result
+ }
+
+ /**
+ * Gets an operation directly contained in this type.
+ */
+ UMLOperation getUMLOperation() {
+ this.getAChild() = result
+ }
+
+ /**
+ * Holds if this is an enum type, that is, if `enum` is one of its
+ * stereotypes.
+ */
+ predicate isEnum() {
+ this.getAStereotype() = "enum"
+ }
+
+ /**
+ * Gets the C class, struct or union type corresponding to this UML type.
+ */
+ Class getCType() {
+ result.getQualifiedName() = this.getUMLQualifiedName()
+ }
+
+ /**
+ * Gets the qualified name of this type. If this type is in a package
+ * then this is `package.name`; otherwise it is just `name`.
+ */
+ string getUMLQualifiedName() {
+ if exists(this.getUMLPackage()) then
+ result = this.getUMLPackage().getUMLQualifiedName() + "." + this.getUMLName()
+ else
+ result = this.getUMLName()
+ }
+
+ string toString() {
+ result = this.getUMLName()
+ }
+}
+
+/**
+ * A UML type representing a class, that is, whose `type` attribute has
+ * value `uml:Class`.
+ */
+class UMLClass extends UMLType {
+ UMLClass() { this.getAttribute("type").getValue() = "uml:Class" }
+}
+
+/**
+ * A UML type representing an interface, that is, whose `type` attribute
+ * has value `uml:Interface`.
+ */
+class UMLInterface extends UMLElement {
+ UMLInterface() { this.getAttribute("type").getValue() = "uml:Interface" }
+}
+
+/**
+ * A UML element representing a property of a UML type.
+ *
+ * In other words, an `ownedAttribute` directly contained in a `UMLType`
+ * whose `type` attribute has value `uml:Property`.
+ */
+class UMLProperty extends UMLElement {
+ UMLProperty() {
+ this.getName() = "ownedAttribute" and
+ this.getAttribute("type").getValue() = "uml:Property" and
+ this.getParent() instanceof UMLType
+ }
+
+ /**
+ * Gets the type that contains this property.
+ */
+ UMLType getUMLType() {
+ result.getUMLProperty() = this
+ }
+
+ /**
+ * Holds if this property represents an enum constant, that is, if it
+ * has a stereotype with name `enum+constant`.
+ */
+ predicate isEnumConstant() {
+ this.getAStereotype() = "enum+constant"
+ }
+
+ /**
+ * Gets the C field corresponding to this property, if any.
+ */
+ Field getCField() {
+ result.hasName(this.getUMLName()) and
+ result.getDeclaringType() = this.getUMLType().getCType()
+ }
+
+ string toString() {
+ if this.isEnumConstant() then
+ result = "- <> " + this.getUMLName()
+ else
+ result = "- " + this.getUMLName()
+ }
+}
+
+/**
+ * A UML element representing an operation of a UML type.
+ *
+ * In other words, an `ownedAttribute` directly contained in a `UMLType`
+ * whose `type` attribute has value `uml:Operation`.
+ */
+class UMLOperation extends UMLElement {
+ UMLOperation() {
+ this.getName() = "ownedOperation" and
+ this.getAttribute("type").getValue() = "uml:Operation" and
+ this.getParent() instanceof UMLType
+ }
+
+ /**
+ * Gets the type that contains this operation.
+ */
+ UMLType getUMLType() {
+ result.getUMLOperation() = this
+ }
+
+ /**
+ * Gets the C function corresponding to this operation, if any.
+ */
+ Function getCFunction() {
+ result.hasName(this.getUMLName()) and
+ result.getDeclaringType() = this.getUMLType().getCType()
+ }
+
+ string toString() {
+ result = "+ " + this.getUMLName()
+ }
+}
+
+/**
+ * A UML property that has an association.
+ */
+class UMLAssociation extends UMLProperty {
+ UMLAssociation() {
+ this.hasAttribute("association")
+ }
+
+ /**
+ * Gets the property that this property is associated with.
+ */
+ UMLAssociation getConverse() {
+ this.getAttribute("association").getValue() = result.getAttribute("association").getValue() and
+ this != result
+ }
+
+ /**
+ * Gets the name of this property.
+ */
+ string getLabel() {
+ result = this.getAttribute("name").getValue()
+ }
+
+ /**
+ * Gets the C field corresponding to this property, if any.
+ */
+ Field getCField() {
+ result.hasName(this.getLabel()) and
+ result.getDeclaringType() = this.getSource().getCType()
+ }
+
+ /**
+ * Gets the class that this association is contained in.
+ */
+ UMLClass getSource() {
+ result = this.getParent()
+ }
+
+ /**
+ * Gets the class that this association is associated with.
+ */
+ UMLClass getDest() {
+ result = this.getConverse().getParent()
+ }
+}
+
+/**
+ * A UML element representing inheritance.
+ *
+ * In other words, an `interfaceRealization` whose `type` attribute has
+ * value `uml:InterfaceRealization`.
+ */
+class UMLInheritance extends UMLElement {
+ UMLInheritance() {
+ this.getName() = "interfaceRealization" and
+ this.getAttributeValue("type") = "uml:InterfaceRealization"
+ }
+
+ /**
+ * Gets the type that is being inherited from.
+ */
+ UMLType getUMLSupplier() {
+ exists(UMLElement e |
+ e.getName() = "supplier" and
+ result.getUMLReference() = e and
+ e = this.getAChild())
+ }
+
+ /**
+ * Gets the type that is inheriting.
+ */
+ UMLType getUMLClient() {
+ exists(UMLElement e |
+ e.getName() = "client" and
+ result.getUMLReference() = e and
+ e = this.getAChild())
+ }
+
+ string toString() {
+ result = this.getUMLClient().getUMLName() + " implements " + this.getUMLSupplier().getUMLName()
+ }
+}
+
+/**
+ * A UML element representing a package.
+ */
+class UMLPackage extends UMLElement {
+ UMLPackage() {
+ this.getName() = "Package"
+ }
+
+ /**
+ * Gets a class in this package.
+ */
+ UMLClass getAClass() {
+ result.getAChild().getAChild() = this.getUMLReference()
+ }
+
+ /**
+ * Gets the parent package of this package, if any.
+ */
+ UMLPackage parentPackage() {
+ result.getAChild().getAChild() = this
+ }
+
+ /**
+ * Gets the qualified name of this package. If this package is in a
+ * parent package then this is `parent.package`; otherwise it is just
+ * `package`.
+ */
+ string getUMLQualifiedName() {
+ if exists(this.parentPackage()) then
+ result = this.parentPackage().getUMLQualifiedName() + "." + this.getUMLName()
+ else
+ result = this.getUMLName()
+ }
+
+ string toString() {
+ result = this.getUMLQualifiedName()
+ }
+}
diff --git a/cpp/ql/src/semmlecode.cpp.dbscheme b/cpp/ql/src/semmlecode.cpp.dbscheme
new file mode 100644
index 000000000000..afff19e455d6
--- /dev/null
+++ b/cpp/ql/src/semmlecode.cpp.dbscheme
@@ -0,0 +1,1755 @@
+
+/**
+ * An invocation of the compiler. Note that more than one file may be
+ * compiled per invocation. For example, this command compiles three
+ * source files:
+ *
+ * gcc -c f1.c f2.c f3.c
+ *
+ * The `id` simply identifies the invocation, while `cwd` is the working
+ * directory from which the compiler was invoked.
+ */
+compilations(
+ /**
+ * An invocation of the compiler. Note that more than one file may
+ * be compiled per invocation. For example, this command compiles
+ * three source files:
+ *
+ * gcc -c f1.c f2.c f3.c
+ */
+ unique int id : @compilation,
+ string cwd : string ref
+);
+
+/**
+ * The arguments that were passed to the extractor for a compiler
+ * invocation. If `id` is for the compiler invocation
+ *
+ * gcc -c f1.c f2.c f3.c
+ *
+ * then typically there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | *path to extractor*
+ * 1 | `--mimic`
+ * 2 | `/usr/bin/gcc`
+ * 3 | `-c`
+ * 4 | f1.c
+ * 5 | f2.c
+ * 6 | f3.c
+ */
+compilation_args(
+ int id : @compilation ref,
+ int num : int ref,
+ string arg : string ref
+);
+
+/**
+ * The source files that are compiled by a compiler invocation.
+ * If `id` is for the compiler invocation
+ *
+ * gcc -c f1.c f2.c f3.c
+ *
+ * then there will be rows for
+ *
+ * num | arg
+ * --- | ---
+ * 0 | f1.c
+ * 1 | f2.c
+ * 2 | f3.c
+ *
+ * Note that even if those files `#include` headers, those headers
+ * do not appear as rows.
+ */
+compilation_compiling_files(
+ int id : @compilation ref,
+ int num : int ref,
+ int file : @file ref
+);
+
+/**
+ * The time taken by the extractor for a compiler invocation.
+ *
+ * For each file `num`, there will be rows for
+ *
+ * kind | seconds
+ * ---- | ---
+ * 1 | CPU seconds used by the extractor frontend
+ * 2 | Elapsed seconds during the extractor frontend
+ * 3 | CPU seconds used by the extractor backend
+ * 4 | Elapsed seconds during the extractor backend
+ */
+compilation_time(
+ int id : @compilation ref,
+ int num : int ref,
+ /* kind:
+ 1 = frontend_cpu_seconds
+ 2 = frontend_elapsed_seconds
+ 3 = extractor_cpu_seconds
+ 4 = extractor_elapsed_seconds
+ */
+ int kind : int ref,
+ float seconds : float ref
+);
+
+/**
+ * An error or warning generated by the extractor.
+ * The diagnosstic message `diagnostic` was generated during compiler
+ * invocation `compilation`, and is the `file_number_diagnostic_number`th
+ * message generated while extracting the `file_number`th file of that
+ * invocation.
+ */
+diagnostic_for(
+ int diagnostic : @diagnostic ref,
+ int compilation : @compilation ref,
+ int file_number : int ref,
+ int file_number_diagnostic_number : int ref
+);
+
+/**
+ * If extraction was successful, then `cpu_seconds` and
+ * `elapsed_seconds` are the CPU time and elapsed time (respectively)
+ * that extractino took for compiler invocation `id`.
+ */
+compilation_finished(
+ unique int id : @compilation ref,
+ float cpu_seconds : float ref,
+ float elapsed_seconds : float ref
+);
+
+
+/**
+ * External data, loaded from CSV files during snapshot creation. See
+ * [Tutorial: Incorporating external data](https://help.semmle.com/wiki/display/SD/Tutorial%3A+Incorporating+external+data)
+ * for more information.
+ */
+externalData(
+ int id : @externalDataElement,
+ string path : string ref,
+ int column: int ref,
+ string value : string ref
+);
+
+/**
+ * The date of the snapshot.
+ */
+snapshotDate(unique date snapshotDate : date ref);
+
+/**
+ * The source location of the snapshot.
+ */
+sourceLocationPrefix(string prefix : string ref);
+
+/**
+ * Data used by the 'duplicate code' detection.
+ */
+duplicateCode(
+ unique int id : @duplication,
+ string relativePath : string ref,
+ int equivClass : int ref
+);
+
+/**
+ * Data used by the 'similar code' detection.
+ */
+similarCode(
+ unique int id : @similarity,
+ string relativePath : string ref,
+ int equivClass : int ref
+);
+
+/**
+ * Data used by the 'duplicate code' and 'similar code' detection.
+ */
+@duplication_or_similarity = @duplication | @similarity
+
+/**
+ * Data used by the 'duplicate code' and 'similar code' detection.
+ */
+tokens(
+ int id : @duplication_or_similarity ref,
+ int offset : int ref,
+ int beginLine : int ref,
+ int beginColumn : int ref,
+ int endLine : int ref,
+ int endColumn : int ref
+);
+
+/*
+ * Mapping of header files to packages
+ */
+
+external_packages(
+ unique int id: @external_package,
+ string namespace : string ref, // "dpkg", "yum", ...
+ string package_name : string ref,
+ string version : string ref
+);
+
+header_to_external_package(
+ int fileid : @file ref,
+ int package : @external_package ref
+);
+
+/*
+ * Version history
+ */
+
+svnentries(
+ int id : @svnentry,
+ string revision : string ref,
+ string author : string ref,
+ date revisionDate : date ref,
+ int changeSize : int ref
+)
+
+svnaffectedfiles(
+ int id : @svnentry ref,
+ int file : @file ref,
+ string action : string ref
+)
+
+svnentrymsg(
+ int id : @svnentry ref,
+ string message : string ref
+)
+
+svnchurn(
+ int commit : @svnentry ref,
+ int file : @file ref,
+ int addedLines : int ref,
+ int deletedLines : int ref
+)
+
+/*
+ * C++ dbscheme
+ */
+
+@location = @location_stmt | @location_expr | @location_default ;
+
+/**
+ * The location of an element that is not an expression or a statement.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [LGTM locations](https://lgtm.com/docs/ql/locations).
+ */
+locations_default(
+ /** The location of an element that is not an expression or a statement. */
+ unique int id: @location_default,
+ int container: @container ref,
+ int startLine: int ref,
+ int startColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref
+);
+
+/**
+ * The location of a statement.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [LGTM locations](https://lgtm.com/docs/ql/locations).
+ */
+locations_stmt(
+ /** The location of a statement. */
+ unique int id: @location_stmt,
+ int container: @container ref,
+ int startLine: int ref,
+ int startColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref
+);
+
+/**
+ * The location of an expression.
+ * The location spans column `startcolumn` of line `startline` to
+ * column `endcolumn` of line `endline` in file `file`.
+ * For more information, see
+ * [LGTM locations](https://lgtm.com/docs/ql/locations).
+ */
+locations_expr(
+ /** The location of an expression. */
+ unique int id: @location_expr,
+ int container: @container ref,
+ int startLine: int ref,
+ int startColumn: int ref,
+ int endLine: int ref,
+ int endColumn: int ref
+);
+
+/** An element for which line-count information is available. */
+@sourceline = @file | @function | @variable | @enumconstant | @xmllocatable;
+
+numlines(
+ int element_id: @sourceline ref,
+ int num_lines: int ref,
+ int num_code: int ref,
+ int num_comment: int ref
+);
+
+diagnostics(
+ unique int id: @diagnostic,
+ int severity: int ref,
+ string error_tag: string ref,
+ string error_message: string ref,
+ string full_error_message: string ref,
+ int location: @location_default ref
+);
+
+/*
+ fromSource(0) = unknown,
+ fromSource(1) = from source,
+ fromSource(2) = from library
+*/
+files(
+ unique int id: @file,
+ string name: string ref,
+ string simple: string ref,
+ string ext: string ref,
+ int fromSource: int ref
+);
+
+folders(
+ unique int id: @folder,
+ string name: string ref,
+ string simple: string ref
+);
+
+@container = @folder | @file
+
+containerparent(
+ int parent: @container ref,
+ unique int child: @container ref
+);
+
+fileannotations(
+ int id: @file ref,
+ int kind: int ref,
+ string name: string ref,
+ string value: string ref
+);
+
+inmacroexpansion(
+ int id: @element ref,
+ int inv: @macroinvocation ref
+);
+
+affectedbymacroexpansion(
+ int id: @element ref,
+ int inv: @macroinvocation ref
+);
+
+/*
+ case @macroinvocations.kind of
+ 1 = macro expansion
+ | 2 = other macro reference
+ ;
+*/
+macroinvocations(
+ unique int id: @macroinvocation,
+ int macro_id: @ppd_define ref,
+ int location: @location_default ref,
+ int kind: int ref
+);
+
+macroparent(
+ unique int id: @macroinvocation ref,
+ int parent_id: @macroinvocation ref
+);
+
+// a macroinvocation may be part of another location
+// the way to find a constant expression that uses a macro
+// is thus to find a constant expression that has a location
+// to which a macro invocation is bound
+macrolocationbind(
+ int id: @macroinvocation ref,
+ int location: @location ref
+);
+
+#keyset[invocation, argument_index]
+macro_argument_unexpanded(
+ int invocation: @macroinvocation ref,
+ int argument_index: int ref,
+ string text: string ref
+);
+
+#keyset[invocation, argument_index]
+macro_argument_expanded(
+ int invocation: @macroinvocation ref,
+ int argument_index: int ref,
+ string text: string ref
+);
+
+/*
+ case @function.kind of
+ 1 = normal
+ | 2 = constructor
+ | 3 = destructor
+ | 4 = conversion
+ | 5 = operator
+ | 6 = builtin // GCC built-in functions, e.g. __builtin___memcpy_chk
+ ;
+*/
+functions(
+ unique int id: @function,
+ string name: string ref,
+ int kind: int ref
+);
+
+function_entry_point(int id: @function ref, int entry_point: @stmt ref);
+
+function_return_type(int id: @function ref, int return_type: @type ref);
+
+purefunctions(unique int id: @function ref);
+
+function_deleted(unique int id: @function ref);
+
+function_defaulted(unique int id: @function ref);
+
+
+
+fun_decls(
+ unique int id: @fun_decl,
+ int function: @function ref,
+ int type_id: @type ref,
+ string name: string ref,
+ int location: @location_default ref
+);
+fun_def(unique int id: @fun_decl ref);
+fun_specialized(unique int id: @fun_decl ref);
+fun_implicit(unique int id: @fun_decl ref);
+fun_decl_specifiers(
+ int id: @fun_decl ref,
+ string name: string ref
+)
+fun_decl_throws(
+ int fun_decl: @fun_decl ref,
+ int index: int ref,
+ int type_id: @type ref
+);
+/* an empty throw specification is different from none */
+fun_decl_empty_throws(unique int fun_decl: @fun_decl ref);
+fun_decl_noexcept(
+ int fun_decl: @fun_decl ref,
+ int constant: @expr ref
+);
+fun_decl_empty_noexcept(int fun_decl: @fun_decl ref);
+fun_decl_typedef_type(
+ unique int fun_decl: @fun_decl ref,
+ int typedeftype_id: @usertype ref
+);
+
+param_decl_bind(
+ unique int id: @var_decl ref,
+ int index: int ref,
+ int fun_decl: @fun_decl ref
+);
+
+var_decls(
+ unique int id: @var_decl,
+ int variable: @variable ref,
+ int type_id: @type ref,
+ string name: string ref,
+ int location: @location_default ref
+);
+var_def(unique int id: @var_decl ref);
+var_decl_specifiers(
+ int id: @var_decl ref,
+ string name: string ref
+)
+
+type_decls(
+ unique int id: @type_decl,
+ int type_id: @type ref,
+ int location: @location_default ref
+);
+type_def(unique int id: @type_decl ref);
+type_decl_top(
+ unique int type_decl: @type_decl ref
+);
+
+namespace_decls(
+ unique int id: @namespace_decl,
+ int namespace_id: @namespace ref,
+ int location: @location_default ref,
+ int bodylocation: @location_default ref
+);
+
+usings(
+ unique int id: @using,
+ int element_id: @element ref,
+ int location: @location_default ref
+);
+
+/** The element which contains the `using` declaration. */
+using_container(
+ int parent: @element ref,
+ int child: @using ref
+);
+
+static_asserts(
+ unique int id: @static_assert,
+ int condition : @expr ref,
+ string message : string ref,
+ int location: @location_default ref
+);
+
+// each function has an ordered list of parameters
+params(
+ int id: @parameter,
+ int function: @functionorblock ref,
+ int index: int ref,
+ int type_id: @type ref
+);
+
+overrides(int new: @function ref, int old: @function ref);
+
+membervariables(
+ unique int id: @membervariable,
+ int type_id: @type ref,
+ string name: string ref
+);
+
+globalvariables(
+ unique int id: @globalvariable,
+ int type_id: @type ref,
+ string name: string ref
+);
+
+localvariables(
+ int id: @localvariable,
+ int type_id: @type ref,
+ string name: string ref
+);
+
+autoderivation(
+ unique int var: @variable ref,
+ int derivation_type: @type ref
+);
+
+enumconstants(
+ unique int id: @enumconstant,
+ int parent: @usertype ref,
+ int index: int ref,
+ int type_id: @type ref,
+ string name: string ref,
+ int location: @location_default ref
+);
+
+@variable = @localscopevariable | @globalvariable | @membervariable;
+
+@localscopevariable = @localvariable | @parameter;
+
+/*
+ Built-in types are the fundamental types, i.e., integral, floating, and void.
+ kind(1) = error, kind(2) = unknown, kind(3) = void, kind(4) = boolean,
+ kind(5) = char, kind(6) = unsigned char, kind(7) = signed char
+ kind(8) = short, kind(9) = unsigned short, kind(10) = signed short
+ kind(11) = int, kind(12) = unsigned int, kind(13) = signed int,
+ kind(14) = long, kind(15) = unsigned long, kind(16) = signed long,
+ kind(17) = long long, kind(18) = unsigned long long, kind(19) = signed long long,
+ kind(20) = __int8, kind(21) = __int16, kind(22) = __int32, kind(23) = __int64, // Microsoft specific
+ kind(24) = float, kind(25) = double, kind(26) = long double,
+ kind(27) = _Complex float, kind(28) = _Complex double, kind(29) = _Complex long double, //C99 specific
+ kind(30) = _Imaginary float, kind(31) = _Imaginary double, kind(32) = _Imaginary long double, //C99 specific
+ kind(33) = wchar_t, // MS specific
+ kind(34) = decltype(nullptr), // C++11
+*/
+builtintypes(
+ unique int id: @builtintype,
+ string name: string ref,
+ int kind: int ref,
+ int size: int ref,
+ int sign: int ref,
+ int alignment: int ref
+);
+
+/*
+ Derived types are types that are directly derived from existing types and
+ point to, refer to, transform type data to return a new type.
+
+ case @derivedtype.kind of
+ 1 = pointer
+ | 2 = reference
+ | 3 = type_with_specifiers
+ | 4 = array
+ | 5 = gnu_vector
+ | 6 = routineptr
+ | 7 = routinereference
+ | 8 = rvalue_reference // C++11
+// ... 9 type_conforming_to_protocols deprecated
+ | 10 = block
+ ;
+*/
+derivedtypes(
+ unique int id: @derivedtype,
+ string name: string ref,
+ int kind: int ref,
+ int type_id: @type ref
+);
+
+pointerishsize(unique int id: @derivedtype ref,
+ int size: int ref,
+ int alignment: int ref);
+
+arraysizes(
+ unique int id: @derivedtype ref,
+ int num_elements: int ref,
+ int bytesize: int ref,
+ int alignment: int ref
+);
+
+typedefbase(
+ unique int id: @usertype ref,
+ int type_id: @type ref
+);
+
+decltypes(
+ unique int id: @decltype,
+ int expr: @expr ref,
+ int base_type: @type ref,
+ boolean parentheses_would_change_meaning: boolean ref
+);
+
+/*
+ case @usertype.kind of
+ 1 = struct
+ | 2 = class
+ | 3 = union
+ | 4 = enum
+ | 5 = typedef
+ | 6 = template
+ | 7 = template_parameter
+ | 8 = template_template_parameter
+ | 9 = proxy_class // a proxy class associated with a template parameter
+// ... 10 objc_class deprecated
+// ... 11 objc_protocol deprecated
+// ... 12 objc_category deprecated
+ | 13 = scoped_enum
+ ;
+*/
+usertypes(
+ unique int id: @usertype,
+ string name: string ref,
+ int kind: int ref
+);
+
+usertypesize(
+ unique int id: @usertype ref,
+ int size: int ref,
+ int alignment: int ref
+);
+
+usertype_final(unique int id: @usertype ref);
+
+usertype_uuid(
+ unique int id: @usertype ref,
+ unique string uuid: string ref
+);
+
+is_pod_class(unique int id: @usertype ref);
+
+is_complete(unique int id: @usertype ref);
+
+is_class_template(unique int id: @usertype ref);
+class_instantiation(
+ int to: @usertype ref,
+ int from: @usertype ref
+);
+class_template_argument(
+ int type_id: @usertype ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+
+is_proxy_class_for(
+ unique int id: @usertype ref,
+ unique int templ_param_id: @usertype ref
+);
+
+type_mentions(
+ unique int id: @type_mention,
+ int type_id: @type ref,
+ int location: @location ref,
+ // a_symbol_reference_kind from the EDG frontend. See symbol_ref.h there.
+ int kind: int ref
+);
+
+is_function_template(unique int id: @function ref);
+function_instantiation(
+ unique int to: @function ref,
+ int from: @function ref
+);
+function_template_argument(
+ int function_id: @function ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+
+is_variable_template(unique int id: @variable ref);
+variable_instantiation(
+ unique int to: @variable ref,
+ int from: @variable ref
+);
+variable_template_argument(
+ int variable_id: @variable ref,
+ int index: int ref,
+ int arg_type: @type ref
+);
+
+/*
+ Fixed point types
+ precision(1) = short, precision(2) = default, precision(3) = long
+ is_unsigned(1) = unsigned is_unsigned(2) = signed
+ is_fract_type(1) = declared with _Fract
+ saturating(1) = declared with _Sat
+*/
+/* TODO
+fixedpointtypes(
+ unique int id: @fixedpointtype,
+ int precision: int ref,
+ int is_unsigned: int ref,
+ int is_fract_type: int ref,
+ int saturating: int ref);
+*/
+
+routinetypes(
+ unique int id: @routinetype,
+ int return_type: @type ref
+);
+
+routinetypeargs(
+ int routine: @routinetype ref,
+ int index: int ref,
+ int type_id: @type ref
+);
+
+ptrtomembers(
+ unique int id: @ptrtomember,
+ int type_id: @type ref,
+ int class_id: @type ref
+);
+
+/*
+ specifiers for types, functions, and variables
+
+ "public",
+ "protected",
+ "private",
+
+ "const",
+ "volatile",
+ "static",
+
+ "pure",
+ "virtual",
+ "sealed", // Microsoft
+ "__interface", // Microsoft
+ "inline",
+ "explicit",
+
+ "near", // near far extension
+ "far", // near far extension
+ "__ptr32", // Microsoft
+ "__ptr64", // Microsoft
+ "__sptr", // Microsoft
+ "__uptr", // Microsoft
+ "dllimport", // Microsoft
+ "dllexport", // Microsoft
+ "thread", // Microsoft
+ "naked", // Microsoft
+ "microsoft_inline", // Microsoft
+ "forceinline", // Microsoft
+ "selectany", // Microsoft
+ "nothrow", // Microsoft
+ "novtable", // Microsoft
+ "noreturn", // Microsoft
+ "noinline", // Microsoft
+ "noalias", // Microsoft
+ "restrict", // Microsoft
+*/
+
+specifiers(
+ unique int id: @specifier,
+ unique string str: string ref
+);
+
+typespecifiers(
+ int type_id: @type ref,
+ int spec_id: @specifier ref
+);
+
+funspecifiers(
+ int func_id: @function ref,
+ int spec_id: @specifier ref
+);
+
+varspecifiers(
+ int var_id: @accessible ref,
+ int spec_id: @specifier ref
+);
+
+@specifiable = @type
+ | @function
+ | @variable
+ | @enumconstant
+ | @frienddecl;
+
+attributes(
+ unique int id: @attribute,
+ int kind: int ref,
+ string name: string ref,
+ string name_space: string ref,
+ int location: @location_default ref
+);
+
+case @attribute.kind of
+ 0 = @gnuattribute
+| 1 = @stdattribute
+| 2 = @declspec
+| 3 = @msattribute
+| 4 = @alignas
+// ... 5 @objc_propertyattribute deprecated
+;
+
+attribute_args(
+ unique int id: @attribute_arg,
+ int kind: int ref,
+ int attribute: @attribute ref,
+ int index: int ref,
+ int location: @location_default ref
+);
+
+case @attribute_arg.kind of
+ 0 = @attribute_arg_empty
+| 1 = @attribute_arg_token
+| 2 = @attribute_arg_constant
+| 3 = @attribute_arg_type
+;
+
+attribute_arg_value(
+ unique int arg: @attribute_arg ref,
+ string value: string ref
+);
+attribute_arg_type(
+ unique int arg: @attribute_arg ref,
+ int type_id: @type ref
+);
+attribute_arg_name(
+ unique int arg: @attribute_arg ref,
+ string name: string ref
+);
+
+typeattributes(
+ int type_id: @type ref,
+ int spec_id: @attribute ref
+);
+
+funcattributes(
+ int func_id: @function ref,
+ int spec_id: @attribute ref
+);
+
+varattributes(
+ int var_id: @accessible ref,
+ int spec_id: @attribute ref
+);
+
+stmtattributes(
+ int stmt_id: @stmt ref,
+ int spec_id: @attribute ref
+);
+
+@type = @builtintype
+ | @derivedtype
+ | @usertype
+ /* TODO | @fixedpointtype */
+ | @routinetype
+ | @ptrtomember
+ | @decltype;
+
+unspecifiedtype(
+ unique int type_id: @type ref,
+ int unspecified_type_id: @type ref
+);
+
+member(
+ int parent: @type ref,
+ int index: int ref,
+ int child: @member ref
+);
+
+@enclosingfunction_child = @usertype | @variable | @namespace
+
+enclosingfunction(
+ unique int child: @enclosingfunction_child ref,
+ int parent: @function ref
+);
+
+derivations(
+ unique int derivation: @derivation,
+ int sub: @type ref,
+ int index: int ref,
+ int super: @type ref,
+ int location: @location_default ref
+);
+
+derspecifiers(
+ int der_id: @derivation ref,
+ int spec_id: @specifier ref
+);
+
+/**
+ * Contains the byte offset of the base class subobject within the derived
+ * class. Only holds for non-virtual base classes, but see table
+ * `virtual_base_offsets` for offsets of virtual base class subobjects.
+ */
+direct_base_offsets(
+ unique int der_id: @derivation ref,
+ int offset: int ref
+);
+
+/**
+ * Contains the byte offset of the virtual base class subobject for class
+ * `super` within a most-derived object of class `sub`. `super` can be either a
+ * direct or indirect base class.
+ */
+#keyset[sub, super]
+virtual_base_offsets(
+ int sub: @usertype ref,
+ int super: @usertype ref,
+ int offset: int ref
+);
+
+frienddecls(
+ unique int id: @frienddecl,
+ int type_id: @type ref,
+ int decl_id: @declaration ref,
+ int location: @location_default ref
+);
+
+@declaredtype = @usertype ;
+
+@declaration = @function
+ | @declaredtype
+ | @variable
+ | @enumconstant
+ | @frienddecl;
+
+@member = @membervariable
+ | @function
+ | @declaredtype
+ | @enumconstant;
+
+@locatable = @diagnostic
+ | @declaration
+ | @ppd_include
+ | @ppd_define
+ | @macroinvocation
+ /*| @funcall*/
+ | @xmllocatable
+ | @attribute
+ | @attribute_arg;
+
+@scope = @stmt | @function | @namedscope;
+@namedscope = @namespace | @usertype;
+
+@element = @locatable
+ | @file
+ | @folder
+ | @specifier
+ | @type
+ | @expr
+ | @namespace
+ | @initialiser
+ | @stmt
+ | @derivation
+ | @comment
+ | @preprocdirect
+ | @fun_decl
+ | @var_decl
+ | @type_decl
+ | @namespace_decl
+ | @using
+ | @namequalifier
+ | @specialnamequalifyingelement
+ | @static_assert
+ | @type_mention;
+
+@exprparent = @element;
+
+comments(
+ unique int id: @comment,
+ string contents: string ref,
+ int location: @location_default ref
+);
+
+commentbinding(
+ int id: @comment ref,
+ int element: @element ref
+);
+
+exprconv(
+ int converted: @expr ref,
+ unique int conversion: @expr ref
+);
+
+compgenerated(unique int id: @element ref);
+
+
+namespaces(
+ unique int id: @namespace,
+ string name: string ref
+);
+
+namespacembrs(
+ int parentid: @namespace ref,
+ unique int memberid: @namespacembr ref
+);
+
+@namespacembr = @declaration | @namespace;
+
+exprparents(
+ int expr_id: @expr ref,
+ int child_index: int ref,
+ int parent_id: @exprparent ref
+);
+
+expr_isload(unique int expr_id: @expr ref);
+
+@cast = @c_style_cast
+ | @const_cast
+ | @dynamic_cast
+ | @reinterpret_cast
+ | @static_cast
+ ;
+
+/*
+case @conversion.kind of
+ 0 = @simple_conversion // a numeric conversion, qualification conversion, or a reinterpret_cast
+| 1 = @bool_conversion // conversion to 'bool'
+| 2 = @base_class_conversion // a derived-to-base conversion
+| 3 = @derived_class_conversion // a base-to-derived conversion
+| 4 = @pm_base_class_conversion // a derived-to-base conversion of a pointer to member
+| 5 = @pm_derived_class_conversion // a base-to-derived conversion of a pointer to member
+| 6 = @glvalue_adjust // an adjustment of the type of a glvalue
+| 7 = @prvalue_adjust // an adjustment of the type of a prvalue
+;
+*/
+/**
+ * Describes the semantics represented by a cast expression. This is largely
+ * independent of the source syntax of the cast, so it is separate from the
+ * regular expression kind.
+ */
+conversionkinds(
+ unique int expr_id: @cast ref,
+ int kind: int ref
+);
+
+/*
+case @funbindexpr.kind of
+ 0 = @normal_call // a normal call
+| 1 = @virtual_call // a virtual call
+| 2 = @adl_call // a call whose target is only found by ADL
+;
+*/
+iscall(unique int caller: @funbindexpr ref, int kind: int ref);
+
+numtemplatearguments(
+ unique int expr_id: @expr ref,
+ int num: int ref
+);
+
+specialnamequalifyingelements(
+ unique int id: @specialnamequalifyingelement,
+ unique string name: string ref
+);
+
+@namequalifiableelement = @expr | @namequalifier;
+@namequalifyingelement = @namespace
+ | @specialnamequalifyingelement
+ | @usertype;
+
+namequalifiers(
+ unique int id: @namequalifier,
+ unique int qualifiableelement: @namequalifiableelement ref,
+ int qualifyingelement: @namequalifyingelement ref,
+ int location: @location_default ref
+);
+
+varbind(
+ int expr: @varbindexpr ref,
+ int var: @accessible ref
+);
+
+funbind(
+ int expr: @funbindexpr ref,
+ int fun: @function ref
+);
+
+@any_new_expr = @new_expr
+ | @new_array_expr;
+
+@new_or_delete_expr = @any_new_expr
+ | @delete_expr
+ | @delete_array_expr;
+
+/*
+ case @allocator.form of
+ 0 = plain
+ | 1 = alignment
+ ;
+*/
+
+/**
+ * The allocator function associated with a `new` or `new[]` expression.
+ * The `form` column specified whether the allocation call contains an alignment
+ * argument.
+ */
+expr_allocator(
+ unique int expr: @any_new_expr ref,
+ int func: @function ref,
+ int form: int ref
+);
+
+/*
+ case @deallocator.form of
+ 0 = plain
+ | 1 = size
+ | 2 = alignment
+ | 3 = size_and_alignment
+ ;
+*/
+
+/**
+ * The deallocator function associated with a `delete`, `delete[]`, `new`, or
+ * `new[]` expression. For a `new` or `new[]` expression, the deallocator is the
+ * one used to free memory if the initialization throws an exception.
+ * The `form` column specifies whether the deallocation call contains a size
+ * argument, and alignment argument, or both.
+ */
+expr_deallocator(
+ unique int expr: @new_or_delete_expr ref,
+ int func: @function ref,
+ int form: int ref
+);
+
+// the second field is a string representation of the value
+// the third field is the actual text in the source or the same as the second field
+values(
+ unique int id: @value,
+ string str: string ref,
+ string text: string ref
+);
+
+valuebind(
+ int val: @value ref,
+ unique int expr: @expr ref
+);
+
+fieldoffsets(
+ unique int id: @variable ref,
+ int byteoffset: int ref,
+ int bitoffset: int ref
+);
+
+bitfield(
+ unique int id: @variable ref,
+ int bits: int ref,
+ int declared_bits: int ref
+);
+
+/* TODO
+memberprefix(
+ int member: @expr ref,
+ int prefix: @expr ref
+);
+*/
+
+/*
+ kind(1) = mbrcallexpr
+ kind(2) = mbrptrcallexpr
+ kind(3) = mbrptrmbrcallexpr
+ kind(4) = ptrmbrptrmbrcallexpr
+ kind(5) = mbrreadexpr // x.y
+ kind(6) = mbrptrreadexpr // p->y
+ kind(7) = mbrptrmbrreadexpr // x.*pm
+ kind(8) = mbrptrmbrptrreadexpr // x->*pm
+ kind(9) = staticmbrreadexpr // static x.y
+ kind(10) = staticmbrptrreadexpr // static p->y
+*/
+/* TODO
+memberaccess(
+ int member: @expr ref,
+ int kind: int ref
+);
+*/
+
+initialisers(
+ unique int init: @initialiser,
+ int var: @accessible ref,
+ unique int expr: @expr ref,
+ int location: @location_expr ref
+);
+
+/**
+ * An ancestor for the expression, for cases in which we cannot
+ * otherwise find the expression's parent.
+ */
+expr_ancestor(
+ int exp: @expr ref,
+ int ancestor: @element ref
+);
+
+exprs(
+ unique int id: @expr,
+ int kind: int ref,
+ int location: @location_expr ref
+);
+
+/*
+ case @value.category of
+ 1 = prval
+ | 2 = xval
+ | 3 = lval
+ ;
+*/
+expr_types(
+ int id: @expr ref,
+ int typeid: @type ref,
+ int value_category: int ref
+);
+
+case @expr.kind of
+ 1 = @errorexpr
+| 2 = @address_of // & AddressOfExpr
+| 3 = @reference_to // ReferenceToExpr (implicit?)
+| 4 = @indirect // * PointerDereferenceExpr
+| 5 = @ref_indirect // ReferenceDereferenceExpr (implicit?)
+// ...
+| 8 = @array_to_pointer // (???)
+| 9 = @vacuous_destructor_call // VacuousDestructorCall
+// ...
+| 11 = @assume // Microsoft
+| 12 = @parexpr
+| 13 = @arithnegexpr
+| 14 = @unaryplusexpr
+| 15 = @complementexpr
+| 16 = @notexpr
+| 17 = @conjugation // GNU ~ operator
+| 18 = @realpartexpr // GNU __real
+| 19 = @imagpartexpr // GNU __imag
+| 20 = @postincrexpr
+| 21 = @postdecrexpr
+| 22 = @preincrexpr
+| 23 = @predecrexpr
+| 24 = @conditionalexpr
+| 25 = @addexpr
+| 26 = @subexpr
+| 27 = @mulexpr
+| 28 = @divexpr
+| 29 = @remexpr
+| 30 = @jmulexpr // C99 mul imaginary
+| 31 = @jdivexpr // C99 div imaginary
+| 32 = @fjaddexpr // C99 add real + imaginary
+| 33 = @jfaddexpr // C99 add imaginary + real
+| 34 = @fjsubexpr // C99 sub real - imaginary
+| 35 = @jfsubexpr // C99 sub imaginary - real
+| 36 = @paddexpr // pointer add (pointer + int or int + pointer)
+| 37 = @psubexpr // pointer sub (pointer - integer)
+| 38 = @pdiffexpr // difference between two pointers
+| 39 = @lshiftexpr
+| 40 = @rshiftexpr
+| 41 = @andexpr
+| 42 = @orexpr
+| 43 = @xorexpr
+| 44 = @eqexpr
+| 45 = @neexpr
+| 46 = @gtexpr
+| 47 = @ltexpr
+| 48 = @geexpr
+| 49 = @leexpr
+| 50 = @minexpr // GNU minimum
+| 51 = @maxexpr // GNU maximum
+| 52 = @assignexpr
+| 53 = @assignaddexpr
+| 54 = @assignsubexpr
+| 55 = @assignmulexpr
+| 56 = @assigndivexpr
+| 57 = @assignremexpr
+| 58 = @assignlshiftexpr
+| 59 = @assignrshiftexpr
+| 60 = @assignandexpr
+| 61 = @assignorexpr
+| 62 = @assignxorexpr
+| 63 = @assignpaddexpr // assign pointer add
+| 64 = @assignpsubexpr // assign pointer sub
+| 65 = @andlogicalexpr
+| 66 = @orlogicalexpr
+| 67 = @commaexpr
+| 68 = @subscriptexpr // access to member of an array, e.g., a[5]
+// ... 69 @objc_subscriptexpr deprecated
+// ... 70 @cmdaccess deprecated
+// ...
+| 73 = @virtfunptrexpr
+| 74 = @callexpr
+// ... 75 @msgexpr_normal deprecated
+// ... 76 @msgexpr_super deprecated
+// ... 77 @atselectorexpr deprecated
+// ... 78 @atprotocolexpr deprecated
+| 79 = @vastartexpr
+| 80 = @vaargexpr
+| 81 = @vaendexpr
+| 82 = @vacopyexpr
+// ... 83 @atencodeexpr deprecated
+| 84 = @varaccess
+| 85 = @thisaccess
+// ... 86 @objc_box_expr deprecated
+| 87 = @new_expr
+| 88 = @delete_expr
+| 89 = @throw_expr
+| 90 = @condition_decl // a variable declared in a condition, e.g., if(int x = y > 2)
+| 91 = @braced_init_list
+| 92 = @type_id
+| 93 = @runtime_sizeof
+| 94 = @runtime_alignof
+| 95 = @sizeof_pack
+| 96 = @expr_stmt // GNU extension
+| 97 = @routineexpr
+| 98 = @type_operand // used to access a type in certain contexts (haven't found any examples yet....)
+| 99 = @offsetofexpr // offsetof ::= type and field
+| 100 = @hasassignexpr // __has_assign ::= type
+| 101 = @hascopyexpr // __has_copy ::= type
+| 102 = @hasnothrowassign // __has_nothrow_assign ::= type
+| 103 = @hasnothrowconstr // __has_nothrow_constructor ::= type
+| 104 = @hasnothrowcopy // __has_nothrow_copy ::= type
+| 105 = @hastrivialassign // __has_trivial_assign ::= type
+| 106 = @hastrivialconstr // __has_trivial_constructor ::= type
+| 107 = @hastrivialcopy // __has_trivial_copy ::= type
+| 108 = @hasuserdestr // __has_user_destructor ::= type
+| 109 = @hasvirtualdestr // __has_virtual_destructor ::= type
+| 110 = @isabstractexpr // __is_abstract ::= type
+| 111 = @isbaseofexpr // __is_base_of ::= type type
+| 112 = @isclassexpr // __is_class ::= type
+| 113 = @isconvtoexpr // __is_convertible_to ::= type type
+| 114 = @isemptyexpr // __is_empty ::= type
+| 115 = @isenumexpr // __is_enum ::= type
+| 116 = @ispodexpr // __is_pod ::= type
+| 117 = @ispolyexpr // __is_polymorphic ::= type
+| 118 = @isunionexpr // __is_union ::= type
+| 119 = @typescompexpr // GNU __builtin_types_compatible ::= type type
+| 120 = @intaddrexpr // EDG internal builtin, used to implement offsetof
+// ...
+| 122 = @hastrivialdestructor // __has_trivial_destructor ::= type
+| 123 = @literal
+| 124 = @uuidof
+| 127 = @aggregateliteral
+| 128 = @delete_array_expr
+| 129 = @new_array_expr
+// ... 130 @objc_array_literal deprecated
+// ... 131 @objc_dictionary_literal deprecated
+// ...
+| 200 = @ctordirectinit
+| 201 = @ctorvirtualinit
+| 202 = @ctorfieldinit
+| 203 = @ctordelegatinginit
+| 204 = @dtordirectdestruct
+| 205 = @dtorvirtualdestruct
+| 206 = @dtorfielddestruct
+// ...
+| 210 = @static_cast
+| 211 = @reinterpret_cast
+| 212 = @const_cast
+| 213 = @dynamic_cast
+| 214 = @c_style_cast
+| 215 = @lambdaexpr
+| 216 = @param_ref
+| 217 = @noopexpr
+// ...
+| 294 = @istriviallyconstructibleexpr
+| 295 = @isdestructibleexpr
+| 296 = @isnothrowdestructibleexpr
+| 297 = @istriviallydestructibleexpr
+| 298 = @istriviallyassignableexpr
+| 299 = @isnothrowassignableexpr
+| 300 = @istrivialexpr
+| 301 = @isstandardlayoutexpr
+| 302 = @istriviallycopyableexpr
+| 303 = @isliteraltypeexpr
+| 304 = @hastrivialmoveconstructorexpr
+| 305 = @hastrivialmoveassignexpr
+| 306 = @hasnothrowmoveassignexpr
+| 307 = @isconstructibleexpr
+| 308 = @isnothrowconstructibleexpr
+| 309 = @hasfinalizerexpr
+| 310 = @isdelegateexpr
+| 311 = @isinterfaceclassexpr
+| 312 = @isrefarrayexpr
+| 313 = @isrefclassexpr
+| 314 = @issealedexpr
+| 315 = @issimplevalueclassexpr
+| 316 = @isvalueclassexpr
+| 317 = @isfinalexpr
+| 319 = @noexceptexpr
+| 320 = @builtinshufflevector
+| 321 = @builtinchooseexpr
+;
+
+new_allocated_type(
+ unique int expr: @new_expr ref,
+ int type_id: @type ref
+);
+
+new_array_allocated_type(
+ unique int expr: @new_array_expr ref,
+ int type_id: @type ref
+);
+
+@ctorinit = @ctordirectinit
+ | @ctorvirtualinit
+ | @ctorfieldinit
+ | @ctordelegatinginit;
+@dtordestruct = @dtordirectdestruct
+ | @dtorvirtualdestruct
+ | @dtorfielddestruct;
+
+
+condition_decl_bind(
+ unique int expr: @condition_decl ref,
+ unique int decl: @declaration ref
+);
+
+typeid_bind(
+ unique int expr: @type_id ref,
+ int type_id: @type ref
+);
+
+uuidof_bind(
+ unique int expr: @uuidof ref,
+ int type_id: @type ref
+);
+
+@runtime_sizeof_or_alignof = @runtime_sizeof | @runtime_alignof;
+
+sizeof_bind(
+ unique int expr: @runtime_sizeof_or_alignof ref,
+ int type_id: @type ref
+);
+
+code_block(
+ unique int block: @literal ref,
+ unique int routine: @function ref
+);
+
+lambdas(
+ unique int expr: @lambdaexpr ref,
+ string default_capture: string ref,
+ boolean has_explicit_return_type: boolean ref
+);
+
+lambda_capture(
+ unique int id: @lambdacapture,
+ int lambda: @lambdaexpr ref,
+ int index: int ref,
+ boolean captured_by_reference: boolean ref,
+ boolean is_implicit: boolean ref,
+ int location: @location_default ref
+);
+
+@funbindexpr = @routineexpr
+ | @new_expr
+ | @delete_expr
+ | @delete_array_expr
+ | @ctordirectinit
+ | @ctorvirtualinit
+ | @ctordelegatinginit
+ | @dtordirectdestruct
+ | @dtorvirtualdestruct;
+
+@varbindexpr = @varaccess | @ctorfieldinit | @dtorfielddestruct;
+@addressable = @function | @variable ;
+@accessible = @addressable | @enumconstant ;
+@callable = @function | @variable; // only for variables with routine types
+
+stmts(
+ unique int id: @stmt,
+ int kind: int ref,
+ int location: @location_stmt ref
+);
+
+case @stmt.kind of
+ 1 = @stmt_expr
+| 2 = @stmt_if
+| 3 = @stmt_while
+| 4 = @stmt_goto
+| 5 = @stmt_label
+| 6 = @stmt_return
+| 7 = @stmt_block
+| 8 = @stmt_end_test_while // do { ... } while ( ... )
+| 9 = @stmt_for
+| 10 = @stmt_switch_case
+| 11 = @stmt_switch
+| 13 = @stmt_asm // "asm" statement or the body of an asm function
+| 15 = @stmt_try_block
+| 16 = @stmt_microsoft_try // Microsoft
+| 17 = @stmt_decl
+| 18 = @stmt_set_vla_size // C99
+| 19 = @stmt_vla_decl // C99
+| 25 = @stmt_assigned_goto // GNU
+| 26 = @stmt_empty
+| 27 = @stmt_continue
+| 28 = @stmt_break
+| 29 = @stmt_range_based_for // C++11
+// ... 30 @stmt_at_autoreleasepool_block deprecated
+// ... 31 @stmt_objc_for_in deprecated
+// ... 32 @stmt_at_synchronized deprecated
+| 33 = @stmt_handler
+// ... 34 @stmt_finally_end deprecated
+;
+
+type_vla(
+ int type_id: @type ref,
+ int decl: @stmt_vla_decl ref
+);
+
+variable_vla(
+ int var: @variable ref,
+ int decl: @stmt_vla_decl ref
+);
+
+if_then(
+ unique int if_stmt: @stmt_if ref,
+ int then_id: @stmt ref
+);
+
+if_else(
+ unique int if_stmt: @stmt_if ref,
+ int else_id: @stmt ref
+);
+
+while_body(
+ unique int while_stmt: @stmt_while ref,
+ int body_id: @stmt ref
+);
+
+do_body(
+ unique int do_stmt: @stmt_end_test_while ref,
+ int body_id: @stmt ref
+);
+
+switch_case(
+ int switch_stmt: @stmt_switch ref,
+ int index: int ref,
+ int case_id: @stmt_switch_case ref
+);
+
+switch_body(
+ int switch_stmt: @stmt_switch ref,
+ int body_id: @stmt ref
+);
+
+for_initialization(
+ int for_stmt: @stmt_for ref,
+ int init_id: @stmt ref
+);
+
+for_condition(
+ int for_stmt: @stmt_for ref,
+ int condition_id: @expr ref
+);
+
+for_update(
+ int for_stmt: @stmt_for ref,
+ int update_id: @expr ref
+);
+
+for_body(
+ int for_stmt: @stmt_for ref,
+ int body_id: @stmt ref
+);
+
+@stmtparent = @stmt | @expr_stmt ;
+stmtparents(
+ unique int id: @stmt ref,
+ int index: int ref,
+ int parent: @stmtparent ref
+);
+
+ishandler(unique int block: @stmt_block ref);
+
+@cfgnode = @stmt | @expr | @function | @initialiser ;
+successors(
+ int from: @cfgnode ref,
+ int to: @cfgnode ref
+);
+
+truecond(
+ unique int from: @cfgnode ref,
+ int to: @cfgnode ref
+);
+
+falsecond(
+ unique int from: @cfgnode ref,
+ int to: @cfgnode ref
+);
+
+stmt_decl_bind(
+ int stmt: @stmt_decl ref,
+ int num: int ref,
+ int decl: @declaration ref
+);
+
+stmt_decl_entry_bind(
+ int stmt: @stmt_decl ref,
+ int num: int ref,
+ int decl_entry: @element ref
+);
+
+@functionorblock = @function | @stmt_block;
+
+blockscope(
+ int block: @stmt_block ref,
+ int enclosing: @functionorblock ref
+);
+
+@jump = @stmt_goto | @stmt_break | @stmt_continue;
+
+@jumporlabel = @jump | @stmt_label | @literal;
+
+jumpinfo(
+ unique int id: @jumporlabel ref,
+ string str: string ref,
+ int target: @stmt ref
+);
+
+preprocdirects(
+ unique int id: @preprocdirect,
+ int kind: int ref,
+ int location: @location_default ref
+);
+case @preprocdirect.kind of
+ 0 = @ppd_if
+| 1 = @ppd_ifdef
+| 2 = @ppd_ifndef
+| 3 = @ppd_elif
+| 4 = @ppd_else
+| 5 = @ppd_endif
+| 6 = @ppd_plain_include
+| 7 = @ppd_define
+| 8 = @ppd_undef
+| 9 = @ppd_line
+| 10 = @ppd_error
+| 11 = @ppd_pragma
+| 12 = @ppd_objc_import
+| 13 = @ppd_include_next
+| 18 = @ppd_warning
+;
+
+@ppd_include = @ppd_plain_include | @ppd_objc_import | @ppd_include_next;
+
+@ppd_branch = @ppd_if | @ppd_ifdef | @ppd_ifndef | @ppd_elif;
+
+preprocpair(
+ int begin : @ppd_branch ref,
+ int elseelifend : @preprocdirect ref
+);
+
+preproctrue(int branch : @ppd_branch ref);
+preprocfalse(int branch : @ppd_branch ref);
+
+preproctext(
+ unique int id: @preprocdirect ref,
+ string head: string ref,
+ string body: string ref
+);
+
+includes(
+ unique int id: @ppd_include ref,
+ int included: @file ref
+);
+
+link_targets(
+ unique int id: @link_target,
+ int binary: @file ref
+);
+
+link_parent(
+ int element : @element ref,
+ int link_target : @link_target ref
+);
+
+/* XML Files */
+
+xmlEncoding(unique int id: @file ref, string encoding: string ref);
+
+xmlDTDs(
+ unique int id: @xmldtd,
+ string root: string ref,
+ string publicId: string ref,
+ string systemId: string ref,
+ int fileid: @file ref
+);
+
+xmlElements(
+ unique int id: @xmlelement,
+ string name: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int fileid: @file ref
+);
+
+xmlAttrs(
+ unique int id: @xmlattribute,
+ int elementid: @xmlelement ref,
+ string name: string ref,
+ string value: string ref,
+ int idx: int ref,
+ int fileid: @file ref
+);
+
+xmlNs(
+ int id: @xmlnamespace,
+ string prefixName: string ref,
+ string URI: string ref,
+ int fileid: @file ref
+);
+
+xmlHasNs(
+ int elementId: @xmlnamespaceable ref,
+ int nsId: @xmlnamespace ref,
+ int fileid: @file ref
+);
+
+xmlComments(
+ unique int id: @xmlcomment,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int fileid: @file ref
+);
+
+xmlChars(
+ unique int id: @xmlcharacters,
+ string text: string ref,
+ int parentid: @xmlparent ref,
+ int idx: int ref,
+ int isCDATA: int ref,
+ int fileid: @file ref
+);
+
+@xmlparent = @file | @xmlelement;
+@xmlnamespaceable = @xmlelement | @xmlattribute;
+
+xmllocations(
+ int xmlElement: @xmllocatable ref,
+ int location: @location_default ref
+);
+
+@xmllocatable = @xmlcharacters
+ | @xmlelement
+ | @xmlcomment
+ | @xmlattribute
+ | @xmldtd
+ | @file
+ | @xmlnamespace;
diff --git a/cpp/ql/src/semmlecode.cpp.dbscheme.stats b/cpp/ql/src/semmlecode.cpp.dbscheme.stats
new file mode 100644
index 000000000000..4b25ede6c982
--- /dev/null
+++ b/cpp/ql/src/semmlecode.cpp.dbscheme.stats
@@ -0,0 +1,39867 @@
+
+
+@compilation
+9298
+
+
+@externalDataElement
+66
+
+
+@duplication
+202049
+
+
+@similarity
+238457
+
+
+@external_package
+4
+
+
+@svnentry
+575525
+
+
+@location_default
+8232279
+
+
+@location_stmt
+5631060
+
+
+@location_expr
+22023911
+
+
+@diagnostic
+66951
+
+
+@file
+57465
+
+
+@folder
+7966
+
+
+@macroinvocation
+37650204
+
+
+@function
+3698710
+
+
+@fun_decl
+3050240
+
+
+@var_decl
+4647089
+
+
+@type_decl
+1388703
+
+
+@namespace_decl
+130885
+
+
+@using
+201199
+
+
+@static_assert
+18201
+
+
+@parameter
+4568553
+
+
+@membervariable
+352723
+
+
+@globalvariable
+336079
+
+
+@localvariable
+664877
+
+
+@enumconstant
+97072
+
+
+@builtintype
+510
+
+
+@derivedtype
+3614061
+
+
+@decltype
+79334
+
+
+@usertype
+3394431
+
+
+@type_mention
+7771692
+
+
+@routinetype
+532763
+
+
+@ptrtomember
+13636
+
+
+@specifier
+466
+
+
+@gnuattribute
+425139
+
+
+@stdattribute
+44
+
+
+@alignas
+288
+
+
+@declspec
+39467
+
+
+@msattribute
+9
+
+
+@attribute_arg_token
+1139
+
+
+@attribute_arg_constant
+135091
+
+
+@attribute_arg_type
+99
+
+
+@attribute_arg_empty
+1
+
+
+@derivation
+220295
+
+
+@frienddecl
+88113
+
+
+@comment
+1490251
+
+
+@namespace
+7878
+
+
+@specialnamequalifyingelement
+11
+
+
+@namequalifier
+942519
+
+
+@value
+10189744
+
+
+@initialiser
+1576583
+
+
+@delete_array_expr
+1342
+
+
+@new_array_expr
+915
+
+
+@ctordirectinit
+122231
+
+
+@ctorvirtualinit
+4848
+
+
+@ctorfieldinit
+270204
+
+
+@ctordelegatinginit
+909
+
+
+@dtordirectdestruct
+30546
+
+
+@dtorvirtualdestruct
+1542
+
+
+@dtorfielddestruct
+33231
+
+
+@static_cast
+248467
+
+
+@reinterpret_cast
+30257
+
+
+@const_cast
+10086
+
+
+@dynamic_cast
+1098
+
+
+@c_style_cast
+5246346
+
+
+@lambdaexpr
+2392
+
+
+@param_ref
+64610
+
+
+@errorexpr
+53204
+
+
+@address_of
+513989
+
+
+@reference_to
+1373246
+
+
+@indirect
+340254
+
+
+@ref_indirect
+1545996
+
+
+@array_to_pointer
+1277596
+
+
+@vacuous_destructor_call
+5048
+
+
+@parexpr
+3645230
+
+
+@arithnegexpr
+735809
+
+
+@unaryplusexpr
+984
+
+
+@complementexpr
+34398
+
+
+@notexpr
+327608
+
+
+@realpartexpr
+66
+
+
+@imagpartexpr
+66
+
+
+@postincrexpr
+63274
+
+
+@postdecrexpr
+7969
+
+
+@preincrexpr
+76272
+
+
+@predecrexpr
+31068
+
+
+@conditionalexpr
+205957
+
+
+@addexpr
+234262
+
+
+@subexpr
+175561
+
+
+@mulexpr
+97668
+
+
+@divexpr
+45104
+
+
+@remexpr
+5192
+
+
+@paddexpr
+120798
+
+
+@psubexpr
+31652
+
+
+@pdiffexpr
+29647
+
+
+@lshiftexpr
+308891
+
+
+@rshiftexpr
+71546
+
+
+@andexpr
+247150
+
+
+@orexpr
+137662
+
+
+@xorexpr
+16063
+
+
+@eqexpr
+292382
+
+
+@neexpr
+115492
+
+
+@gtexpr
+68024
+
+
+@ltexpr
+76105
+
+
+@geexpr
+30625
+
+
+@leexpr
+271958
+
+
+@assignexpr
+709791
+
+
+@assignaddexpr
+77403
+
+
+@assignsubexpr
+9543
+
+
+@assignmulexpr
+6457
+
+
+@assigndivexpr
+1786
+
+
+@assignremexpr
+266
+
+
+@assignlshiftexpr
+767
+
+
+@assignrshiftexpr
+4528
+
+
+@assignandexpr
+10782
+
+
+@assignorexpr
+26430
+
+
+@assignxorexpr
+4415
+
+
+@assignpaddexpr
+12023
+
+
+@assignpsubexpr
+865
+
+
+@andlogicalexpr
+131744
+
+
+@orlogicalexpr
+72311
+
+
+@commaexpr
+21573
+
+
+@subscriptexpr
+253161
+
+
+@callexpr
+208589
+
+
+@vastartexpr
+681
+
+
+@vaargexpr
+1891
+
+
+@vaendexpr
+744
+
+
+@varaccess
+6694687
+
+
+@thisaccess
+1393374
+
+
+@new_expr
+36283
+
+
+@delete_expr
+8320
+
+
+@throw_expr
+23833
+
+
+@condition_decl
+12582
+
+
+@braced_init_list
+33
+
+
+@type_id
+4405
+
+
+@runtime_sizeof
+272313
+
+
+@runtime_alignof
+1126
+
+
+@sizeof_pack
+155
+
+
+@expr_stmt
+199692
+
+
+@routineexpr
+2804180
+
+
+@type_operand
+50536
+
+
+@offsetofexpr
+43233
+
+
+@hastrivialdestructor
+99
+
+
+@literal
+5209090
+
+
+@aggregateliteral
+1094155
+
+
+@istrivialexpr
+2596
+
+
+@istriviallycopyableexpr
+55
+
+
+@noexceptexpr
+76
+
+
+@assume
+39
+
+
+@conjugation
+1
+
+
+@jmulexpr
+1
+
+
+@jdivexpr
+1
+
+
+@fjaddexpr
+1
+
+
+@jfaddexpr
+1
+
+
+@fjsubexpr
+1
+
+
+@jfsubexpr
+1
+
+
+@minexpr
+1
+
+
+@maxexpr
+1
+
+
+@virtfunptrexpr
+1
+
+
+@vacopyexpr
+34
+
+
+@hasassignexpr
+2
+
+
+@hascopyexpr
+2
+
+
+@hasnothrowassign
+3
+
+
+@hasnothrowconstr
+3
+
+
+@hasnothrowcopy
+3
+
+
+@hastrivialassign
+2
+
+
+@hastrivialconstr
+3
+
+
+@hastrivialcopy
+2
+
+
+@hasuserdestr
+3
+
+
+@hasvirtualdestr
+3
+
+
+@isabstractexpr
+3
+
+
+@isbaseofexpr
+12
+
+
+@isclassexpr
+5
+
+
+@isconvtoexpr
+12
+
+
+@isemptyexpr
+5
+
+
+@isenumexpr
+642
+
+
+@ispodexpr
+3
+
+
+@ispolyexpr
+3
+
+
+@isunionexpr
+5
+
+
+@typescompexpr
+3651
+
+
+@intaddrexpr
+1
+
+
+@uuidof
+121
+
+
+@noopexpr
+41
+
+
+@istriviallyconstructibleexpr
+3
+
+
+@isdestructibleexpr
+4
+
+
+@isnothrowdestructibleexpr
+5
+
+
+@istriviallydestructibleexpr
+5
+
+
+@istriviallyassignableexpr
+3
+
+
+@isnothrowassignableexpr
+3
+
+
+@isstandardlayoutexpr
+2
+
+
+@isliteraltypeexpr
+2
+
+
+@hastrivialmoveconstructorexpr
+3
+
+
+@hastrivialmoveassignexpr
+3
+
+
+@hasnothrowmoveassignexpr
+4
+
+
+@isconstructibleexpr
+3
+
+
+@isnothrowconstructibleexpr
+3
+
+
+@hasfinalizerexpr
+1
+
+
+@isdelegateexpr
+1
+
+
+@isinterfaceclassexpr
+1
+
+
+@isrefarrayexpr
+1
+
+
+@isrefclassexpr
+1
+
+
+@issealedexpr
+1
+
+
+@issimplevalueclassexpr
+1
+
+
+@isvalueclassexpr
+1
+
+
+@isfinalexpr
+2
+
+
+@builtinshufflevector
+1
+
+
+@builtinchooseexpr
+3070
+
+
+@lambdacapture
+266
+
+
+@stmt_expr
+1572664
+
+
+@stmt_if
+658624
+
+
+@stmt_while
+41808
+
+
+@stmt_goto
+126716
+
+
+@stmt_label
+118849
+
+
+@stmt_return
+1367598
+
+
+@stmt_block
+1616111
+
+
+@stmt_end_test_while
+220170
+
+
+@stmt_for
+42104
+
+
+@stmt_switch_case
+388126
+
+
+@stmt_switch
+76075
+
+
+@stmt_asm
+297358
+
+
+@stmt_try_block
+19473
+
+
+@stmt_decl
+694074
+
+
+@stmt_empty
+88844
+
+
+@stmt_continue
+12084
+
+
+@stmt_break
+321362
+
+
+@stmt_range_based_for
+23
+
+
+@stmt_handler
+21514
+
+
+@stmt_microsoft_try
+268
+
+
+@stmt_set_vla_size
+104
+
+
+@stmt_vla_decl
+104
+
+
+@stmt_assigned_goto
+2
+
+
+@ppd_if
+133815
+
+
+@ppd_ifdef
+49931
+
+
+@ppd_ifndef
+76782
+
+
+@ppd_elif
+16754
+
+
+@ppd_else
+51062
+
+
+@ppd_endif
+260551
+
+
+@ppd_plain_include
+281755
+
+
+@ppd_define
+313511
+
+
+@ppd_undef
+17098
+
+
+@ppd_line
+13915
+
+
+@ppd_error
+44
+
+
+@ppd_pragma
+7101
+
+
+@ppd_include_next
+77
+
+
+@ppd_warning
+22
+
+
+@ppd_objc_import
+2
+
+
+@link_target
+1295
+
+
+@xmldtd
+1
+
+
+@xmlelement
+1270313
+
+
+@xmlattribute
+1202020
+
+
+@xmlnamespace
+4185
+
+
+@xmlcomment
+26812
+
+
+@xmlcharacters
+439958
+
+
+
+compilations
+9298
+
+
+id
+9298
+
+
+cwd
+22
+
+
+
+
+id
+cwd
+
+
+12
+
+
+1
+2
+9298
+
+
+
+
+
+
+cwd
+id
+
+
+12
+
+
+2
+3
+11
+
+
+836
+837
+11
+
+
+
+
+
+
+
+
+compilation_args
+535255
+
+
+id
+6859
+
+
+num
+255
+
+
+arg
+28821
+
+
+
+
+id
+num
+
+
+12
+
+
+10
+43
+514
+
+
+49
+72
+170
+
+
+83
+84
+5040
+
+
+84
+85
+624
+
+
+85
+94
+509
+
+
+
+
+
+
+id
+arg
+
+
+12
+
+
+10
+42
+514
+
+
+49
+72
+170
+
+
+83
+84
+5051
+
+
+84
+85
+613
+
+
+85
+90
+509
+
+
+
+
+
+
+num
+id
+
+
+12
+
+
+2
+4
+22
+
+
+185
+413
+5
+
+
+2244
+2245
+33
+
+
+2269
+2281
+19
+
+
+2282
+2293
+19
+
+
+2293
+2305
+19
+
+
+2305
+2307
+22
+
+
+2312
+2334
+19
+
+
+2336
+2356
+16
+
+
+2359
+2364
+22
+
+
+2384
+2397
+19
+
+
+2404
+2412
+11
+
+
+2493
+2494
+27
+
+
+
+
+
+
+num
+arg
+
+
+12
+
+
+1
+2
+13
+
+
+2
+3
+27
+
+
+3
+6
+22
+
+
+6
+7
+16
+
+
+7
+9
+22
+
+
+9
+10
+11
+
+
+10
+11
+44
+
+
+11
+12
+13
+
+
+12
+14
+16
+
+
+14
+18
+16
+
+
+18
+27
+22
+
+
+27
+1403
+19
+
+
+1653
+2303
+11
+
+
+
+
+
+
+arg
+id
+
+
+12
+
+
+1
+2
+27511
+
+
+2
+2494
+1309
+
+
+
+
+
+
+arg
+num
+
+
+12
+
+
+1
+2
+28329
+
+
+2
+49
+492
+
+
+
+
+
+
+
+
+compilation_compiling_files
+10341
+
+
+id
+9298
+
+
+num
+543
+
+
+file
+5226
+
+
+
+
+id
+num
+
+
+12
+
+
+1
+2
+9276
+
+
+47
+50
+22
+
+
+
+
+
+
+id
+file
+
+
+12
+
+
+1
+2
+9276
+
+
+47
+50
+22
+
+
+
+
+
+
+num
+id
+
+
+12
+
+
+1
+2
+22
+
+
+2
+3
+510
+
+
+838
+839
+11
+
+
+
+
+
+
+num
+file
+
+
+12
+
+
+1
+2
+122
+
+
+2
+3
+410
+
+
+423
+424
+11
+
+
+
+
+
+
+file
+id
+
+
+12
+
+
+1
+2
+255
+
+
+2
+3
+4937
+
+
+3
+14
+33
+
+
+
+
+
+
+file
+num
+
+
+12
+
+
+1
+2
+4815
+
+
+2
+3
+410
+
+
+
+
+
+
+
+
+compilation_time
+41187
+
+
+id
+9253
+
+
+num
+543
+
+
+kind
+44
+
+
+seconds
+12982
+
+
+
+
+id
+num
+
+
+12
+
+
+1
+2
+9231
+
+
+47
+50
+22
+
+
+
+
+
+
+id
+kind
+
+
+12
+
+
+4
+5
+9253
+
+
+
+
+
+
+id
+seconds
+
+
+12
+
+
+2
+3
+11
+
+
+3
+4
+1797
+
+
+4
+5
+7423
+
+
+52
+59
+22
+
+
+
+
+
+
+num
+id
+
+
+12
+
+
+1
+2
+22
+
+
+2
+3
+510
+
+
+834
+835
+11
+
+
+
+
+
+
+num
+kind
+
+
+12
+
+
+4
+5
+543
+
+
+
+
+
+
+num
+seconds
+
+
+12
+
+
+3
+4
+22
+
+
+4
+5
+33
+
+
+5
+6
+388
+
+
+6
+7
+88
+
+
+1158
+1159
+11
+
+
+
+
+
+
+kind
+id
+
+
+12
+
+
+834
+835
+44
+
+
+
+
+
+
+kind
+num
+
+
+12
+
+
+49
+50
+44
+
+
+
+
+
+
+kind
+seconds
+
+
+12
+
+
+17
+18
+11
+
+
+18
+19
+11
+
+
+502
+503
+11
+
+
+781
+782
+11
+
+
+
+
+
+
+seconds
+id
+
+
+12
+
+
+1
+2
+9364
+
+
+2
+3
+1830
+
+
+3
+5
+1165
+
+
+5
+598
+621
+
+
+
+
+
+
+seconds
+num
+
+
+12
+
+
+1
+2
+12116
+
+
+2
+50
+865
+
+
+
+
+
+
+seconds
+kind
+
+
+12
+
+
+1
+2
+11350
+
+
+2
+3
+1619
+
+
+3
+4
+11
+
+
+
+
+
+
+
+
+diagnostic_for
+767073
+
+
+diagnostic
+66951
+
+
+compilation
+3650
+
+
+file_number
+11
+
+
+file_number_diagnostic_number
+6391
+
+
+
+
+diagnostic
+compilation
+
+
+12
+
+
+1
+2
+4327
+
+
+2
+3
+59750
+
+
+4
+307
+2873
+
+
+
+
+
+
+diagnostic
+file_number
+
+
+12
+
+
+1
+2
+66951
+
+
+
+
+
+
+diagnostic
+file_number_diagnostic_number
+
+
+12
+
+
+1
+2
+66951
+
+
+
+
+
+
+compilation
+diagnostic
+
+
+12
+
+
+2
+3
+499
+
+
+13
+18
+332
+
+
+93
+94
+22
+
+
+230
+231
+1864
+
+
+246
+279
+310
+
+
+294
+375
+288
+
+
+386
+561
+288
+
+
+576
+577
+44
+
+
+
+
+
+
+compilation
+file_number
+
+
+12
+
+
+1
+2
+3650
+
+
+
+
+
+
+compilation
+file_number_diagnostic_number
+
+
+12
+
+
+2
+3
+499
+
+
+13
+18
+332
+
+
+93
+94
+22
+
+
+230
+231
+1864
+
+
+246
+279
+310
+
+
+294
+375
+288
+
+
+386
+561
+288
+
+
+576
+577
+44
+
+
+
+
+
+
+file_number
+diagnostic
+
+
+12
+
+
+6034
+6035
+11
+
+
+
+
+
+
+file_number
+compilation
+
+
+12
+
+
+329
+330
+11
+
+
+
+
+
+
+file_number
+file_number_diagnostic_number
+
+
+12
+
+
+576
+577
+11
+
+
+
+
+
+
+file_number_diagnostic_number
+diagnostic
+
+
+12
+
+
+1
+2
+1520
+
+
+2
+3
+1020
+
+
+3
+5
+399
+
+
+5
+6
+1065
+
+
+7
+12
+488
+
+
+12
+19
+466
+
+
+19
+21
+488
+
+
+22
+29
+399
+
+
+39
+43
+532
+
+
+329
+330
+11
+
+
+
+
+
+
+file_number_diagnostic_number
+compilation
+
+
+12
+
+
+4
+9
+565
+
+
+10
+11
+1065
+
+
+14
+23
+477
+
+
+30
+39
+576
+
+
+40
+49
+443
+
+
+56
+79
+532
+
+
+84
+85
+177
+
+
+252
+253
+1520
+
+
+254
+255
+843
+
+
+268
+330
+188
+
+
+
+
+
+
+file_number_diagnostic_number
+file_number
+
+
+12
+
+
+1
+2
+6391
+
+
+
+
+
+
+
+
+compilation_finished
+9298
+
+
+id
+9298
+
+
+cpu_seconds
+8676
+
+
+elapsed_seconds
+299
+
+
+
+
+id
+cpu_seconds
+
+
+12
+
+
+1
+2
+9298
+
+
+
+
+
+
+id
+elapsed_seconds
+
+
+12
+
+
+1
+2
+9298
+
+
+
+
+
+
+cpu_seconds
+id
+
+
+12
+
+
+1
+2
+8155
+
+
+2
+5
+521
+
+
+
+
+
+
+cpu_seconds
+elapsed_seconds
+
+
+12
+
+
+1
+2
+8488
+
+
+2
+3
+188
+
+
+
+
+
+
+elapsed_seconds
+id
+
+
+12
+
+
+1
+2
+110
+
+
+2
+3
+22
+
+
+3
+6
+22
+
+
+7
+8
+22
+
+
+8
+9
+22
+
+
+15
+24
+22
+
+
+27
+44
+22
+
+
+105
+115
+22
+
+
+115
+157
+22
+
+
+188
+189
+11
+
+
+
+
+
+
+elapsed_seconds
+cpu_seconds
+
+
+12
+
+
+1
+2
+110
+
+
+2
+3
+22
+
+
+3
+6
+22
+
+
+7
+8
+22
+
+
+8
+9
+22
+
+
+15
+24
+22
+
+
+26
+44
+22
+
+
+100
+105
+22
+
+
+110
+151
+22
+
+
+176
+177
+11
+
+
+
+
+
+
+
+
+externalData
+133
+
+
+id
+66
+
+
+path
+11
+
+
+column
+22
+
+
+value
+133
+
+
+
+
+id
+path
+
+
+12
+
+
+1
+2
+66
+
+
+
+
+
+
+id
+column
+
+
+12
+
+
+2
+3
+66
+
+
+
+
+
+
+id
+value
+
+
+12
+
+
+2
+3
+66
+
+
+
+
+
+
+path
+id
+
+
+12
+
+
+6
+7
+11
+
+
+
+
+
+
+path
+column
+
+
+12
+
+
+2
+3
+11
+
+
+
+
+
+
+path
+value
+
+
+12
+
+
+12
+13
+11
+
+
+
+
+
+
+column
+id
+
+
+12
+
+
+6
+7
+22
+
+
+
+
+
+
+column
+path
+
+
+12
+
+
+1
+2
+22
+
+
+
+
+
+
+column
+value
+
+
+12
+
+
+6
+7
+22
+
+
+
+
+
+
+value
+id
+
+
+12
+
+
+1
+2
+133
+
+
+
+
+
+
+value
+path
+
+
+12
+
+
+1
+2
+133
+
+
+
+
+
+
+value
+column
+
+
+12
+
+
+1
+2
+133
+
+
+
+
+
+
+
+
+snapshotDate
+11
+
+
+snapshotDate
+11
+
+
+
+
+
+sourceLocationPrefix
+11
+
+
+prefix
+11
+
+
+
+
+
+duplicateCode
+202049
+
+
+id
+202049
+
+
+relativePath
+785
+
+
+equivClass
+81466
+
+
+
+
+id
+relativePath
+
+
+12
+
+
+1
+2
+202049
+
+
+
+
+
+
+id
+equivClass
+
+
+12
+
+
+1
+2
+202049
+
+
+
+
+
+
+relativePath
+id
+
+
+12
+
+
+1
+2
+104
+
+
+2
+3
+215
+
+
+3
+4
+69
+
+
+4
+5
+83
+
+
+5
+8
+55
+
+
+8
+15
+62
+
+
+16
+22
+62
+
+
+23
+32
+62
+
+
+38
+6340
+62
+
+
+18087
+18088
+6
+
+
+
+
+
+
+relativePath
+equivClass
+
+
+12
+
+
+1
+2
+292
+
+
+2
+3
+146
+
+
+3
+4
+62
+
+
+4
+7
+62
+
+
+7
+12
+69
+
+
+13
+18
+62
+
+
+18
+109
+62
+
+
+150
+8251
+27
+
+
+
+
+
+
+equivClass
+id
+
+
+12
+
+
+1
+2
+20493
+
+
+2
+3
+34763
+
+
+3
+4
+11967
+
+
+4
+5
+6529
+
+
+5
+9
+6717
+
+
+9
+11
+994
+
+
+
+
+
+
+equivClass
+relativePath
+
+
+12
+
+
+1
+2
+80465
+
+
+2
+6
+1001
+
+
+
+
+
+
+
+
+similarCode
+238457
+
+
+id
+238457
+
+
+relativePath
+2646
+
+
+equivClass
+63734
+
+
+
+
+id
+relativePath
+
+
+12
+
+
+1
+2
+238457
+
+
+
+
+
+
+id
+equivClass
+
+
+12
+
+
+1
+2
+238457
+
+
+
+
+
+
+relativePath
+id
+
+
+12
+
+
+1
+2
+114
+
+
+2
+4
+205
+
+
+4
+7
+190
+
+
+7
+11
+221
+
+
+11
+16
+231
+
+
+16
+21
+238
+
+
+21
+28
+218
+
+
+28
+38
+201
+
+
+38
+52
+201
+
+
+52
+75
+199
+
+
+75
+125
+199
+
+
+125
+231
+199
+
+
+236
+1038
+199
+
+
+1055
+5166
+26
+
+
+
+
+
+
+relativePath
+equivClass
+
+
+12
+
+
+1
+2
+153
+
+
+2
+3
+154
+
+
+3
+6
+228
+
+
+6
+9
+192
+
+
+9
+13
+207
+
+
+13
+17
+201
+
+
+17
+22
+207
+
+
+22
+30
+210
+
+
+30
+38
+201
+
+
+38
+54
+205
+
+
+54
+79
+203
+
+
+79
+128
+203
+
+
+128
+330
+199
+
+
+342
+1467
+78
+
+
+
+
+
+
+equivClass
+id
+
+
+12
+
+
+1
+2
+22
+
+
+2
+3
+26416
+
+
+3
+4
+12363
+
+
+4
+5
+7511
+
+
+5
+6
+5122
+
+
+6
+7
+3776
+
+
+7
+9
+5168
+
+
+9
+11
+3354
+
+
+
+
+
+
+equivClass
+relativePath
+
+
+12
+
+
+1
+2
+27115
+
+
+2
+3
+17565
+
+
+3
+4
+7524
+
+
+4
+5
+4245
+
+
+5
+8
+5730
+
+
+8
+11
+1554
+
+
+
+
+
+
+
+
+tokens
+44513159
+
+
+id
+313175
+
+
+offset
+23149
+
+
+beginLine
+843295
+
+
+beginColumn
+1599
+
+
+endLine
+843295
+
+
+endColumn
+1592
+
+
+
+
+id
+offset
+
+
+12
+
+
+100
+101
+8518
+
+
+101
+102
+30750
+
+
+102
+105
+25173
+
+
+105
+108
+28907
+
+
+108
+112
+28907
+
+
+112
+115
+14867
+
+
+115
+117
+24234
+
+
+117
+124
+24624
+
+
+124
+132
+25709
+
+
+132
+150
+24060
+
+
+150
+184
+24248
+
+
+184
+200
+23907
+
+
+200
+338
+23504
+
+
+339
+3330
+5757
+
+
+
+
+
+
+id
+beginLine
+
+
+12
+
+
+4
+5
+1460
+
+
+5
+6
+115916
+
+
+6
+7
+18963
+
+
+7
+8
+30980
+
+
+8
+12
+27531
+
+
+12
+17
+28727
+
+
+17
+19
+20882
+
+
+19
+22
+28295
+
+
+22
+27
+23581
+
+
+27
+525
+16835
+
+
+
+
+
+
+id
+beginColumn
+
+
+12
+
+
+3
+25
+23574
+
+
+25
+30
+24575
+
+
+30
+32
+7301
+
+
+32
+33
+172446
+
+
+33
+50
+23595
+
+
+50
+60
+25396
+
+
+60
+72
+23664
+
+
+72
+120
+12621
+
+
+
+
+
+
+id
+endLine
+
+
+12
+
+
+4
+5
+1460
+
+
+5
+6
+115916
+
+
+6
+7
+18963
+
+
+7
+8
+30980
+
+
+8
+12
+27531
+
+
+12
+17
+28727
+
+
+17
+19
+20882
+
+
+19
+22
+28295
+
+
+22
+27
+23581
+
+
+27
+525
+16835
+
+
+
+
+
+
+id
+endColumn
+
+
+12
+
+
+3
+25
+26807
+
+
+25
+31
+28365
+
+
+31
+32
+1801
+
+
+32
+33
+173350
+
+
+33
+54
+24888
+
+
+54
+64
+25375
+
+
+64
+78
+23782
+
+
+78
+126
+8803
+
+
+
+
+
+
+offset
+id
+
+
+12
+
+
+4
+5
+660
+
+
+8
+9
+3525
+
+
+10
+11
+1613
+
+
+12
+13
+2823
+
+
+14
+18
+2030
+
+
+19
+22
+1821
+
+
+24
+48
+1641
+
+
+55
+88
+1974
+
+
+89
+186
+1738
+
+
+189
+332
+1780
+
+
+333
+1477
+1738
+
+
+1489
+45036
+1801
+
+
+
+
+
+
+offset
+beginLine
+
+
+12
+
+
+2
+3
+660
+
+
+4
+5
+2913
+
+
+6
+7
+1835
+
+
+8
+9
+2572
+
+
+10
+13
+1752
+
+
+13
+16
+1689
+
+
+17
+27
+1780
+
+
+28
+58
+1870
+
+
+59
+116
+1828
+
+
+117
+226
+1773
+
+
+227
+567
+1738
+
+
+569
+10989
+1738
+
+
+11187
+32851
+994
+
+
+
+
+
+
+offset
+beginColumn
+
+
+12
+
+
+1
+3
+744
+
+
+3
+4
+3588
+
+
+4
+5
+1933
+
+
+5
+6
+3546
+
+
+6
+8
+1870
+
+
+8
+12
+2002
+
+
+12
+15
+1279
+
+
+15
+17
+1912
+
+
+17
+23
+1947
+
+
+23
+47
+1738
+
+
+47
+143
+1738
+
+
+143
+178
+848
+
+
+
+
+
+
+offset
+endLine
+
+
+12
+
+
+2
+3
+660
+
+
+4
+5
+2913
+
+
+6
+7
+1835
+
+
+8
+9
+2572
+
+
+10
+13
+1752
+
+
+13
+16
+1689
+
+
+17
+27
+1780
+
+
+28
+58
+1870
+
+
+59
+116
+1828
+
+
+117
+226
+1773
+
+
+227
+567
+1738
+
+
+569
+10989
+1738
+
+
+11187
+32851
+994
+
+
+
+
+
+
+offset
+endColumn
+
+
+12
+
+
+1
+3
+737
+
+
+3
+4
+3546
+
+
+4
+5
+1884
+
+
+5
+6
+3664
+
+
+6
+8
+1898
+
+
+8
+12
+1961
+
+
+12
+15
+1446
+
+
+15
+17
+1884
+
+
+17
+24
+1870
+
+
+24
+50
+1752
+
+
+50
+152
+1745
+
+
+152
+181
+757
+
+
+
+
+
+
+beginLine
+id
+
+
+12
+
+
+1
+2
+413751
+
+
+2
+3
+110270
+
+
+3
+4
+48991
+
+
+4
+5
+43080
+
+
+5
+7
+71988
+
+
+7
+10
+70632
+
+
+10
+23
+63907
+
+
+23
+136
+20674
+
+
+
+
+
+
+beginLine
+offset
+
+
+12
+
+
+1
+7
+72189
+
+
+7
+12
+69985
+
+
+12
+23
+63358
+
+
+23
+32
+39950
+
+
+32
+33
+268864
+
+
+33
+41
+67377
+
+
+41
+54
+64060
+
+
+54
+67
+63796
+
+
+67
+88
+63393
+
+
+88
+153
+63351
+
+
+153
+253
+6967
+
+
+
+
+
+
+beginLine
+beginColumn
+
+
+12
+
+
+1
+5
+72057
+
+
+5
+9
+63935
+
+
+9
+14
+64651
+
+
+14
+26
+66466
+
+
+26
+32
+18588
+
+
+32
+33
+351957
+
+
+33
+37
+71619
+
+
+37
+42
+69164
+
+
+42
+85
+63295
+
+
+85
+126
+1557
+
+
+
+
+
+
+beginLine
+endLine
+
+
+12
+
+
+1
+2
+843267
+
+
+2
+3
+27
+
+
+
+
+
+
+beginLine
+endColumn
+
+
+12
+
+
+1
+5
+71988
+
+
+5
+9
+63879
+
+
+9
+14
+64623
+
+
+14
+26
+66411
+
+
+26
+32
+18602
+
+
+32
+33
+352298
+
+
+33
+37
+74067
+
+
+37
+42
+65367
+
+
+42
+82
+63393
+
+
+82
+131
+2663
+
+
+
+
+
+
+beginColumn
+id
+
+
+12
+
+
+2
+22
+125
+
+
+22
+48
+125
+
+
+49
+143
+125
+
+
+146
+246
+125
+
+
+250
+353
+125
+
+
+355
+643
+125
+
+
+654
+1045
+125
+
+
+1083
+2655
+125
+
+
+2775
+8521
+125
+
+
+8632
+13241
+125
+
+
+13451
+16577
+125
+
+
+26032
+34843
+125
+
+
+35215
+40498
+97
+
+
+
+
+
+
+beginColumn
+offset
+
+
+12
+
+
+2
+8
+146
+
+
+8
+27
+125
+
+
+27
+53
+125
+
+
+53
+70
+125
+
+
+70
+96
+125
+
+
+97
+150
+125
+
+
+150
+181
+125
+
+
+182
+273
+125
+
+
+277
+447
+125
+
+
+451
+557
+125
+
+
+563
+816
+125
+
+
+830
+962
+125
+
+
+964
+1333
+76
+
+
+
+
+
+
+beginColumn
+beginLine
+
+
+12
+
+
+2
+8
+125
+
+
+8
+13
+125
+
+
+13
+34
+125
+
+
+35
+63
+125
+
+
+63
+108
+132
+
+
+108
+267
+125
+
+
+270
+396
+125
+
+
+502
+1252
+125
+
+
+1433
+4481
+125
+
+
+4551
+9574
+125
+
+
+9924
+85543
+125
+
+
+85608
+89662
+125
+
+
+89973
+98415
+90
+
+
+
+
+
+
+beginColumn
+endLine
+
+
+12
+
+
+2
+8
+125
+
+
+8
+13
+125
+
+
+13
+34
+125
+
+
+35
+63
+125
+
+
+63
+108
+132
+
+
+108
+267
+125
+
+
+270
+396
+125
+
+
+502
+1252
+125
+
+
+1433
+4481
+125
+
+
+4551
+9574
+125
+
+
+9924
+85543
+125
+
+
+85608
+89662
+125
+
+
+89973
+98415
+90
+
+
+
+
+
+
+beginColumn
+endColumn
+
+
+12
+
+
+1
+2
+146
+
+
+2
+3
+69
+
+
+3
+4
+125
+
+
+4
+7
+125
+
+
+7
+9
+111
+
+
+9
+14
+139
+
+
+14
+19
+125
+
+
+19
+24
+146
+
+
+24
+27
+132
+
+
+27
+33
+125
+
+
+33
+37
+125
+
+
+37
+42
+132
+
+
+44
+69
+97
+
+
+
+
+
+
+endLine
+id
+
+
+12
+
+
+1
+2
+413737
+
+
+2
+3
+110270
+
+
+3
+4
+48998
+
+
+4
+5
+43080
+
+
+5
+7
+71988
+
+
+7
+10
+70632
+
+
+10
+23
+63914
+
+
+23
+136
+20674
+
+
+
+
+
+
+endLine
+offset
+
+
+12
+
+
+1
+7
+72189
+
+
+7
+12
+69985
+
+
+12
+23
+63351
+
+
+23
+32
+39957
+
+
+32
+33
+268864
+
+
+33
+41
+67377
+
+
+41
+54
+64060
+
+
+54
+67
+63796
+
+
+67
+88
+63393
+
+
+88
+153
+63351
+
+
+153
+253
+6967
+
+
+
+
+
+
+endLine
+beginLine
+
+
+12
+
+
+1
+2
+843267
+
+
+2
+3
+27
+
+
+
+
+
+
+endLine
+beginColumn
+
+
+12
+
+
+1
+5
+72057
+
+
+5
+9
+63935
+
+
+9
+14
+64658
+
+
+14
+26
+66459
+
+
+26
+32
+18588
+
+
+32
+33
+351957
+
+
+33
+37
+71619
+
+
+37
+42
+69164
+
+
+42
+85
+63295
+
+
+85
+126
+1557
+
+
+
+
+
+
+endLine
+endColumn
+
+
+12
+
+
+1
+5
+71995
+
+
+5
+9
+63872
+
+
+9
+14
+64623
+
+
+14
+26
+66411
+
+
+26
+32
+18602
+
+
+32
+33
+352298
+
+
+33
+37
+74067
+
+
+37
+42
+65367
+
+
+42
+82
+63393
+
+
+82
+131
+2663
+
+
+
+
+
+
+endColumn
+id
+
+
+12
+
+
+2
+28
+132
+
+
+30
+58
+132
+
+
+62
+176
+125
+
+
+180
+270
+125
+
+
+278
+431
+125
+
+
+432
+846
+125
+
+
+857
+1304
+125
+
+
+1365
+3518
+125
+
+
+3737
+9376
+125
+
+
+9525
+13591
+125
+
+
+14018
+26850
+125
+
+
+26982
+35719
+125
+
+
+35858
+41835
+76
+
+
+
+
+
+
+endColumn
+offset
+
+
+12
+
+
+2
+9
+125
+
+
+9
+25
+132
+
+
+27
+52
+125
+
+
+53
+75
+125
+
+
+75
+100
+125
+
+
+112
+159
+125
+
+
+159
+191
+132
+
+
+191
+274
+125
+
+
+294
+455
+125
+
+
+461
+580
+125
+
+
+584
+789
+125
+
+
+791
+956
+125
+
+
+978
+1265
+76
+
+
+
+
+
+
+endColumn
+beginLine
+
+
+12
+
+
+2
+8
+104
+
+
+9
+13
+125
+
+
+13
+35
+125
+
+
+37
+61
+125
+
+
+65
+114
+125
+
+
+118
+269
+125
+
+
+279
+454
+125
+
+
+455
+1242
+125
+
+
+1257
+3972
+125
+
+
+4012
+9064
+125
+
+
+9096
+14469
+125
+
+
+14530
+88904
+125
+
+
+89377
+97930
+111
+
+
+
+
+
+
+endColumn
+beginColumn
+
+
+12
+
+
+1
+2
+104
+
+
+2
+3
+90
+
+
+3
+5
+146
+
+
+5
+7
+118
+
+
+7
+10
+125
+
+
+10
+15
+111
+
+
+15
+19
+111
+
+
+19
+24
+146
+
+
+24
+27
+125
+
+
+27
+33
+139
+
+
+33
+35
+48
+
+
+35
+37
+132
+
+
+37
+41
+146
+
+
+41
+43
+48
+
+
+
+
+
+
+endColumn
+endLine
+
+
+12
+
+
+2
+8
+104
+
+
+9
+13
+125
+
+
+13
+35
+125
+
+
+37
+61
+125
+
+
+65
+114
+125
+
+
+118
+269
+125
+
+
+279
+454
+125
+
+
+455
+1242
+125
+
+
+1257
+3972
+125
+
+
+4012
+9064
+125
+
+
+9096
+14469
+125
+
+
+14530
+88904
+125
+
+
+89377
+97930
+111
+
+
+
+
+
+
+
+
+external_packages
+4
+
+
+id
+4
+
+
+namespace
+1
+
+
+package_name
+4
+
+
+version
+4
+
+
+
+
+id
+namespace
+
+
+12
+
+
+1
+2
+4
+
+
+
+
+
+
+id
+package_name
+
+
+12
+
+
+1
+2
+4
+
+
+
+
+
+
+id
+version
+
+
+12
+
+
+1
+2
+4
+
+
+
+
+
+
+namespace
+id
+
+
+12
+
+
+4
+5
+1
+
+
+
+
+
+
+namespace
+package_name
+
+
+12
+
+
+4
+5
+1
+
+
+
+
+
+
+namespace
+version
+
+
+12
+
+
+4
+5
+1
+
+
+
+
+
+
+package_name
+id
+
+
+12
+
+
+1
+2
+4
+
+
+
+
+
+
+package_name
+namespace
+
+
+12
+
+
+1
+2
+4
+
+
+
+
+
+
+package_name
+version
+
+
+12
+
+
+1
+2
+4
+
+
+
+
+
+
+version
+id
+
+
+12
+
+
+1
+2
+4
+
+
+
+
+
+
+version
+namespace
+
+
+12
+
+
+1
+2
+4
+
+
+
+
+
+
+version
+package_name
+
+
+12
+
+
+1
+2
+4
+
+
+
+
+
+
+
+
+header_to_external_package
+92
+
+
+fileid
+92
+
+
+package
+4
+
+
+
+
+fileid
+package
+
+
+12
+
+
+1
+2
+92
+
+
+
+
+
+
+package
+fileid
+
+
+12
+
+
+1
+2
+1
+
+
+5
+6
+1
+
+
+6
+7
+1
+
+
+80
+81
+1
+
+
+
+
+
+
+
+
+svnentries
+575525
+
+
+id
+575525
+
+
+revision
+575525
+
+
+author
+19539
+
+
+revisionDate
+547759
+
+
+changeSize
+1
+
+
+
+
+id
+revision
+
+
+12
+
+
+1
+2
+575525
+
+
+
+
+
+
+id
+author
+
+
+12
+
+
+1
+2
+575525
+
+
+
+
+
+
+id
+revisionDate
+
+
+12
+
+
+1
+2
+575525
+
+
+
+
+
+
+id
+changeSize
+
+
+12
+
+
+1
+2
+575525
+
+
+
+
+
+
+revision
+id
+
+
+12
+
+
+1
+2
+575525
+
+
+
+
+
+
+revision
+author
+
+
+12
+
+
+1
+2
+575525
+
+
+
+
+
+
+revision
+revisionDate
+
+
+12
+
+
+1
+2
+575525
+
+
+
+
+
+
+revision
+changeSize
+
+
+12
+
+
+1
+2
+575525
+
+
+
+
+
+
+author
+id
+
+
+12
+
+
+1
+2
+7913
+
+
+2
+3
+2531
+
+
+3
+4
+1388
+
+
+4
+6
+1523
+
+
+6
+10
+1529
+
+
+10
+20
+1509
+
+
+20
+52
+1488
+
+
+52
+568
+1466
+
+
+569
+16582
+192
+
+
+
+
+
+
+author
+revision
+
+
+12
+
+
+1
+2
+7913
+
+
+2
+3
+2531
+
+
+3
+4
+1388
+
+
+4
+6
+1523
+
+
+6
+10
+1529
+
+
+10
+20
+1509
+
+
+20
+52
+1488
+
+
+52
+568
+1466
+
+
+569
+16582
+192
+
+
+
+
+
+
+author
+revisionDate
+
+
+12
+
+
+1
+2
+7996
+
+
+2
+3
+2509
+
+
+3
+4
+1379
+
+
+4
+6
+1520
+
+
+6
+10
+1529
+
+
+10
+20
+1507
+
+
+20
+52
+1474
+
+
+52
+662
+1466
+
+
+663
+16573
+159
+
+
+
+
+
+
+author
+changeSize
+
+
+12
+
+
+1
+2
+19539
+
+
+
+
+
+
+revisionDate
+id
+
+
+12
+
+
+1
+2
+531878
+
+
+2
+100
+15881
+
+
+
+
+
+
+revisionDate
+revision
+
+
+12
+
+
+1
+2
+531878
+
+
+2
+100
+15881
+
+
+
+
+
+
+revisionDate
+author
+
+
+12
+
+
+1
+2
+542505
+
+
+2
+17
+5254
+
+
+
+
+
+
+revisionDate
+changeSize
+
+
+12
+
+
+1
+2
+547759
+
+
+
+
+
+
+changeSize
+id
+
+
+12
+
+
+575525
+575526
+1
+
+
+
+
+
+
+changeSize
+revision
+
+
+12
+
+
+575525
+575526
+1
+
+
+
+
+
+
+changeSize
+author
+
+
+12
+
+
+19539
+19540
+1
+
+
+
+
+
+
+changeSize
+revisionDate
+
+
+12
+
+
+547759
+547760
+1
+
+
+
+
+
+
+
+
+svnaffectedfiles
+1314068
+
+
+id
+531628
+
+
+file
+90924
+
+
+action
+1
+
+
+
+
+id
+file
+
+
+12
+
+
+1
+2
+337698
+
+
+2
+3
+77525
+
+
+3
+4
+43024
+
+
+4
+7
+46689
+
+
+7
+16635
+26692
+
+
+
+
+
+
+id
+action
+
+
+12
+
+
+1
+2
+531628
+
+
+
+
+
+
+file
+id
+
+
+12
+
+
+1
+2
+11819
+
+
+2
+3
+18230
+
+
+3
+4
+9501
+
+
+4
+5
+6656
+
+
+5
+6
+5012
+
+
+6
+8
+7103
+
+
+8
+11
+6788
+
+
+11
+16
+6996
+
+
+16
+26
+7180
+
+
+26
+54
+6824
+
+
+54
+3572
+4815
+
+
+
+
+
+
+file
+action
+
+
+12
+
+
+1
+2
+90924
+
+
+
+
+
+
+action
+id
+
+
+12
+
+
+531628
+531629
+1
+
+
+
+
+
+
+action
+file
+
+
+12
+
+
+90924
+90925
+1
+
+
+
+
+
+
+
+
+svnentrymsg
+575525
+
+
+id
+575525
+
+
+message
+568305
+
+
+
+
+id
+message
+
+
+12
+
+
+1
+2
+575525
+
+
+
+
+
+
+message
+id
+
+
+12
+
+
+1
+2
+565381
+
+
+2
+142
+2924
+
+
+
+
+
+
+
+
+svnchurn
+46790
+
+
+commit
+22361
+
+
+file
+16124
+
+
+addedLines
+910
+
+
+deletedLines
+787
+
+
+
+
+commit
+file
+
+
+12
+
+
+1
+2
+15208
+
+
+2
+3
+3101
+
+
+3
+4
+1746
+
+
+4
+8
+1774
+
+
+8
+246
+532
+
+
+
+
+
+
+commit
+addedLines
+
+
+12
+
+
+1
+2
+16074
+
+
+2
+3
+3323
+
+
+3
+4
+1561
+
+
+4
+118
+1403
+
+
+
+
+
+
+commit
+deletedLines
+
+
+12
+
+
+1
+2
+16799
+
+
+2
+3
+3286
+
+
+3
+5
+1763
+
+
+5
+113
+513
+
+
+
+
+
+
+file
+commit
+
+
+12
+
+
+1
+2
+8618
+
+
+2
+3
+2956
+
+
+3
+4
+1426
+
+
+4
+6
+1364
+
+
+6
+12
+1210
+
+
+12
+448
+550
+
+
+
+
+
+
+file
+addedLines
+
+
+12
+
+
+1
+2
+9240
+
+
+2
+3
+3129
+
+
+3
+4
+1393
+
+
+4
+6
+1239
+
+
+6
+59
+1123
+
+
+
+
+
+
+file
+deletedLines
+
+
+12
+
+
+1
+2
+9525
+
+
+2
+3
+3192
+
+
+3
+4
+1401
+
+
+4
+7
+1387
+
+
+7
+70
+619
+
+
+
+
+
+
+addedLines
+commit
+
+
+12
+
+
+1
+2
+446
+
+
+2
+3
+133
+
+
+3
+4
+70
+
+
+4
+6
+68
+
+
+6
+12
+70
+
+
+12
+57
+69
+
+
+57
+6874
+54
+
+
+
+
+
+
+addedLines
+file
+
+
+12
+
+
+1
+2
+445
+
+
+2
+3
+132
+
+
+3
+4
+69
+
+
+4
+6
+68
+
+
+6
+12
+73
+
+
+12
+58
+69
+
+
+58
+6663
+54
+
+
+
+
+
+
+addedLines
+deletedLines
+
+
+12
+
+
+1
+2
+621
+
+
+2
+3
+96
+
+
+3
+7
+81
+
+
+7
+34
+70
+
+
+34
+727
+42
+
+
+
+
+
+
+deletedLines
+commit
+
+
+12
+
+
+1
+2
+439
+
+
+2
+3
+116
+
+
+3
+4
+48
+
+
+4
+8
+67
+
+
+8
+28
+60
+
+
+28
+6794
+57
+
+
+
+
+
+
+deletedLines
+file
+
+
+12
+
+
+1
+2
+437
+
+
+2
+3
+113
+
+
+3
+4
+49
+
+
+4
+7
+61
+
+
+7
+19
+60
+
+
+19
+770
+60
+
+
+985
+7318
+7
+
+
+
+
+
+
+deletedLines
+addedLines
+
+
+12
+
+
+1
+2
+545
+
+
+2
+3
+72
+
+
+3
+7
+69
+
+
+7
+30
+60
+
+
+30
+871
+41
+
+
+
+
+
+
+
+
+locations_default
+8232279
+
+
+id
+8232279
+
+
+container
+65431
+
+
+startLine
+133582
+
+
+startColumn
+6069
+
+
+endLine
+133471
+
+
+endColumn
+8122
+
+
+
+
+id
+container
+
+
+12
+
+
+1
+2
+8232279
+
+
+
+
+
+
+id
+startLine
+
+
+12
+
+
+1
+2
+8232279
+
+
+
+
+
+
+id
+startColumn
+
+
+12
+
+
+1
+2
+8232279
+
+
+
+
+
+
+id
+endLine
+
+
+12
+
+
+1
+2
+8232279
+
+
+
+
+
+
+id
+endColumn
+
+
+12
+
+
+1
+2
+8232279
+
+
+
+
+
+
+container
+id
+
+
+12
+
+
+1
+2
+8621
+
+
+2
+19
+5603
+
+
+19
+25
+5525
+
+
+25
+31
+5270
+
+
+31
+40
+5004
+
+
+40
+51
+4970
+
+
+51
+68
+5137
+
+
+68
+90
+4970
+
+
+90
+122
+4926
+
+
+122
+181
+4915
+
+
+181
+315
+4937
+
+
+315
+1243
+4915
+
+
+1268
+18386
+632
+
+
+
+
+
+
+container
+startLine
+
+
+12
+
+
+1
+2
+8621
+
+
+2
+15
+5514
+
+
+15
+20
+5991
+
+
+20
+25
+5392
+
+
+25
+32
+5803
+
+
+32
+41
+5292
+
+
+41
+52
+5026
+
+
+52
+67
+4948
+
+
+67
+91
+5015
+
+
+91
+138
+4948
+
+
+138
+259
+4915
+
+
+259
+8116
+3961
+
+
+
+
+
+
+container
+startColumn
+
+
+12
+
+
+1
+2
+8621
+
+
+2
+4
+6002
+
+
+4
+8
+6002
+
+
+8
+11
+4859
+
+
+11
+14
+5581
+
+
+14
+18
+6013
+
+
+18
+23
+5547
+
+
+23
+29
+5736
+
+
+29
+36
+5015
+
+
+36
+48
+5237
+
+
+48
+70
+5059
+
+
+70
+187
+1753
+
+
+
+
+
+
+container
+endLine
+
+
+12
+
+
+1
+2
+8621
+
+
+2
+15
+5525
+
+
+15
+20
+5958
+
+
+20
+25
+5370
+
+
+25
+32
+5703
+
+
+32
+41
+5337
+
+
+41
+52
+5148
+
+
+52
+68
+5192
+
+
+68
+92
+4948
+
+
+92
+140
+4915
+
+
+140
+265
+4926
+
+
+265
+8116
+3783
+
+
+
+
+
+
+container
+endColumn
+
+
+12
+
+
+1
+2
+8621
+
+
+2
+14
+5081
+
+
+14
+19
+5902
+
+
+19
+23
+5736
+
+
+23
+27
+5481
+
+
+27
+32
+5325
+
+
+32
+38
+4959
+
+
+38
+45
+5581
+
+
+45
+54
+5203
+
+
+54
+65
+5226
+
+
+65
+80
+5092
+
+
+80
+215
+3217
+
+
+
+
+
+
+startLine
+id
+
+
+12
+
+
+1
+2
+20937
+
+
+2
+3
+15866
+
+
+3
+4
+14269
+
+
+4
+5
+10208
+
+
+5
+6
+7467
+
+
+6
+7
+6036
+
+
+7
+8
+6768
+
+
+8
+10
+10330
+
+
+10
+14
+10585
+
+
+14
+31
+10041
+
+
+31
+117
+10030
+
+
+117
+1729
+10019
+
+
+1734
+5898
+1020
+
+
+
+
+
+
+startLine
+container
+
+
+12
+
+
+1
+2
+38413
+
+
+2
+3
+33908
+
+
+3
+4
+9387
+
+
+4
+5
+8565
+
+
+5
+7
+11473
+
+
+7
+17
+10374
+
+
+17
+62
+10052
+
+
+62
+820
+10019
+
+
+821
+5898
+1386
+
+
+
+
+
+
+startLine
+startColumn
+
+
+12
+
+
+1
+2
+21891
+
+
+2
+3
+15556
+
+
+3
+4
+16721
+
+
+4
+5
+9398
+
+
+5
+6
+8011
+
+
+6
+7
+5891
+
+
+7
+8
+7489
+
+
+8
+10
+10052
+
+
+10
+14
+10518
+
+
+14
+29
+10219
+
+
+29
+63
+10197
+
+
+63
+164
+7633
+
+
+
+
+
+
+startLine
+endLine
+
+
+12
+
+
+1
+2
+97997
+
+
+2
+3
+15600
+
+
+3
+6
+10596
+
+
+6
+177
+9387
+
+
+
+
+
+
+startLine
+endColumn
+
+
+12
+
+
+1
+2
+21581
+
+
+2
+3
+15866
+
+
+3
+4
+15012
+
+
+4
+5
+10330
+
+
+5
+6
+7767
+
+
+6
+7
+5958
+
+
+7
+8
+6857
+
+
+8
+10
+10629
+
+
+10
+14
+10341
+
+
+14
+31
+10152
+
+
+31
+73
+10119
+
+
+73
+196
+8965
+
+
+
+
+
+
+startColumn
+id
+
+
+12
+
+
+1
+2
+1353
+
+
+2
+3
+1020
+
+
+3
+5
+488
+
+
+5
+9
+554
+
+
+9
+21
+466
+
+
+21
+49
+466
+
+
+50
+157
+466
+
+
+165
+1206
+477
+
+
+1337
+7569
+466
+
+
+7573
+184045
+310
+
+
+
+
+
+
+startColumn
+container
+
+
+12
+
+
+1
+2
+2907
+
+
+2
+3
+443
+
+
+3
+6
+477
+
+
+6
+14
+488
+
+
+14
+65
+466
+
+
+66
+358
+466
+
+
+393
+1478
+466
+
+
+1509
+5898
+355
+
+
+
+
+
+
+startColumn
+startLine
+
+
+12
+
+
+1
+2
+1386
+
+
+2
+3
+1009
+
+
+3
+5
+477
+
+
+5
+8
+466
+
+
+8
+17
+510
+
+
+17
+43
+466
+
+
+45
+119
+466
+
+
+120
+570
+466
+
+
+577
+1853
+466
+
+
+1863
+5945
+355
+
+
+
+
+
+
+startColumn
+endLine
+
+
+12
+
+
+1
+2
+1386
+
+
+2
+3
+1009
+
+
+3
+5
+477
+
+
+5
+8
+466
+
+
+8
+17
+510
+
+
+17
+43
+466
+
+
+45
+119
+466
+
+
+121
+570
+466
+
+
+577
+1855
+466
+
+
+1861
+5942
+355
+
+
+
+
+
+
+startColumn
+endColumn
+
+
+12
+
+
+1
+2
+3051
+
+
+2
+3
+454
+
+
+3
+7
+510
+
+
+7
+13
+477
+
+
+13
+28
+466
+
+
+28
+55
+477
+
+
+56
+108
+466
+
+
+114
+426
+166
+
+
+
+
+
+
+endLine
+id
+
+
+12
+
+
+1
+2
+20948
+
+
+2
+3
+15611
+
+
+3
+4
+14280
+
+
+4
+5
+10119
+
+
+5
+6
+7467
+
+
+6
+7
+6246
+
+
+7
+8
+7123
+
+
+8
+10
+9875
+
+
+10
+14
+10640
+
+
+14
+31
+10074
+
+
+31
+118
+10097
+
+
+118
+1791
+10019
+
+
+1807
+5898
+965
+
+
+
+
+
+
+endLine
+container
+
+
+12
+
+
+1
+2
+38335
+
+
+2
+3
+33853
+
+
+3
+4
+9320
+
+
+4
+5
+8454
+
+
+5
+7
+11661
+
+
+7
+17
+10418
+
+
+17
+63
+10130
+
+
+63
+897
+10019
+
+
+898
+5898
+1276
+
+
+
+
+
+
+endLine
+startLine
+
+
+12
+
+
+1
+2
+97354
+
+
+2
+3
+15445
+
+
+3
+6
+10374
+
+
+6
+37
+10019
+
+
+37
+44
+277
+
+
+
+
+
+
+endLine
+startColumn
+
+
+12
+
+
+1
+2
+21880
+
+
+2
+3
+15345
+
+
+3
+4
+16821
+
+
+4
+5
+9298
+
+
+5
+6
+7988
+
+
+6
+7
+6080
+
+
+7
+8
+7378
+
+
+8
+10
+10041
+
+
+10
+14
+10596
+
+
+14
+29
+10185
+
+
+29
+63
+10185
+
+
+63
+164
+7667
+
+
+
+
+
+
+endLine
+endColumn
+
+
+12
+
+
+1
+2
+21614
+
+
+2
+3
+15600
+
+
+3
+4
+15045
+
+
+4
+5
+10174
+
+
+5
+6
+8011
+
+
+6
+7
+5914
+
+
+7
+8
+7190
+
+
+8
+10
+10197
+
+
+10
+14
+10463
+
+
+14
+31
+10119
+
+
+31
+73
+10152
+
+
+73
+196
+8987
+
+
+
+
+
+
+endColumn
+id
+
+
+12
+
+
+1
+2
+2696
+
+
+2
+3
+1043
+
+
+3
+4
+554
+
+
+4
+7
+599
+
+
+7
+17
+665
+
+
+17
+58
+632
+
+
+60
+246
+610
+
+
+268
+5177
+610
+
+
+5177
+13550
+610
+
+
+13603
+22043
+99
+
+
+
+
+
+
+endColumn
+container
+
+
+12
+
+
+1
+2
+3561
+
+
+2
+3
+954
+
+
+3
+4
+532
+
+
+4
+9
+643
+
+
+9
+27
+621
+
+
+27
+197
+610
+
+
+200
+1849
+610
+
+
+1899
+5898
+588
+
+
+
+
+
+
+endColumn
+startLine
+
+
+12
+
+
+1
+2
+2707
+
+
+2
+3
+1065
+
+
+3
+4
+532
+
+
+4
+7
+599
+
+
+7
+17
+676
+
+
+17
+53
+610
+
+
+53
+215
+610
+
+
+217
+1337
+610
+
+
+1362
+2896
+610
+
+
+2914
+4469
+99
+
+
+
+
+
+
+endColumn
+startColumn
+
+
+12
+
+
+1
+2
+3705
+
+
+2
+3
+1054
+
+
+3
+5
+721
+
+
+5
+13
+610
+
+
+13
+27
+610
+
+
+27
+50
+632
+
+
+50
+76
+621
+
+
+76
+81
+166
+
+
+
+
+
+
+endColumn
+endLine
+
+
+12
+
+
+1
+2
+2707
+
+
+2
+3
+1065
+
+
+3
+4
+532
+
+
+4
+7
+599
+
+
+7
+15
+610
+
+
+15
+46
+610
+
+
+46
+176
+621
+
+
+182
+1211
+610
+
+
+1221
+2450
+610
+
+
+2609
+4469
+155
+
+
+
+
+
+
+
+
+locations_stmt
+5631060
+
+
+id
+5631060
+
+
+container
+9396
+
+
+startLine
+46320
+
+
+startColumn
+299
+
+
+endLine
+44708
+
+
+endColumn
+412
+
+
+
+
+id
+container
+
+
+12
+
+
+1
+2
+5631060
+
+
+
+
+
+
+id
+startLine
+
+
+12
+
+
+1
+2
+5631060
+
+
+
+
+
+
+id
+startColumn
+
+
+12
+
+
+1
+2
+5631060
+
+
+
+
+
+
+id
+endLine
+
+
+12
+
+
+1
+2
+5631060
+
+
+
+
+
+
+id
+endColumn
+
+
+12
+
+
+1
+2
+5631060
+
+
+
+
+
+
+container
+id
+
+
+12
+
+
+1
+6
+709
+
+
+6
+14
+759
+
+
+14
+27
+737
+
+
+27
+48
+729
+
+
+48
+76
+729
+
+
+76
+115
+726
+
+
+115
+171
+709
+
+
+171
+237
+712
+
+
+237
+348
+707
+
+
+348
+528
+712
+
+
+528
+840
+709
+
+
+841
+1620
+707
+
+
+1620
+11419
+707
+
+
+11860
+84476
+38
+
+
+
+
+
+
+container
+startLine
+
+
+12
+
+
+1
+5
+819
+
+
+5
+11
+723
+
+
+11
+20
+745
+
+
+20
+33
+740
+
+
+33
+52
+715
+
+
+52
+73
+718
+
+
+73
+105
+718
+
+
+105
+153
+709
+
+
+153
+209
+707
+
+
+209
+307
+715
+
+
+307
+490
+707
+
+
+490
+903
+707
+
+
+903
+10013
+668
+
+
+
+
+
+
+container
+startColumn
+
+
+12
+
+
+1
+2
+126
+
+
+2
+3
+1350
+
+
+3
+4
+830
+
+
+4
+5
+520
+
+
+5
+7
+756
+
+
+7
+9
+605
+
+
+9
+12
+748
+
+
+12
+16
+797
+
+
+16
+21
+742
+
+
+21
+27
+726
+
+
+27
+35
+729
+
+
+35
+46
+723
+
+
+46
+71
+715
+
+
+71
+76
+22
+
+
+
+
+
+
+container
+endLine
+
+
+12
+
+
+1
+5
+869
+
+
+5
+11
+778
+
+
+11
+19
+742
+
+
+19
+31
+740
+
+
+31
+49
+712
+
+
+49
+69
+715
+
+
+69
+99
+718
+
+
+99
+142
+720
+
+
+142
+198
+715
+
+
+198
+292
+709
+
+
+292
+469
+707
+
+
+469
+894
+707
+
+
+895
+8668
+558
+
+
+
+
+
+
+container
+endColumn
+
+
+12
+
+
+1
+3
+594
+
+
+3
+6
+808
+
+
+6
+10
+756
+
+
+10
+15
+718
+
+
+15
+22
+751
+
+
+22
+29
+709
+
+
+29
+38
+740
+
+
+38
+46
+759
+
+
+46
+53
+759
+
+
+53
+60
+773
+
+
+60
+67
+817
+
+
+67
+73
+729
+
+
+73
+109
+478
+
+
+
+
+
+
+startLine
+id
+
+
+12
+
+
+1
+2
+8650
+
+
+2
+3
+7420
+
+
+3
+4
+3719
+
+
+4
+6
+3667
+
+
+6
+10
+3582
+
+
+10
+19
+3615
+
+
+19
+37
+3486
+
+
+37
+81
+3491
+
+
+81
+228
+3475
+
+
+228
+953
+3475
+
+
+953
+5507
+1736
+
+
+
+
+
+
+startLine
+container
+
+
+12
+
+
+1
+2
+9822
+
+
+2
+3
+8620
+
+
+3
+4
+3923
+
+
+4
+6
+3392
+
+
+6
+11
+3981
+
+
+11
+22
+3552
+
+
+22
+42
+3563
+
+
+42
+98
+3483
+
+
+98
+299
+3480
+
+
+299
+946
+2501
+
+
+
+
+
+
+startLine
+startColumn
+
+
+12
+
+
+1
+2
+11338
+
+
+2
+3
+9473
+
+
+3
+4
+5123
+
+
+4
+5
+3191
+
+
+5
+7
+3975
+
+
+7
+10
+3695
+
+
+10
+17
+3821
+
+
+17
+35
+3538
+
+
+35
+65
+2162
+
+
+
+
+
+
+startLine
+endLine
+
+
+12
+
+
+1
+2
+15862
+
+
+2
+3
+9261
+
+
+3
+4
+3937
+
+
+4
+6
+4149
+
+
+6
+9
+3626
+
+
+9
+15
+3629
+
+
+15
+27
+3549
+
+
+27
+62
+2305
+
+
+
+
+
+
+startLine
+endColumn
+
+
+12
+
+
+1
+2
+9544
+
+
+2
+3
+8276
+
+
+3
+4
+4212
+
+
+4
+6
+3830
+
+
+6
+10
+3656
+
+
+10
+18
+3684
+
+
+18
+29
+3560
+
+
+29
+46
+3488
+
+
+46
+64
+3477
+
+
+64
+84
+2589
+
+
+
+
+
+
+startColumn
+id
+
+
+12
+
+
+1
+2
+19
+
+
+2
+3
+13
+
+
+3
+7
+24
+
+
+7
+20
+24
+
+
+22
+177
+24
+
+
+217
+428
+24
+
+
+563
+874
+24
+
+
+964
+1575
+24
+
+
+1900
+2624
+24
+
+
+2880
+4018
+24
+
+
+4047
+5227
+24
+
+
+5723
+27012
+24
+
+
+32000
+631138
+19
+
+
+
+
+
+
+startColumn
+container
+
+
+12
+
+
+1
+2
+22
+
+
+2
+4
+27
+
+
+4
+12
+24
+
+
+14
+74
+24
+
+
+120
+246
+24
+
+
+280
+418
+24
+
+
+444
+562
+24
+
+
+577
+732
+27
+
+
+739
+778
+24
+
+
+791
+836
+24
+
+
+840
+973
+24
+
+
+977
+3376
+24
+
+
+
+
+
+
+startColumn
+startLine
+
+
+12
+
+
+1
+2
+19
+
+
+2
+3
+13
+
+
+3
+7
+24
+
+
+7
+19
+24
+
+
+20
+169
+24
+
+
+193
+375
+24
+
+
+446
+688
+24
+
+
+780
+1061
+24
+
+
+1091
+1251
+24
+
+
+1279
+1359
+24
+
+
+1364
+1475
+24
+
+
+1568
+2722
+24
+
+
+3168
+13523
+19
+
+
+
+
+
+
+startColumn
+endLine
+
+
+12
+
+
+1
+2
+19
+
+
+2
+3
+13
+
+
+3
+7
+24
+
+
+7
+19
+24
+
+
+20
+173
+24
+
+
+192
+384
+24
+
+
+453
+681
+24
+
+
+794
+1045
+24
+
+
+1088
+1247
+24
+
+
+1258
+1359
+24
+
+
+1366
+1484
+24
+
+
+1530
+2730
+24
+
+
+2911
+13557
+19
+
+
+
+
+
+
+startColumn
+endColumn
+
+
+12
+
+
+1
+2
+22
+
+
+2
+3
+24
+
+
+3
+5
+27
+
+
+5
+10
+19
+
+
+10
+12
+24
+
+
+12
+15
+19
+
+
+16
+23
+22
+
+
+23
+36
+24
+
+
+38
+59
+24
+
+
+59
+65
+27
+
+
+65
+69
+24
+
+
+69
+87
+24
+
+
+101
+133
+13
+
+
+
+
+
+
+endLine
+id
+
+
+12
+
+
+1
+2
+7461
+
+
+2
+3
+6193
+
+
+3
+4
+4055
+
+
+4
+6
+3912
+
+
+6
+10
+3752
+
+
+10
+18
+3442
+
+
+18
+36
+3527
+
+
+36
+74
+3370
+
+
+74
+202
+3362
+
+
+202
+744
+3354
+
+
+745
+4894
+2275
+
+
+
+
+
+
+endLine
+container
+
+
+12
+
+
+1
+2
+10568
+
+
+2
+3
+7792
+
+
+3
+4
+3607
+
+
+4
+6
+3106
+
+
+6
+11
+3791
+
+
+11
+22
+3516
+
+
+22
+42
+3356
+
+
+42
+94
+3365
+
+
+94
+288
+3356
+
+
+288
+838
+2247
+
+
+
+
+
+
+endLine
+startLine
+
+
+12
+
+
+1
+2
+13721
+
+
+2
+3
+9269
+
+
+3
+4
+4292
+
+
+4
+5
+2536
+
+
+5
+7
+3150
+
+
+7
+11
+3631
+
+
+11
+18
+3439
+
+
+18
+33
+3370
+
+
+33
+51
+1295
+
+
+
+
+
+
+endLine
+startColumn
+
+
+12
+
+
+1
+2
+9679
+
+
+2
+3
+9349
+
+
+3
+4
+5456
+
+
+4
+5
+3343
+
+
+5
+7
+3824
+
+
+7
+10
+3568
+
+
+10
+16
+3475
+
+
+16
+31
+3389
+
+
+31
+59
+2622
+
+
+
+
+
+
+endLine
+endColumn
+
+
+12
+
+
+1
+2
+10265
+
+
+2
+3
+7676
+
+
+3
+4
+3857
+
+
+4
+6
+3307
+
+
+6
+10
+3538
+
+
+10
+18
+3615
+
+
+18
+29
+3381
+
+
+29
+46
+3395
+
+
+46
+65
+3472
+
+
+65
+84
+2198
+
+
+
+
+
+
+endColumn
+id
+
+
+12
+
+
+1
+2
+44
+
+
+2
+4
+33
+
+
+4
+10
+33
+
+
+10
+39
+33
+
+
+41
+108
+33
+
+
+121
+2080
+33
+
+
+2761
+5372
+33
+
+
+6979
+16637
+33
+
+
+16827
+22261
+33
+
+
+22373
+26352
+33
+
+
+26608
+28939
+33
+
+
+29002
+39436
+33
+
+
+105141
+513216
+5
+
+
+
+
+
+
+endColumn
+container
+
+
+12
+
+
+1
+2
+57
+
+
+2
+3
+19
+
+
+3
+7
+35
+
+
+7
+19
+33
+
+
+20
+49
+33
+
+
+62
+263
+33
+
+
+513
+1036
+33
+
+
+1086
+1395
+33
+
+
+1398
+1737
+33
+
+
+1737
+1886
+33
+
+
+1893
+1950
+33
+
+
+1951
+2346
+33
+
+
+3360
+3361
+2
+
+
+
+
+
+
+endColumn
+startLine
+
+
+12
+
+
+1
+2
+49
+
+
+2
+3
+24
+
+
+3
+6
+30
+
+
+7
+21
+33
+
+
+21
+42
+33
+
+
+57
+271
+33
+
+
+290
+1569
+33
+
+
+1578
+2600
+33
+
+
+2675
+3394
+33
+
+
+3507
+4212
+33
+
+
+4223
+4454
+33
+
+
+4506
+5479
+33
+
+
+5487
+7385
+11
+
+
+
+
+
+
+endColumn
+startColumn
+
+
+12
+
+
+1
+2
+55
+
+
+2
+3
+30
+
+
+3
+4
+27
+
+
+4
+6
+33
+
+
+6
+13
+33
+
+
+14
+22
+33
+
+
+22
+31
+33
+
+
+32
+37
+35
+
+
+37
+44
+35
+
+
+44
+49
+33
+
+
+49
+53
+35
+
+
+53
+100
+27
+
+
+
+
+
+
+endColumn
+endLine
+
+
+12
+
+
+1
+2
+55
+
+
+2
+3
+22
+
+
+3
+7
+33
+
+
+7
+21
+35
+
+
+22
+59
+33
+
+
+77
+372
+33
+
+
+764
+1800
+33
+
+
+1820
+2849
+33
+
+
+2893
+3480
+33
+
+
+3651
+4070
+33
+
+
+4091
+4246
+33
+
+
+4256
+6581
+33
+
+
+7012
+7013
+2
+
+
+
+
+
+
+
+
+locations_expr
+22023911
+
+
+id
+22023911
+
+
+container
+4089
+
+
+startLine
+229350
+
+
+startColumn
+504
+
+
+endLine
+229860
+
+
+endColumn
+600
+
+
+
+
+id
+container
+
+
+12
+
+
+1
+2
+22023911
+
+
+
+
+
+
+id
+startLine
+
+
+12
+
+
+1
+2
+22023911
+
+
+
+
+
+
+id
+startColumn
+
+
+12
+
+
+1
+2
+22023911
+
+
+
+
+
+
+id
+endLine
+
+
+12
+
+
+1
+2
+22023911
+
+
+
+
+
+
+id
+endColumn
+
+
+12
+
+
+1
+2
+22023911
+
+
+
+
+
+
+container
+id
+
+
+12
+
+
+1
+18
+307
+
+
+18
+35
+309
+
+
+35
+91
+309
+
+
+91
+231
+307
+
+
+231
+387
+311
+
+
+388
+590
+310
+
+
+590
+917
+307
+
+
+917
+1413
+307
+
+
+1415
+2130
+307
+
+
+2131
+3358
+307
+
+
+3360
+5751
+307
+
+
+5751
+11505
+307
+
+
+11533
+44558
+307
+
+
+44700
+908128
+77
+
+
+
+
+
+
+container
+startLine
+
+
+12
+
+
+1
+3
+302
+
+
+3
+7
+352
+
+
+7
+19
+318
+
+
+19
+40
+314
+
+
+40
+62
+314
+
+
+62
+90
+309
+
+
+90
+141
+309
+
+
+141
+207
+309
+
+
+207
+336
+307
+
+
+336
+522
+307
+
+
+522
+890
+307
+
+
+890
+1809
+307
+
+
+1813
+11869
+307
+
+
+12483
+139195
+19
+
+
+
+
+
+
+container
+startColumn
+
+
+12
+
+
+1
+3
+330
+
+
+3
+7
+313
+
+
+7
+20
+323
+
+
+20
+42
+321
+
+
+42
+54
+323
+
+
+54
+64
+335
+
+
+64
+74
+328
+
+
+74
+83
+313
+
+
+83
+92
+339
+
+
+92
+104
+322
+
+
+104
+119
+310
+
+
+119
+146
+310
+
+
+146
+330
+217
+
+
+
+
+
+
+container
+endLine
+
+
+12
+
+
+1
+3
+296
+
+
+3
+7
+356
+
+
+7
+19
+317
+
+
+19
+40
+313
+
+
+40
+61
+307
+
+
+61
+90
+313
+
+
+90
+141
+310
+
+
+141
+208
+310
+
+
+209
+339
+307
+
+
+339
+533
+309
+
+
+533
+902
+309
+
+
+905
+1894
+307
+
+
+1894
+11844
+307
+
+
+12485
+139999
+22
+
+
+
+
+
+
+container
+endColumn
+
+
+12
+
+
+1
+3
+283
+
+
+3
+7
+317
+
+
+7
+21
+326
+
+
+21
+47
+311
+
+
+47
+63
+334
+
+
+63
+74
+332
+
+
+74
+85
+330
+
+
+85
+95
+327
+
+
+95
+106
+338
+
+
+106
+120
+334
+
+
+120
+137
+319
+
+
+137
+165
+309
+
+
+165
+416
+225
+
+
+
+
+
+
+startLine
+id
+
+
+12
+
+
+1
+3
+11387
+
+
+3
+4
+10675
+
+
+4
+5
+23096
+
+
+5
+7
+7702
+
+
+7
+8
+19288
+
+
+8
+9
+2573
+
+
+9
+10
+25155
+
+
+10
+11
+18536
+
+
+11
+13
+18611
+
+
+13
+19
+19317
+
+
+19
+27
+18258
+
+
+27
+49
+17604
+
+
+49
+185
+17207
+
+
+185
+1650
+17205
+
+
+1650
+12866
+2730
+
+
+
+
+
+
+startLine
+container
+
+
+12
+
+
+1
+2
+124619
+
+
+2
+3
+26056
+
+
+3
+4
+18837
+
+
+4
+5
+16080
+
+
+5
+11
+17831
+
+
+11
+70
+17290
+
+
+70
+1186
+8633
+
+
+
+
+
+
+startLine
+startColumn
+
+
+12
+
+
+1
+2
+11418
+
+
+2
+3
+32844
+
+
+3
+4
+42846
+
+
+4
+5
+18227
+
+
+5
+6
+13390
+
+
+6
+7
+16116
+
+
+7
+9
+16527
+
+
+9
+12
+17531
+
+
+12
+17
+17493
+
+
+17
+30
+17810
+
+
+30
+95
+17257
+
+
+95
+196
+7887
+
+
+
+
+
+
+startLine
+endLine
+
+
+12
+
+
+1
+2
+116391
+
+
+2
+3
+74812
+
+
+3
+4
+14973
+
+
+4
+8
+19018
+
+
+8
+55
+4153
+
+
+
+
+
+
+startLine
+endColumn
+
+
+12
+
+
+1
+2
+22287
+
+
+2
+3
+39994
+
+
+3
+4
+26137
+
+
+4
+5
+17801
+
+
+5
+6
+23505
+
+
+6
+8
+11278
+
+
+8
+11
+20762
+
+
+11
+16
+18521
+
+
+16
+25
+17247
+
+
+25
+70
+17269
+
+
+70
+183
+14543
+
+
+
+
+
+
+startColumn
+id
+
+
+12
+
+
+1
+3
+39
+
+
+3
+6
+40
+
+
+6
+17
+39
+
+
+18
+63
+39
+
+
+67
+285
+38
+
+
+293
+961
+38
+
+
+1059
+2449
+38
+
+
+2583
+5443
+38
+
+
+5520
+11130
+38
+
+
+11557
+30611
+38
+
+
+31981
+74350
+38
+
+
+76021
+155966
+38
+
+
+161191
+675108
+38
+
+
+827342
+1129445
+3
+
+
+
+
+
+
+startColumn
+container
+
+
+12
+
+
+1
+2
+98
+
+
+2
+3
+39
+
+
+3
+8
+39
+
+
+8
+21
+39
+
+
+21
+55
+38
+
+
+56
+131
+38
+
+
+136
+336
+38
+
+
+341
+729
+38
+
+
+733
+1424
+38
+
+
+1471
+1972
+38
+
+
+2001
+2204
+38
+
+
+2210
+2528
+22
+
+
+
+
+
+
+startColumn
+startLine
+
+
+12
+
+
+1
+2
+55
+
+
+2
+4
+38
+
+
+4
+9
+38
+
+
+9
+30
+39
+
+
+31
+119
+38
+
+
+128
+344
+38
+
+
+368
+881
+39
+
+
+937
+2167
+38
+
+
+2203
+5695
+38
+
+
+5825
+11890
+38
+
+
+12106
+16720
+38
+
+
+16802
+25740
+38
+
+
+25952
+100812
+28
+
+
+
+
+
+
+startColumn
+endLine
+
+
+12
+
+
+1
+2
+55
+
+
+2
+4
+38
+
+
+4
+9
+38
+
+
+9
+30
+39
+
+
+31
+119
+38
+
+
+128
+344
+38
+
+
+368
+881
+39
+
+
+937
+2167
+38
+
+
+2204
+5695
+38
+
+
+5826
+11882
+38
+
+
+12096
+16722
+38
+
+
+16802
+25747
+38
+
+
+25952
+100803
+28
+
+
+
+
+
+
+startColumn
+endColumn
+
+
+12
+
+
+1
+2
+45
+
+
+2
+3
+43
+
+
+3
+4
+28
+
+
+4
+7
+38
+
+
+7
+13
+41
+
+
+13
+29
+38
+
+
+29
+48
+40
+
+
+48
+64
+38
+
+
+64
+86
+38
+
+
+86
+115
+38
+
+
+116
+154
+38
+
+
+154
+172
+39
+
+
+172
+292
+36
+
+
+
+
+
+
+endLine
+id
+
+
+12
+
+
+1
+3
+11894
+
+
+3
+4
+27646
+
+
+4
+6
+3709
+
+
+6
+7
+27277
+
+
+7
+9
+9505
+
+
+9
+10
+25862
+
+
+10
+12
+11199
+
+
+12
+13
+15813
+
+
+13
+17
+18651
+
+
+17
+24
+18713
+
+
+24
+40
+17830
+
+
+40
+111
+17254
+
+
+111
+682
+17248
+
+
+682
+12555
+7252
+
+
+
+
+
+
+endLine
+container
+
+
+12
+
+
+1
+2
+124920
+
+
+2
+3
+25883
+
+
+3
+4
+18722
+
+
+4
+5
+16270
+
+
+5
+11
+18123
+
+
+11
+73
+17298
+
+
+73
+1184
+8640
+
+
+
+
+
+
+endLine
+startLine
+
+
+12
+
+
+1
+2
+144556
+
+
+2
+3
+24454
+
+
+3
+4
+33678
+
+
+4
+7
+20357
+
+
+7
+23
+6812
+
+
+
+
+
+
+endLine
+startColumn
+
+
+12
+
+
+1
+2
+11894
+
+
+2
+3
+45878
+
+
+3
+4
+9882
+
+
+4
+5
+36610
+
+
+5
+6
+12359
+
+
+6
+7
+16776
+
+
+7
+9
+17358
+
+
+9
+12
+17962
+
+
+12
+17
+17368
+
+
+17
+29
+17835
+
+
+29
+92
+17288
+
+
+92
+196
+8644
+
+
+
+
+
+
+endLine
+endColumn
+
+
+12
+
+
+1
+2
+39524
+
+
+2
+3
+20467
+
+
+3
+4
+11696
+
+
+4
+5
+34241
+
+
+5
+6
+22970
+
+
+6
+8
+17793
+
+
+8
+12
+19985
+
+
+12
+18
+19862
+
+
+18
+34
+17734
+
+
+34
+107
+17342
+
+
+107
+185
+8240
+
+
+
+
+
+
+endColumn
+id
+
+
+12
+
+
+1
+3
+55
+
+
+3
+6
+49
+
+
+6
+11
+44
+
+
+11
+19
+45
+
+
+19
+76
+45
+
+
+82
+485
+45
+
+
+519
+1557
+45
+
+
+1577
+4435
+45
+
+
+4620
+13284
+45
+
+
+13504
+39571
+45
+
+
+44472
+101042
+45
+
+
+104467
+222423
+45
+
+
+222557
+374461
+38
+
+
+
+
+
+
+endColumn
+container
+
+
+12
+
+
+1
+2
+131
+
+
+2
+3
+58
+
+
+3
+9
+48
+
+
+9
+26
+45
+
+
+26
+66
+45
+
+
+69
+201
+47
+
+
+202
+538
+45
+
+
+544
+1085
+45
+
+
+1099
+1899
+45
+
+
+1909
+2234
+45
+
+
+2243
+2368
+39
+
+
+
+
+
+
+endColumn
+startLine
+
+
+12
+
+
+1
+2
+61
+
+
+2
+4
+47
+
+
+4
+10
+41
+
+
+10
+15
+45
+
+
+15
+37
+45
+
+
+43
+186
+45
+
+
+198
+606
+45
+
+
+635
+1783
+45
+
+
+1785
+5015
+45
+
+
+5017
+11631
+45
+
+
+11782
+17737
+45
+
+
+17876
+25461
+45
+
+
+25466
+57229
+36
+
+
+
+
+
+
+endColumn
+startColumn
+
+
+12
+
+
+1
+2
+61
+
+
+2
+3
+70
+
+
+3
+5
+49
+
+
+5
+12
+47
+
+
+12
+34
+47
+
+
+35
+54
+53
+
+
+54
+65
+45
+
+
+65
+82
+45
+
+
+82
+103
+45
+
+
+103
+123
+45
+
+
+123
+133
+48
+
+
+133
+152
+38
+
+
+
+
+
+
+endColumn
+endLine
+
+
+12
+
+
+1
+2
+61
+
+
+2
+4
+47
+
+
+4
+10
+41
+
+
+10
+15
+45
+
+
+15
+37
+45
+
+
+43
+186
+45
+
+
+198
+606
+45
+
+
+635
+1783
+45
+
+
+1787
+5010
+45
+
+
+5014
+11616
+45
+
+
+11748
+17725
+45
+
+
+17881
+25509
+45
+
+
+25511
+57229
+36
+
+
+
+
+
+
+
+
+numlines
+464735
+
+
+element_id
+464491
+
+
+num_lines
+9098
+
+
+num_code
+7234
+
+
+num_comment
+3805
+
+
+
+
+element_id
+num_lines
+
+
+12
+
+
+1
+2
+464291
+
+
+2
+7
+199
+
+
+
+
+
+
+element_id
+num_code
+
+
+12
+
+
+1
+2
+464336
+
+
+2
+7
+155
+
+
+
+
+
+
+element_id
+num_comment
+
+
+12
+
+
+1
+2
+464480
+
+
+2
+3
+11
+
+
+
+
+
+
+num_lines
+element_id
+
+
+12
+
+
+1
+2
+4094
+
+
+2
+3
+1242
+
+
+3
+4
+621
+
+
+4
+6
+721
+
+
+6
+11
+754
+
+
+11
+24
+721
+
+
+24
+116
+687
+
+
+125
+7329
+255
+
+
+
+
+
+
+num_lines
+num_code
+
+
+12
+
+
+1
+2
+4138
+
+
+2
+3
+1298
+
+
+3
+4
+599
+
+
+4
+6
+754
+
+
+6
+10
+776
+
+
+10
+18
+787
+
+
+18
+29
+732
+
+
+29
+30
+11
+
+
+
+
+
+
+num_lines
+num_comment
+
+
+12
+
+
+1
+2
+4105
+
+
+2
+3
+1298
+
+
+3
+4
+643
+
+
+4
+6
+732
+
+
+6
+10
+787
+
+
+10
+16
+765
+
+
+16
+24
+699
+
+
+24
+28
+66
+
+
+
+
+
+
+num_code
+element_id
+
+
+12
+
+
+1
+2
+2951
+
+
+2
+3
+1165
+
+
+3
+4
+565
+
+
+4
+6
+621
+
+
+6
+11
+565
+
+
+11
+24
+554
+
+
+24
+133
+543
+
+
+143
+7334
+266
+
+
+
+
+
+
+num_code
+num_lines
+
+
+12
+
+
+1
+2
+2984
+
+
+2
+3
+1153
+
+
+3
+4
+599
+
+
+4
+6
+610
+
+
+6
+11
+565
+
+
+11
+20
+543
+
+
+20
+34
+543
+
+
+34
+40
+233
+
+
+
+
+
+
+num_code
+num_comment
+
+
+12
+
+
+1
+2
+2973
+
+
+2
+3
+1176
+
+
+3
+4
+565
+
+
+4
+6
+621
+
+
+6
+11
+599
+
+
+11
+18
+554
+
+
+18
+29
+610
+
+
+29
+33
+133
+
+
+
+
+
+
+num_comment
+element_id
+
+
+12
+
+
+1
+2
+1753
+
+
+2
+3
+477
+
+
+3
+4
+210
+
+
+4
+7
+343
+
+
+7
+12
+288
+
+
+12
+27
+299
+
+
+34
+200
+288
+
+
+228
+33793
+144
+
+
+
+
+
+
+num_comment
+num_lines
+
+
+12
+
+
+1
+2
+1753
+
+
+2
+3
+488
+
+
+3
+5
+343
+
+
+5
+8
+299
+
+
+8
+15
+299
+
+
+15
+47
+288
+
+
+48
+108
+299
+
+
+111
+121
+33
+
+
+
+
+
+
+num_comment
+num_code
+
+
+12
+
+
+1
+2
+1753
+
+
+2
+3
+488
+
+
+3
+5
+343
+
+
+5
+8
+299
+
+
+8
+15
+299
+
+
+15
+46
+310
+
+
+51
+102
+288
+
+
+106
+108
+22
+
+
+
+
+
+
+
+
+diagnostics
+66951
+
+
+id
+66951
+
+
+severity
+22
+
+
+error_tag
+133
+
+
+error_message
+388
+
+
+full_error_message
+63312
+
+
+location
+16377
+
+
+
+
+id
+severity
+
+
+12
+
+
+1
+2
+66951
+
+
+
+
+
+
+id
+error_tag
+
+
+12
+
+
+1
+2
+66951
+
+
+
+
+
+
+id
+error_message
+
+
+12
+
+
+1
+2
+66951
+
+
+
+
+
+
+id
+full_error_message
+
+
+12
+
+
+1
+2
+66951
+
+
+
+
+
+
+id
+location
+
+
+12
+
+
+1
+2
+66951
+
+
+
+
+
+
+severity
+id
+
+
+12
+
+
+2
+3
+11
+
+
+6032
+6033
+11
+
+
+
+
+
+
+severity
+error_tag
+
+
+12
+
+
+1
+2
+11
+
+
+11
+12
+11
+
+
+
+
+
+
+severity
+error_message
+
+
+12
+
+
+2
+3
+11
+
+
+33
+34
+11
+
+
+
+
+
+
+severity
+full_error_message
+
+
+12
+
+
+2
+3
+11
+
+
+5704
+5705
+11
+
+
+
+
+
+
+severity
+location
+
+
+12
+
+
+2
+3
+11
+
+
+1474
+1475
+11
+
+
+
+
+
+
+error_tag
+id
+
+
+12
+
+
+1
+2
+22
+
+
+2
+3
+22
+
+
+36
+37
+11
+
+
+45
+46
+33
+
+
+92
+93
+11
+
+
+329
+330
+11
+
+
+437
+438
+11
+
+
+4999
+5000
+11
+
+
+
+
+
+
+error_tag
+severity
+
+
+12
+
+
+1
+2
+133
+
+
+
+
+
+
+error_tag
+error_message
+
+
+12
+
+
+1
+2
+88
+
+
+2
+3
+11
+
+
+3
+4
+11
+
+
+10
+11
+11
+
+
+12
+13
+11
+
+
+
+
+
+
+error_tag
+full_error_message
+
+
+12
+
+
+1
+2
+33
+
+
+2
+3
+22
+
+
+36
+37
+11
+
+
+45
+46
+33
+
+
+92
+93
+11
+
+
+437
+438
+11
+
+
+4999
+5000
+11
+
+
+
+
+
+
+error_tag
+location
+
+
+12
+
+
+1
+2
+77
+
+
+2
+3
+11
+
+
+6
+7
+11
+
+
+71
+72
+11
+
+
+92
+93
+11
+
+
+1302
+1303
+11
+
+
+
+
+
+
+error_message
+id
+
+
+12
+
+
+1
+2
+44
+
+
+2
+3
+11
+
+
+3
+4
+133
+
+
+4
+5
+22
+
+
+8
+9
+22
+
+
+10
+11
+22
+
+
+12
+13
+44
+
+
+45
+46
+33
+
+
+60
+303
+33
+
+
+329
+5000
+22
+
+
+
+
+
+
+error_message
+severity
+
+
+12
+
+
+1
+2
+388
+
+
+
+
+
+
+error_message
+error_tag
+
+
+12
+
+
+1
+2
+388
+
+
+
+
+
+
+error_message
+full_error_message
+
+
+12
+
+
+1
+2
+55
+
+
+2
+3
+11
+
+
+3
+4
+133
+
+
+4
+5
+22
+
+
+8
+9
+22
+
+
+10
+11
+22
+
+
+12
+13
+44
+
+
+45
+46
+33
+
+
+60
+303
+33
+
+
+4999
+5000
+11
+
+
+
+
+
+
+error_message
+location
+
+
+12
+
+
+1
+2
+233
+
+
+4
+5
+22
+
+
+8
+9
+22
+
+
+10
+11
+22
+
+
+12
+13
+44
+
+
+17
+35
+33
+
+
+1302
+1303
+11
+
+
+
+
+
+
+full_error_message
+id
+
+
+12
+
+
+1
+2
+63301
+
+
+329
+330
+11
+
+
+
+
+
+
+full_error_message
+severity
+
+
+12
+
+
+1
+2
+63312
+
+
+
+
+
+
+full_error_message
+error_tag
+
+
+12
+
+
+1
+2
+63312
+
+
+
+
+
+
+full_error_message
+error_message
+
+
+12
+
+
+1
+2
+63312
+
+
+
+
+
+
+full_error_message
+location
+
+
+12
+
+
+1
+2
+63312
+
+
+
+
+
+
+location
+id
+
+
+12
+
+
+1
+2
+3872
+
+
+2
+3
+2407
+
+
+3
+4
+6113
+
+
+4
+5
+1730
+
+
+6
+7
+1531
+
+
+15
+467
+721
+
+
+
+
+
+
+location
+severity
+
+
+12
+
+
+1
+2
+16377
+
+
+
+
+
+
+location
+error_tag
+
+
+12
+
+
+1
+2
+16366
+
+
+5
+6
+11
+
+
+
+
+
+
+location
+error_message
+
+
+12
+
+
+1
+2
+16299
+
+
+2
+6
+77
+
+
+
+
+
+
+location
+full_error_message
+
+
+12
+
+
+1
+2
+3872
+
+
+2
+3
+2407
+
+
+3
+4
+6113
+
+
+4
+5
+1730
+
+
+6
+7
+1531
+
+
+15
+139
+721
+
+
+
+
+
+
+
+
+files
+57465
+
+
+id
+57465
+
+
+name
+57465
+
+
+simple
+39201
+
+
+ext
+99
+
+
+fromSource
+11
+
+
+
+
+id
+name
+
+
+12
+
+
+1
+2
+57465
+
+
+
+
+
+
+id
+simple
+
+
+12
+
+
+1
+2
+57465
+
+
+
+
+
+
+id
+ext
+
+
+12
+
+
+1
+2
+57465
+
+
+
+
+
+
+id
+fromSource
+
+
+12
+
+
+1
+2
+57465
+
+
+
+
+
+
+name
+id
+
+
+12
+
+
+1
+2
+57465
+
+
+
+
+
+
+name
+simple
+
+
+12
+
+
+1
+2
+57465
+
+
+
+
+
+
+name
+ext
+
+
+12
+
+
+1
+2
+57465
+
+
+
+
+
+
+name
+fromSource
+
+
+12
+
+
+1
+2
+57465
+
+
+
+
+
+
+simple
+id
+
+
+12
+
+
+1
+2
+29703
+
+
+2
+3
+5914
+
+
+3
+7
+3117
+
+
+7
+36
+466
+
+
+
+
+
+
+simple
+name
+
+
+12
+
+
+1
+2
+29703
+
+
+2
+3
+5914
+
+
+3
+7
+3117
+
+
+7
+36
+466
+
+
+
+
+
+
+simple
+ext
+
+
+12
+
+
+1
+2
+34674
+
+
+2
+3
+3828
+
+
+3
+6
+699
+
+
+
+
+
+
+simple
+fromSource
+
+
+12
+
+
+1
+2
+39201
+
+
+
+
+
+
+ext
+id
+
+
+12
+
+
+1
+2
+11
+
+
+14
+15
+11
+
+
+35
+36
+11
+
+
+52
+53
+11
+
+
+88
+89
+11
+
+
+116
+117
+11
+
+
+421
+422
+11
+
+
+662
+663
+11
+
+
+3790
+3791
+11
+
+
+
+
+
+
+ext
+name
+
+
+12
+
+
+1
+2
+11
+
+
+14
+15
+11
+
+
+35
+36
+11
+
+
+52
+53
+11
+
+
+88
+89
+11
+
+
+116
+117
+11
+
+
+421
+422
+11
+
+
+662
+663
+11
+
+
+3790
+3791
+11
+
+
+
+
+
+
+ext
+simple
+
+
+12
+
+
+1
+2
+11
+
+
+14
+15
+11
+
+
+34
+35
+11
+
+
+52
+53
+11
+
+
+85
+86
+11
+
+
+114
+115
+11
+
+
+407
+408
+11
+
+
+585
+586
+11
+
+
+2721
+2722
+11
+
+
+
+
+
+
+ext
+fromSource
+
+
+12
+
+
+1
+2
+99
+
+
+
+
+
+
+fromSource
+id
+
+
+12
+
+
+5179
+5180
+11
+
+
+
+
+
+
+fromSource
+name
+
+
+12
+
+
+5179
+5180
+11
+
+
+
+
+
+
+fromSource
+simple
+
+
+12
+
+
+3533
+3534
+11
+
+
+
+
+
+
+fromSource
+ext
+
+
+12
+
+
+9
+10
+11
+
+
+
+
+
+
+
+
+folders
+7966
+
+
+id
+7966
+
+
+name
+7966
+
+
+simple
+3073
+
+
+
+
+id
+name
+
+
+12
+
+
+1
+2
+7966
+
+
+
+
+
+
+id
+simple
+
+
+12
+
+
+1
+2
+7966
+
+
+
+
+
+
+name
+id
+
+
+12
+
+
+1
+2
+7966
+
+
+
+
+
+
+name
+simple
+
+
+12
+
+
+1
+2
+7966
+
+
+
+
+
+
+simple
+id
+
+
+12
+
+
+1
+2
+1963
+
+
+2
+3
+488
+
+
+3
+4
+355
+
+
+4
+29
+233
+
+
+29
+107
+33
+
+
+
+
+
+
+simple
+name
+
+
+12
+
+
+1
+2
+1963
+
+
+2
+3
+488
+
+
+3
+4
+355
+
+
+4
+29
+233
+
+
+29
+107
+33
+
+
+
+
+
+
+
+
+containerparent
+65409
+
+
+parent
+7966
+
+
+child
+65409
+
+
+
+
+parent
+child
+
+
+12
+
+
+1
+2
+2840
+
+
+2
+3
+987
+
+
+3
+4
+410
+
+
+4
+5
+599
+
+
+5
+7
+599
+
+
+7
+10
+499
+
+
+10
+13
+676
+
+
+13
+20
+654
+
+
+20
+77
+599
+
+
+77
+155
+99
+
+
+
+
+
+
+child
+parent
+
+
+12
+
+
+1
+2
+65409
+
+
+
+
+
+
+
+
+fileannotations
+5449491
+
+
+id
+5203
+
+
+kind
+22
+
+
+name
+51617
+
+
+value
+45248
+
+
+
+
+id
+kind
+
+
+12
+
+
+1
+2
+122
+
+
+2
+3
+5081
+
+
+
+
+
+
+id
+name
+
+
+12
+
+
+1
+67
+421
+
+
+67
+85
+399
+
+
+89
+189
+399
+
+
+190
+296
+399
+
+
+337
+488
+399
+
+
+488
+593
+399
+
+
+593
+687
+399
+
+
+687
+933
+399
+
+
+935
+974
+233
+
+
+974
+975
+1398
+
+
+976
+2244
+355
+
+
+
+
+
+
+id
+value
+
+
+12
+
+
+1
+80
+410
+
+
+89
+109
+410
+
+
+109
+234
+410
+
+
+234
+533
+399
+
+
+536
+744
+399
+
+
+744
+934
+399
+
+
+934
+1154
+410
+
+
+1166
+1612
+366
+
+
+1616
+1617
+1398
+
+
+1635
+2819
+399
+
+
+2827
+4079
+199
+
+
+
+
+
+
+kind
+id
+
+
+12
+
+
+458
+459
+11
+
+
+469
+470
+11
+
+
+
+
+
+
+kind
+name
+
+
+12
+
+
+2
+3
+11
+
+
+4650
+4651
+11
+
+
+
+
+
+
+kind
+value
+
+
+12
+
+
+1
+2
+11
+
+
+4078
+4079
+11
+
+
+
+
+
+
+name
+id
+
+
+12
+
+
+1
+2
+7633
+
+
+2
+3
+5270
+
+
+3
+6
+4049
+
+
+6
+8
+4405
+
+
+8
+13
+4205
+
+
+13
+17
+4382
+
+
+17
+21
+4582
+
+
+21
+35
+3972
+
+
+35
+155
+4227
+
+
+155
+262
+3872
+
+
+262
+380
+3905
+
+
+380
+457
+1109
+
+
+
+
+
+
+name
+kind
+
+
+12
+
+
+1
+2
+51617
+
+
+
+
+
+
+name
+value
+
+
+12
+
+
+1
+2
+9586
+
+
+2
+3
+6124
+
+
+3
+4
+2086
+
+
+4
+6
+3861
+
+
+6
+9
+4449
+
+
+9
+14
+4227
+
+
+14
+17
+4149
+
+
+17
+21
+4127
+
+
+21
+38
+3916
+
+
+38
+101
+3894
+
+
+101
+149
+3872
+
+
+150
+2005
+1320
+
+
+
+
+
+
+value
+id
+
+
+12
+
+
+1
+2
+4904
+
+
+2
+3
+2418
+
+
+3
+6
+3916
+
+
+6
+21
+4127
+
+
+21
+24
+3317
+
+
+24
+26
+3528
+
+
+26
+41
+3395
+
+
+41
+196
+3306
+
+
+196
+213
+3395
+
+
+213
+267
+3639
+
+
+267
+323
+3395
+
+
+323
+366
+3428
+
+
+366
+470
+2474
+
+
+
+
+
+
+value
+kind
+
+
+12
+
+
+1
+2
+45237
+
+
+2
+3
+11
+
+
+
+
+
+
+value
+name
+
+
+12
+
+
+1
+2
+4959
+
+
+2
+3
+2807
+
+
+3
+6
+3484
+
+
+6
+15
+3927
+
+
+15
+18
+3417
+
+
+18
+20
+3362
+
+
+20
+24
+3805
+
+
+24
+40
+3517
+
+
+40
+50
+3439
+
+
+50
+77
+3495
+
+
+77
+95
+3395
+
+
+95
+109
+3617
+
+
+109
+167
+2019
+
+
+
+
+
+
+
+
+inmacroexpansion
+63452833
+
+
+id
+18693802
+
+
+inv
+2624364
+
+
+
+
+id
+inv
+
+
+12
+
+
+1
+2
+5514134
+
+
+2
+3
+3596100
+
+
+3
+4
+2525028
+
+
+4
+5
+1762416
+
+
+5
+6
+1364780
+
+
+6
+7
+895889
+
+
+7
+8
+1716180
+
+
+8
+2023
+1319271
+
+
+
+
+
+
+inv
+id
+
+
+12
+
+
+1
+2
+619235
+
+
+2
+3
+363933
+
+
+3
+4
+191730
+
+
+4
+5
+222590
+
+
+5
+7
+198749
+
+
+7
+10
+222714
+
+
+10
+15
+213496
+
+
+15
+24
+198952
+
+
+24
+52
+198586
+
+
+52
+61799
+194374
+
+
+
+
+
+
+
+
+affectedbymacroexpansion
+41757016
+
+
+id
+4872284
+
+
+inv
+3777162
+
+
+
+
+id
+inv
+
+
+12
+
+
+1
+2
+1547962
+
+
+2
+3
+940276
+
+
+3
+4
+790792
+
+
+4
+6
+395719
+
+
+6
+10
+382771
+
+
+10
+25
+394460
+
+
+25
+83
+365469
+
+
+83
+11028
+54832
+
+
+
+
+
+
+inv
+id
+
+
+12
+
+
+1
+2
+221152
+
+
+2
+3
+297570
+
+
+3
+4
+256423
+
+
+4
+5
+331756
+
+
+5
+6
+326665
+
+
+6
+7
+309023
+
+
+7
+8
+256875
+
+
+8
+9
+246492
+
+
+9
+10
+209406
+
+
+10
+12
+317632
+
+
+12
+15
+288105
+
+
+15
+22
+300866
+
+
+22
+50
+284976
+
+
+50
+526
+130214
+
+
+
+
+
+
+
+
+macroinvocations
+37650204
+
+
+id
+37650204
+
+
+macro_id
+79368
+
+
+location
+711283
+
+
+kind
+22
+
+
+
+
+id
+macro_id
+
+
+12
+
+
+1
+2
+37650204
+
+
+
+
+
+
+id
+location
+
+
+12
+
+
+1
+2
+37650204
+
+
+
+
+
+
+id
+kind
+
+
+12
+
+
+1
+2
+37650204
+
+
+
+
+
+
+macro_id
+id
+
+
+12
+
+
+1
+2
+17575
+
+
+2
+3
+10796
+
+
+3
+4
+4382
+
+
+4
+5
+6479
+
+
+5
+8
+5448
+
+
+8
+13
+6557
+
+
+13
+27
+6147
+
+
+27
+52
+6058
+
+
+52
+145
+5980
+
+
+145
+907
+5958
+
+
+921
+207618
+3983
+
+
+
+
+
+
+macro_id
+location
+
+
+12
+
+
+1
+2
+40943
+
+
+2
+3
+11029
+
+
+3
+4
+5647
+
+
+4
+5
+4793
+
+
+5
+9
+6546
+
+
+9
+27
+6013
+
+
+27
+3101
+4393
+
+
+
+
+
+
+macro_id
+kind
+
+
+12
+
+
+1
+2
+73742
+
+
+2
+3
+5625
+
+
+
+
+
+
+location
+id
+
+
+12
+
+
+1
+2
+291841
+
+
+2
+3
+148994
+
+
+3
+4
+34574
+
+
+4
+6
+64388
+
+
+6
+11
+62879
+
+
+11
+33
+53892
+
+
+33
+2013
+53348
+
+
+2064
+268130
+1364
+
+
+
+
+
+
+location
+macro_id
+
+
+12
+
+
+1
+2
+665691
+
+
+2
+356
+45592
+
+
+
+
+
+
+location
+kind
+
+
+12
+
+
+1
+2
+711283
+
+
+
+
+
+
+kind
+id
+
+
+12
+
+
+40547
+40548
+11
+
+
+3352654
+3352655
+11
+
+
+
+
+
+
+kind
+macro_id
+
+
+12
+
+
+1745
+1746
+11
+
+
+5915
+5916
+11
+
+
+
+
+
+
+kind
+location
+
+
+12
+
+
+5415
+5416
+11
+
+
+58689
+58690
+11
+
+
+
+
+
+
+
+
+macroparent
+33270445
+
+
+id
+33270445
+
+
+parent_id
+25964519
+
+
+
+
+id
+parent_id
+
+
+12
+
+
+1
+2
+33270445
+
+
+
+
+
+
+parent_id
+id
+
+
+12
+
+
+1
+2
+20030530
+
+
+2
+3
+5082698
+
+
+3
+88
+851290
+
+
+
+
+
+
+
+
+macrolocationbind
+16645292
+
+
+id
+3297751
+
+
+location
+15489990
+
+
+
+
+id
+location
+
+
+12
+
+
+1
+2
+767809
+
+
+2
+3
+538486
+
+
+3
+4
+742858
+
+
+4
+5
+383751
+
+
+5
+6
+188308
+
+
+6
+8
+250282
+
+
+8
+14
+270108
+
+
+14
+984
+156145
+
+
+
+
+
+
+location
+id
+
+
+12
+
+
+1
+2
+15194777
+
+
+2
+272
+295212
+
+
+
+
+
+
+
+
+macro_argument_unexpanded
+98490828
+
+
+invocation
+28576010
+
+
+argument_index
+732
+
+
+text
+308551
+
+
+
+
+invocation
+argument_index
+
+
+12
+
+
+1
+2
+7849008
+
+
+2
+3
+12096905
+
+
+3
+4
+6528112
+
+
+4
+67
+2101984
+
+
+
+
+
+
+invocation
+text
+
+
+12
+
+
+1
+2
+7909436
+
+
+2
+3
+12273561
+
+
+3
+4
+6341703
+
+
+4
+67
+2051309
+
+
+
+
+
+
+argument_index
+invocation
+
+
+12
+
+
+55017
+55018
+643
+
+
+55186
+189441
+55
+
+
+777782
+2575396
+33
+
+
+
+
+
+
+argument_index
+text
+
+
+12
+
+
+2
+3
+643
+
+
+13
+921
+55
+
+
+6053
+19178
+33
+
+
+
+
+
+
+text
+invocation
+
+
+12
+
+
+1
+2
+42496
+
+
+2
+3
+48000
+
+
+3
+4
+13104
+
+
+4
+5
+56976
+
+
+5
+8
+20316
+
+
+8
+12
+17475
+
+
+12
+16
+20848
+
+
+16
+25
+26086
+
+
+25
+50
+23645
+
+
+50
+208
+23167
+
+
+208
+596657
+16432
+
+
+
+
+
+
+text
+argument_index
+
+
+12
+
+
+1
+2
+227030
+
+
+2
+3
+70990
+
+
+3
+9
+10529
+
+
+
+
+
+
+
+
+macro_argument_expanded
+98490828
+
+
+invocation
+28576010
+
+
+argument_index
+732
+
+
+text
+184955
+
+
+
+
+invocation
+argument_index
+
+
+12
+
+
+1
+2
+7849008
+
+
+2
+3
+12096905
+
+
+3
+4
+6528112
+
+
+4
+67
+2101984
+
+
+
+
+
+
+invocation
+text
+
+
+12
+
+
+1
+2
+11463891
+
+
+2
+3
+10533599
+
+
+3
+4
+5478950
+
+
+4
+9
+1099569
+
+
+
+
+
+
+argument_index
+invocation
+
+
+12
+
+
+55017
+55018
+643
+
+
+55186
+189441
+55
+
+
+777782
+2575396
+33
+
+
+
+
+
+
+argument_index
+text
+
+
+12
+
+
+1
+2
+632
+
+
+2
+80
+55
+
+
+767
+13318
+44
+
+
+
+
+
+
+text
+invocation
+
+
+12
+
+
+1
+2
+27428
+
+
+2
+3
+37969
+
+
+3
+4
+5669
+
+
+4
+5
+16632
+
+
+5
+6
+2407
+
+
+6
+7
+16832
+
+
+7
+11
+15756
+
+
+11
+17
+15112
+
+
+17
+37
+14602
+
+
+37
+109
+13947
+
+
+110
+641
+13880
+
+
+641
+1149670
+4715
+
+
+
+
+
+
+text
+argument_index
+
+
+12
+
+
+1
+2
+96921
+
+
+2
+3
+73454
+
+
+3
+5
+14102
+
+
+5
+66
+477
+
+
+
+
+
+
+
+
+functions
+3698710
+
+
+id
+3698710
+
+
+name
+266409
+
+
+kind
+77
+
+
+
+
+id
+name
+
+
+12
+
+
+1
+2
+3698710
+
+
+
+
+
+
+id
+kind
+
+
+12
+
+
+1
+2
+3698710
+
+
+
+
+
+
+name
+id
+
+
+12
+
+
+1
+2
+173737
+
+
+2
+3
+25930
+
+
+3
+4
+14846
+
+
+4
+7
+20283
+
+
+7
+24
+20194
+
+
+24
+63010
+11417
+
+
+
+
+
+
+name
+kind
+
+
+12
+
+
+1
+2
+264889
+
+
+2
+3
+1520
+
+
+
+
+
+
+kind
+id
+
+
+12
+
+
+30
+31
+11
+
+
+1563
+1564
+11
+
+
+2406
+2407
+11
+
+
+6934
+6935
+11
+
+
+66893
+66894
+11
+
+
+96418
+96419
+11
+
+
+159100
+159101
+11
+
+
+
+
+
+
+kind
+name
+
+
+12
+
+
+10
+11
+11
+
+
+42
+43
+11
+
+
+425
+426
+11
+
+
+1449
+1450
+11
+
+
+2406
+2407
+11
+
+
+2766
+2767
+11
+
+
+17049
+17050
+11
+
+
+
+
+
+
+
+
+function_entry_point
+1222898
+
+
+id
+1201683
+
+
+entry_point
+1222887
+
+
+
+
+id
+entry_point
+
+
+12
+
+
+1
+2
+1194116
+
+
+2
+84
+7567
+
+
+
+
+
+
+entry_point
+id
+
+
+12
+
+
+1
+2
+1222876
+
+
+2
+3
+11
+
+
+
+
+
+
+
+
+function_return_type
+3751671
+
+
+id
+3698688
+
+
+return_type
+884222
+
+
+
+
+id
+return_type
+
+
+12
+
+
+1
+2
+3649490
+
+
+2
+6
+49198
+
+
+
+
+
+
+return_type
+id
+
+
+12
+
+
+1
+2
+433201
+
+
+2
+3
+329400
+
+
+3
+5
+69925
+
+
+5
+118707
+51695
+
+
+
+
+
+
+
+
+purefunctions
+33130
+
+
+id
+33130
+
+
+
+
+
+function_deleted
+70191
+
+
+id
+70191
+
+
+
+
+
+function_defaulted
+20560
+
+
+id
+20560
+
+
+
+
+
+fun_decls
+3050240
+
+
+id
+3050240
+
+
+function
+2845512
+
+
+type_id
+727206
+
+
+name
+237715
+
+
+location
+675633
+
+
+
+
+id
+function
+
+
+12
+
+
+1
+2
+3050240
+
+
+
+
+
+
+id
+type_id
+
+
+12
+
+
+1
+2
+3050240
+
+
+
+
+
+
+id
+name
+
+
+12
+
+
+1
+2
+3050240
+
+
+
+
+
+
+id
+location
+
+
+12
+
+
+1
+2
+3050240
+
+
+
+
+
+
+function
+id
+
+
+12
+
+
+1
+2
+2676301
+
+
+2
+29
+169210
+
+
+
+
+
+
+function
+type_id
+
+
+12
+
+
+1
+2
+2808374
+
+
+2
+6
+37137
+
+
+
+
+
+
+function
+name
+
+
+12
+
+
+1
+2
+2845512
+
+
+
+
+
+
+function
+location
+
+
+12
+
+
+1
+2
+2755547
+
+
+2
+29
+89964
+
+
+
+
+
+
+type_id
+id
+
+
+12
+
+
+1
+2
+313167
+
+
+2
+3
+308218
+
+
+3
+5
+65098
+
+
+5
+93469
+40721
+
+
+
+
+
+
+type_id
+function
+
+
+12
+
+
+1
+2
+328324
+
+
+2
+3
+303780
+
+
+3
+5
+57975
+
+
+5
+87492
+37126
+
+
+
+
+
+
+type_id
+name
+
+
+12
+
+
+1
+2
+620098
+
+
+2
+4
+64644
+
+
+4
+7436
+42463
+
+
+
+
+
+
+type_id
+location
+
+
+12
+
+
+1
+2
+576248
+
+
+2
+3
+69936
+
+
+3
+6
+59340
+
+
+6
+18812
+21681
+
+
+
+
+
+
+name
+id
+
+
+12
+
+
+1
+2
+136311
+
+
+2
+3
+32222
+
+
+3
+4
+17020
+
+
+4
+6
+17997
+
+
+6
+13
+19195
+
+
+13
+62669
+14968
+
+
+
+
+
+
+name
+function
+
+
+12
+
+
+1
+2
+149759
+
+
+2
+3
+29581
+
+
+3
+4
+15234
+
+
+4
+7
+18885
+
+
+7
+32
+17842
+
+
+32
+62314
+6413
+
+
+
+
+
+
+name
+type_id
+
+
+12
+
+
+1
+2
+208378
+
+
+2
+5
+19073
+
+
+5
+32496
+10263
+
+
+
+
+
+
+name
+location
+
+
+12
+
+
+1
+2
+154320
+
+
+2
+3
+46568
+
+
+3
+5
+18718
+
+
+5
+133
+17830
+
+
+134
+7703
+277
+
+
+
+
+
+
+location
+id
+
+
+12
+
+
+1
+2
+438793
+
+
+2
+3
+107762
+
+
+3
+5
+57953
+
+
+5
+18
+51084
+
+
+18
+1219
+20038
+
+
+
+
+
+
+location
+function
+
+
+12
+
+
+1
+2
+449123
+
+
+2
+3
+115884
+
+
+3
+6
+52826
+
+
+6
+71
+50774
+
+
+71
+1219
+7023
+
+
+
+
+
+
+location
+type_id
+
+
+12
+
+
+1
+2
+581596
+
+
+2
+4
+59883
+
+
+4
+611
+34152
+
+
+
+
+
+
+location
+name
+
+
+12
+
+
+1
+2
+651155
+
+
+2
+126
+24477
+
+
+
+
+
+
+
+
+fun_def
+577324
+
+
+id
+577324
+
+
+
+
+
+fun_specialized
+2585
+
+
+id
+2585
+
+
+
+
+
+fun_implicit
+410
+
+
+id
+410
+
+
+
+
+
+fun_decl_specifiers
+656424
+
+
+id
+368087
+
+
+name
+11
+
+
+
+
+id
+name
+
+
+12
+
+
+1
+2
+107397
+
+
+2
+3
+233043
+
+
+3
+4
+27646
+
+
+
+
+
+
+name
+id
+
+
+12
+
+
+13599
+13600
+2
+
+
+25854
+25855
+2
+
+
+65341
+65342
+2
+
+
+133779
+133780
+2
+
+
+
+
+
+
+
+
+fun_decl_throws
+7
+
+
+fun_decl
+7
+
+
+index
+1
+
+
+type_id
+2
+
+
+
+
+fun_decl
+index
+
+
+12
+
+
+1
+2
+7
+
+
+
+
+
+
+fun_decl
+type_id
+
+
+12
+
+
+1
+2
+7
+
+
+
+
+
+
+index
+fun_decl
+
+
+12
+
+
+7
+8
+1
+
+
+
+
+
+
+index
+type_id
+
+
+12
+
+
+2
+3
+1
+
+
+
+
+
+
+type_id
+fun_decl
+
+
+12
+
+
+1
+2
+1
+
+
+6
+7
+1
+
+
+
+
+
+
+type_id
+index
+
+
+12
+
+
+1
+2
+2
+
+
+
+
+
+
+
+
+fun_decl_empty_throws
+730557
+
+
+fun_decl
+730557
+
+
+
+
+
+fun_decl_noexcept
+7911
+
+
+fun_decl
+7134
+
+
+constant
+7889
+
+
+
+
+fun_decl
+constant
+
+
+12
+
+
+1
+2
+6357
+
+
+2
+3
+776
+
+
+
+
+
+
+constant
+fun_decl
+
+
+12
+
+
+1
+2
+7866
+
+
+2
+3
+22
+
+
+
+
+
+
+
+
+fun_decl_empty_noexcept
+455104
+
+
+fun_decl
+455104
+
+
+
+
+
+fun_decl_typedef_type
+177
+
+
+fun_decl
+177
+
+
+typedeftype_id
+88
+
+
+
+
+fun_decl
+typedeftype_id
+
+
+12
+
+
+1
+2
+177
+
+
+
+
+
+
+typedeftype_id
+fun_decl
+
+
+12
+
+
+2
+3
+88
+
+
+
+
+
+
+
+
+param_decl_bind
+3782805
+
+
+id
+3782805
+
+
+index
+355
+
+
+fun_decl
+2425903
+
+
+
+
+id
+index
+
+
+12
+
+
+1
+2
+3782805
+
+
+
+
+
+
+id
+fun_decl
+
+
+12
+
+
+1
+2
+3782805
+
+
+
+
+
+
+index
+id
+
+
+12
+
+
+2
+3
+144
+
+
+4
+10
+22
+
+
+15
+44
+22
+
+
+118
+197
+22
+
+
+272
+349
+22
+
+
+436
+641
+22
+
+
+915
+1254
+22
+
+
+1770
+2683
+22
+
+
+4837
+11858
+22
+
+
+29350
+67520
+22
+
+
+218633
+218634
+11
+
+
+
+
+
+
+index
+fun_decl
+
+
+12
+
+
+2
+3
+144
+
+
+4
+10
+22
+
+
+15
+44
+22
+
+
+118
+197
+22
+
+
+272
+349
+22
+
+
+436
+641
+22
+
+
+915
+1254
+22
+
+
+1770
+2683
+22
+
+
+4837
+11858
+22
+
+
+29350
+67520
+22
+
+
+218633
+218634
+11
+
+
+
+
+
+
+fun_decl
+id
+
+
+12
+
+
+1
+2
+1676727
+
+
+2
+3
+423514
+
+
+3
+4
+194098
+
+
+4
+33
+131562
+
+
+
+
+
+
+fun_decl
+index
+
+
+12
+
+
+1
+2
+1676727
+
+
+2
+3
+423514
+
+
+3
+4
+194098
+
+
+4
+33
+131562
+
+
+
+
+
+
+
+
+var_decls
+4647089
+
+
+id
+4647089
+
+
+variable
+4346826
+
+
+type_id
+1416642
+
+
+name
+130197
+
+
+location
+1190266
+
+
+
+
+id
+variable
+
+
+12
+
+
+1
+2
+4647089
+
+
+
+
+
+
+id
+type_id
+
+
+12
+
+
+1
+2
+4647089
+
+
+
+
+
+
+id
+name
+
+
+12
+
+
+1
+2
+4647089
+
+
+
+
+
+
+id
+location
+
+
+12
+
+
+1
+2
+4647089
+
+
+
+
+
+
+variable
+id
+
+
+12
+
+
+1
+2
+4099679
+
+
+2
+9
+247147
+
+
+
+
+
+
+variable
+type_id
+
+
+12
+
+
+1
+2
+4284057
+
+
+2
+9
+62768
+
+
+
+
+
+
+variable
+name
+
+
+12
+
+
+1
+2
+4329217
+
+
+2
+3
+17608
+
+
+
+
+
+
+variable
+location
+
+
+12
+
+
+1
+2
+4230032
+
+
+2
+9
+116794
+
+
+
+
+
+
+type_id
+id
+
+
+12
+
+
+1
+2
+927107
+
+
+2
+3
+270914
+
+
+3
+5
+106586
+
+
+5
+61
+106308
+
+
+61
+8408
+5725
+
+
+
+
+
+
+type_id
+variable
+
+
+12
+
+
+1
+2
+952417
+
+
+2
+3
+268429
+
+
+3
+6
+112988
+
+
+6
+7848
+82807
+
+
+
+
+
+
+type_id
+name
+
+
+12
+
+
+1
+2
+1238843
+
+
+2
+3
+119867
+
+
+3
+1005
+57931
+
+
+
+
+
+
+type_id
+location
+
+
+12
+
+
+1
+2
+1128640
+
+
+2
+3
+141204
+
+
+3
+8
+106885
+
+
+8
+3994
+39911
+
+
+
+
+
+
+name
+id
+
+
+12
+
+
+1
+2
+50208
+
+
+2
+3
+25087
+
+
+3
+4
+10729
+
+
+4
+6
+11717
+
+
+6
+9
+10030
+
+
+9
+21
+9952
+
+
+21
+168
+9775
+
+
+169
+101174
+2696
+
+
+
+
+
+
+name
+variable
+
+
+12
+
+
+1
+2
+54735
+
+
+2
+3
+23645
+
+
+3
+4
+11539
+
+
+4
+6
+10529
+
+
+6
+10
+9919
+
+
+10
+25
+9875
+
+
+25
+2795
+9775
+
+
+2917
+99535
+177
+
+
+
+
+
+
+name
+type_id
+
+
+12
+
+
+1
+2
+79789
+
+
+2
+3
+17786
+
+
+3
+4
+8022
+
+
+4
+7
+10984
+
+
+7
+33
+9864
+
+
+33
+60702
+3750
+
+
+
+
+
+
+name
+location
+
+
+12
+
+
+1
+2
+75484
+
+
+2
+3
+20305
+
+
+3
+4
+7023
+
+
+4
+7
+11506
+
+
+7
+22
+9930
+
+
+22
+9251
+5947
+
+
+
+
+
+
+location
+id
+
+
+12
+
+
+1
+2
+844488
+
+
+2
+3
+158270
+
+
+3
+5
+90508
+
+
+5
+65
+89365
+
+
+65
+64659
+7633
+
+
+
+
+
+
+location
+variable
+
+
+12
+
+
+1
+2
+890092
+
+
+2
+3
+140350
+
+
+3
+7
+95889
+
+
+7
+64264
+63933
+
+
+
+
+
+
+location
+type_id
+
+
+12
+
+
+1
+2
+1026936
+
+
+2
+4
+109881
+
+
+4
+52838
+53448
+
+
+
+
+
+
+location
+name
+
+
+12
+
+
+1
+2
+1181411
+
+
+2
+52
+8854
+
+
+
+
+
+
+
+
+var_def
+1669548
+
+
+id
+1669548
+
+
+
+
+
+var_decl_specifiers
+348206
+
+
+id
+348206
+
+
+name
+5
+
+
+
+
+id
+name
+
+
+12
+
+
+1
+2
+348206
+
+
+
+
+
+
+name
+id
+
+
+12
+
+
+29
+30
+1
+
+
+37
+38
+1
+
+
+2792
+2793
+1
+
+
+262875
+262876
+1
+
+
+
+
+
+
+
+
+type_decls
+1388703
+
+
+id
+1388703
+
+
+type_id
+1360431
+
+
+location
+1078842
+
+
+
+
+id
+type_id
+
+
+12
+
+
+1
+2
+1388703
+
+
+
+
+
+
+id
+location
+
+
+12
+
+
+1
+2
+1388703
+
+
+
+
+
+
+type_id
+id
+
+
+12
+
+
+1
+2
+1339571
+
+
+2
+24
+20860
+
+
+
+
+
+
+type_id
+location
+
+
+12
+
+
+1
+2
+1340658
+
+
+2
+24
+19772
+
+
+
+
+
+
+location
+id
+
+
+12
+
+
+1
+2
+1018448
+
+
+2
+585
+60394
+
+
+
+
+
+
+location
+type_id
+
+
+12
+
+
+1
+2
+1019535
+
+
+2
+585
+59306
+
+
+
+
+
+
+
+
+type_def
+923545
+
+
+id
+923545
+
+
+
+
+
+type_decl_top
+265444
+
+
+type_decl
+265444
+
+
+
+
+
+namespace_decls
+130885
+
+
+id
+130885
+
+
+namespace_id
+7866
+
+
+location
+116061
+
+
+bodylocation
+116383
+
+
+
+
+id
+namespace_id
+
+
+12
+
+
+1
+2
+130885
+
+
+
+
+
+
+id
+location
+
+
+12
+
+
+1
+2
+130885
+
+
+
+
+
+
+id
+bodylocation
+
+
+12
+
+
+1
+2
+130885
+
+
+
+
+
+
+namespace_id
+id
+
+
+12
+
+
+1
+2
+4038
+
+
+2
+3
+920
+
+
+3
+5
+699
+
+
+5
+9
+599
+
+
+9
+18
+621
+
+
+18
+67
+621
+
+
+68
+3515
+366
+
+
+
+
+
+
+namespace_id
+location
+
+
+12
+
+
+1
+2
+4038
+
+
+2
+3
+920
+
+
+3
+5
+699
+
+
+5
+9
+599
+
+
+9
+18
+621
+
+
+18
+67
+621
+
+
+68
+3515
+366
+
+
+
+
+
+
+namespace_id
+bodylocation
+
+
+12
+
+
+1
+2
+4038
+
+
+2
+3
+920
+
+
+3
+5
+699
+
+
+5
+9
+599
+
+
+9
+18
+621
+
+
+18
+67
+621
+
+
+68
+3514
+366
+
+
+
+
+
+
+location
+id
+
+
+12
+
+
+1
+2
+107706
+
+
+2
+29
+8355
+
+
+
+
+
+
+location
+namespace_id
+
+
+12
+
+
+1
+2
+107706
+
+
+2
+29
+8355
+
+
+
+
+
+
+location
+bodylocation
+
+
+12
+
+
+1
+2
+115329
+
+
+2
+3
+732
+
+
+
+
+
+
+bodylocation
+id
+
+
+12
+
+
+1
+2
+108383
+
+
+2
+29
+8000
+
+
+
+
+
+
+bodylocation
+namespace_id
+
+
+12
+
+
+1
+2
+108383
+
+
+2
+29
+8000
+
+
+
+
+
+
+bodylocation
+location
+
+
+12
+
+
+1
+2
+115995
+
+
+2
+5
+388
+
+
+
+
+
+
+
+
+usings
+201199
+
+
+id
+201199
+
+
+element_id
+19883
+
+
+location
+20560
+
+
+
+
+id
+element_id
+
+
+12
+
+
+1
+2
+201199
+
+
+
+
+
+
+id
+location
+
+
+12
+
+
+1
+2
+201199
+
+
+
+
+
+
+element_id
+id
+
+
+12
+
+
+1
+2
+14757
+
+
+2
+3
+2152
+
+
+3
+96
+1464
+
+
+113
+116
+1509
+
+
+
+
+
+
+element_id
+location
+
+
+12
+
+
+1
+2
+14757
+
+
+2
+3
+2152
+
+
+3
+96
+1464
+
+
+113
+116
+1509
+
+
+
+
+
+
+location
+id
+
+
+12
+
+
+1
+2
+16898
+
+
+2
+3
+1697
+
+
+3
+138
+1675
+
+
+138
+139
+288
+
+
+
+
+
+
+location
+element_id
+
+
+12
+
+
+1
+2
+16898
+
+
+2
+3
+1697
+
+
+3
+138
+1675
+
+
+138
+139
+288
+
+
+
+
+
+
+
+
+using_container
+587887
+
+
+parent
+10984
+
+
+child
+198536
+
+
+
+
+parent
+child
+
+
+12
+
+
+1
+2
+5115
+
+
+2
+6
+843
+
+
+6
+39
+832
+
+
+39
+134
+221
+
+
+137
+138
+3040
+
+
+138
+141
+832
+
+
+153
+433
+99
+
+
+
+
+
+
+child
+parent
+
+
+12
+
+
+1
+2
+22402
+
+
+2
+3
+43850
+
+
+3
+4
+98852
+
+
+4
+5
+18973
+
+
+5
+128
+14457
+
+
+
+
+
+
+
+
+static_asserts
+18201
+
+
+id
+18201
+
+
+condition
+18201
+
+
+message
+3770
+
+
+location
+11603
+
+
+
+
+id
+condition
+
+
+12
+
+
+1
+2
+18201
+
+
+
+
+
+
+id
+message
+
+
+12
+
+
+1
+2
+18201
+
+
+
+
+
+
+id
+location
+
+
+12
+
+
+1
+2
+18201
+
+
+
+
+
+
+condition
+id
+
+
+12
+
+
+1
+2
+18201
+
+
+
+
+
+
+condition
+message
+
+
+12
+
+
+1
+2
+18201
+
+
+
+
+
+
+condition
+location
+
+
+12
+
+
+1
+2
+18201
+
+
+
+
+
+
+message
+id
+
+
+12
+
+
+1
+2
+3532
+
+
+2
+3227
+238
+
+
+
+
+
+
+message
+condition
+
+
+12
+
+
+1
+2
+3532
+
+
+2
+3227
+238
+
+
+
+
+
+
+message
+location
+
+
+12
+
+
+1
+2
+3622
+
+
+2
+2872
+148
+
+
+
+
+
+
+location
+id
+
+
+12
+
+
+1
+2
+9349
+
+
+2
+3
+1745
+
+
+3
+168
+509
+
+
+
+
+
+
+location
+condition
+
+
+12
+
+
+1
+2
+9349
+
+
+2
+3
+1745
+
+
+3
+168
+509
+
+
+
+
+
+
+location
+message
+
+
+12
+
+
+1
+2
+9947
+
+
+2
+3
+1358
+
+
+3
+47
+298
+
+
+
+
+
+
+
+
+params
+4638656
+
+
+id
+4568553
+
+
+function
+2877789
+
+
+index
+355
+
+
+type_id
+1332824
+
+
+
+
+id
+function
+
+
+12
+
+
+1
+2
+4567898
+
+
+2
+65
+654
+
+
+
+
+
+
+id
+index
+
+
+12
+
+
+1
+2
+4568553
+
+
+
+
+
+
+id
+type_id
+
+
+12
+
+
+1
+2
+4504253
+
+
+2
+9
+64300
+
+
+
+
+
+
+function
+id
+
+
+12
+
+
+1
+2
+1906398
+
+
+2
+3
+559515
+
+
+3
+4
+258465
+
+
+4
+33
+153410
+
+
+
+
+
+
+function
+index
+
+
+12
+
+
+1
+2
+1906398
+
+
+2
+3
+559515
+
+
+3
+4
+258465
+
+
+4
+33
+153410
+
+
+
+
+
+
+function
+type_id
+
+
+12
+
+
+1
+2
+2004119
+
+
+2
+3
+555598
+
+
+3
+4
+213893
+
+
+4
+20
+104178
+
+
+
+
+
+
+index
+id
+
+
+12
+
+
+2
+3
+144
+
+
+4
+10
+22
+
+
+15
+44
+22
+
+
+119
+199
+22
+
+
+275
+353
+22
+
+
+441
+660
+22
+
+
+939
+1280
+22
+
+
+1788
+2750
+22
+
+
+5151
+13827
+22
+
+
+37120
+87547
+22
+
+
+259199
+259200
+11
+
+
+
+
+
+
+index
+function
+
+
+12
+
+
+2
+3
+144
+
+
+4
+10
+22
+
+
+15
+44
+22
+
+
+119
+199
+22
+
+
+275
+353
+22
+
+
+441
+660
+22
+
+
+939
+1280
+22
+
+
+1788
+2750
+22
+
+
+5151
+13827
+22
+
+
+37120
+87547
+22
+
+
+259359
+259360
+11
+
+
+
+
+
+
+index
+type_id
+
+
+12
+
+
+1
+2
+144
+
+
+3
+7
+22
+
+
+8
+20
+22
+
+
+38
+42
+22
+
+
+44
+47
+22
+
+
+62
+107
+22
+
+
+177
+259
+22
+
+
+420
+675
+22
+
+
+1210
+2885
+22
+
+
+8583
+23874
+22
+
+
+100628
+100629
+11
+
+
+
+
+
+
+type_id
+id
+
+
+12
+
+
+1
+2
+845575
+
+
+2
+3
+252961
+
+
+3
+5
+102946
+
+
+5
+16
+101004
+
+
+16
+6402
+30335
+
+
+
+
+
+
+type_id
+function
+
+
+12
+
+
+1
+2
+868411
+
+
+2
+3
+238736
+
+
+3
+5
+102979
+
+
+5
+19
+101681
+
+
+19
+6013
+21015
+
+
+
+
+
+
+type_id
+index
+
+
+12
+
+
+1
+2
+1169961
+
+
+2
+3
+130497
+
+
+3
+33
+32366
+
+
+
+
+
+
+
+
+overrides
+81081
+
+
+new
+78180
+
+
+old
+25208
+
+
+
+
+new
+old
+
+
+12
+
+
+1
+2
+75401
+
+
+2
+14
+2779
+
+
+
+
+
+
+old
+new
+
+
+12
+
+
+1
+2
+16878
+
+
+2
+3
+3636
+
+
+3
+4
+1571
+
+
+4
+8
+1954
+
+
+8
+1923
+1169
+
+
+
+
+
+
+
+
+membervariables
+352723
+
+
+id
+352723
+
+
+type_id
+165704
+
+
+name
+53415
+
+
+
+
+id
+type_id
+
+
+12
+
+
+1
+2
+352723
+
+
+
+
+
+
+id
+name
+
+
+12
+
+
+1
+2
+352723
+
+
+
+
+
+
+type_id
+id
+
+
+12
+
+
+1
+2
+138808
+
+
+2
+3
+13448
+
+
+3
+23
+12471
+
+
+23
+2170
+976
+
+
+
+
+
+
+type_id
+name
+
+
+12
+
+
+1
+2
+148206
+
+
+2
+4
+13636
+
+
+4
+322
+3861
+
+
+
+
+
+
+name
+id
+
+
+12
+
+
+1
+2
+27528
+
+
+2
+3
+8710
+
+
+3
+4
+5137
+
+
+4
+6
+3794
+
+
+6
+13
+4294
+
+
+13
+2076
+3950
+
+
+
+
+
+
+name
+type_id
+
+
+12
+
+
+1
+2
+34485
+
+
+2
+3
+6857
+
+
+3
+4
+3095
+
+
+4
+7
+4704
+
+
+7
+128
+4016
+
+
+130
+899
+255
+
+
+
+
+
+
+
+
+globalvariables
+336079
+
+
+id
+336079
+
+
+type_id
+1692
+
+
+name
+329434
+
+
+
+
+id
+type_id
+
+
+12
+
+
+1
+2
+336079
+
+
+
+
+
+
+id
+name
+
+
+12
+
+
+1
+2
+336079
+
+
+
+
+
+
+type_id
+id
+
+
+12
+
+
+1
+2
+1176
+
+
+2
+3
+172
+
+
+3
+6
+127
+
+
+6
+34
+128
+
+
+34
+143737
+87
+
+
+
+
+
+
+type_id
+name
+
+
+12
+
+
+1
+2
+1226
+
+
+2
+3
+138
+
+
+3
+7
+142
+
+
+7
+83
+127
+
+
+89
+142875
+57
+
+
+
+
+
+
+name
+id
+
+
+12
+
+
+1
+2
+325314
+
+
+2
+30
+4119
+
+
+
+
+
+
+name
+type_id
+
+
+12
+
+
+1
+2
+328733
+
+
+2
+12
+701
+
+
+
+
+
+
+
+
+localvariables
+664877
+
+
+id
+664877
+
+
+type_id
+39010
+
+
+name
+56256
+
+
+
+
+id
+type_id
+
+
+12
+
+
+1
+2
+664877
+
+
+
+
+
+
+id
+name
+
+
+12
+
+
+1
+2
+664877
+
+
+
+
+
+
+type_id
+id
+
+
+12
+
+
+1
+2
+15185
+
+
+2
+3
+9792
+
+
+3
+4
+2044
+
+
+4
+5
+4407
+
+
+5
+9
+3004
+
+
+9
+28
+2960
+
+
+28
+57646
+1615
+
+
+
+
+
+
+type_id
+name
+
+
+12
+
+
+1
+2
+29435
+
+
+2
+3
+5175
+
+
+3
+7
+3059
+
+
+7
+4629
+1339
+
+
+
+
+
+
+name
+id
+
+
+12
+
+
+1
+2
+33617
+
+
+2
+3
+9002
+
+
+3
+4
+3450
+
+
+4
+7
+4308
+
+
+7
+33
+4251
+
+
+33
+14411
+1626
+
+
+
+
+
+
+name
+type_id
+
+
+12
+
+
+1
+2
+45228
+
+
+2
+3
+5841
+
+
+3
+11
+4308
+
+
+11
+3978
+877
+
+
+
+
+
+
+
+
+autoderivation
+4993
+
+
+var
+4993
+
+
+derivation_type
+55
+
+
+
+
+var
+derivation_type
+
+
+12
+
+
+1
+2
+4993
+
+
+
+
+
+
+derivation_type
+var
+
+
+12
+
+
+8
+9
+11
+
+
+30
+31
+11
+
+
+74
+75
+11
+
+
+125
+126
+11
+
+
+213
+214
+11
+
+
+
+
+
+
+
+
+enumconstants
+97072
+
+
+id
+97072
+
+
+parent
+13127
+
+
+index
+6695
+
+
+type_id
+12441
+
+
+name
+62521
+
+
+location
+76630
+
+
+
+
+id
+parent
+
+
+12
+
+
+1
+2
+97072
+
+
+
+
+
+
+id
+index
+
+
+12
+
+
+1
+2
+97072
+
+
+
+
+
+
+id
+type_id
+
+
+12
+
+
+1
+2
+97072
+
+
+
+
+
+
+id
+name
+
+
+12
+
+
+1
+2
+97072
+
+
+
+
+
+
+id
+location
+
+
+12
+
+
+1
+2
+97072
+
+
+
+
+
+
+parent
+id
+
+
+12
+
+
+1
+2
+4980
+
+
+2
+3
+1603
+
+
+3
+4
+1643
+
+
+4
+5
+1204
+
+
+5
+6
+713
+
+
+6
+8
+891
+
+
+8
+13
+1058
+
+
+13
+135
+985
+
+
+136
+6696
+50
+
+
+
+
+
+
+parent
+index
+
+
+12
+
+
+1
+2
+5033
+
+
+2
+3
+1751
+
+
+3
+4
+1875
+
+
+4
+5
+1173
+
+
+5
+6
+802
+
+
+6
+9
+1019
+
+
+9
+20
+994
+
+
+20
+6696
+480
+
+
+
+
+
+
+parent
+type_id
+
+
+12
+
+
+1
+2
+12519
+
+
+2
+3
+608
+
+
+
+
+
+
+parent
+name
+
+
+12
+
+
+1
+2
+5032
+
+
+2
+3
+1752
+
+
+3
+4
+1875
+
+
+4
+5
+1172
+
+
+5
+6
+802
+
+
+6
+9
+1018
+
+
+9
+20
+996
+
+
+20
+6696
+480
+
+
+
+
+
+
+parent
+location
+
+
+12
+
+
+1
+2
+5002
+
+
+2
+3
+1616
+
+
+3
+4
+1627
+
+
+4
+5
+1207
+
+
+5
+6
+714
+
+
+6
+8
+892
+
+
+8
+13
+1056
+
+
+13
+189
+985
+
+
+193
+2234
+28
+
+
+
+
+
+
+index
+id
+
+
+12
+
+
+1
+2
+5530
+
+
+2
+8
+470
+
+
+9
+31
+510
+
+
+32
+14225
+185
+
+
+
+
+
+
+index
+parent
+
+
+12
+
+
+1
+2
+5530
+
+
+2
+7
+470
+
+
+7
+26
+510
+
+
+27
+13128
+185
+
+
+
+
+
+
+index
+type_id
+
+
+12
+
+
+1
+2
+5530
+
+
+2
+7
+470
+
+
+7
+24
+510
+
+
+25
+12442
+185
+
+
+
+
+
+
+index
+name
+
+
+12
+
+
+1
+2
+5530
+
+
+2
+7
+470
+
+
+7
+24
+510
+
+
+25
+6691
+185
+
+
+
+
+
+
+index
+location
+
+
+12
+
+
+1
+2
+5530
+
+
+2
+8
+470
+
+
+9
+30
+510
+
+
+31
+11208
+185
+
+
+
+
+
+
+type_id
+id
+
+
+12
+
+
+1
+2
+4957
+
+
+2
+3
+1523
+
+
+3
+4
+1579
+
+
+4
+5
+1114
+
+
+5
+6
+671
+
+
+6
+9
+1131
+
+
+9
+19
+943
+
+
+19
+16086
+523
+
+
+
+
+
+
+type_id
+parent
+
+
+12
+
+
+1
+2
+12440
+
+
+1295
+1296
+1
+
+
+
+
+
+
+type_id
+index
+
+
+12
+
+
+1
+2
+5002
+
+
+2
+3
+1647
+
+
+3
+4
+1754
+
+
+4
+5
+1070
+
+
+5
+7
+1114
+
+
+7
+12
+984
+
+
+12
+6696
+870
+
+
+
+
+
+
+type_id
+name
+
+
+12
+
+
+1
+2
+5001
+
+
+2
+3
+1648
+
+
+3
+4
+1754
+
+
+4
+5
+1069
+
+
+5
+7
+1114
+
+
+7
+12
+985
+
+
+12
+12517
+870
+
+
+
+
+
+
+type_id
+location
+
+
+12
+
+
+1
+2
+4979
+
+
+2
+3
+1534
+
+
+3
+4
+1563
+
+
+4
+5
+1117
+
+
+5
+6
+672
+
+
+6
+9
+1130
+
+
+9
+19
+941
+
+
+19
+15911
+505
+
+
+
+
+
+
+name
+id
+
+
+12
+
+
+1
+2
+45879
+
+
+2
+3
+13216
+
+
+3
+1343
+3426
+
+
+
+
+
+
+name
+parent
+
+
+12
+
+
+1
+2
+55370
+
+
+2
+3
+4738
+
+
+3
+1343
+2413
+
+
+
+
+
+
+name
+index
+
+
+12
+
+
+1
+2
+60721
+
+
+2
+19
+1800
+
+
+
+
+
+
+name
+type_id
+
+
+12
+
+
+1
+2
+49401
+
+
+2
+3
+12189
+
+
+3
+1343
+931
+
+
+
+
+
+
+name
+location
+
+
+12
+
+
+1
+2
+46883
+
+
+2
+3
+14895
+
+
+3
+1343
+743
+
+
+
+
+
+
+location
+id
+
+
+12
+
+
+1
+2
+70131
+
+
+2
+4
+6328
+
+
+4
+504
+171
+
+
+
+
+
+
+location
+parent
+
+
+12
+
+
+1
+2
+72451
+
+
+2
+504
+4179
+
+
+
+
+
+
+location
+index
+
+
+12
+
+
+1
+2
+73906
+
+
+2
+347
+2724
+
+
+
+
+
+
+location
+type_id
+
+
+12
+
+
+1
+2
+66489
+
+
+2
+3
+9907
+
+
+3
+504
+234
+
+
+
+
+
+
+location
+name
+
+
+12
+
+
+1
+2
+74059
+
+
+2
+347
+2571
+
+
+
+
+
+
+
+
+builtintypes
+510
+
+
+id
+510
+
+
+name
+510
+
+
+kind
+510
+
+
+size
+77
+
+
+sign
+33
+
+
+alignment
+66
+
+
+
+
+id
+name
+
+
+12
+
+
+1
+2
+510
+
+
+
+
+
+
+id
+kind
+
+
+12
+
+
+1
+2
+510
+
+
+
+
+
+
+id
+size
+
+
+12
+
+
+1
+2
+510
+
+
+
+
+
+
+id
+sign
+
+
+12
+
+
+1
+2
+510
+
+
+
+
+
+
+id
+alignment
+
+
+12
+
+
+1
+2
+510
+
+
+
+
+
+
+name
+id
+
+
+12
+
+
+1
+2
+510
+
+
+
+
+
+
+name
+kind
+
+
+12
+
+
+1
+2
+510
+
+
+
+
+
+
+name
+size
+
+
+12
+
+
+1
+2
+510
+
+
+
+
+
+
+name
+sign
+
+
+12
+
+
+1
+2
+510
+
+
+
+
+
+
+name
+alignment
+
+
+12
+
+
+1
+2
+510
+
+
+
+
+
+
+kind
+id
+
+
+12
+
+
+1
+2
+510
+
+
+
+
+
+
+kind
+name
+
+
+12
+
+
+1
+2
+510
+
+
+
+
+
+
+kind
+size
+
+
+12
+
+
+1
+2
+510
+
+
+
+
+
+
+kind
+sign
+
+
+12
+
+
+1
+2
+510
+
+
+
+
+
+
+kind
+alignment
+
+
+12
+
+
+1
+2
+510
+
+
+
+
+
+
+size
+id
+
+
+12
+
+
+2
+3
+11
+
+
+3
+4
+11
+
+
+4
+5
+22
+
+
+9
+10
+11
+
+
+11
+12
+11
+
+
+13
+14
+11
+
+
+
+
+
+
+size
+name
+
+
+12
+
+
+2
+3
+11
+
+
+3
+4
+11
+
+
+4
+5
+22
+
+
+9
+10
+11
+
+
+11
+12
+11
+
+
+13
+14
+11
+
+
+
+
+
+
+size
+kind
+
+
+12
+
+
+2
+3
+11
+
+
+3
+4
+11
+
+
+4
+5
+22
+
+
+9
+10
+11
+
+
+11
+12
+11
+
+
+13
+14
+11
+
+
+
+
+
+
+size
+sign
+
+
+12
+
+
+1
+2
+22
+
+
+3
+4
+55
+
+
+
+
+
+
+size
+alignment
+
+
+12
+
+
+1
+2
+44
+
+
+2
+3
+33
+
+
+
+
+
+
+sign
+id
+
+
+12
+
+
+6
+7
+11
+
+
+12
+13
+11
+
+
+28
+29
+11
+
+
+
+
+
+
+sign
+name
+
+
+12
+
+
+6
+7
+11
+
+
+12
+13
+11
+
+
+28
+29
+11
+
+
+
+
+
+
+sign
+kind
+
+
+12
+
+
+6
+7
+11
+
+
+12
+13
+11
+
+
+28
+29
+11
+
+
+
+
+
+
+sign
+size
+
+
+12
+
+
+5
+6
+22
+
+
+7
+8
+11
+
+
+
+
+
+
+sign
+alignment
+
+
+12
+
+
+5
+6
+22
+
+
+6
+7
+11
+
+
+
+
+
+
+alignment
+id
+
+
+12
+
+
+2
+3
+11
+
+
+4
+5
+11
+
+
+5
+6
+11
+
+
+10
+11
+11
+
+
+12
+13
+11
+
+
+13
+14
+11
+
+
+
+
+
+
+alignment
+name
+
+
+12
+
+
+2
+3
+11
+
+
+4
+5
+11
+
+
+5
+6
+11
+
+
+10
+11
+11
+
+
+12
+13
+11
+
+
+13
+14
+11
+
+
+
+
+
+
+alignment
+kind
+
+
+12
+
+
+2
+3
+11
+
+
+4
+5
+11
+
+
+5
+6
+11
+
+
+10
+11
+11
+
+
+12
+13
+11
+
+
+13
+14
+11
+
+
+
+
+
+
+alignment
+size
+
+
+12
+
+
+1
+2
+22
+
+
+2
+3
+44
+
+
+
+
+
+
+alignment
+sign
+
+
+12
+
+
+1
+2
+11
+
+
+3
+4
+55
+
+
+
+
+
+
+
+
+derivedtypes
+3614061
+
+
+id
+3614061
+
+
+name
+1415033
+
+
+kind
+88
+
+
+type_id
+2300088
+
+
+
+
+id
+name
+
+
+12
+
+
+1
+2
+3614061
+
+
+
+
+
+
+id
+kind
+
+
+12
+
+
+1
+2
+3614061
+
+
+
+
+
+
+id
+type_id
+
+
+12
+
+
+1
+2
+3614061
+
+
+
+
+
+
+name
+id
+
+
+12
+
+
+1
+2
+985460
+
+
+2
+3
+348584
+
+
+3
+59432
+80988
+
+
+
+
+
+
+name
+kind
+
+
+12
+
+
+1
+2
+1415011
+
+
+2
+3
+22
+
+
+
+
+
+
+name
+type_id
+
+
+12
+
+
+1
+2
+985460
+
+
+2
+3
+348584
+
+
+3
+59414
+80988
+
+
+
+
+
+
+kind
+id
+
+
+12
+
+
+23
+24
+11
+
+
+37
+38
+11
+
+
+2154
+2155
+11
+
+
+30292
+30293
+11
+
+
+33879
+33880
+11
+
+
+59477
+59478
+11
+
+
+87607
+87608
+11
+
+
+112218
+112219
+11
+
+
+
+
+
+
+kind
+name
+
+
+12
+
+
+1
+2
+11
+
+
+13
+14
+11
+
+
+37
+38
+11
+
+
+1234
+1235
+11
+
+
+17157
+17158
+11
+
+
+20434
+20435
+11
+
+
+36775
+36776
+11
+
+
+51880
+51881
+11
+
+
+
+
+
+
+kind
+type_id
+
+
+12
+
+
+11
+12
+11
+
+
+23
+24
+11
+
+
+1015
+1016
+11
+
+
+30292
+30293
+11
+
+
+33879
+33880
+11
+
+
+59477
+59478
+11
+
+
+87290
+87291
+11
+
+
+112218
+112219
+11
+
+
+
+
+
+
+type_id
+id
+
+
+12
+
+
+1
+2
+1453901
+
+
+2
+3
+477318
+
+
+3
+4
+281411
+
+
+4
+210
+87456
+
+
+
+
+
+
+type_id
+name
+
+
+12
+
+
+1
+2
+1455078
+
+
+2
+3
+477173
+
+
+3
+4
+280334
+
+
+4
+210
+87501
+
+
+
+
+
+
+type_id
+kind
+
+
+12
+
+
+1
+2
+1455632
+
+
+2
+3
+478505
+
+
+3
+4
+279957
+
+
+4
+7
+85992
+
+
+
+
+
+
+
+
+pointerishsize
+2617371
+
+
+id
+2617371
+
+
+size
+22
+
+
+alignment
+11
+
+
+
+
+id
+size
+
+
+12
+
+
+1
+2
+2617371
+
+
+
+
+
+
+id
+alignment
+
+
+12
+
+
+1
+2
+2617371
+
+
+
+
+
+
+size
+id
+
+
+12
+
+
+23
+24
+11
+
+
+235866
+235867
+11
+
+
+
+
+
+
+size
+alignment
+
+
+12
+
+
+1
+2
+22
+
+
+
+
+
+
+alignment
+id
+
+
+12
+
+
+235889
+235890
+11
+
+
+
+
+
+
+alignment
+size
+
+
+12
+
+
+2
+3
+11
+
+
+
+
+
+
+
+
+arraysizes
+18574
+
+
+id
+18574
+
+
+num_elements
+2352
+
+
+bytesize
+2785
+
+
+alignment
+77
+
+
+
+
+id
+num_elements
+
+
+12
+
+
+1
+2
+18574
+
+
+
+
+
+
+id
+bytesize
+
+
+12
+
+
+1
+2
+18574
+
+
+
+
+
+
+id
+alignment
+
+
+12
+
+
+1
+2
+18574
+
+
+
+
+
+
+num_elements
+id
+
+
+12
+
+
+1
+2
+255
+
+
+2
+3
+1331
+
+
+3
+4
+55
+
+
+4
+5
+166
+
+
+5
+9
+199
+
+
+9
+25
+177
+
+
+25
+129
+166
+
+
+
+
+
+
+num_elements
+bytesize
+
+
+12
+
+
+1
+2
+1742
+
+
+2
+3
+210
+
+
+3
+4
+122
+
+
+4
+6
+210
+
+
+6
+17
+66
+
+
+
+
+
+
+num_elements
+alignment
+
+
+12
+
+
+1
+2
+1753
+
+
+2
+3
+210
+
+
+3
+4
+199
+
+
+4
+8
+188
+
+
+
+
+
+
+bytesize
+id
+
+
+12
+
+
+1
+2
+244
+
+
+2
+3
+1542
+
+
+3
+4
+99
+
+
+4
+6
+244
+
+
+6
+9
+233
+
+
+9
+26
+210
+
+
+28
+81
+210
+
+
+
+
+
+
+bytesize
+num_elements
+
+
+12
+
+
+1
+2
+2163
+
+
+2
+3
+343
+
+
+3
+6
+233
+
+
+6
+8
+44
+
+
+
+
+
+
+bytesize
+alignment
+
+
+12
+
+
+1
+2
+2219
+
+
+2
+3
+277
+
+
+3
+5
+244
+
+
+5
+7
+44
+
+
+
+
+
+
+alignment
+id
+
+
+12
+
+
+11
+12
+11
+
+
+12
+13
+11
+
+
+42
+43
+11
+
+
+43
+44
+11
+
+
+212
+213
+11
+
+
+468
+469
+11
+
+
+886
+887
+11
+
+
+
+
+
+
+alignment
+num_elements
+
+
+12
+
+
+4
+5
+11
+
+
+5
+6
+11
+
+
+15
+16
+11
+
+
+17
+18
+11
+
+
+40
+41
+11
+
+
+44
+45
+11
+
+
+204
+205
+11
+
+
+
+
+
+
+alignment
+bytesize
+
+
+12
+
+
+1
+2
+11
+
+
+2
+3
+11
+
+
+16
+17
+11
+
+
+18
+19
+11
+
+
+43
+44
+11
+
+
+59
+60
+11
+
+
+205
+206
+11
+
+
+
+
+
+
+
+
+typedefbase
+1603728
+
+
+id
+1603728
+
+
+type_id
+761891
+
+
+
+
+id
+type_id
+
+
+12
+
+
+1
+2
+1603728
+
+
+
+
+
+
+type_id
+id
+
+
+12
+
+
+1
+2
+588642
+
+
+2
+3
+75994
+
+
+3
+6
+65609
+
+
+6
+4247
+31645
+
+
+
+
+
+
+
+
+decltypes
+79334
+
+
+id
+79334
+
+
+expr
+74896
+
+
+base_type
+8055
+
+
+parentheses_would_change_meaning
+22
+
+
+
+
+id
+expr
+
+
+12
+
+
+1
+2
+79334
+
+
+
+
+
+
+id
+base_type
+
+
+12
+
+
+1
+2
+79334
+
+
+
+
+
+
+id
+parentheses_would_change_meaning
+
+
+12
+
+
+1
+2
+79334
+
+
+
+
+
+
+expr
+id
+
+
+12
+
+
+1
+2
+70480
+
+
+2
+4
+4416
+
+
+
+
+
+
+expr
+base_type
+
+
+12
+
+
+1
+2
+70480
+
+
+2
+4
+4416
+
+
+
+
+
+
+expr
+parentheses_would_change_meaning
+
+
+12
+
+
+1
+2
+74896
+
+
+
+
+
+
+base_type
+id
+
+
+12
+
+
+1
+2
+4926
+
+
+2
+3
+2785
+
+
+3
+247
+343
+
+
+
+
+
+
+base_type
+expr
+
+
+12
+
+
+1
+2
+2363
+
+
+2
+3
+3561
+
+
+3
+4
+277
+
+
+4
+5
+965
+
+
+5
+15
+676
+
+
+15
+2687
+210
+
+
+
+
+
+
+base_type
+parentheses_would_change_meaning
+
+
+12
+
+
+1
+2
+8055
+
+
+
+
+
+
+parentheses_would_change_meaning
+id
+
+
+12
+
+
+6
+7
+11
+
+
+1304
+1305
+11
+
+
+
+
+
+
+parentheses_would_change_meaning
+expr
+
+
+12
+
+
+9
+10
+11
+
+
+6741
+6742
+11
+
+
+
+
+
+
+parentheses_would_change_meaning
+base_type
+
+
+12
+
+
+6
+7
+11
+
+
+720
+721
+11
+
+
+
+
+
+
+
+
+usertypes
+3394431
+
+
+id
+3394431
+
+
+name
+608880
+
+
+kind
+110
+
+
+
+
+id
+name
+
+
+12
+
+
+1
+2
+3394431
+
+
+
+
+
+
+id
+kind
+
+
+12
+
+
+1
+2
+3394431
+
+
+
+
+
+
+name
+id
+
+
+12
+
+
+1
+2
+414072
+
+
+2
+3
+119224
+
+
+3
+7
+46546
+
+
+7
+27586
+29037
+
+
+
+
+
+
+name
+kind
+
+
+12
+
+
+1
+2
+563732
+
+
+2
+9
+45148
+
+
+
+
+
+
+kind
+id
+
+
+12
+
+
+23
+24
+11
+
+
+161
+162
+11
+
+
+608
+609
+11
+
+
+805
+806
+11
+
+
+1211
+1212
+11
+
+
+15458
+15459
+11
+
+
+17960
+17961
+11
+
+
+50501
+50502
+11
+
+
+74656
+74657
+11
+
+
+144535
+144536
+11
+
+
+
+
+
+
+kind
+name
+
+
+12
+
+
+15
+16
+11
+
+
+18
+19
+11
+
+
+37
+38
+11
+
+
+83
+84
+11
+
+
+398
+399
+11
+
+
+2650
+2651
+11
+
+
+4695
+4696
+11
+
+
+10425
+10426
+11
+
+
+10826
+10827
+11
+
+
+30022
+30023
+11
+
+
+
+
+
+
+
+
+usertypesize
+876666
+
+
+id
+876666
+
+
+size
+1564
+
+
+alignment
+88
+
+
+
+
+id
+size
+
+
+12
+
+
+1
+2
+876666
+
+
+
+
+
+
+id
+alignment
+
+
+12
+
+
+1
+2
+876666
+
+
+
+
+
+
+size
+id
+
+
+12
+
+
+1
+2
+477
+
+
+2
+3
+210
+
+
+3
+5
+144
+
+
+5
+8
+133
+
+
+8
+12
+122
+
+
+12
+21
+144
+
+
+21
+63
+122
+
+
+72
+378
+122
+
+
+549
+53250
+88
+
+
+
+
+
+
+size
+alignment
+
+
+12
+
+
+1
+2
+1253
+
+
+2
+3
+221
+
+
+3
+6
+88
+
+
+
+
+
+
+alignment
+id
+
+
+12
+
+
+1
+2
+11
+
+
+3
+4
+11
+
+
+27
+28
+11
+
+
+53
+54
+11
+
+
+59
+60
+11
+
+
+381
+382
+11
+
+
+10892
+10893
+11
+
+
+67593
+67594
+11
+
+
+
+
+
+
+alignment
+size
+
+
+12
+
+
+1
+2
+22
+
+
+8
+9
+22
+
+
+12
+13
+11
+
+
+19
+20
+11
+
+
+26
+27
+11
+
+
+109
+110
+11
+
+
+
+
+
+
+
+
+usertype_final
+4311
+
+
+id
+4311
+
+
+
+
+
+usertype_uuid
+3076
+
+
+id
+3076
+
+
+uuid
+3076
+
+
+
+
+id
+uuid
+
+
+12
+
+
+1
+2
+3076
+
+
+
+
+
+
+uuid
+id
+
+
+12
+
+
+1
+2
+3076
+
+
+
+
+
+
+
+
+is_pod_class
+588875
+
+
+id
+588875
+
+
+
+
+
+is_complete
+876666
+
+
+id
+876666
+
+
+
+
+
+is_class_template
+171518
+
+
+id
+171518
+
+
+
+
+
+class_instantiation
+680992
+
+
+to
+680426
+
+
+from
+57409
+
+
+
+
+to
+from
+
+
+12
+
+
+1
+2
+679904
+
+
+2
+4
+521
+
+
+
+
+
+
+from
+to
+
+
+12
+
+
+1
+2
+18208
+
+
+2
+3
+10330
+
+
+3
+4
+6246
+
+
+4
+5
+3994
+
+
+5
+7
+4948
+
+
+7
+11
+5237
+
+
+11
+24
+4349
+
+
+24
+2199
+4094
+
+
+
+
+
+
+
+
+class_template_argument
+1723884
+
+
+type_id
+842335
+
+
+index
+443
+
+
+arg_type
+716720
+
+
+
+
+type_id
+index
+
+
+12
+
+
+1
+2
+379886
+
+
+2
+3
+291519
+
+
+3
+4
+105687
+
+
+4
+21
+64433
+
+
+21
+41
+809
+
+
+
+
+
+
+type_id
+arg_type
+
+
+12
+
+
+1
+2
+395575
+
+
+2
+3
+291552
+
+
+3
+4
+103412
+
+
+4
+41
+51795
+
+
+
+
+
+
+index
+type_id
+
+
+12
+
+
+1
+6
+33
+
+
+7
+12
+33
+
+
+15
+24
+33
+
+
+27
+36
+33
+
+
+39
+48
+33
+
+
+51
+62
+33
+
+
+67
+230
+33
+
+
+245
+299
+33
+
+
+317
+386
+33
+
+
+511
+678
+33
+
+
+993
+1396
+33
+
+
+1719
+4462
+33
+
+
+6599
+41796
+33
+
+
+72036
+72037
+11
+
+
+
+
+
+
+index
+arg_type
+
+
+12
+
+
+1
+4
+33
+
+
+4
+7
+33
+
+
+9
+11
+22
+
+
+11
+13
+33
+
+
+13
+16
+33
+
+
+16
+21
+33
+
+
+21
+28
+33
+
+
+41
+63
+33
+
+
+77
+106
+33
+
+
+117
+187
+33
+
+
+226
+454
+33
+
+
+573
+1114
+33
+
+
+1966
+7930
+33
+
+
+20642
+33985
+22
+
+
+
+
+
+
+arg_type
+type_id
+
+
+12
+
+
+1
+2
+474877
+
+
+2
+3
+151179
+
+
+3
+6
+59062
+
+
+6
+2551
+31600
+
+
+
+
+
+
+arg_type
+index
+
+
+12
+
+
+1
+2
+646107
+
+
+2
+3
+61548
+
+
+3
+22
+9065
+
+
+
+
+
+
+
+
+is_proxy_class_for
+6746
+
+
+id
+6746
+
+
+templ_param_id
+6746
+
+
+
+
+id
+templ_param_id
+
+
+12
+
+
+1
+2
+6746
+
+
+
+
+
+
+templ_param_id
+id
+
+
+12
+
+
+1
+2
+6746
+
+
+
+
+
+
+
+
+type_mentions
+7771692
+
+
+id
+7771692
+
+
+type_id
+90190
+
+
+location
+1895039
+
+
+kind
+2
+
+
+
+
+id
+type_id
+
+
+12
+
+
+1
+2
+7771692
+
+
+
+
+
+
+id
+location
+
+
+12
+
+
+1
+2
+7771692
+
+
+
+
+
+
+id
+kind
+
+
+12
+
+
+1
+2
+7771692
+
+
+
+
+
+
+type_id
+id
+
+
+12
+
+
+1
+2
+18983
+
+
+2
+3
+10246
+
+
+3
+4
+6520
+
+
+4
+5
+5136
+
+
+5
+7
+7307
+
+
+7
+11
+8149
+
+
+11
+17
+7152
+
+
+17
+27
+6850
+
+
+27
+49
+6932
+
+
+49
+124
+6794
+
+
+124
+275000
+6121
+
+
+
+
+
+
+type_id
+location
+
+
+12
+
+
+1
+2
+30113
+
+
+2
+3
+14640
+
+
+3
+4
+7010
+
+
+4
+6
+8217
+
+
+6
+8
+6533
+
+
+8
+13
+7435
+
+
+13
+24
+6942
+
+
+24
+85
+6792
+
+
+85
+60827
+2508
+
+
+
+
+
+
+type_id
+kind
+
+
+12
+
+
+1
+2
+88534
+
+
+2
+3
+1656
+
+
+
+
+
+
+location
+id
+
+
+12
+
+
+1
+2
+1273524
+
+
+2
+3
+176920
+
+
+3
+5
+161931
+
+
+5
+11
+143004
+
+
+11
+339
+139660
+
+
+
+
+
+
+location
+type_id
+
+
+12
+
+
+1
+2
+1800160
+
+
+2
+14
+94879
+
+
+
+
+
+
+location
+kind
+
+
+12
+
+
+1
+2
+1895037
+
+
+2
+3
+2
+
+
+
+
+
+
+kind
+id
+
+
+12
+
+
+33594
+33595
+1
+
+
+7673652
+7673653
+1
+
+
+
+
+
+
+kind
+type_id
+
+
+12
+
+
+1842
+1843
+1
+
+
+90004
+90005
+1
+
+
+
+
+
+
+kind
+location
+
+
+12
+
+
+6460
+6461
+1
+
+
+1888581
+1888582
+1
+
+
+
+
+
+
+
+
+is_function_template
+945393
+
+
+id
+945393
+
+
+
+
+
+function_instantiation
+1762697
+
+
+to
+1762697
+
+
+from
+229249
+
+
+
+
+to
+from
+
+
+12
+
+
+1
+2
+1762697
+
+
+
+
+
+
+from
+to
+
+
+12
+
+
+1
+2
+100916
+
+
+2
+3
+54679
+
+
+3
+4
+13070
+
+
+4
+6
+17964
+
+
+6
+11
+18430
+
+
+11
+44
+17287
+
+
+44
+962
+6901
+
+
+
+
+
+
+
+
+function_template_argument
+1881078
+
+
+function_id
+1082559
+
+
+index
+221
+
+
+arg_type
+348030
+
+
+
+
+function_id
+index
+
+
+12
+
+
+1
+2
+615671
+
+
+2
+3
+345677
+
+
+3
+5
+91739
+
+
+5
+21
+29470
+
+
+
+
+
+
+function_id
+arg_type
+
+
+12
+
+
+1
+2
+628242
+
+
+2
+3
+323586
+
+
+3
+4
+74552
+
+
+4
+21
+56177
+
+
+
+
+
+
+index
+function_id
+
+
+12
+
+
+4
+5
+11
+
+
+7
+8
+11
+
+
+17
+18
+11
+
+
+38
+39
+11
+
+
+64
+65
+11
+
+
+153
+154
+11
+
+
+241
+242
+11
+
+
+330
+331
+11
+
+
+427
+428
+11
+
+
+530
+531
+11
+
+
+767
+768
+11
+
+
+1024
+1025
+11
+
+
+1281
+1282
+11
+
+
+1543
+1544
+11
+
+
+2530
+2531
+11
+
+
+2886
+2887
+11
+
+
+4855
+4856
+11
+
+
+15383
+15384
+11
+
+
+43437
+43438
+11
+
+
+90216
+90217
+11
+
+
+
+
+
+
+index
+arg_type
+
+
+12
+
+
+4
+5
+11
+
+
+7
+8
+11
+
+
+14
+15
+11
+
+
+22
+23
+11
+
+
+32
+33
+11
+
+
+55
+56
+11
+
+
+58
+59
+11
+
+
+62
+63
+11
+
+
+74
+75
+11
+
+
+92
+93
+11
+
+
+136
+137
+11
+
+
+223
+224
+11
+
+
+239
+240
+11
+
+
+327
+328
+11
+
+
+528
+529
+11
+
+
+695
+696
+11
+
+
+1442
+1443
+11
+
+
+4101
+4102
+11
+
+
+9159
+9160
+11
+
+
+18077
+18078
+11
+
+
+
+
+
+
+arg_type
+function_id
+
+
+12
+
+
+1
+2
+233044
+
+
+2
+3
+42186
+
+
+3
+6
+27883
+
+
+6
+15
+26518
+
+
+15
+928
+18396
+
+
+
+
+
+
+arg_type
+index
+
+
+12
+
+
+1
+2
+318016
+
+
+2
+4
+28638
+
+
+4
+16
+1375
+
+
+
+
+
+
+
+
+is_variable_template
+25897
+
+
+id
+25897
+
+
+
+
+
+variable_instantiation
+25298
+
+
+to
+25298
+
+
+from
+5514
+
+
+
+
+to
+from
+
+
+12
+
+
+1
+2
+25298
+
+
+
+
+
+
+from
+to
+
+
+12
+
+
+1
+2
+1797
+
+
+2
+3
+1963
+
+
+3
+4
+510
+
+
+4
+7
+454
+
+
+7
+14
+466
+
+
+14
+207
+321
+
+
+
+
+
+
+
+
+variable_template_argument
+28
+
+
+variable_id
+22
+
+
+index
+2
+
+
+arg_type
+17
+
+
+
+
+variable_id
+index
+
+
+12
+
+
+1
+2
+16
+
+
+2
+3
+6
+
+
+
+
+
+
+variable_id
+arg_type
+
+
+12
+
+
+1
+2
+16
+
+
+2
+3
+6
+
+
+
+
+
+
+index
+variable_id
+
+
+12
+
+
+6
+7
+1
+
+
+22
+23
+1
+
+
+
+
+
+
+index
+arg_type
+
+
+12
+
+
+5
+6
+1
+
+
+13
+14
+1
+
+
+
+
+
+
+arg_type
+variable_id
+
+
+12
+
+
+1
+2
+11
+
+
+2
+3
+3
+
+
+3
+4
+1
+
+
+4
+5
+2
+
+
+
+
+
+
+arg_type
+index
+
+
+12
+
+
+1
+2
+16
+
+
+2
+3
+1
+
+
+
+
+
+
+
+
+routinetypes
+532763
+
+
+id
+532763
+
+
+return_type
+257521
+
+
+
+
+id
+return_type
+
+
+12
+
+
+1
+2
+532763
+
+
+
+
+
+
+return_type
+id
+
+
+12
+
+
+1
+2
+214925
+
+
+2
+3
+25409
+
+
+3
+9092
+17187
+
+
+
+
+
+
+
+
+routinetypeargs
+844211
+
+
+routine
+406449
+
+
+index
+355
+
+
+type_id
+261982
+
+
+
+
+routine
+index
+
+
+12
+
+
+1
+2
+191901
+
+
+2
+3
+108161
+
+
+3
+4
+62258
+
+
+4
+6
+33686
+
+
+6
+33
+10441
+
+
+
+
+
+
+routine
+type_id
+
+
+12
+
+
+1
+2
+219108
+
+
+2
+3
+109670
+
+
+3
+4
+52383
+
+
+4
+27
+25287
+
+
+
+
+
+
+index
+routine
+
+
+12
+
+
+1
+2
+66
+
+
+6
+17
+22
+
+
+26
+37
+22
+
+
+46
+58
+22
+
+
+71
+86
+22
+
+
+100
+115
+22
+
+
+137
+170
+22
+
+
+202
+235
+22
+
+
+267
+305
+22
+
+
+376
+460
+22
+
+
+564
+691
+22
+
+
+941
+1647
+22
+
+
+3977
+9589
+22
+
+
+19336
+36632
+22
+
+
+
+
+
+
+index
+type_id
+
+
+12
+
+
+1
+2
+66
+
+
+2
+13
+22
+
+
+22
+33
+22
+
+
+42
+53
+22
+
+
+64
+77
+22
+
+
+89
+102
+22
+
+
+121
+146
+22
+
+
+158
+171
+22
+
+
+183
+197
+22
+
+
+245
+299
+22
+
+
+366
+444
+22
+
+
+561
+687
+22
+
+
+1297
+3121
+22
+
+
+7008
+15194
+22
+
+
+
+
+
+
+type_id
+routine
+
+
+12
+
+
+1
+2
+166447
+
+
+2
+3
+43140
+
+
+3
+4
+17664
+
+
+4
+7
+19861
+
+
+7
+1090
+14868
+
+
+
+
+
+
+type_id
+index
+
+
+12
+
+
+1
+2
+202253
+
+
+2
+3
+46668
+
+
+3
+33
+13059
+
+
+
+
+
+
+
+
+ptrtomembers
+13636
+
+
+id
+13636
+
+
+type_id
+11772
+
+
+class_id
+7556
+
+
+
+
+id
+type_id
+
+
+12
+
+
+1
+2
+13636
+
+
+
+
+
+
+id
+class_id
+
+
+12
+
+
+1
+2
+13636
+
+
+
+
+
+
+type_id
+id
+
+
+12
+
+
+1
+2
+11539
+
+
+2
+72
+233
+
+
+
+
+
+
+type_id
+class_id
+
+
+12
+
+
+1
+2
+11539
+
+
+2
+72
+233
+
+
+
+
+
+
+class_id
+id
+
+
+12
+
+
+1
+2
+6724
+
+
+2
+4
+332
+
+
+8
+65
+499
+
+
+
+
+
+
+class_id
+type_id
+
+
+12
+
+
+1
+2
+6724
+
+
+2
+4
+332
+
+
+8
+65
+499
+
+
+
+
+
+
+
+
+specifiers
+466
+
+
+id
+466
+
+
+str
+466
+
+
+
+
+id
+str
+
+
+12
+
+
+1
+2
+466
+
+
+
+
+
+
+str
+id
+
+
+12
+
+
+1
+2
+466
+
+
+
+
+
+
+
+
+typespecifiers
+1107391
+
+
+type_id
+1102842
+
+
+spec_id
+77
+
+
+
+
+type_id
+spec_id
+
+
+12
+
+
+1
+2
+1098293
+
+
+2
+3
+4549
+
+
+
+
+
+
+spec_id
+type_id
+
+
+12
+
+
+111
+112
+11
+
+
+214
+215
+11
+
+
+256
+257
+11
+
+
+754
+755
+11
+
+
+1731
+1732
+11
+
+
+9613
+9614
+11
+
+
+87124
+87125
+11
+
+
+
+
+
+
+
+
+funspecifiers
+9771518
+
+
+func_id
+3652064
+
+
+spec_id
+155
+
+
+
+
+func_id
+spec_id
+
+
+12
+
+
+1
+2
+352756
+
+
+2
+3
+949876
+
+
+3
+4
+1882920
+
+
+4
+5
+462327
+
+
+5
+7
+4183
+
+
+
+
+
+
+spec_id
+func_id
+
+
+12
+
+
+2
+3
+11
+
+
+135
+136
+11
+
+
+652
+653
+11
+
+
+908
+909
+11
+
+
+1031
+1032
+11
+
+
+5939
+5940
+11
+
+
+11598
+11599
+11
+
+
+16932
+16933
+11
+
+
+18534
+18535
+11
+
+
+35244
+35245
+11
+
+
+60580
+60581
+11
+
+
+230299
+230300
+11
+
+
+239580
+239581
+11
+
+
+259218
+259219
+11
+
+
+
+
+
+
+
+
+varspecifiers
+1125224
+
+
+var_id
+1032943
+
+
+spec_id
+19
+
+
+
+
+var_id
+spec_id
+
+
+12
+
+
+1
+2
+940661
+
+
+2
+3
+92281
+
+
+
+
+
+
+spec_id
+var_id
+
+
+12
+
+
+784
+785
+2
+
+
+3139
+3140
+2
+
+
+14786
+14787
+2
+
+
+18771
+18772
+2
+
+
+40646
+40647
+2
+
+
+93832
+93833
+2
+
+
+236997
+236998
+2
+
+
+
+
+
+
+
+
+attributes
+425143
+
+
+id
+425143
+
+
+kind
+2
+
+
+name
+38
+
+
+name_space
+2
+
+
+location
+415778
+
+
+
+
+id
+kind
+
+
+12
+
+
+1
+2
+425143
+
+
+
+
+
+
+id
+name
+
+
+12
+
+
+1
+2
+425143
+
+
+
+
+
+
+id
+name_space
+
+
+12
+
+
+1
+2
+425143
+
+
+
+
+
+
+id
+location
+
+
+12
+
+
+1
+2
+425143
+
+
+
+
+
+
+kind
+id
+
+
+12
+
+
+3
+4
+1
+
+
+324444
+324445
+1
+
+
+
+
+
+
+kind
+name
+
+
+12
+
+
+2
+3
+1
+
+
+29
+30
+1
+
+
+
+
+
+
+kind
+name_space
+
+
+12
+
+
+1
+2
+1
+
+
+2
+3
+1
+
+
+
+
+
+
+kind
+location
+
+
+12
+
+
+3
+4
+1
+
+
+317297
+317298
+1
+
+
+
+
+
+
+name
+id
+
+
+12
+
+
+1
+2
+2
+
+
+4
+6
+2
+
+
+7
+9
+2
+
+
+9
+11
+2
+
+
+12
+16
+2
+
+
+18
+20
+2
+
+
+28
+37
+2
+
+
+79
+88
+2
+
+
+129
+147
+2
+
+
+233
+269
+2
+
+
+450
+496
+2
+
+
+1162
+1173
+2
+
+
+1238
+1314
+2
+
+
+1369
+6317
+2
+
+
+309817
+309818
+1
+
+
+
+
+
+
+name
+kind
+
+
+12
+
+
+1
+2
+35
+
+
+2
+3
+2
+
+
+
+
+
+
+name
+name_space
+
+
+12
+
+
+1
+2
+36
+
+
+2
+3
+1
+
+
+
+
+
+
+name
+location
+
+
+12
+
+
+1
+2
+2
+
+
+4
+6
+2
+
+
+7
+9
+2
+
+
+9
+10
+2
+
+
+12
+16
+2
+
+
+18
+20
+2
+
+
+28
+37
+2
+
+
+78
+83
+2
+
+
+125
+128
+2
+
+
+160
+184
+2
+
+
+424
+465
+2
+
+
+707
+708
+1
+
+
+773
+774
+2
+
+
+777
+835
+2
+
+
+4273
+308275
+2
+
+
+
+
+
+
+name_space
+id
+
+
+12
+
+
+1
+2
+1
+
+
+324446
+324447
+1
+
+
+
+
+
+
+name_space
+kind
+
+
+12
+
+
+1
+2
+1
+
+
+2
+3
+1
+
+
+
+
+
+
+name_space
+name
+
+
+12
+
+
+1
+2
+1
+
+
+29
+30
+1
+
+
+
+
+
+
+name_space
+location
+
+
+12
+
+
+1
+2
+1
+
+
+317299
+317300
+1
+
+
+
+
+
+
+location
+id
+
+
+12
+
+
+1
+2
+408386
+
+
+2
+13
+7391
+
+
+
+
+
+
+location
+kind
+
+
+12
+
+
+1
+2
+415778
+
+
+
+
+
+
+location
+name
+
+
+12
+
+
+1
+2
+414667
+
+
+2
+4
+1111
+
+
+
+
+
+
+location
+name_space
+
+
+12
+
+
+1
+2
+415778
+
+
+
+
+
+
+
+
+attribute_args
+136271
+
+
+id
+136271
+
+
+kind
+5
+
+
+attribute
+134117
+
+
+index
+19
+
+
+location
+86164
+
+
+
+
+id
+kind
+
+
+12
+
+
+1
+2
+136271
+
+
+
+
+
+
+id
+attribute
+
+
+12
+
+
+1
+2
+136271
+
+
+
+
+
+
+id
+index
+
+
+12
+
+
+1
+2
+136271
+
+
+
+
+
+
+id
+location
+
+
+12
+
+
+1
+2
+136271
+
+
+
+
+
+
+kind
+id
+
+
+12
+
+
+414
+415
+2
+
+
+49098
+49099
+2
+
+
+
+
+
+
+kind
+attribute
+
+
+12
+
+
+330
+331
+2
+
+
+48712
+48713
+2
+
+
+
+
+
+
+kind
+index
+
+
+12
+
+
+3
+4
+2
+
+
+7
+8
+2
+
+
+
+
+
+
+kind
+location
+
+
+12
+
+
+211
+212
+2
+
+
+31108
+31109
+2
+
+
+
+
+
+
+attribute
+id
+
+
+12
+
+
+1
+2
+132994
+
+
+2
+8
+1122
+
+
+
+
+
+
+attribute
+kind
+
+
+12
+
+
+1
+2
+133297
+
+
+2
+3
+819
+
+
+
+
+
+
+attribute
+index
+
+
+12
+
+
+1
+2
+132994
+
+
+2
+8
+1122
+
+
+
+
+
+
+attribute
+location
+
+
+12
+
+
+1
+2
+133046
+
+
+2
+4
+1070
+
+
+
+
+
+
+index
+id
+
+
+12
+
+
+4
+5
+2
+
+
+16
+17
+8
+
+
+323
+324
+2
+
+
+408
+409
+2
+
+
+48729
+48730
+2
+
+
+
+
+
+
+index
+kind
+
+
+12
+
+
+1
+2
+11
+
+
+2
+3
+8
+
+
+
+
+
+
+index
+attribute
+
+
+12
+
+
+4
+5
+2
+
+
+16
+17
+8
+
+
+323
+324
+2
+
+
+408
+409
+2
+
+
+48744
+48745
+2
+
+
+
+
+
+
+index
+location
+
+
+12
+
+
+2
+3
+2
+
+
+8
+9
+8
+
+
+204
+205
+2
+
+
+289
+290
+2
+
+
+30845
+30846
+2
+
+
+
+
+
+
+location
+id
+
+
+12
+
+
+1
+2
+50742
+
+
+2
+3
+31325
+
+
+3
+25
+4096
+
+
+
+
+
+
+location
+kind
+
+
+12
+
+
+1
+2
+86156
+
+
+2
+3
+8
+
+
+
+
+
+
+location
+attribute
+
+
+12
+
+
+1
+2
+50717
+
+
+2
+3
+31374
+
+
+3
+25
+4072
+
+
+
+
+
+
+location
+index
+
+
+12
+
+
+1
+2
+86134
+
+
+3
+8
+30
+
+
+
+
+
+
+
+
+attribute_arg_value
+136230
+
+
+arg
+136230
+
+
+value
+29825
+
+
+
+
+arg
+value
+
+
+12
+
+
+1
+2
+136230
+
+
+
+
+
+
+value
+arg
+
+
+12
+
+
+1
+2
+29242
+
+
+2
+10083
+583
+
+
+
+
+
+
+
+
+attribute_arg_type
+99
+
+
+arg
+99
+
+
+type_id
+44
+
+
+
+
+arg
+type_id
+
+
+12
+
+
+1
+2
+99
+
+
+
+
+
+
+type_id
+arg
+
+
+12
+
+
+1
+2
+11
+
+
+2
+3
+22
+
+
+4
+5
+11
+
+
+
+
+
+
+
+
+attribute_arg_name
+6
+
+
+arg
+6
+
+
+name
+5
+
+
+
+
+arg
+name
+
+
+12
+
+
+1
+2
+6
+
+
+
+
+
+
+name
+arg
+
+
+12
+
+
+1
+2
+4
+
+
+2
+3
+1
+
+
+
+
+
+
+
+
+typeattributes
+8188
+
+
+type_id
+7578
+
+
+spec_id
+8188
+
+
+
+
+type_id
+spec_id
+
+
+12
+
+
+1
+2
+7312
+
+
+2
+22
+266
+
+
+
+
+
+
+spec_id
+type_id
+
+
+12
+
+
+1
+2
+8188
+
+
+
+
+
+
+
+
+funcattributes
+258842
+
+
+func_id
+135989
+
+
+spec_id
+258842
+
+
+
+
+func_id
+spec_id
+
+
+12
+
+
+1
+2
+68305
+
+
+2
+3
+13880
+
+
+3
+4
+52926
+
+
+4
+7
+876
+
+
+
+
+
+
+spec_id
+func_id
+
+
+12
+
+
+1
+2
+258842
+
+
+
+
+
+
+
+
+varattributes
+406582
+
+
+var_id
+351026
+
+
+spec_id
+406582
+
+
+
+
+var_id
+spec_id
+
+
+12
+
+
+1
+2
+295487
+
+
+2
+3
+55538
+
+
+14
+15
+1
+
+
+
+
+
+
+spec_id
+var_id
+
+
+12
+
+
+1
+2
+406582
+
+
+
+
+
+
+
+
+stmtattributes
+6
+
+
+stmt_id
+6
+
+
+spec_id
+6
+
+
+
+
+stmt_id
+spec_id
+
+
+12
+
+
+1
+2
+6
+
+
+
+
+
+
+spec_id
+stmt_id
+
+
+12
+
+
+1
+2
+6
+
+
+
+
+
+
+
+
+unspecifiedtype
+7569595
+
+
+type_id
+7569595
+
+
+unspecified_type_id
+3993891
+
+
+
+
+type_id
+unspecified_type_id
+
+
+12
+
+
+1
+2
+7569595
+
+
+
+
+
+
+unspecified_type_id
+type_id
+
+
+12
+
+
+1
+2
+2251444
+
+
+2
+3
+1376286
+
+
+3
+8
+309361
+
+
+8
+5869
+56799
+
+
+
+
+
+
+
+
+member
+4607455
+
+
+parent
+458333
+
+
+index
+2640
+
+
+child
+4564536
+
+
+
+
+parent
+index
+
+
+12
+
+
+1
+2
+47101
+
+
+2
+3
+76993
+
+
+3
+4
+58951
+
+
+4
+5
+39489
+
+
+5
+6
+29381
+
+
+6
+8
+41842
+
+
+8
+9
+20371
+
+
+9
+12
+35584
+
+
+12
+18
+37825
+
+
+18
+25
+35018
+
+
+25
+142
+35617
+
+
+142
+239
+155
+
+
+
+
+
+
+parent
+child
+
+
+12
+
+
+1
+2
+46580
+
+
+2
+3
+76971
+
+
+3
+4
+57842
+
+
+4
+5
+39678
+
+
+5
+6
+29204
+
+
+6
+8
+41609
+
+
+8
+9
+20183
+
+
+9
+12
+36249
+
+
+12
+18
+37736
+
+
+18
+25
+35173
+
+
+25
+110
+34541
+
+
+110
+303
+2563
+
+
+
+
+
+
+index
+parent
+
+
+12
+
+
+1
+2
+454
+
+
+2
+9
+210
+
+
+9
+11
+188
+
+
+11
+13
+210
+
+
+14
+178
+199
+
+
+186
+375
+199
+
+
+387
+492
+199
+
+
+492
+553
+199
+
+
+578
+924
+199
+
+
+928
+1716
+199
+
+
+2044
+6774
+199
+
+
+7261
+41308
+177
+
+
+
+
+
+
+index
+child
+
+
+12
+
+
+1
+2
+454
+
+
+2
+9
+144
+
+
+9
+11
+244
+
+
+11
+24
+210
+
+
+24
+171
+199
+
+
+185
+227
+199
+
+
+379
+499
+199
+
+
+502
+577
+199
+
+
+579
+717
+199
+
+
+949
+1613
+199
+
+
+1763
+6528
+199
+
+
+6950
+41816
+188
+
+
+
+
+
+
+child
+parent
+
+
+12
+
+
+1
+2
+4564536
+
+
+
+
+
+
+child
+index
+
+
+12
+
+
+1
+2
+4536708
+
+
+2
+14
+27828
+
+
+
+
+
+
+
+
+enclosingfunction
+156494
+
+
+child
+156494
+
+
+parent
+86979
+
+
+
+
+child
+parent
+
+
+12
+
+
+1
+2
+156494
+
+
+
+
+
+
+parent
+child
+
+
+12
+
+
+1
+2
+42263
+
+
+2
+3
+31944
+
+
+3
+4
+6413
+
+
+4
+49
+6357
+
+
+
+
+
+
+
+
+derivations
+220295
+
+
+derivation
+220295
+
+
+sub
+208101
+
+
+index
+66
+
+
+super
+157071
+
+
+location
+80988
+
+
+
+
+derivation
+sub
+
+
+12
+
+
+1
+2
+220295
+
+
+
+
+
+
+derivation
+index
+
+
+12
+
+
+1
+2
+220295
+
+
+
+
+
+
+derivation
+super
+
+
+12
+
+
+1
+2
+220295
+
+
+
+
+
+
+derivation
+location
+
+
+12
+
+
+1
+2
+220295
+
+
+
+
+
+
+sub
+derivation
+
+
+12
+
+
+1
+2
+197615
+
+
+2
+7
+10485
+
+
+
+
+
+
+sub
+index
+
+
+12
+
+
+1
+2
+199113
+
+
+2
+7
+8987
+
+
+
+
+
+
+sub
+super
+
+
+12
+
+
+1
+2
+197615
+
+
+2
+7
+10485
+
+
+
+
+
+
+sub
+location
+
+
+12
+
+
+1
+2
+199147
+
+
+2
+7
+8954
+
+
+
+
+
+
+index
+derivation
+
+
+12
+
+
+1
+2
+11
+
+
+4
+5
+11
+
+
+35
+36
+11
+
+
+104
+105
+11
+
+
+812
+813
+11
+
+
+18898
+18899
+11
+
+
+
+
+
+
+index
+sub
+
+
+12
+
+
+1
+2
+11
+
+
+4
+5
+11
+
+
+35
+36
+11
+
+
+104
+105
+11
+
+
+810
+811
+11
+
+
+18755
+18756
+11
+
+
+
+
+
+
+index
+super
+
+
+12
+
+
+1
+2
+11
+
+
+3
+4
+11
+
+
+22
+23
+11
+
+
+84
+85
+11
+
+
+401
+402
+11
+
+
+13697
+13698
+11
+
+
+
+
+
+
+index
+location
+
+
+12
+
+
+1
+2
+11
+
+
+4
+5
+11
+
+
+18
+19
+11
+
+
+50
+51
+11
+
+
+248
+249
+11
+
+
+6984
+6985
+11
+
+
+
+
+
+
+super
+derivation
+
+
+12
+
+
+1
+2
+147518
+
+
+2
+454
+9553
+
+
+
+
+
+
+super
+sub
+
+
+12
+
+
+1
+2
+147518
+
+
+2
+454
+9553
+
+
+
+
+
+
+super
+index
+
+
+12
+
+
+1
+2
+156528
+
+
+2
+4
+543
+
+
+
+
+
+
+super
+location
+
+
+12
+
+
+1
+2
+151734
+
+
+2
+441
+5337
+
+
+
+
+
+
+location
+derivation
+
+
+12
+
+
+1
+2
+64277
+
+
+2
+3
+7178
+
+
+3
+8
+6135
+
+
+8
+430
+3395
+
+
+
+
+
+
+location
+sub
+
+
+12
+
+
+1
+2
+65087
+
+
+2
+3
+6479
+
+
+3
+9
+6402
+
+
+9
+422
+3018
+
+
+
+
+
+
+location
+index
+
+
+12
+
+
+1
+2
+80932
+
+
+2
+4
+55
+
+
+
+
+
+
+location
+super
+
+
+12
+
+
+1
+2
+66863
+
+
+2
+3
+6546
+
+
+3
+12
+6091
+
+
+12
+427
+1486
+
+
+
+
+
+
+
+
+derspecifiers
+222803
+
+
+der_id
+220284
+
+
+spec_id
+44
+
+
+
+
+der_id
+spec_id
+
+
+12
+
+
+1
+2
+217765
+
+
+2
+3
+2518
+
+
+
+
+
+
+spec_id
+der_id
+
+
+12
+
+
+227
+228
+11
+
+
+238
+239
+11
+
+
+723
+724
+11
+
+
+18892
+18893
+11
+
+
+
+
+
+
+
+
+direct_base_offsets
+147817
+
+
+der_id
+147817
+
+
+offset
+221
+
+
+
+
+der_id
+offset
+
+
+12
+
+
+1
+2
+147817
+
+
+
+
+
+
+offset
+der_id
+
+
+12
+
+
+1
+2
+66
+
+
+2
+3
+11
+
+
+4
+5
+22
+
+
+5
+6
+22
+
+
+6
+7
+11
+
+
+7
+8
+11
+
+
+8
+9
+11
+
+
+9
+10
+11
+
+
+16
+17
+11
+
+
+17
+18
+11
+
+
+79
+80
+11
+
+
+81
+82
+11
+
+
+13073
+13074
+11
+
+
+
+
+
+
+
+
+virtual_base_offsets
+5470
+
+
+sub
+2607
+
+
+super
+499
+
+
+offset
+244
+
+
+
+
+sub
+super
+
+
+12
+
+
+1
+2
+1852
+
+
+2
+3
+88
+
+
+3
+4
+221
+
+
+4
+6
+144
+
+
+6
+7
+110
+
+
+7
+11
+188
+
+
+
+
+
+
+sub
+offset
+
+
+12
+
+
+1
+2
+2052
+
+
+2
+3
+199
+
+
+3
+5
+221
+
+
+5
+8
+133
+
+
+
+
+
+
+super
+sub
+
+
+12
+
+
+1
+2
+88
+
+
+2
+3
+44
+
+
+3
+4
+55
+
+
+4
+5
+88
+
+
+5
+7
+33
+
+
+8
+13
+44
+
+
+13
+15
+44
+
+
+15
+23
+44
+
+
+24
+60
+44
+
+
+110
+111
+11
+
+
+
+
+
+
+super
+offset
+
+
+12
+
+
+1
+2
+288
+
+
+2
+3
+77
+
+
+4
+6
+33
+
+
+6
+8
+44
+
+
+8
+10
+44
+
+
+15
+16
+11
+
+
+
+
+
+
+offset
+sub
+
+
+12
+
+
+1
+2
+11
+
+
+2
+3
+33
+
+
+4
+5
+33
+
+
+5
+6
+33
+
+
+6
+7
+11
+
+
+7
+8
+22
+
+
+8
+11
+22
+
+
+18
+22
+22
+
+
+26
+31
+22
+
+
+36
+59
+22
+
+
+97
+98
+11
+
+
+
+
+
+
+offset
+super
+
+
+12
+
+
+1
+2
+77
+
+
+2
+3
+22
+
+
+3
+4
+55
+
+
+5
+7
+22
+
+
+7
+10
+22
+
+
+12
+14
+22
+
+
+21
+30
+22
+
+
+
+
+
+
+
+
+frienddecls
+88113
+
+
+id
+88113
+
+
+type_id
+9165
+
+
+decl_id
+11676
+
+
+location
+4615
+
+
+
+
+id
+type_id
+
+
+12
+
+
+1
+2
+88113
+
+
+
+
+
+
+id
+decl_id
+
+
+12
+
+
+1
+2
+88113
+
+
+
+
+
+
+id
+location
+
+
+12
+
+
+1
+2
+88113
+
+
+
+
+
+
+type_id
+id
+
+
+12
+
+
+1
+2
+4993
+
+
+2
+3
+1713
+
+
+3
+4
+530
+
+
+4
+10
+721
+
+
+10
+58
+739
+
+
+58
+333
+469
+
+
+
+
+
+
+type_id
+decl_id
+
+
+12
+
+
+1
+2
+5120
+
+
+2
+3
+1671
+
+
+3
+5
+843
+
+
+5
+37
+719
+
+
+39
+118
+688
+
+
+118
+333
+124
+
+
+
+
+
+
+type_id
+location
+
+
+12
+
+
+1
+2
+8232
+
+
+2
+4
+691
+
+
+4
+31
+242
+
+
+
+
+
+
+decl_id
+id
+
+
+12
+
+
+1
+2
+9156
+
+
+2
+3
+900
+
+
+3
+14
+908
+
+
+14
+669
+712
+
+
+
+
+
+
+decl_id
+type_id
+
+
+12
+
+
+1
+2
+9561
+
+
+2
+4
+903
+
+
+4
+48
+876
+
+
+48
+669
+336
+
+
+
+
+
+
+decl_id
+location
+
+
+12
+
+
+1
+2
+10693
+
+
+2
+5
+896
+
+
+5
+115
+87
+
+
+
+
+
+
+location
+id
+
+
+12
+
+
+1
+2
+3240
+
+
+2
+3
+1314
+
+
+3
+82041
+61
+
+
+
+
+
+
+location
+type_id
+
+
+12
+
+
+1
+2
+4442
+
+
+2
+6627
+173
+
+
+
+
+
+
+location
+decl_id
+
+
+12
+
+
+1
+2
+3264
+
+
+2
+3
+1322
+
+
+3
+7681
+29
+
+
+
+
+
+
+
+
+comments
+1490251
+
+
+id
+1490251
+
+
+contents
+757542
+
+
+location
+1490251
+
+
+
+
+id
+contents
+
+
+12
+
+
+1
+2
+1490251
+
+
+
+
+
+
+id
+location
+
+
+12
+
+
+1
+2
+1490251
+
+
+
+
+
+
+contents
+id
+
+
+12
+
+
+1
+2
+649324
+
+
+2
+3
+67451
+
+
+3
+10112
+40765
+
+
+
+
+
+
+contents
+location
+
+
+12
+
+
+1
+2
+649324
+
+
+2
+3
+67451
+
+
+3
+10112
+40765
+
+
+
+
+
+
+location
+id
+
+
+12
+
+
+1
+2
+1490251
+
+
+
+
+
+
+location
+contents
+
+
+12
+
+
+1
+2
+1490251
+
+
+
+
+
+
+
+
+commentbinding
+690900
+
+
+id
+592680
+
+
+element
+665458
+
+
+
+
+id
+element
+
+
+12
+
+
+1
+2
+527182
+
+
+2
+3
+51151
+
+
+3
+67
+14346
+
+
+
+
+
+
+element
+id
+
+
+12
+
+
+1
+2
+640015
+
+
+2
+3
+25442
+
+
+
+
+
+
+
+
+exprconv
+8065841
+
+
+converted
+8065488
+
+
+conversion
+8065841
+
+
+
+
+converted
+conversion
+
+
+12
+
+
+1
+2
+8065136
+
+
+2
+3
+352
+
+
+
+
+
+
+conversion
+converted
+
+
+12
+
+
+1
+2
+8065841
+
+
+
+
+
+
+
+
+compgenerated
+7351784
+
+
+id
+7351784
+
+
+
+
+
+namespaces
+7878
+
+
+id
+7878
+
+
+name
+4449
+
+
+
+
+id
+name
+
+
+12
+
+
+1
+2
+7878
+
+
+
+
+
+
+name
+id
+
+
+12
+
+
+1
+2
+3816
+
+
+2
+3
+421
+
+
+3
+140
+210
+
+
+
+
+
+
+
+
+namespacembrs
+1153750
+
+
+parentid
+7400
+
+
+memberid
+1153750
+
+
+
+
+parentid
+memberid
+
+
+12
+
+
+1
+2
+721
+
+
+2
+3
+765
+
+
+3
+4
+543
+
+
+4
+6
+665
+
+
+6
+10
+610
+
+
+10
+17
+632
+
+
+17
+26
+510
+
+
+26
+35
+565
+
+
+35
+53
+565
+
+
+53
+113
+576
+
+
+115
+261
+565
+
+
+261
+1041
+565
+
+
+1691
+24643
+110
+
+
+
+
+
+
+memberid
+parentid
+
+
+12
+
+
+1
+2
+1153750
+
+
+
+
+
+
+
+
+exprparents
+16652035
+
+
+expr_id
+16400802
+
+
+child_index
+2214
+
+
+parent_id
+11485996
+
+
+
+
+expr_id
+child_index
+
+
+12
+
+
+1
+2
+16235076
+
+
+2
+4
+165726
+
+
+
+
+
+
+expr_id
+parent_id
+
+
+12
+
+
+1
+2
+16341056
+
+
+2
+3
+59745
+
+
+
+
+
+
+child_index
+expr_id
+
+
+12
+
+
+1
+2
+214
+
+
+2
+3
+242
+
+
+3
+4
+566
+
+
+5
+6
+115
+
+
+6
+8
+184
+
+
+8
+9
+360
+
+
+9
+33
+200
+
+
+33
+113
+167
+
+
+115
+3470758
+162
+
+
+
+
+
+
+child_index
+parent_id
+
+
+12
+
+
+1
+2
+214
+
+
+2
+3
+242
+
+
+3
+4
+566
+
+
+5
+6
+115
+
+
+6
+8
+184
+
+
+8
+9
+360
+
+
+9
+33
+200
+
+
+33
+113
+167
+
+
+115
+3482076
+162
+
+
+
+
+
+
+parent_id
+expr_id
+
+
+12
+
+
+1
+2
+7456196
+
+
+2
+3
+3521605
+
+
+3
+403
+508195
+
+
+
+
+
+
+parent_id
+child_index
+
+
+12
+
+
+1
+2
+7422292
+
+
+2
+3
+3542901
+
+
+3
+805
+520802
+
+
+
+
+
+
+
+
+expr_isload
+5379876
+
+
+expr_id
+5379876
+
+
+
+
+
+conversionkinds
+5257931
+
+
+expr_id
+5257931
+
+
+kind
+7
+
+
+
+
+expr_id
+kind
+
+
+12
+
+
+1
+2
+5257931
+
+
+
+
+
+
+kind
+expr_id
+
+
+12
+
+
+1750
+1751
+1
+
+
+11952
+11953
+1
+
+
+12205
+12206
+1
+
+
+14480
+14481
+1
+
+
+40906
+40907
+1
+
+
+3931281
+3931282
+1
+
+
+
+
+
+
+
+
+iscall
+2879054
+
+
+caller
+2879054
+
+
+kind
+33
+
+
+
+
+caller
+kind
+
+
+12
+
+
+1
+2
+2879054
+
+
+
+
+
+
+kind
+caller
+
+
+12
+
+
+1791
+1792
+11
+
+
+6435
+6436
+11
+
+
+251247
+251248
+11
+
+
+
+
+
+
+
+
+numtemplatearguments
+171718
+
+
+expr_id
+171718
+
+
+num
+44
+
+
+
+
+expr_id
+num
+
+
+12
+
+
+1
+2
+171718
+
+
+
+
+
+
+num
+expr_id
+
+
+12
+
+
+3
+4
+11
+
+
+35
+36
+11
+
+
+1630
+1631
+11
+
+
+13808
+13809
+11
+
+
+
+
+
+
+
+
+specialnamequalifyingelements
+11
+
+
+id
+11
+
+
+name
+11
+
+
+
+
+id
+name
+
+
+12
+
+
+1
+2
+11
+
+
+
+
+
+
+name
+id
+
+
+12
+
+
+1
+2
+11
+
+
+
+
+
+
+
+
+namequalifiers
+942519
+
+
+id
+942519
+
+
+qualifiableelement
+942519
+
+
+qualifyingelement
+78746
+
+
+location
+198425
+
+
+
+
+id
+qualifiableelement
+
+
+12
+
+
+1
+2
+942519
+
+
+
+
+
+
+id
+qualifyingelement
+
+
+12
+
+
+1
+2
+942519
+
+
+
+
+
+
+id
+location
+
+
+12
+
+
+1
+2
+942519
+
+
+
+
+
+
+qualifiableelement
+id
+
+
+12
+
+
+1
+2
+942519
+
+
+
+
+
+
+qualifiableelement
+qualifyingelement
+
+
+12
+
+
+1
+2
+942519
+
+
+
+
+
+
+qualifiableelement
+location
+
+
+12
+
+
+1
+2
+942519
+
+
+
+
+
+
+qualifyingelement
+id
+
+
+12
+
+
+1
+2
+43517
+
+
+2
+3
+13270
+
+
+3
+4
+5126
+
+
+4
+6
+6701
+
+
+6
+13
+6091
+
+
+13
+20492
+4038
+
+
+
+
+
+
+qualifyingelement
+qualifiableelement
+
+
+12
+
+
+1
+2
+43517
+
+
+2
+3
+13270
+
+
+3
+4
+5126
+
+
+4
+6
+6701
+
+
+6
+13
+6091
+
+
+13
+20492
+4038
+
+
+
+
+
+
+qualifyingelement
+location
+
+
+12
+
+
+1
+2
+51273
+
+
+2
+3
+12371
+
+
+3
+5
+6380
+
+
+5
+10
+6091
+
+
+10
+3208
+2629
+
+
+
+
+
+
+location
+id
+
+
+12
+
+
+1
+2
+86402
+
+
+2
+3
+37126
+
+
+3
+4
+31445
+
+
+4
+6
+15622
+
+
+6
+11
+16288
+
+
+11
+1309
+11539
+
+
+
+
+
+
+location
+qualifiableelement
+
+
+12
+
+
+1
+2
+86402
+
+
+2
+3
+37126
+
+
+3
+4
+31445
+
+
+4
+6
+15622
+
+
+6
+11
+16288
+
+
+11
+1309
+11539
+
+
+
+
+
+
+location
+qualifyingelement
+
+
+12
+
+
+1
+2
+155762
+
+
+2
+3
+18496
+
+
+3
+4
+15866
+
+
+4
+312
+8299
+
+
+
+
+
+
+
+
+varbind
+6694687
+
+
+expr
+6694687
+
+
+var
+1300121
+
+
+
+
+expr
+var
+
+
+12
+
+
+1
+2
+6694687
+
+
+
+
+
+
+var
+expr
+
+
+12
+
+
+1
+2
+421705
+
+
+2
+3
+255855
+
+
+3
+4
+162383
+
+
+4
+5
+98477
+
+
+5
+6
+124514
+
+
+6
+9
+115495
+
+
+9
+25
+98642
+
+
+25
+69786
+23046
+
+
+
+
+
+
+
+
+funbind
+2933069
+
+
+expr
+2863531
+
+
+fun
+983030
+
+
+
+
+expr
+fun
+
+
+12
+
+
+1
+2
+2795525
+
+
+2
+4
+68006
+
+
+
+
+
+
+fun
+expr
+
+
+12
+
+
+1
+2
+637152
+
+
+2
+3
+162076
+
+
+3
+4
+57764
+
+
+4
+8
+75506
+
+
+8
+2144
+50530
+
+
+
+
+
+
+
+
+expr_allocator
+34663
+
+
+expr
+34663
+
+
+func
+122
+
+
+form
+11
+
+
+
+
+expr
+func
+
+
+12
+
+
+1
+2
+34663
+
+
+
+
+
+
+expr
+form
+
+
+12
+
+
+1
+2
+34663
+
+
+
+
+
+
+func
+expr
+
+
+12
+
+
+1
+2
+44
+
+
+3
+4
+11
+
+
+4
+5
+11
+
+
+9
+10
+22
+
+
+38
+39
+11
+
+
+1250
+1251
+11
+
+
+1807
+1808
+11
+
+
+
+
+
+
+func
+form
+
+
+12
+
+
+1
+2
+122
+
+
+
+
+
+
+form
+expr
+
+
+12
+
+
+3124
+3125
+11
+
+
+
+
+
+
+form
+func
+
+
+12
+
+
+11
+12
+11
+
+
+
+
+
+
+
+
+expr_deallocator
+37814
+
+
+expr
+37814
+
+
+func
+122
+
+
+form
+22
+
+
+
+
+expr
+func
+
+
+12
+
+
+1
+2
+37814
+
+
+
+
+
+
+expr
+form
+
+
+12
+
+
+1
+2
+37814
+
+
+
+
+
+
+func
+expr
+
+
+12
+
+
+1
+2
+33
+
+
+2
+3
+11
+
+
+3
+4
+11
+
+
+4
+5
+11
+
+
+9
+10
+22
+
+
+116
+117
+11
+
+
+1112
+1113
+11
+
+
+2150
+2151
+11
+
+
+
+
+
+
+func
+form
+
+
+12
+
+
+1
+2
+122
+
+
+
+
+
+
+form
+expr
+
+
+12
+
+
+1117
+1118
+11
+
+
+2291
+2292
+11
+
+
+
+
+
+
+form
+func
+
+
+12
+
+
+3
+4
+11
+
+
+8
+9
+11
+
+
+
+
+
+
+
+
+values
+10189744
+
+
+id
+10189744
+
+
+str
+849227
+
+
+text
+991801
+
+
+
+
+id
+str
+
+
+12
+
+
+1
+2
+10189744
+
+
+
+
+
+
+id
+text
+
+
+12
+
+
+1
+2
+10189744
+
+
+
+
+
+
+str
+id
+
+
+12
+
+
+1
+2
+713829
+
+
+2
+3
+73119
+
+
+3
+3378922
+62277
+
+
+
+
+
+
+str
+text
+
+
+12
+
+
+1
+2
+824811
+
+
+2
+23640
+24416
+
+
+
+
+
+
+text
+id
+
+
+12
+
+
+1
+2
+736526
+
+
+2
+3
+125247
+
+
+3
+6
+78409
+
+
+6
+1512711
+51617
+
+
+
+
+
+
+text
+str
+
+
+12
+
+
+1
+2
+963944
+
+
+2
+5856
+27857
+
+
+
+
+
+
+
+
+valuebind
+11000680
+
+
+val
+10183302
+
+
+expr
+11000680
+
+
+
+
+val
+expr
+
+
+12
+
+
+1
+2
+9367015
+
+
+2
+3
+815204
+
+
+3
+6
+1082
+
+
+
+
+
+
+expr
+val
+
+
+12
+
+
+1
+2
+11000680
+
+
+
+
+
+
+
+
+fieldoffsets
+281688
+
+
+id
+281688
+
+
+byteoffset
+3461
+
+
+bitoffset
+77
+
+
+
+
+id
+byteoffset
+
+
+12
+
+
+1
+2
+281688
+
+
+
+
+
+
+id
+bitoffset
+
+
+12
+
+
+1
+2
+281688
+
+
+
+
+
+
+byteoffset
+id
+
+
+12
+
+
+1
+2
+1342
+
+
+2
+3
+466
+
+
+3
+4
+210
+
+
+4
+6
+244
+
+
+6
+9
+266
+
+
+9
+14
+266
+
+
+14
+34
+277
+
+
+36
+157
+266
+
+
+157
+14470
+122
+
+
+
+
+
+
+byteoffset
+bitoffset
+
+
+12
+
+
+1
+2
+3406
+
+
+2
+8
+55
+
+
+
+
+
+
+bitoffset
+id
+
+
+12
+
+
+1
+2
+22
+
+
+2
+3
+22
+
+
+3
+4
+11
+
+
+4
+5
+11
+
+
+25374
+25375
+11
+
+
+
+
+
+
+bitoffset
+byteoffset
+
+
+12
+
+
+1
+2
+22
+
+
+2
+3
+33
+
+
+3
+4
+11
+
+
+312
+313
+11
+
+
+
+
+
+
+
+
+bitfield
+16189
+
+
+id
+16189
+
+
+bits
+104
+
+
+declared_bits
+104
+
+
+
+
+id
+bits
+
+
+12
+
+
+1
+2
+16189
+
+
+
+
+
+
+id
+declared_bits
+
+
+12
+
+
+1
+2
+16189
+
+
+
+
+
+
+bits
+id
+
+
+12
+
+
+1
+2
+27
+
+
+2
+3
+11
+
+
+3
+4
+11
+
+
+4
+5
+8
+
+
+5
+6
+5
+
+
+6
+9
+8
+
+
+14
+25
+8
+
+
+29
+50
+8
+
+
+68
+118
+8
+
+
+132
+3562
+8
+
+
+
+
+
+
+bits
+declared_bits
+
+
+12
+
+
+1
+2
+104
+
+
+
+
+
+
+declared_bits
+id
+
+
+12
+
+
+1
+2
+27
+
+
+2
+3
+11
+
+
+3
+4
+11
+
+
+4
+5
+8
+
+
+5
+6
+5
+
+
+6
+9
+8
+
+
+14
+25
+8
+
+
+29
+50
+8
+
+
+68
+118
+8
+
+
+132
+3562
+8
+
+
+
+
+
+
+declared_bits
+bits
+
+
+12
+
+
+1
+2
+104
+
+
+
+
+
+
+
+
+initialisers
+1576583
+
+
+init
+1576583
+
+
+var
+625276
+
+
+expr
+1576583
+
+
+location
+428767
+
+
+
+
+init
+var
+
+
+12
+
+
+1
+2
+1576583
+
+
+
+
+
+
+init
+expr
+
+
+12
+
+
+1
+2
+1576583
+
+
+
+
+
+
+init
+location
+
+
+12
+
+
+1
+2
+1576583
+
+
+
+
+
+
+var
+init
+
+
+12
+
+
+1
+2
+540943
+
+
+2
+6
+48511
+
+
+6
+7693
+35822
+
+
+
+
+
+
+var
+expr
+
+
+12
+
+
+1
+2
+540943
+
+
+2
+6
+48511
+
+
+6
+7693
+35822
+
+
+
+
+
+
+var
+location
+
+
+12
+
+
+1
+2
+624458
+
+
+2
+36
+818
+
+
+
+
+
+
+expr
+init
+
+
+12
+
+
+1
+2
+1576583
+
+
+
+
+
+
+expr
+var
+
+
+12
+
+
+1
+2
+1576583
+
+
+
+
+
+
+expr
+location
+
+
+12
+
+
+1
+2
+1576583
+
+
+
+
+
+
+location
+init
+
+
+12
+
+
+1
+2
+375378
+
+
+2
+6
+34656
+
+
+6
+545994
+18733
+
+
+
+
+
+
+location
+var
+
+
+12
+
+
+1
+2
+406693
+
+
+2
+59565
+22074
+
+
+
+
+
+
+location
+expr
+
+
+12
+
+
+1
+2
+375378
+
+
+2
+6
+34656
+
+
+6
+545994
+18733
+
+
+
+
+
+
+
+
+expr_ancestor
+154467
+
+
+exp
+154134
+
+
+ancestor
+85940
+
+
+
+
+exp
+ancestor
+
+
+12
+
+
+1
+2
+153960
+
+
+2
+34
+174
+
+
+
+
+
+
+ancestor
+exp
+
+
+12
+
+
+1
+2
+52526
+
+
+2
+3
+19527
+
+
+3
+4
+5723
+
+
+4
+7
+6718
+
+
+7
+322
+1446
+
+
+
+
+
+
+
+
+exprs
+22820542
+
+
+id
+22820542
+
+
+kind
+1065
+
+
+location
+19069924
+
+
+
+
+id
+kind
+
+
+12
+
+
+1
+2
+22820542
+
+
+
+
+
+
+id
+location
+
+
+12
+
+
+1
+2
+22820542
+
+
+
+
+
+
+kind
+id
+
+
+12
+
+
+2
+15
+88
+
+
+22
+51
+77
+
+
+70
+122
+88
+
+
+129
+290
+88
+
+
+376
+642
+88
+
+
+658
+1453
+88
+
+
+1851
+2906
+88
+
+
+2995
+4796
+88
+
+
+4934
+6867
+88
+
+
+6874
+8573
+88
+
+
+9217
+24353
+88
+
+
+42229
+268985
+88
+
+
+524785
+524786
+11
+
+
+
+
+
+
+kind
+location
+
+
+12
+
+
+1
+12
+88
+
+
+14
+51
+88
+
+
+70
+122
+88
+
+
+129
+377
+88
+
+
+397
+659
+88
+
+
+663
+1453
+88
+
+
+1851
+2906
+88
+
+
+2972
+4066
+88
+
+
+4362
+6861
+88
+
+
+6874
+9218
+88
+
+
+10966
+29509
+88
+
+
+42203
+505591
+88
+
+
+
+
+
+
+location
+id
+
+
+12
+
+
+1
+2
+18631686
+
+
+2
+141281
+438238
+
+
+
+
+
+
+location
+kind
+
+
+12
+
+
+1
+2
+18973669
+
+
+2
+23
+96255
+
+
+
+
+
+
+
+
+expr_types
+23060865
+
+
+id
+22820542
+
+
+typeid
+1681154
+
+
+value_category
+33
+
+
+
+
+id
+typeid
+
+
+12
+
+
+1
+2
+22582115
+
+
+2
+4
+238426
+
+
+
+
+
+
+id
+value_category
+
+
+12
+
+
+1
+2
+22820542
+
+
+
+
+
+
+typeid
+id
+
+
+12
+
+
+1
+2
+681081
+
+
+2
+3
+311780
+
+
+3
+4
+129021
+
+
+4
+5
+113298
+
+
+5
+8
+149349
+
+
+8
+15
+135601
+
+
+15
+62
+126791
+
+
+62
+195406
+34230
+
+
+
+
+
+
+typeid
+value_category
+
+
+12
+
+
+1
+2
+1463200
+
+
+2
+3
+209577
+
+
+3
+4
+8377
+
+
+
+
+
+
+value_category
+id
+
+
+12
+
+
+6236
+6237
+11
+
+
+441248
+441249
+11
+
+
+1609203
+1609204
+11
+
+
+
+
+
+
+value_category
+typeid
+
+
+12
+
+
+1649
+1650
+11
+
+
+36307
+36308
+11
+
+
+133955
+133956
+11
+
+
+
+
+
+
+
+
+new_allocated_type
+36793
+
+
+expr
+36793
+
+
+type_id
+22735
+
+
+
+
+expr
+type_id
+
+
+12
+
+
+1
+2
+36793
+
+
+
+
+
+
+type_id
+expr
+
+
+12
+
+
+1
+2
+15256
+
+
+2
+3
+5703
+
+
+3
+9
+1708
+
+
+13
+122
+66
+
+
+
+
+
+
+
+
+new_array_allocated_type
+915
+
+
+expr
+915
+
+
+type_id
+248
+
+
+
+
+expr
+type_id
+
+
+12
+
+
+1
+2
+915
+
+
+
+
+
+
+type_id
+expr
+
+
+12
+
+
+1
+2
+167
+
+
+2
+3
+32
+
+
+3
+4
+12
+
+
+4
+7
+19
+
+
+7
+147
+18
+
+
+
+
+
+
+
+
+condition_decl_bind
+12582
+
+
+expr
+12582
+
+
+decl
+12582
+
+
+
+
+expr
+decl
+
+
+12
+
+
+1
+2
+12582
+
+
+
+
+
+
+decl
+expr
+
+
+12
+
+
+1
+2
+12582
+
+
+
+
+
+
+
+
+typeid_bind
+4482
+
+
+expr
+4482
+
+
+type_id
+2596
+
+
+
+
+expr
+type_id
+
+
+12
+
+
+1
+2
+4482
+
+
+
+
+
+
+type_id
+expr
+
+
+12
+
+
+1
+2
+1986
+
+
+2
+3
+366
+
+
+3
+7
+199
+
+
+7
+40
+44
+
+
+
+
+
+
+
+
+uuidof_bind
+122
+
+
+expr
+122
+
+
+type_id
+62
+
+
+
+
+expr
+type_id
+
+
+12
+
+
+1
+2
+122
+
+
+
+
+
+
+type_id
+expr
+
+
+12
+
+
+1
+2
+38
+
+
+2
+3
+11
+
+
+3
+4
+7
+
+
+4
+9
+4
+
+
+10
+11
+2
+
+
+
+
+
+
+
+
+sizeof_bind
+208210
+
+
+expr
+208210
+
+
+type_id
+4095
+
+
+
+
+expr
+type_id
+
+
+12
+
+
+1
+2
+208210
+
+
+
+
+
+
+type_id
+expr
+
+
+12
+
+
+1
+2
+1627
+
+
+2
+3
+757
+
+
+3
+4
+299
+
+
+4
+7
+361
+
+
+7
+34
+229
+
+
+34
+37
+312
+
+
+37
+77
+312
+
+
+77
+9386
+194
+
+
+
+
+
+
+
+
+code_block
+15
+
+
+block
+15
+
+
+routine
+15
+
+
+
+
+block
+routine
+
+
+12
+
+
+1
+2
+15
+
+
+
+
+
+
+routine
+block
+
+
+12
+
+
+1
+2
+15
+
+
+
+
+
+
+
+
+lambdas
+2392
+
+
+expr
+2392
+
+
+default_capture
+1
+
+
+has_explicit_return_type
+1
+
+
+
+
+expr
+default_capture
+
+
+12
+
+
+1
+2
+2392
+
+
+
+
+
+
+expr
+has_explicit_return_type
+
+
+12
+
+
+1
+2
+2392
+
+
+
+
+
+
+default_capture
+expr
+
+
+12
+
+
+1826
+1827
+1
+
+
+
+
+
+
+default_capture
+has_explicit_return_type
+
+
+12
+
+
+1
+2
+1
+
+
+
+
+
+
+has_explicit_return_type
+expr
+
+
+12
+
+
+1826
+1827
+1
+
+
+
+
+
+
+has_explicit_return_type
+default_capture
+
+
+12
+
+
+1
+2
+1
+
+
+
+
+
+
+
+
+lambda_capture
+266
+
+
+id
+266
+
+
+lambda
+155
+
+
+index
+44
+
+
+captured_by_reference
+22
+
+
+is_implicit
+22
+
+
+location
+133
+
+
+
+
+id
+lambda
+
+
+12
+
+
+1
+2
+266
+
+
+
+
+
+
+id
+index
+
+
+12
+
+
+1
+2
+266
+
+
+
+
+
+
+id
+captured_by_reference
+
+
+12
+
+
+1
+2
+266
+
+
+
+
+
+
+id
+is_implicit
+
+
+12
+
+
+1
+2
+266
+
+
+
+
+
+
+id
+location
+
+
+12
+
+
+1
+2
+266
+
+
+
+
+
+
+lambda
+id
+
+
+12
+
+
+1
+2
+66
+
+
+2
+3
+77
+
+
+4
+5
+11
+
+
+
+
+
+
+lambda
+index
+
+
+12
+
+
+1
+2
+66
+
+
+2
+3
+77
+
+
+4
+5
+11
+
+
+
+
+
+
+lambda
+captured_by_reference
+
+
+12
+
+
+1
+2
+144
+
+
+2
+3
+11
+
+
+
+
+
+
+lambda
+is_implicit
+
+
+12
+
+
+1
+2
+155
+
+
+
+
+
+
+lambda
+location
+
+
+12
+
+
+1
+2
+66
+
+
+2
+3
+88
+
+
+
+
+
+
+index
+id
+
+
+12
+
+
+1
+2
+22
+
+
+8
+9
+11
+
+
+14
+15
+11
+
+
+
+
+
+
+index
+lambda
+
+
+12
+
+
+1
+2
+22
+
+
+8
+9
+11
+
+
+14
+15
+11
+
+
+
+
+
+
+index
+captured_by_reference
+
+
+12
+
+
+1
+2
+33
+
+
+2
+3
+11
+
+
+
+
+
+
+index
+is_implicit
+
+
+12
+
+
+1
+2
+22
+
+
+2
+3
+22
+
+
+
+
+
+
+index
+location
+
+
+12
+
+
+1
+2
+22
+
+
+3
+4
+11
+
+
+9
+10
+11
+
+
+
+
+
+
+captured_by_reference
+id
+
+
+12
+
+
+1
+2
+11
+
+
+23
+24
+11
+
+
+
+
+
+
+captured_by_reference
+lambda
+
+
+12
+
+
+1
+2
+11
+
+
+14
+15
+11
+
+
+
+
+
+
+captured_by_reference
+index
+
+
+12
+
+
+1
+2
+11
+
+
+4
+5
+11
+
+
+
+
+
+
+captured_by_reference
+is_implicit
+
+
+12
+
+
+1
+2
+11
+
+
+2
+3
+11
+
+
+
+
+
+
+captured_by_reference
+location
+
+
+12
+
+
+1
+2
+11
+
+
+11
+12
+11
+
+
+
+
+
+
+is_implicit
+id
+
+
+12
+
+
+6
+7
+11
+
+
+18
+19
+11
+
+
+
+
+
+
+is_implicit
+lambda
+
+
+12
+
+
+5
+6
+11
+
+
+9
+10
+11
+
+
+
+
+
+
+is_implicit
+index
+
+
+12
+
+
+2
+3
+11
+
+
+4
+5
+11
+
+
+
+
+
+
+is_implicit
+captured_by_reference
+
+
+12
+
+
+1
+2
+11
+
+
+2
+3
+11
+
+
+
+
+
+
+is_implicit
+location
+
+
+12
+
+
+6
+7
+22
+
+
+
+
+
+
+location
+id
+
+
+12
+
+
+1
+2
+110
+
+
+6
+7
+11
+
+
+8
+9
+11
+
+
+
+
+
+
+location
+lambda
+
+
+12
+
+
+1
+2
+110
+
+
+6
+7
+22
+
+
+
+
+
+
+location
+index
+
+
+12
+
+
+1
+2
+122
+
+
+3
+4
+11
+
+
+
+
+
+
+location
+captured_by_reference
+
+
+12
+
+
+1
+2
+133
+
+
+
+
+
+
+location
+is_implicit
+
+
+12
+
+
+1
+2
+133
+
+
+
+
+
+
+
+
+stmts
+5687673
+
+
+id
+5687673
+
+
+kind
+210
+
+
+location
+5604699
+
+
+
+
+id
+kind
+
+
+12
+
+
+1
+2
+5687673
+
+
+
+
+
+
+id
+location
+
+
+12
+
+
+1
+2
+5687673
+
+
+
+
+
+
+kind
+id
+
+
+12
+
+
+2
+3
+11
+
+
+25
+26
+11
+
+
+452
+453
+11
+
+
+619
+620
+11
+
+
+858
+859
+11
+
+
+1755
+1756
+11
+
+
+1939
+1940
+11
+
+
+2505
+2506
+11
+
+
+2603
+2604
+11
+
+
+2767
+2768
+11
+
+
+3377
+3378
+11
+
+
+3768
+3769
+11
+
+
+4427
+4428
+11
+
+
+6231
+6232
+11
+
+
+37830
+37831
+11
+
+
+62553
+62554
+11
+
+
+111982
+111983
+11
+
+
+123254
+123255
+11
+
+
+145651
+145652
+11
+
+
+
+
+
+
+kind
+location
+
+
+12
+
+
+2
+3
+11
+
+
+25
+26
+11
+
+
+452
+453
+11
+
+
+619
+620
+11
+
+
+858
+859
+11
+
+
+1755
+1756
+11
+
+
+1939
+1940
+11
+
+
+2505
+2506
+11
+
+
+2603
+2604
+11
+
+
+2767
+2768
+11
+
+
+3377
+3378
+11
+
+
+3768
+3769
+11
+
+
+4427
+4428
+11
+
+
+6231
+6232
+11
+
+
+37830
+37831
+11
+
+
+62549
+62550
+11
+
+
+111896
+111897
+11
+
+
+120613
+120614
+11
+
+
+142847
+142848
+11
+
+
+
+
+
+
+location
+id
+
+
+12
+
+
+1
+2
+5583151
+
+
+2
+5535
+21548
+
+
+
+
+
+
+location
+kind
+
+
+12
+
+
+1
+2
+5583151
+
+
+2
+4
+21548
+
+
+
+
+
+
+
+
+type_vla
+1
+
+
+type_id
+1
+
+
+decl
+1
+
+
+
+
+type_id
+decl
+
+
+12
+
+
+1
+2
+1
+
+
+
+
+
+
+decl
+type_id
+
+
+12
+
+
+1
+2
+1
+
+
+
+
+
+
+
+
+variable_vla
+104
+
+
+var
+104
+
+
+decl
+104
+
+
+
+
+var
+decl
+
+
+12
+
+
+1
+2
+104
+
+
+
+
+
+
+decl
+var
+
+
+12
+
+
+1
+2
+104
+
+
+
+
+
+
+
+
+if_then
+658624
+
+
+if_stmt
+658624
+
+
+then_id
+658624
+
+
+
+
+if_stmt
+then_id
+
+
+12
+
+
+1
+2
+658624
+
+
+
+
+
+
+then_id
+if_stmt
+
+
+12
+
+
+1
+2
+658624
+
+
+
+
+
+
+
+
+if_else
+192230
+
+
+if_stmt
+192230
+
+
+else_id
+192230
+
+
+
+
+if_stmt
+else_id
+
+
+12
+
+
+1
+2
+192230
+
+
+
+
+
+
+else_id
+if_stmt
+
+
+12
+
+
+1
+2
+192230
+
+
+
+
+
+
+
+
+while_body
+41808
+
+
+while_stmt
+41808
+
+
+body_id
+41808
+
+
+
+
+while_stmt
+body_id
+
+
+12
+
+
+1
+2
+41808
+
+
+
+
+
+
+body_id
+while_stmt
+
+
+12
+
+
+1
+2
+41808
+
+
+
+
+
+
+
+
+do_body
+220170
+
+
+do_stmt
+220170
+
+
+body_id
+220170
+
+
+
+
+do_stmt
+body_id
+
+
+12
+
+
+1
+2
+220170
+
+
+
+
+
+
+body_id
+do_stmt
+
+
+12
+
+
+1
+2
+220170
+
+
+
+
+
+
+
+
+switch_case
+388126
+
+
+switch_stmt
+76066
+
+
+index
+426
+
+
+case_id
+388126
+
+
+
+
+switch_stmt
+index
+
+
+12
+
+
+1
+5
+5877
+
+
+5
+6
+67190
+
+
+6
+156
+2999
+
+
+
+
+
+
+switch_stmt
+case_id
+
+
+12
+
+
+1
+5
+5877
+
+
+5
+6
+67190
+
+
+6
+156
+2999
+
+
+
+
+
+
+index
+switch_stmt
+
+
+12
+
+
+1
+2
+167
+
+
+2
+3
+46
+
+
+3
+5
+38
+
+
+5
+11
+33
+
+
+11
+28
+33
+
+
+28
+56
+33
+
+
+59
+158
+33
+
+
+177
+26285
+33
+
+
+27166
+27647
+8
+
+
+
+
+
+
+index
+case_id
+
+
+12
+
+
+1
+2
+167
+
+
+2
+3
+46
+
+
+3
+5
+38
+
+
+5
+11
+33
+
+
+11
+28
+33
+
+
+28
+56
+33
+
+
+59
+158
+33
+
+
+177
+26285
+33
+
+
+27166
+27647
+8
+
+
+
+
+
+
+case_id
+switch_stmt
+
+
+12
+
+
+1
+2
+388126
+
+
+
+
+
+
+case_id
+index
+
+
+12
+
+
+1
+2
+388126
+
+
+
+
+
+
+
+
+switch_body
+76075
+
+
+switch_stmt
+76075
+
+
+body_id
+76075
+
+
+
+
+switch_stmt
+body_id
+
+
+12
+
+
+1
+2
+76075
+
+
+
+
+
+
+body_id
+switch_stmt
+
+
+12
+
+
+1
+2
+76075
+
+
+
+
+
+
+
+
+for_initialization
+35089
+
+
+for_stmt
+35089
+
+
+init_id
+35089
+
+
+
+
+for_stmt
+init_id
+
+
+12
+
+
+1
+2
+35089
+
+
+
+
+
+
+init_id
+for_stmt
+
+
+12
+
+
+1
+2
+35089
+
+
+
+
+
+
+
+
+for_condition
+40832
+
+
+for_stmt
+40832
+
+
+condition_id
+40832
+
+
+
+
+for_stmt
+condition_id
+
+
+12
+
+
+1
+2
+40832
+
+
+
+
+
+
+condition_id
+for_stmt
+
+
+12
+
+
+1
+2
+40832
+
+
+
+
+
+
+
+
+for_update
+39995
+
+
+for_stmt
+39995
+
+
+update_id
+39995
+
+
+
+
+for_stmt
+update_id
+
+
+12
+
+
+1
+2
+39995
+
+
+
+
+
+
+update_id
+for_stmt
+
+
+12
+
+
+1
+2
+39995
+
+
+
+
+
+
+
+
+for_body
+42104
+
+
+for_stmt
+42104
+
+
+body_id
+42104
+
+
+
+
+for_stmt
+body_id
+
+
+12
+
+
+1
+2
+42104
+
+
+
+
+
+
+body_id
+for_stmt
+
+
+12
+
+
+1
+2
+42104
+
+
+
+
+
+
+
+
+stmtparents
+5409488
+
+
+id
+5409488
+
+
+index
+1273
+
+
+parent
+1953109
+
+
+
+
+id
+index
+
+
+12
+
+
+1
+2
+5409488
+
+
+
+
+
+
+id
+parent
+
+
+12
+
+
+1
+2
+5409488
+
+
+
+
+
+
+index
+id
+
+
+12
+
+
+1
+2
+448
+
+
+2
+3
+55
+
+
+3
+4
+90
+
+
+4
+6
+104
+
+
+6
+10
+90
+
+
+10
+19
+115
+
+
+22
+46
+96
+
+
+47
+149
+96
+
+
+161
+1629
+96
+
+
+1801
+579863
+79
+
+
+
+
+
+
+index
+parent
+
+
+12
+
+
+1
+2
+448
+
+
+2
+3
+55
+
+
+3
+4
+90
+
+
+4
+6
+104
+
+
+6
+10
+90
+
+
+10
+19
+115
+
+
+22
+46
+96
+
+
+47
+149
+96
+
+
+161
+1629
+96
+
+
+1801
+579863
+79
+
+
+
+
+
+
+parent
+id
+
+
+12
+
+
+1
+2
+984434
+
+
+2
+3
+483283
+
+
+3
+4
+163888
+
+
+4
+7
+153217
+
+
+7
+17
+147973
+
+
+17
+464
+20311
+
+
+
+
+
+
+parent
+index
+
+
+12
+
+
+1
+2
+984434
+
+
+2
+3
+483283
+
+
+3
+4
+163888
+
+
+4
+7
+153217
+
+
+7
+17
+147973
+
+
+17
+464
+20311
+
+
+
+
+
+
+
+
+ishandler
+21514
+
+
+block
+21514
+
+
+
+
+
+successors
+21584873
+
+
+from
+20200932
+
+
+to
+20198819
+
+
+
+
+from
+to
+
+
+12
+
+
+1
+2
+19055919
+
+
+2
+156
+1145012
+
+
+
+
+
+
+to
+from
+
+
+12
+
+
+1
+2
+19381610
+
+
+2
+349
+817209
+
+
+
+
+
+
+
+
+truecond
+1246775
+
+
+from
+1246775
+
+
+to
+1206657
+
+
+
+
+from
+to
+
+
+12
+
+
+1
+2
+1246775
+
+
+
+
+
+
+to
+from
+
+
+12
+
+
+1
+2
+1173793
+
+
+2
+23
+32864
+
+
+
+
+
+
+
+
+falsecond
+1246775
+
+
+from
+1246775
+
+
+to
+1026937
+
+
+
+
+from
+to
+
+
+12
+
+
+1
+2
+1246775
+
+
+
+
+
+
+to
+from
+
+
+12
+
+
+1
+2
+878392
+
+
+2
+3
+109699
+
+
+3
+22
+38845
+
+
+
+
+
+
+
+
+stmt_decl_bind
+702192
+
+
+stmt
+640540
+
+
+num
+740
+
+
+decl
+676381
+
+
+
+
+stmt
+num
+
+
+12
+
+
+1
+2
+596376
+
+
+2
+270
+44163
+
+
+
+
+
+
+stmt
+decl
+
+
+12
+
+
+1
+2
+596376
+
+
+2
+15
+44163
+
+
+
+
+
+
+num
+stmt
+
+
+12
+
+
+8
+9
+365
+
+
+10
+11
+2
+
+
+15
+16
+332
+
+
+16
+232801
+38
+
+
+
+
+
+
+num
+decl
+
+
+12
+
+
+8
+9
+365
+
+
+9
+10
+330
+
+
+10
+226538
+44
+
+
+
+
+
+
+decl
+stmt
+
+
+12
+
+
+1
+2
+668555
+
+
+2
+81
+7825
+
+
+
+
+
+
+decl
+num
+
+
+12
+
+
+1
+2
+676320
+
+
+2
+269
+60
+
+
+
+
+
+
+
+
+stmt_decl_entry_bind
+702192
+
+
+stmt
+640540
+
+
+num
+740
+
+
+decl_entry
+679737
+
+
+
+
+stmt
+num
+
+
+12
+
+
+1
+2
+596376
+
+
+2
+270
+44163
+
+
+
+
+
+
+stmt
+decl_entry
+
+
+12
+
+
+1
+2
+596376
+
+
+2
+15
+44163
+
+
+
+
+
+
+num
+stmt
+
+
+12
+
+
+8
+9
+365
+
+
+10
+11
+2
+
+
+15
+16
+332
+
+
+16
+232801
+38
+
+
+
+
+
+
+num
+decl_entry
+
+
+12
+
+
+8
+9
+365
+
+
+9
+10
+330
+
+
+10
+227748
+44
+
+
+
+
+
+
+decl_entry
+stmt
+
+
+12
+
+
+1
+2
+672245
+
+
+2
+17
+7492
+
+
+
+
+
+
+decl_entry
+num
+
+
+12
+
+
+1
+2
+679663
+
+
+2
+269
+74
+
+
+
+
+
+
+
+
+blockscope
+1614668
+
+
+block
+1614657
+
+
+enclosing
+1429080
+
+
+
+
+block
+enclosing
+
+
+12
+
+
+1
+2
+1614646
+
+
+2
+3
+11
+
+
+
+
+
+
+enclosing
+block
+
+
+12
+
+
+1
+2
+1329806
+
+
+2
+692
+99273
+
+
+
+
+
+
+
+
+jumpinfo
+508905
+
+
+id
+508905
+
+
+str
+8898
+
+
+target
+118849
+
+
+
+
+id
+str
+
+
+12
+
+
+1
+2
+508905
+
+
+
+
+
+
+id
+target
+
+
+12
+
+
+1
+2
+508905
+
+
+
+
+
+
+str
+id
+
+
+12
+
+
+1
+2
+5
+
+
+2
+3
+4850
+
+
+3
+4
+1172
+
+
+4
+5
+1059
+
+
+5
+7
+726
+
+
+7
+16
+693
+
+
+16
+154441
+390
+
+
+
+
+
+
+str
+target
+
+
+12
+
+
+1
+2
+7076
+
+
+2
+3
+1023
+
+
+3
+12
+676
+
+
+12
+33252
+121
+
+
+
+
+
+
+target
+id
+
+
+12
+
+
+1
+2
+16
+
+
+2
+3
+30010
+
+
+3
+4
+10557
+
+
+4
+5
+5524
+
+
+5
+6
+54916
+
+
+6
+7
+15207
+
+
+7
+155
+2616
+
+
+
+
+
+
+target
+str
+
+
+12
+
+
+1
+2
+118849
+
+
+
+
+
+
+
+
+preprocdirects
+1209495
+
+
+id
+1209495
+
+
+kind
+155
+
+
+location
+1203037
+
+
+
+
+id
+kind
+
+
+12
+
+
+1
+2
+1209495
+
+
+
+
+
+
+id
+location
+
+
+12
+
+
+1
+2
+1209495
+
+
+
+
+
+
+kind
+id
+
+
+12
+
+
+2
+3
+11
+
+
+4
+5
+11
+
+
+7
+8
+11
+
+
+89
+90
+11
+
+
+640
+641
+11
+
+
+1510
+1511
+11
+
+
+1541
+1542
+11
+
+
+4500
+4501
+11
+
+
+4602
+4603
+11
+
+
+6920
+6921
+11
+
+
+12060
+12061
+11
+
+
+23482
+23483
+11
+
+
+25393
+25394
+11
+
+
+28255
+28256
+11
+
+
+
+
+
+
+kind
+location
+
+
+12
+
+
+2
+3
+11
+
+
+4
+5
+11
+
+
+6
+7
+11
+
+
+89
+90
+11
+
+
+640
+641
+11
+
+
+1510
+1511
+11
+
+
+1541
+1542
+11
+
+
+4500
+4501
+11
+
+
+4602
+4603
+11
+
+
+6920
+6921
+11
+
+
+12060
+12061
+11
+
+
+23482
+23483
+11
+
+
+25034
+25035
+11
+
+
+28033
+28034
+11
+
+
+
+
+
+
+location
+id
+
+
+12
+
+
+1
+2
+1202704
+
+
+2
+224
+332
+
+
+
+
+
+
+location
+kind
+
+
+12
+
+
+1
+2
+1203037
+
+
+
+
+
+
+
+
+preprocpair
+328368
+
+
+begin
+260551
+
+
+elseelifend
+328368
+
+
+
+
+begin
+elseelifend
+
+
+12
+
+
+1
+2
+206348
+
+
+2
+3
+48355
+
+
+3
+53
+5847
+
+
+
+
+
+
+elseelifend
+begin
+
+
+12
+
+
+1
+2
+328368
+
+
+
+
+
+
+
+
+preproctrue
+146475
+
+
+branch
+146475
+
+
+
+
+
+preprocfalse
+106186
+
+
+branch
+106186
+
+
+
+
+
+preproctext
+897870
+
+
+id
+897870
+
+
+head
+445096
+
+
+body
+175257
+
+
+
+
+id
+head
+
+
+12
+
+
+1
+2
+897870
+
+
+
+
+
+
+id
+body
+
+
+12
+
+
+1
+2
+897870
+
+
+
+
+
+
+head
+id
+
+
+12
+
+
+1
+2
+341306
+
+
+2
+3
+68993
+
+
+3
+45
+33398
+
+
+45
+671
+1398
+
+
+
+
+
+
+head
+body
+
+
+12
+
+
+1
+2
+428907
+
+
+2
+40
+16188
+
+
+
+
+
+
+body
+id
+
+
+12
+
+
+1
+2
+164927
+
+
+2
+58048
+10330
+
+
+
+
+
+
+body
+head
+
+
+12
+
+
+1
+2
+165759
+
+
+2
+19352
+9497
+
+
+
+
+
+
+
+
+includes
+281832
+
+
+id
+281832
+
+
+included
+51595
+
+
+
+
+id
+included
+
+
+12
+
+
+1
+2
+281832
+
+
+
+
+
+
+included
+id
+
+
+12
+
+
+1
+2
+24976
+
+
+2
+3
+8565
+
+
+3
+4
+4083
+
+
+4
+6
+4726
+
+
+6
+11
+4016
+
+
+11
+32
+3916
+
+
+32
+684
+1309
+
+
+
+
+
+
+
+
+link_targets
+1295
+
+
+id
+1295
+
+
+binary
+1295
+
+
+
+
+id
+binary
+
+
+12
+
+
+1
+2
+1295
+
+
+
+
+
+
+binary
+id
+
+
+12
+
+
+1
+2
+1295
+
+
+
+
+
+
+
+
+link_parent
+12935047
+
+
+element
+4650728
+
+
+link_target
+654
+
+
+
+
+element
+link_target
+
+
+12
+
+
+1
+2
+2823653
+
+
+2
+3
+1009804
+
+
+3
+5
+416424
+
+
+5
+36
+355131
+
+
+36
+60
+45714
+
+
+
+
+
+
+link_target
+element
+
+
+12
+
+
+5
+7
+55
+
+
+7
+9
+44
+
+
+9
+25
+55
+
+
+50
+977
+55
+
+
+4264
+6130
+55
+
+
+6207
+8492
+55
+
+
+8548
+14604
+55
+
+
+16365
+19508
+55
+
+
+19529
+21610
+55
+
+
+22168
+27227
+55
+
+
+27483
+38406
+55
+
+
+39263
+327210
+55
+
+
+
+
+
+
+
+
+xmlEncoding
+39724
+
+
+id
+39724
+
+
+encoding
+1
+
+
+
+
+id
+encoding
+
+
+12
+
+
+1
+2
+39724
+
+
+
+
+
+
+encoding
+id
+
+
+12
+
+
+39724
+39725
+1
+
+
+
+
+
+
+
+
+xmlDTDs
+1
+
+
+id
+1
+
+
+root
+1
+
+
+publicId
+1
+
+
+systemId
+1
+
+
+fileid
+1
+
+
+
+
+id
+root
+
+
+12
+
+
+1
+2
+1
+
+
+
+
+
+
+id
+publicId
+
+
+12
+
+
+1
+2
+1
+
+
+
+
+
+
+id
+systemId
+
+
+12
+
+
+1
+2
+1
+
+
+
+
+
+
+id
+fileid
+
+
+12
+
+
+1
+2
+1
+
+
+
+
+
+
+root
+id
+
+
+12
+
+
+1
+2
+1
+
+
+
+
+
+
+root
+publicId
+
+
+12
+
+
+1
+2
+1
+
+
+
+
+
+
+root
+systemId
+
+
+12
+
+
+1
+2
+1
+
+
+
+
+
+
+root
+fileid
+
+
+12
+
+
+1
+2
+1
+
+
+
+
+
+
+publicId
+id
+
+
+12
+
+
+1
+2
+1
+
+
+
+
+
+
+publicId
+root
+
+
+12
+
+
+1
+2
+1
+
+
+
+
+
+
+publicId
+systemId
+
+
+12
+
+
+1
+2
+1
+
+
+
+
+
+
+publicId
+fileid
+
+
+12
+
+
+1
+2
+1
+
+
+
+
+
+
+systemId
+id
+
+
+12
+
+
+1
+2
+1
+
+
+
+
+
+
+systemId
+root
+
+
+12
+
+
+1
+2
+1
+
+
+
+
+
+
+systemId
+publicId
+
+
+12
+
+
+1
+2
+1
+
+
+
+
+
+
+systemId
+fileid
+
+
+12
+
+
+1
+2
+1
+
+
+
+
+
+
+fileid
+id
+
+
+12
+
+
+1
+2
+1
+
+
+
+
+
+
+fileid
+root
+
+
+12
+
+
+1
+2
+1
+
+
+
+
+
+
+fileid
+publicId
+
+
+12
+
+
+1
+2
+1
+
+
+
+
+
+
+fileid
+systemId
+
+
+12
+
+
+1
+2
+1
+
+
+
+
+
+
+
+
+xmlElements
+1270313
+
+
+id
+1270313
+
+
+name
+4655
+
+
+parentid
+578021
+
+
+idx
+35122
+
+
+fileid
+39721
+
+
+
+
+id
+name
+
+
+12
+
+
+1
+2
+1270313
+
+
+
+
+
+
+id
+parentid
+
+
+12
+
+
+1
+2
+1270313
+
+
+
+
+
+
+id
+idx
+
+
+12
+
+
+1
+2
+1270313
+
+
+
+
+
+
+id
+fileid
+
+
+12
+
+
+1
+2
+1270313
+
+
+
+
+
+
+name
+id
+
+
+12
+
+
+1
+2
+420
+
+
+2
+5
+156
+
+
+5
+6
+3832
+
+
+6
+310317
+247
+
+
+
+
+
+
+name
+parentid
+
+
+12
+
+
+1
+2
+456
+
+
+2
+5
+150
+
+
+5
+6
+3829
+
+
+6
+161565
+220
+
+
+
+
+
+
+name
+idx
+
+
+12
+
+
+1
+2
+4358
+
+
+2
+35123
+297
+
+
+
+
+
+
+name
+fileid
+
+
+12
+
+
+1
+2
+486
+
+
+2
+5
+133
+
+
+5
+6
+3831
+
+
+6
+14503
+205
+
+
+
+
+
+
+parentid
+id
+
+
+12
+
+
+1
+2
+371969
+
+
+2
+3
+62095
+
+
+3
+4
+104113
+
+
+4
+35123
+39844
+
+
+
+
+
+
+parentid
+name
+
+
+12
+
+
+1
+2
+500482
+
+
+2
+3
+17866
+
+
+3
+4
+49117
+
+
+4
+45
+10556
+
+
+
+
+
+
+parentid
+idx
+
+
+12
+
+
+1
+2
+371969
+
+
+2
+3
+62095
+
+
+3
+4
+104113
+
+
+4
+35123
+39844
+
+
+
+
+
+
+parentid
+fileid
+
+
+12
+
+
+1
+2
+578021
+
+
+
+
+
+
+idx
+id
+
+
+12
+
+
+2
+3
+606
+
+
+4
+5
+17851
+
+
+5
+6
+6533
+
+
+6
+7
+859
+
+
+7
+8
+4471
+
+
+9
+16
+2719
+
+
+16
+578022
+2083
+
+
+
+
+
+
+idx
+name
+
+
+12
+
+
+1
+2
+18457
+
+
+2
+3
+6533
+
+
+3
+4
+6178
+
+
+4
+8
+2624
+
+
+8
+4397
+1330
+
+
+
+
+
+
+idx
+parentid
+
+
+12
+
+
+2
+3
+606
+
+
+4
+5
+17851
+
+
+5
+6
+6533
+
+
+6
+7
+859
+
+
+7
+8
+4471
+
+
+9
+16
+2719
+
+
+16
+578022
+2083
+
+
+
+
+
+
+idx
+fileid
+
+
+12
+
+
+2
+3
+606
+
+
+4
+5
+17851
+
+
+5
+6
+6533
+
+
+6
+7
+859
+
+
+7
+8
+4471
+
+
+9
+16
+2719
+
+
+16
+39722
+2083
+
+
+
+
+
+
+fileid
+id
+
+
+12
+
+
+1
+2
+20457
+
+
+2
+3
+3115
+
+
+3
+7
+3026
+
+
+7
+8
+3588
+
+
+8
+9
+2220
+
+
+9
+11
+3099
+
+
+11
+19
+3087
+
+
+19
+114506
+1129
+
+
+
+
+
+
+fileid
+name
+
+
+12
+
+
+1
+2
+20459
+
+
+2
+3
+3458
+
+
+3
+5
+2569
+
+
+5
+7
+2172
+
+
+7
+8
+6158
+
+
+8
+9
+3501
+
+
+9
+46
+1404
+
+
+
+
+
+
+fileid
+parentid
+
+
+12
+
+
+1
+2
+20457
+
+
+2
+3
+3870
+
+
+3
+5
+2152
+
+
+5
+6
+2876
+
+
+6
+7
+2720
+
+
+7
+8
+4132
+
+
+8
+14
+3096
+
+
+14
+31079
+418
+
+
+
+
+
+
+fileid
+idx
+
+
+12
+
+
+1
+2
+25894
+
+
+2
+3
+5301
+
+
+3
+4
+3787
+
+
+4
+6
+3268
+
+
+6
+35123
+1471
+
+
+
+
+
+
+
+
+xmlAttrs
+1202020
+
+
+id
+1202020
+
+
+elementid
+760198
+
+
+name
+3649
+
+
+value
+121803
+
+
+idx
+2000
+
+
+fileid
+39448
+
+
+
+
+id
+elementid
+
+
+12
+
+
+1
+2
+1202020
+
+
+
+
+
+
+id
+name
+
+
+12
+
+
+1
+2
+1202020
+
+
+
+
+
+
+id
+value
+
+
+12
+
+
+1
+2
+1202020
+
+
+
+
+
+
+id
+idx
+
+
+12
+
+
+1
+2
+1202020
+
+
+
+
+
+
+id
+fileid
+
+
+12
+
+
+1
+2
+1202020
+
+
+
+
+
+
+elementid
+id
+
+
+12
+
+
+1
+2
+425697
+
+
+2
+3
+249659
+
+
+3
+4
+66474
+
+
+4
+2001
+18368
+
+
+
+
+
+
+elementid
+name
+
+
+12
+
+
+1
+2
+425778
+
+
+2
+3
+249579
+
+
+3
+4
+66475
+
+
+4
+2001
+18366
+
+
+
+
+
+
+elementid
+value
+
+
+12
+
+
+1
+2
+466237
+
+
+2
+3
+266291
+
+
+3
+46
+27670
+
+
+
+
+
+
+elementid
+idx
+
+
+12
+
+
+1
+2
+425697
+
+
+2
+3
+249659
+
+
+3
+4
+66474
+
+
+4
+2001
+18368
+
+
+
+
+
+
+elementid
+fileid
+
+
+12
+
+
+1
+2
+760198
+
+
+
+
+
+
+name
+id
+
+
+12
+
+
+1
+2
+3467
+
+
+2
+262475
+182
+
+
+
+
+
+
+name
+elementid
+
+
+12
+
+
+1
+2
+3467
+
+
+2
+262475
+182
+
+
+
+
+
+
+name
+value
+
+
+12
+
+
+1
+2
+3501
+
+
+2
+54146
+148
+
+
+
+
+
+
+name
+idx
+
+
+12
+
+
+1
+2
+3531
+
+
+2
+11
+118
+
+
+
+
+
+
+name
+fileid
+
+
+12
+
+
+1
+2
+3491
+
+
+2
+21768
+158
+
+
+
+
+
+
+value
+id
+
+
+12
+
+
+1
+2
+72032
+
+
+2
+3
+42366
+
+
+3
+199269
+7405
+
+
+
+
+
+
+value
+elementid
+
+
+12
+
+
+1
+2
+72036
+
+
+2
+3
+42374
+
+
+3
+199269
+7393
+
+
+
+
+
+
+value
+name
+
+
+12
+
+
+1
+2
+116722
+
+
+2
+2041
+5081
+
+
+
+
+
+
+value
+idx
+
+
+12
+
+
+1
+2
+117957
+
+
+2
+2001
+3846
+
+
+
+
+
+
+value
+fileid
+
+
+12
+
+
+1
+2
+86306
+
+
+2
+3
+28570
+
+
+3
+4175
+6927
+
+
+
+
+
+
+idx
+id
+
+
+12
+
+
+1
+2
+1955
+
+
+2
+760199
+45
+
+
+
+
+
+
+idx
+elementid
+
+
+12
+
+
+1
+2
+1955
+
+
+2
+760199
+45
+
+
+
+
+
+
+idx
+name
+
+
+12
+
+
+1
+2
+1955
+
+
+2
+189
+45
+
+
+
+
+
+
+idx
+value
+
+
+12
+
+
+1
+2
+1955
+
+
+2
+116643
+45
+
+
+
+
+
+
+idx
+fileid
+
+
+12
+
+
+1
+2
+1955
+
+
+2
+39449
+45
+
+
+
+
+
+
+fileid
+id
+
+
+12
+
+
+1
+2
+22884
+
+
+2
+4
+2565
+
+
+4
+6
+2294
+
+
+6
+7
+3299
+
+
+7
+9
+3272
+
+
+9
+16
+3143
+
+
+16
+129952
+1991
+
+
+
+
+
+
+fileid
+elementid
+
+
+12
+
+
+1
+2
+23890
+
+
+2
+4
+2131
+
+
+4
+5
+1971
+
+
+5
+6
+4096
+
+
+6
+8
+3519
+
+
+8
+16
+3137
+
+
+16
+106600
+704
+
+
+
+
+
+
+fileid
+name
+
+
+12
+
+
+1
+2
+22946
+
+
+2
+3
+2338
+
+
+3
+4
+2726
+
+
+4
+5
+2824
+
+
+5
+6
+2994
+
+
+6
+7
+3876
+
+
+7
+2002
+1744
+
+
+
+
+
+
+fileid
+value
+
+
+12
+
+
+1
+2
+22916
+
+
+2
+4
+2772
+
+
+4
+5
+2112
+
+
+5
+6
+3510
+
+
+6
+8
+1993
+
+
+8
+11
+3365
+
+
+11
+50357
+2780
+
+
+
+
+
+
+fileid
+idx
+
+
+12
+
+
+1
+2
+26133
+
+
+2
+3
+9699
+
+
+3
+5
+3511
+
+
+5
+2001
+105
+
+
+
+
+
+
+
+
+xmlNs
+71201
+
+
+id
+4185
+
+
+prefixName
+958
+
+
+URI
+4185
+
+
+fileid
+39544
+
+
+
+
+id
+prefixName
+
+
+12
+
+
+1
+2
+2602
+
+
+2
+3
+1553
+
+
+3
+872
+30
+
+
+
+
+
+
+id
+URI
+
+
+12
+
+
+1
+2
+4185
+
+
+
+
+
+
+id
+fileid
+
+
+12
+
+
+1
+6
+274
+
+
+6
+7
+3825
+
+
+7
+24905
+86
+
+
+
+
+
+
+prefixName
+id
+
+
+12
+
+
+1
+2
+915
+
+
+2
+4054
+43
+
+
+
+
+
+
+prefixName
+URI
+
+
+12
+
+
+1
+2
+915
+
+
+2
+4054
+43
+
+
+
+
+
+
+prefixName
+fileid
+
+
+12
+
+
+1
+2
+828
+
+
+2
+5
+73
+
+
+5
+24903
+57
+
+
+
+
+
+
+URI
+id
+
+
+12
+
+
+1
+2
+4185
+
+
+
+
+
+
+URI
+prefixName
+
+
+12
+
+
+1
+2
+2602
+
+
+2
+3
+1553
+
+
+3
+872
+30
+
+
+
+
+
+
+URI
+fileid
+
+
+12
+
+
+1
+6
+274
+
+
+6
+7
+3825
+
+
+7
+24905
+86
+
+
+
+
+
+
+fileid
+id
+
+
+12
+
+
+1
+2
+11655
+
+
+2
+3
+26146
+
+
+3
+8
+1743
+
+
+
+
+
+
+fileid
+prefixName
+
+
+12
+
+
+1
+2
+11653
+
+
+2
+3
+25982
+
+
+3
+31
+1909
+
+
+
+
+
+
+fileid
+URI
+
+
+12
+
+
+1
+2
+11655
+
+
+2
+3
+26146
+
+
+3
+8
+1743
+
+
+
+
+
+
+
+
+xmlHasNs
+1139730
+
+
+elementId
+1139730
+
+
+nsId
+4136
+
+
+fileid
+39537
+
+
+
+
+elementId
+nsId
+
+
+12
+
+
+1
+2
+1139730
+
+
+
+
+
+
+elementId
+fileid
+
+
+12
+
+
+1
+2
+1139730
+
+
+
+
+
+
+nsId
+elementId
+
+
+12
+
+
+1
+5
+234
+
+
+5
+6
+3824
+
+
+6
+643289
+78
+
+
+
+
+
+
+nsId
+fileid
+
+
+12
+
+
+1
+5
+257
+
+
+5
+6
+3823
+
+
+6
+24759
+56
+
+
+
+
+
+
+fileid
+elementId
+
+
+12
+
+
+1
+2
+3669
+
+
+2
+3
+20429
+
+
+3
+7
+2536
+
+
+7
+8
+3473
+
+
+8
+9
+2258
+
+
+9
+11
+3036
+
+
+11
+18
+2966
+
+
+18
+147552
+1170
+
+
+
+
+
+
+fileid
+nsId
+
+
+12
+
+
+1
+2
+18261
+
+
+2
+3
+21032
+
+
+3
+8
+244
+
+
+
+
+
+
+
+
+xmlComments
+26812
+
+
+id
+26812
+
+
+text
+22933
+
+
+parentid
+26546
+
+
+fileid
+26368
+
+
+
+
+id
+text
+
+
+12
+
+
+1
+2
+26812
+
+
+
+
+
+
+id
+parentid
+
+
+12
+
+
+1
+2
+26812
+
+
+
+
+
+
+id
+fileid
+
+
+12
+
+
+1
+2
+26812
+
+
+
+
+
+
+text
+id
+
+
+12
+
+
+1
+2
+21517
+
+
+2
+62
+1416
+
+
+
+
+
+
+text
+parentid
+
+
+12
+
+
+1
+2
+21519
+
+
+2
+62
+1414
+
+
+
+
+
+
+text
+fileid
+
+
+12
+
+
+1
+2
+21522
+
+
+2
+62
+1411
+
+
+
+
+
+
+parentid
+id
+
+
+12
+
+
+1
+2
+26379
+
+
+2
+17
+167
+
+
+
+
+
+
+parentid
+text
+
+
+12
+
+
+1
+2
+26379
+
+
+2
+17
+167
+
+
+
+
+
+
+parentid
+fileid
+
+
+12
+
+
+1
+2
+26546
+
+
+
+
+
+
+fileid
+id
+
+
+12
+
+
+1
+2
+26161
+
+
+2
+17
+207
+
+
+
+
+
+
+fileid
+text
+
+
+12
+
+
+1
+2
+26165
+
+
+2
+17
+203
+
+
+
+
+
+
+fileid
+parentid
+
+
+12
+
+
+1
+2
+26223
+
+
+2
+10
+145
+
+
+
+
+
+
+
+
+xmlChars
+439958
+
+
+id
+439958
+
+
+text
+100518
+
+
+parentid
+433851
+
+
+idx
+4
+
+
+isCDATA
+1
+
+
+fileid
+26494
+
+
+
+
+id
+text
+
+
+12
+
+
+1
+2
+439958
+
+
+
+
+
+
+id
+parentid
+
+
+12
+
+
+1
+2
+439958
+
+
+
+
+
+
+id
+idx
+
+
+12
+
+
+1
+2
+439958
+
+
+
+
+
+
+id
+isCDATA
+
+
+12
+
+
+1
+2
+439958
+
+
+
+
+
+
+id
+fileid
+
+
+12
+
+
+1
+2
+439958
+
+
+
+
+
+
+text
+id
+
+
+12
+
+
+1
+2
+60389
+
+
+2
+4
+3811
+
+
+4
+5
+29257
+
+
+5
+23171
+7061
+
+
+
+
+
+
+text
+parentid
+
+
+12
+
+
+1
+2
+60389
+
+
+2
+4
+3811
+
+
+4
+5
+29257
+
+
+5
+23171
+7061
+
+
+
+
+
+
+text
+idx
+
+
+12
+
+
+1
+2
+100517
+
+
+2
+3
+1
+
+
+
+
+
+
+text
+isCDATA
+
+
+12
+
+
+1
+2
+100518
+
+
+
+
+
+
+text
+fileid
+
+
+12
+
+
+1
+2
+61284
+
+
+2
+4
+4205
+
+
+4
+5
+28328
+
+
+5
+351
+6701
+
+
+
+
+
+
+parentid
+id
+
+
+12
+
+
+1
+2
+429716
+
+
+2
+5
+4135
+
+
+
+
+
+
+parentid
+text
+
+
+12
+
+
+1
+2
+429716
+
+
+2
+5
+4135
+
+
+
+
+
+
+parentid
+idx
+
+
+12
+
+
+1
+2
+429716
+
+
+2
+5
+4135
+
+
+
+
+
+
+parentid
+isCDATA
+
+
+12
+
+
+1
+2
+433851
+
+
+
+
+
+
+parentid
+fileid
+
+
+12
+
+
+1
+2
+433851
+
+
+
+
+
+
+idx
+id
+
+
+12
+
+
+80
+81
+1
+
+
+1892
+1893
+1
+
+
+4135
+4136
+1
+
+
+433851
+433852
+1
+
+
+
+
+
+
+idx
+text
+
+
+12
+
+
+1
+2
+1
+
+
+3
+4
+1
+
+
+16
+17
+1
+
+
+100499
+100500
+1
+
+
+
+
+
+
+idx
+parentid
+
+
+12
+
+
+80
+81
+1
+
+
+1892
+1893
+1
+
+
+4135
+4136
+1
+
+
+433851
+433852
+1
+
+
+
+
+
+
+idx
+isCDATA
+
+
+12
+
+
+1
+2
+4
+
+
+
+
+
+
+idx
+fileid
+
+
+12
+
+
+4
+5
+1
+
+
+46
+47
+1
+
+
+97
+98
+1
+
+
+26494
+26495
+1
+
+
+
+
+
+
+isCDATA
+id
+
+
+12
+
+
+439958
+439959
+1
+
+
+
+
+
+
+isCDATA
+text
+
+
+12
+
+
+100518
+100519
+1
+
+
+
+
+
+
+isCDATA
+parentid
+
+
+12
+
+
+433851
+433852
+1
+
+
+
+
+
+
+isCDATA
+idx
+
+
+12
+
+
+4
+5
+1
+
+
+
+
+
+
+isCDATA
+fileid
+
+
+12
+
+
+26494
+26495
+1
+
+
+
+
+
+
+fileid
+id
+
+
+12
+
+
+1
+2
+25303
+
+
+2
+35123
+1191
+
+
+
+
+
+
+fileid
+text
+
+
+12
+
+
+1
+2
+25765
+
+
+2
+35123
+729
+
+
+
+
+
+
+fileid
+parentid
+
+
+12
+
+
+1
+2
+25312
+
+
+2
+35123
+1182
+
+
+
+
+
+
+fileid
+idx
+
+
+12
+
+
+1
+2
+26397
+
+
+2
+5
+97
+
+
+
+
+
+
+fileid
+isCDATA
+
+
+12
+
+
+1
+2
+26494
+
+
+
+
+
+
+
+
+xmllocations
+3051056
+
+
+xmlElement
+2982460
+
+
+location
+3051056
+
+
+
+
+xmlElement
+location
+
+
+12
+
+
+1
+2
+2978326
+
+
+2
+24903
+4134
+
+
+
+
+
+
+location
+xmlElement
+
+
+12
+
+
+1
+2
+3051056
+
+
+
+
+
+
+
+
+
diff --git a/cpp/ql/src/tools/instantiate_templates.py b/cpp/ql/src/tools/instantiate_templates.py
new file mode 100644
index 000000000000..0beeeed20d8e
--- /dev/null
+++ b/cpp/ql/src/tools/instantiate_templates.py
@@ -0,0 +1,137 @@
+import sys
+import os.path
+import glob
+import re
+import json
+
+BEGIN_TEMPLATE = re.compile(r"^/\*template\s*$")
+END_TEMPLATE = re.compile(r"^\*/\s*$")
+
+def expand_template_params(args, param_arg_map):
+ '''Given a list of template arguments that may reference template parameters
+ of the current template, return a new list of template arguments with each
+ parameter use replaced with the appropriate fully-qualified argument for
+ that parameter.'''
+ result = []
+ for arg in args:
+ if arg in param_arg_map:
+ result.append(param_arg_map[arg])
+ else:
+ result.append(arg)
+
+ return result
+
+def find_instantiation(module, args, templates):
+ '''Given a template module and a set of template arguments, find the module
+ name of the instantiation of that module with those arguments.'''
+ template = templates[module]
+ for instantiation in template["template_def"]["instantiations"]:
+ if instantiation["args"] == args:
+ return instantiation["name"]
+ return None
+
+def instantiate_template(template, instantiation, root, templates):
+ '''Create a single instantiation of a template.'''
+ template_def = template["template_def"]
+ output_components = instantiation["name"].split(".")
+ output_path = root
+ for component in output_components:
+ output_path = os.path.join(output_path, component)
+ output_path = output_path + ".qll"
+ with open(output_path, "w") as output:
+ output.write(
+"""
+/*
+ * THIS FILE IS AUTOMATICALLY GENERATED FROM '%s'.
+ * DO NOT EDIT MANUALLY.
+ */
+
+""" % (template["name"].replace(".", "/") + ".qllt")
+ )
+ param_arg_map = {}
+ for param_index in range(len(template_def["params"])):
+ param = template_def["params"][param_index]
+ arg = instantiation["args"][param_index]
+ output.write("private import %s as %s // Template parameter\n" % (arg, param))
+ param_arg_map[param] = arg
+ for import_record in template_def["imports"]:
+ if "access" in import_record:
+ output.write(import_record["access"] + " ")
+ imported_module = find_instantiation(import_record["module"],
+ expand_template_params(import_record["args"], param_arg_map), templates)
+ output.write("import %s // %s<%s>\n" %
+ (
+ imported_module,
+ import_record["module"],
+ ", ".join(import_record["args"])
+ )
+ )
+
+ output.writelines(template_def["body_lines"])
+
+def generate_instantiations(template, root, templates):
+ '''Create a .qll source file for each instantiation of the specified template.'''
+ template_def = template["template_def"]
+ if "instantiations" in template_def:
+ for instantiation in template_def["instantiations"]:
+ instantiate_template(template, instantiation, root, templates)
+
+def read_template(template_path, module_name):
+ '''Read a .qllt template file from template_path, using module_name as the
+ fully qualified name of the module.'''
+ with open(template_path) as input:
+ in_template = False
+ template_text = ""
+ template_def = None
+ body_lines = []
+ for line in iter(input):
+ if in_template:
+ if END_TEMPLATE.match(line):
+ template_def = json.loads(template_text)
+ in_template = False
+ else:
+ template_text += line
+ else:
+ if BEGIN_TEMPLATE.match(line) and not template_def:
+ in_template = True
+ else:
+ body_lines.append(line)
+
+ if template_def:
+ template_def["body_lines"] = body_lines
+
+ result = { "name": module_name }
+ if template_def:
+ result["template_def"] = template_def
+ return result
+
+def module_name_from_path_impl(path):
+ (head, tail) = os.path.split(path)
+ if head == "":
+ return tail
+ else:
+ return module_name_from_path(head) + "." + tail
+
+def module_name_from_path(path):
+ '''Compute the fully qualified name of a module from the path of its .qll[t]
+ file. The path should be relative to the library root.'''
+ (module_root, ext) = os.path.splitext(path)
+ return module_name_from_path_impl(module_root)
+
+def main():
+ templates = {}
+
+ root = sys.argv[1]
+ for template_path in glob.glob(os.path.join(root, "**\\*.qllt"), recursive = True):
+ print(template_path)
+ module_name = module_name_from_path(os.path.relpath(template_path, root))
+ print(module_name)
+ template = read_template(template_path, module_name)
+ templates[template["name"]] = template
+
+ for name, template in templates.items():
+ if "template_def" in template:
+ generate_instantiations(template, root, templates)
+
+if __name__ == "__main__":
+ main()
diff --git a/cpp/ql/test/duplication-tests/duplicate_functions/FLinesOfDuplicatedCode.expected b/cpp/ql/test/duplication-tests/duplicate_functions/FLinesOfDuplicatedCode.expected
new file mode 100644
index 000000000000..2a106a36d6b9
--- /dev/null
+++ b/cpp/ql/test/duplication-tests/duplicate_functions/FLinesOfDuplicatedCode.expected
@@ -0,0 +1,2 @@
+| duplicate_functions.cpp:0:0:0:0 | duplicate_functions.cpp | 42 |
+| file://:0:0:0:0 | | 0 |
diff --git a/cpp/ql/test/duplication-tests/duplicate_functions/FLinesOfDuplicatedCode.qlref b/cpp/ql/test/duplication-tests/duplicate_functions/FLinesOfDuplicatedCode.qlref
new file mode 100644
index 000000000000..7e9bdfa57f7c
--- /dev/null
+++ b/cpp/ql/test/duplication-tests/duplicate_functions/FLinesOfDuplicatedCode.qlref
@@ -0,0 +1 @@
+Metrics/Files/FLinesOfDuplicatedCode.ql
diff --git a/cpp/ql/test/duplication-tests/duplicate_functions/duplicate_functions.cpp b/cpp/ql/test/duplication-tests/duplicate_functions/duplicate_functions.cpp
new file mode 100644
index 000000000000..d31bfa2d90ff
--- /dev/null
+++ b/cpp/ql/test/duplication-tests/duplicate_functions/duplicate_functions.cpp
@@ -0,0 +1,47 @@
+int x;
+
+void Void1()
+{
+ x = 0;
+ x = 1;
+ x = 2;
+ x = 3;
+ x = 4;
+ x = 5;
+ x = 6;
+}
+
+void Void2()
+{
+ x = 0;
+ x = 1;
+ x = 2;
+ x = 3;
+ x = 4;
+ x = 5;
+ x = 6;
+}
+
+int Int1()
+{
+ x = 0;
+ ++x;
+ ++x;
+ --x;
+ --x;
+ ++x;
+ --x;
+ return x;
+}
+
+int Int2()
+{
+ x = 0;
+ ++x;
+ ++x;
+ --x;
+ --x;
+ ++x;
+ --x;
+ return x;
+}
diff --git a/cpp/ql/test/duplication-tests/duplicate_functions/duplicate_functions.expected b/cpp/ql/test/duplication-tests/duplicate_functions/duplicate_functions.expected
new file mode 100644
index 000000000000..d31c0b9d72d6
--- /dev/null
+++ b/cpp/ql/test/duplication-tests/duplicate_functions/duplicate_functions.expected
@@ -0,0 +1,4 @@
+| duplicate_functions.cpp:3:6:3:10 | definition of Void1 | Function Void1 is duplicated at $@. | duplicate_functions.cpp:14:6:14:10 | definition of Void2 | duplicate_functions.cpp:14 |
+| duplicate_functions.cpp:14:6:14:10 | definition of Void2 | Function Void2 is duplicated at $@. | duplicate_functions.cpp:3:6:3:10 | definition of Void1 | duplicate_functions.cpp:3 |
+| duplicate_functions.cpp:25:5:25:8 | definition of Int1 | Function Int1 is duplicated at $@. | duplicate_functions.cpp:37:5:37:8 | definition of Int2 | duplicate_functions.cpp:37 |
+| duplicate_functions.cpp:37:5:37:8 | definition of Int2 | Function Int2 is duplicated at $@. | duplicate_functions.cpp:25:5:25:8 | definition of Int1 | duplicate_functions.cpp:25 |
diff --git a/cpp/ql/test/duplication-tests/duplicate_functions/duplicate_functions.qlref b/cpp/ql/test/duplication-tests/duplicate_functions/duplicate_functions.qlref
new file mode 100644
index 000000000000..bb7e3a454178
--- /dev/null
+++ b/cpp/ql/test/duplication-tests/duplicate_functions/duplicate_functions.qlref
@@ -0,0 +1 @@
+external/DuplicateFunction.ql
diff --git a/cpp/ql/test/duplication-tests/tokenising/FLinesOfDuplicatedCode.expected b/cpp/ql/test/duplication-tests/tokenising/FLinesOfDuplicatedCode.expected
new file mode 100644
index 000000000000..d79f7cfd0864
--- /dev/null
+++ b/cpp/ql/test/duplication-tests/tokenising/FLinesOfDuplicatedCode.expected
@@ -0,0 +1,2 @@
+| test.c:0:0:0:0 | test.c | 10 |
+| file://:0:0:0:0 | | 0 |
diff --git a/cpp/ql/test/duplication-tests/tokenising/FLinesOfDuplicatedCode.qlref b/cpp/ql/test/duplication-tests/tokenising/FLinesOfDuplicatedCode.qlref
new file mode 100644
index 000000000000..7e9bdfa57f7c
--- /dev/null
+++ b/cpp/ql/test/duplication-tests/tokenising/FLinesOfDuplicatedCode.qlref
@@ -0,0 +1 @@
+Metrics/Files/FLinesOfDuplicatedCode.ql
diff --git a/cpp/ql/test/duplication-tests/tokenising/duplications.expected b/cpp/ql/test/duplication-tests/tokenising/duplications.expected
new file mode 100644
index 000000000000..a882f18620ba
--- /dev/null
+++ b/cpp/ql/test/duplication-tests/tokenising/duplications.expected
@@ -0,0 +1 @@
+| 2 |
diff --git a/cpp/ql/test/duplication-tests/tokenising/duplications.ql b/cpp/ql/test/duplication-tests/tokenising/duplications.ql
new file mode 100644
index 000000000000..fd142954d483
--- /dev/null
+++ b/cpp/ql/test/duplication-tests/tokenising/duplications.ql
@@ -0,0 +1,6 @@
+import cpp
+
+// Provided tokenisation succeeded, we ought to have some
+// @duplication rows.
+select count(@duplication d)
+
diff --git a/cpp/ql/test/duplication-tests/tokenising/test.c b/cpp/ql/test/duplication-tests/tokenising/test.c
new file mode 100644
index 000000000000..c7c0b991a66a
--- /dev/null
+++ b/cpp/ql/test/duplication-tests/tokenising/test.c
@@ -0,0 +1,18 @@
+
+#define foo "/*bar"
+#define bar aaa \ bbb
+
+int i;
+
+void f(void) {
+ i = 1;
+ i = 2;
+ i = 3;
+}
+
+void g(void) {
+ i = 1;
+ i = 2;
+ i = 3;
+}
+
diff --git a/cpp/ql/test/examples/expressions/AddressOf.c b/cpp/ql/test/examples/expressions/AddressOf.c
new file mode 100644
index 000000000000..40d89d7a1feb
--- /dev/null
+++ b/cpp/ql/test/examples/expressions/AddressOf.c
@@ -0,0 +1,3 @@
+void v(int i) {
+ int *j = &i;
+}
diff --git a/cpp/ql/test/examples/expressions/ArrayToPointer.c b/cpp/ql/test/examples/expressions/ArrayToPointer.c
new file mode 100644
index 000000000000..1bf2f9afae40
--- /dev/null
+++ b/cpp/ql/test/examples/expressions/ArrayToPointer.c
@@ -0,0 +1,10 @@
+struct S {
+ char* name;
+};
+
+void v()
+{
+ char c[] = "hello";
+ struct S s;
+ s.name = c;
+}
diff --git a/cpp/ql/test/examples/expressions/Cast.c b/cpp/ql/test/examples/expressions/Cast.c
new file mode 100644
index 000000000000..8c4c174939d2
--- /dev/null
+++ b/cpp/ql/test/examples/expressions/Cast.c
@@ -0,0 +1,3 @@
+void v(char *c, void *v) {
+ c = (char *)v;
+}
\ No newline at end of file
diff --git a/cpp/ql/test/examples/expressions/ConditionDecl.cpp b/cpp/ql/test/examples/expressions/ConditionDecl.cpp
new file mode 100644
index 000000000000..ffcbf3482165
--- /dev/null
+++ b/cpp/ql/test/examples/expressions/ConditionDecl.cpp
@@ -0,0 +1,5 @@
+void v() {
+ int j = 0;
+ while(int k = j < 5) {
+ }
+}
diff --git a/cpp/ql/test/examples/expressions/ConstructorCall.cpp b/cpp/ql/test/examples/expressions/ConstructorCall.cpp
new file mode 100644
index 000000000000..e600548fc524
--- /dev/null
+++ b/cpp/ql/test/examples/expressions/ConstructorCall.cpp
@@ -0,0 +1,21 @@
+class C {
+public:
+ C(int i) {
+ }
+};
+
+class D {
+public:
+ D() {
+ }
+};
+
+class E {
+public:
+};
+
+void v(C *c, D *d, E *e) {
+ c = new C(5);
+ d = new D();
+ e = new E();
+}
\ No newline at end of file
diff --git a/cpp/ql/test/examples/expressions/Conversion1.c b/cpp/ql/test/examples/expressions/Conversion1.c
new file mode 100644
index 000000000000..f512dfab80cd
--- /dev/null
+++ b/cpp/ql/test/examples/expressions/Conversion1.c
@@ -0,0 +1,4 @@
+void v() {
+ int i = (int)1;
+}
+
\ No newline at end of file
diff --git a/cpp/ql/test/examples/expressions/Conversion2.c b/cpp/ql/test/examples/expressions/Conversion2.c
new file mode 100644
index 000000000000..831797db4dc8
--- /dev/null
+++ b/cpp/ql/test/examples/expressions/Conversion2.c
@@ -0,0 +1,3 @@
+void v(int x) {
+ x = (int)5 + (int)7;
+}
\ No newline at end of file
diff --git a/cpp/ql/test/examples/expressions/Conversion3.cpp b/cpp/ql/test/examples/expressions/Conversion3.cpp
new file mode 100644
index 000000000000..185b4b8be00b
--- /dev/null
+++ b/cpp/ql/test/examples/expressions/Conversion3.cpp
@@ -0,0 +1,3 @@
+void v(int x) {
+ x = (bool)(int)5 + ((int)7);
+}
\ No newline at end of file
diff --git a/cpp/ql/test/examples/expressions/Conversion4.c b/cpp/ql/test/examples/expressions/Conversion4.c
new file mode 100644
index 000000000000..5afc646a00b4
--- /dev/null
+++ b/cpp/ql/test/examples/expressions/Conversion4.c
@@ -0,0 +1,3 @@
+void v(int x) {
+ x = ((int)7);
+}
\ No newline at end of file
diff --git a/cpp/ql/test/examples/expressions/ConvertVirtualFunctionPointer.cpp b/cpp/ql/test/examples/expressions/ConvertVirtualFunctionPointer.cpp
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/cpp/ql/test/examples/expressions/DestructorCall.cpp b/cpp/ql/test/examples/expressions/DestructorCall.cpp
new file mode 100644
index 000000000000..303d3d0ce667
--- /dev/null
+++ b/cpp/ql/test/examples/expressions/DestructorCall.cpp
@@ -0,0 +1,14 @@
+class C {
+public:
+ ~C() {
+ }
+};
+
+class D {
+public:
+};
+
+void v(C *c, D *d) {
+ delete c;
+ delete d;
+}
\ No newline at end of file
diff --git a/cpp/ql/test/examples/expressions/DynamicCast.cpp b/cpp/ql/test/examples/expressions/DynamicCast.cpp
new file mode 100644
index 000000000000..63085edecadc
--- /dev/null
+++ b/cpp/ql/test/examples/expressions/DynamicCast.cpp
@@ -0,0 +1,14 @@
+class Base {
+ virtual void f() { }
+};
+class Derived : public Base {
+ void f() { }
+};
+
+void v(Base *bp, Derived *d) {
+ d = dynamic_cast(bp);
+}
+
+void v_ref(Base &bp, Derived &d) {
+ d = dynamic_cast(bp);
+}
\ No newline at end of file
diff --git a/cpp/ql/test/examples/expressions/Parenthesis.c b/cpp/ql/test/examples/expressions/Parenthesis.c
new file mode 100644
index 000000000000..dee54291df97
--- /dev/null
+++ b/cpp/ql/test/examples/expressions/Parenthesis.c
@@ -0,0 +1,3 @@
+void v(int i) {
+ i = (i + 1) * 2;
+}
\ No newline at end of file
diff --git a/cpp/ql/test/examples/expressions/PointerDereference.c b/cpp/ql/test/examples/expressions/PointerDereference.c
new file mode 100644
index 000000000000..f88490ff1fe0
--- /dev/null
+++ b/cpp/ql/test/examples/expressions/PointerDereference.c
@@ -0,0 +1,3 @@
+void v(int *i, int j) {
+ j = *i;
+}
\ No newline at end of file
diff --git a/cpp/ql/test/examples/expressions/PrintAST.expected b/cpp/ql/test/examples/expressions/PrintAST.expected
new file mode 100644
index 000000000000..ffc83484efee
--- /dev/null
+++ b/cpp/ql/test/examples/expressions/PrintAST.expected
@@ -0,0 +1,1843 @@
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | AddressOf.c:1:6:1:6 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | ArrayToPointer.c:5:6:5:6 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Cast.c:1:6:1:6 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Conversion1.c:1:6:1:6 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Conversion2.c:1:6:1:6 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Conversion4.c:1:6:1:6 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Parenthesis.c:1:6:1:6 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | PointerDereference.c:1:6:1:6 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Sizeof.c:1:6:1:6 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | StatementExpr.c:1:6:1:6 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Subscript.c:1:6:1:6 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | AddressOf.c:1:15:3:1 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | ArrayToPointer.c:6:1:10:1 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Cast.c:1:26:3:1 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion1.c:1:10:3:1 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion2.c:1:15:3:1 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion4.c:1:15:3:1 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Parenthesis.c:1:15:3:1 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | PointerDereference.c:1:23:3:1 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Sizeof.c:1:21:4:1 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | StatementExpr.c:1:10:3:1 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Subscript.c:1:24:3:1 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Cast.c:2:3:2:16 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Conversion2.c:2:3:2:22 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Conversion4.c:2:3:2:15 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Parenthesis.c:2:3:2:18 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | PointerDereference.c:2:3:2:9 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Subscript.c:2:3:2:11 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | AddressOf.c:2:3:2:14 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | ArrayToPointer.c:7:3:7:21 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | Conversion1.c:2:3:2:17 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | Sizeof.c:2:3:2:22 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | StatementExpr.c:2:3:2:30 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: char * | Cast.c:2:3:2:15 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Conversion2.c:2:3:2:21 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Conversion4.c:2:3:2:14 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Parenthesis.c:2:3:2:17 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | PointerDereference.c:2:3:2:8 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Subscript.c:2:3:2:10 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of c | | | char[] | ArrayToPointer.c:7:8:7:8 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of i | | | int | Conversion1.c:2:7:2:7 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of i | | | int | Sizeof.c:2:7:2:7 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of j | | | int | StatementExpr.c:2:7:2:7 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of j | | | int * | AddressOf.c:2:8:2:8 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: char * | Cast.c:2:3:2:3 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: char * | Cast.c:2:3:2:3 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: char * | Cast.c:2:3:2:3 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for c | | | | ArrayToPointer.c:7:14:7:20 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for i | | | | Conversion1.c:2:10:2:16 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for i | | | | Sizeof.c:2:10:2:21 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for j | | | | AddressOf.c:2:11:2:13 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for j | | | | StatementExpr.c:2:10:2:29 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | j | | | lvalue: int | PointerDereference.c:2:3:2:3 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | j | | | lvalue: int | Subscript.c:2:3:2:3 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | v | | | lvalue: int | PointerDereference.c:2:3:2:3 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | v | | | lvalue: int | Subscript.c:2:3:2:3 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: char * | Cast.c:2:3:2:3 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | (...) | | =7 | prvalue: int | Conversion4.c:2:7:2:14 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | (char *)... | pointer conversion | | prvalue: char * | Cast.c:2:7:2:15 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | * ... | | | prvalue(load): int | PointerDereference.c:2:7:2:8 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | ... * ... | | | prvalue: int | Parenthesis.c:2:7:2:17 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | ... + ... | | =12 | prvalue: int | Conversion2.c:2:7:2:21 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | access to array | | | prvalue(load): int | Subscript.c:2:7:2:10 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | & ... | | | prvalue: int * | AddressOf.c:2:12:2:13 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | (int)... | integral conversion | =1 | prvalue: int | Conversion1.c:2:11:2:16 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | (int)... | integral conversion | =4 | prvalue: int | Sizeof.c:2:11:2:21 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | (statement expression) | | | prvalue: int | StatementExpr.c:2:11:2:29 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | hello | | =hello | lvalue: char[6] | ArrayToPointer.c:7:14:7:20 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 1 | 1 | declaration | | | | ArrayToPointer.c:8:3:8:13 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 1 | 1 | return ... | | | | StatementExpr.c:3:1:3:1 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | 1 | | =1 | prvalue: int | Conversion1.c:2:16:2:16 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | (...) | | | prvalue: int | Parenthesis.c:2:7:2:13 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | (int)... | integral conversion | =5 | prvalue: int | Conversion2.c:2:7:2:12 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | (int)... | integral conversion | =7 | prvalue: int | Conversion4.c:2:8:2:13 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | array | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | array | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | array | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | c | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | c | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | c | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | i | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | i | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | i | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | j | | | prvalue(load): void * | Cast.c:2:15:2:15 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | sizeof(int) | | =4 | prvalue: unsigned long | Sizeof.c:2:11:2:21 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | v | | | prvalue(load): void * | Cast.c:2:15:2:15 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | x | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | x | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | x | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | declaration | | | | Sizeof.c:3:3:3:24 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | AddressOf.c:3:1:3:1 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | Cast.c:3:1:3:1 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | Conversion1.c:3:1:3:1 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | PointerDereference.c:3:1:3:1 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 5 | 1 | 5 | | =5 | prvalue: int | Subscript.c:2:9:2:9 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | 5 | | =5 | prvalue: int | Conversion2.c:2:12:2:12 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | 7 | | =7 | prvalue: int | Conversion4.c:2:13:2:13 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | ... + ... | | | prvalue: int | Parenthesis.c:2:8:2:12 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | definition of s | | | S | ArrayToPointer.c:8:12:8:12 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 1 | 1 | return ... | | | | Conversion4.c:3:1:3:1 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 1 | 1 | return ... | | | | Subscript.c:3:1:3:1 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 1 | 2 | ExprStmt | | | | ArrayToPointer.c:9:3:9:13 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 5 | 1 | (int)... | integral conversion | =7 | prvalue: int | Conversion2.c:2:16:2:21 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | array | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | c | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | definition of j | | | int | Sizeof.c:3:7:3:7 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | i | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | x | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 7 | 1 | 1 | | =1 | prvalue: int | Parenthesis.c:2:12:2:12 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 8 | 0 | 7 | | =7 | prvalue: int | Conversion2.c:2:21:2:21 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 8 | 0 | ... = ... | | | prvalue: char * | ArrayToPointer.c:9:3:9:12 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 8 | 0 | initializer for j | | | | Sizeof.c:3:10:3:23 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 1 | 1 | return ... | | | | Conversion2.c:3:1:3:1 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 5 | 1 | 2 | | =2 | prvalue: int | Parenthesis.c:2:17:2:17 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 9 | 0 | (int)... | integral conversion | =8 | prvalue: int | Sizeof.c:3:11:3:23 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 9 | 0 | name | | | lvalue: char * | ArrayToPointer.c:9:5:9:8 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 11 | 1 | 1 | return ... | | | | Parenthesis.c:3:1:3:1 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 11 | 10 | 0 | sizeof() | | =8 | prvalue: unsigned long | Sizeof.c:3:11:3:23 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 11 | 10 | -1 | s | | | lvalue: S | ArrayToPointer.c:9:3:9:3 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 12 | 9 | 1 | array to pointer conversion | | | prvalue: char * | ArrayToPointer.c:9:12:9:12 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 12 | 11 | 0 | (...) | | | lvalue: int * | Sizeof.c:3:18:3:23 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | array | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | c | | | lvalue: char[6] | ArrayToPointer.c:9:12:9:12 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | c | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | i | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | x | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 14 | 1 | 2 | return ... | | | | Sizeof.c:4:1:4:1 |
+| AddressOf.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 14 | 1 | 3 | return ... | | | | ArrayToPointer.c:10:1:10:1 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | AddressOf.c:1:6:1:6 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | ArrayToPointer.c:5:6:5:6 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Cast.c:1:6:1:6 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Conversion1.c:1:6:1:6 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Conversion2.c:1:6:1:6 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Conversion4.c:1:6:1:6 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Parenthesis.c:1:6:1:6 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | PointerDereference.c:1:6:1:6 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Sizeof.c:1:6:1:6 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | StatementExpr.c:1:6:1:6 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Subscript.c:1:6:1:6 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | AddressOf.c:1:15:3:1 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | ArrayToPointer.c:6:1:10:1 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Cast.c:1:26:3:1 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion1.c:1:10:3:1 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion2.c:1:15:3:1 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion4.c:1:15:3:1 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Parenthesis.c:1:15:3:1 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | PointerDereference.c:1:23:3:1 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Sizeof.c:1:21:4:1 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | StatementExpr.c:1:10:3:1 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Subscript.c:1:24:3:1 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Cast.c:2:3:2:16 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Conversion2.c:2:3:2:22 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Conversion4.c:2:3:2:15 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Parenthesis.c:2:3:2:18 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | PointerDereference.c:2:3:2:9 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Subscript.c:2:3:2:11 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | AddressOf.c:2:3:2:14 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | ArrayToPointer.c:7:3:7:21 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | Conversion1.c:2:3:2:17 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | Sizeof.c:2:3:2:22 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | StatementExpr.c:2:3:2:30 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: char * | Cast.c:2:3:2:15 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Conversion2.c:2:3:2:21 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Conversion4.c:2:3:2:14 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Parenthesis.c:2:3:2:17 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | PointerDereference.c:2:3:2:8 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Subscript.c:2:3:2:10 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of c | | | char[] | ArrayToPointer.c:7:8:7:8 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of i | | | int | Conversion1.c:2:7:2:7 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of i | | | int | Sizeof.c:2:7:2:7 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of j | | | int | StatementExpr.c:2:7:2:7 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of j | | | int * | AddressOf.c:2:8:2:8 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: char * | Cast.c:2:3:2:3 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: char * | Cast.c:2:3:2:3 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: char * | Cast.c:2:3:2:3 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for c | | | | ArrayToPointer.c:7:14:7:20 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for i | | | | Conversion1.c:2:10:2:16 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for i | | | | Sizeof.c:2:10:2:21 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for j | | | | AddressOf.c:2:11:2:13 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for j | | | | StatementExpr.c:2:10:2:29 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | j | | | lvalue: int | PointerDereference.c:2:3:2:3 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | j | | | lvalue: int | Subscript.c:2:3:2:3 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | v | | | lvalue: int | PointerDereference.c:2:3:2:3 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | v | | | lvalue: int | Subscript.c:2:3:2:3 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: char * | Cast.c:2:3:2:3 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | (...) | | =7 | prvalue: int | Conversion4.c:2:7:2:14 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | (char *)... | pointer conversion | | prvalue: char * | Cast.c:2:7:2:15 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | * ... | | | prvalue(load): int | PointerDereference.c:2:7:2:8 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | ... * ... | | | prvalue: int | Parenthesis.c:2:7:2:17 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | ... + ... | | =12 | prvalue: int | Conversion2.c:2:7:2:21 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | access to array | | | prvalue(load): int | Subscript.c:2:7:2:10 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | & ... | | | prvalue: int * | AddressOf.c:2:12:2:13 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | (int)... | integral conversion | =1 | prvalue: int | Conversion1.c:2:11:2:16 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | (int)... | integral conversion | =4 | prvalue: int | Sizeof.c:2:11:2:21 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | (statement expression) | | | prvalue: int | StatementExpr.c:2:11:2:29 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | hello | | =hello | lvalue: char[6] | ArrayToPointer.c:7:14:7:20 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 1 | 1 | declaration | | | | ArrayToPointer.c:8:3:8:13 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 1 | 1 | return ... | | | | StatementExpr.c:3:1:3:1 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | 1 | | =1 | prvalue: int | Conversion1.c:2:16:2:16 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | (...) | | | prvalue: int | Parenthesis.c:2:7:2:13 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | (int)... | integral conversion | =5 | prvalue: int | Conversion2.c:2:7:2:12 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | (int)... | integral conversion | =7 | prvalue: int | Conversion4.c:2:8:2:13 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | array | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | array | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | array | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | c | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | c | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | c | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | i | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | i | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | i | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | j | | | prvalue(load): void * | Cast.c:2:15:2:15 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | sizeof(int) | | =4 | prvalue: unsigned long | Sizeof.c:2:11:2:21 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | v | | | prvalue(load): void * | Cast.c:2:15:2:15 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | x | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | x | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | x | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | declaration | | | | Sizeof.c:3:3:3:24 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | AddressOf.c:3:1:3:1 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | Cast.c:3:1:3:1 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | Conversion1.c:3:1:3:1 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | PointerDereference.c:3:1:3:1 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 5 | 1 | 5 | | =5 | prvalue: int | Subscript.c:2:9:2:9 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | 5 | | =5 | prvalue: int | Conversion2.c:2:12:2:12 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | 7 | | =7 | prvalue: int | Conversion4.c:2:13:2:13 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | ... + ... | | | prvalue: int | Parenthesis.c:2:8:2:12 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | definition of s | | | S | ArrayToPointer.c:8:12:8:12 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 1 | 1 | return ... | | | | Conversion4.c:3:1:3:1 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 1 | 1 | return ... | | | | Subscript.c:3:1:3:1 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 1 | 2 | ExprStmt | | | | ArrayToPointer.c:9:3:9:13 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 5 | 1 | (int)... | integral conversion | =7 | prvalue: int | Conversion2.c:2:16:2:21 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | array | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | c | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | definition of j | | | int | Sizeof.c:3:7:3:7 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | i | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | x | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 7 | 1 | 1 | | =1 | prvalue: int | Parenthesis.c:2:12:2:12 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 8 | 0 | 7 | | =7 | prvalue: int | Conversion2.c:2:21:2:21 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 8 | 0 | ... = ... | | | prvalue: char * | ArrayToPointer.c:9:3:9:12 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 8 | 0 | initializer for j | | | | Sizeof.c:3:10:3:23 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 1 | 1 | return ... | | | | Conversion2.c:3:1:3:1 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 5 | 1 | 2 | | =2 | prvalue: int | Parenthesis.c:2:17:2:17 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 9 | 0 | (int)... | integral conversion | =8 | prvalue: int | Sizeof.c:3:11:3:23 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 9 | 0 | name | | | lvalue: char * | ArrayToPointer.c:9:5:9:8 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 11 | 1 | 1 | return ... | | | | Parenthesis.c:3:1:3:1 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 11 | 10 | 0 | sizeof() | | =8 | prvalue: unsigned long | Sizeof.c:3:11:3:23 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 11 | 10 | -1 | s | | | lvalue: S | ArrayToPointer.c:9:3:9:3 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 12 | 9 | 1 | array to pointer conversion | | | prvalue: char * | ArrayToPointer.c:9:12:9:12 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 12 | 11 | 0 | (...) | | | lvalue: int * | Sizeof.c:3:18:3:23 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | array | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | c | | | lvalue: char[6] | ArrayToPointer.c:9:12:9:12 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | c | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | i | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | x | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 14 | 1 | 2 | return ... | | | | Sizeof.c:4:1:4:1 |
+| ArrayToPointer.c:5:6:5:6 | v(int[], int *, int, char *, void *, int) -> void | 14 | 1 | 3 | return ... | | | | ArrayToPointer.c:10:1:10:1 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | AddressOf.c:1:6:1:6 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | ArrayToPointer.c:5:6:5:6 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Cast.c:1:6:1:6 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Conversion1.c:1:6:1:6 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Conversion2.c:1:6:1:6 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Conversion4.c:1:6:1:6 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Parenthesis.c:1:6:1:6 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | PointerDereference.c:1:6:1:6 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Sizeof.c:1:6:1:6 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | StatementExpr.c:1:6:1:6 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Subscript.c:1:6:1:6 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | AddressOf.c:1:15:3:1 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | ArrayToPointer.c:6:1:10:1 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Cast.c:1:26:3:1 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion1.c:1:10:3:1 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion2.c:1:15:3:1 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion4.c:1:15:3:1 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Parenthesis.c:1:15:3:1 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | PointerDereference.c:1:23:3:1 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Sizeof.c:1:21:4:1 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | StatementExpr.c:1:10:3:1 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Subscript.c:1:24:3:1 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Cast.c:2:3:2:16 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Conversion2.c:2:3:2:22 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Conversion4.c:2:3:2:15 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Parenthesis.c:2:3:2:18 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | PointerDereference.c:2:3:2:9 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Subscript.c:2:3:2:11 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | AddressOf.c:2:3:2:14 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | ArrayToPointer.c:7:3:7:21 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | Conversion1.c:2:3:2:17 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | Sizeof.c:2:3:2:22 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | StatementExpr.c:2:3:2:30 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: char * | Cast.c:2:3:2:15 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Conversion2.c:2:3:2:21 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Conversion4.c:2:3:2:14 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Parenthesis.c:2:3:2:17 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | PointerDereference.c:2:3:2:8 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Subscript.c:2:3:2:10 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of c | | | char[] | ArrayToPointer.c:7:8:7:8 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of i | | | int | Conversion1.c:2:7:2:7 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of i | | | int | Sizeof.c:2:7:2:7 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of j | | | int | StatementExpr.c:2:7:2:7 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of j | | | int * | AddressOf.c:2:8:2:8 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: char * | Cast.c:2:3:2:3 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: char * | Cast.c:2:3:2:3 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: char * | Cast.c:2:3:2:3 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for c | | | | ArrayToPointer.c:7:14:7:20 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for i | | | | Conversion1.c:2:10:2:16 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for i | | | | Sizeof.c:2:10:2:21 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for j | | | | AddressOf.c:2:11:2:13 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for j | | | | StatementExpr.c:2:10:2:29 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | j | | | lvalue: int | PointerDereference.c:2:3:2:3 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | j | | | lvalue: int | Subscript.c:2:3:2:3 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | v | | | lvalue: int | PointerDereference.c:2:3:2:3 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | v | | | lvalue: int | Subscript.c:2:3:2:3 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: char * | Cast.c:2:3:2:3 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | (...) | | =7 | prvalue: int | Conversion4.c:2:7:2:14 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | (char *)... | pointer conversion | | prvalue: char * | Cast.c:2:7:2:15 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | * ... | | | prvalue(load): int | PointerDereference.c:2:7:2:8 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | ... * ... | | | prvalue: int | Parenthesis.c:2:7:2:17 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | ... + ... | | =12 | prvalue: int | Conversion2.c:2:7:2:21 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | access to array | | | prvalue(load): int | Subscript.c:2:7:2:10 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | & ... | | | prvalue: int * | AddressOf.c:2:12:2:13 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | (int)... | integral conversion | =1 | prvalue: int | Conversion1.c:2:11:2:16 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | (int)... | integral conversion | =4 | prvalue: int | Sizeof.c:2:11:2:21 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | (statement expression) | | | prvalue: int | StatementExpr.c:2:11:2:29 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | hello | | =hello | lvalue: char[6] | ArrayToPointer.c:7:14:7:20 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 1 | 1 | declaration | | | | ArrayToPointer.c:8:3:8:13 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 1 | 1 | return ... | | | | StatementExpr.c:3:1:3:1 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | 1 | | =1 | prvalue: int | Conversion1.c:2:16:2:16 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | (...) | | | prvalue: int | Parenthesis.c:2:7:2:13 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | (int)... | integral conversion | =5 | prvalue: int | Conversion2.c:2:7:2:12 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | (int)... | integral conversion | =7 | prvalue: int | Conversion4.c:2:8:2:13 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | array | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | array | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | array | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | c | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | c | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | c | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | i | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | i | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | i | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | j | | | prvalue(load): void * | Cast.c:2:15:2:15 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | sizeof(int) | | =4 | prvalue: unsigned long | Sizeof.c:2:11:2:21 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | v | | | prvalue(load): void * | Cast.c:2:15:2:15 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | x | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | x | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | x | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | declaration | | | | Sizeof.c:3:3:3:24 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | AddressOf.c:3:1:3:1 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | Cast.c:3:1:3:1 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | Conversion1.c:3:1:3:1 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | PointerDereference.c:3:1:3:1 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 5 | 1 | 5 | | =5 | prvalue: int | Subscript.c:2:9:2:9 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | 5 | | =5 | prvalue: int | Conversion2.c:2:12:2:12 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | 7 | | =7 | prvalue: int | Conversion4.c:2:13:2:13 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | ... + ... | | | prvalue: int | Parenthesis.c:2:8:2:12 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | definition of s | | | S | ArrayToPointer.c:8:12:8:12 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 1 | 1 | return ... | | | | Conversion4.c:3:1:3:1 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 1 | 1 | return ... | | | | Subscript.c:3:1:3:1 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 1 | 2 | ExprStmt | | | | ArrayToPointer.c:9:3:9:13 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 5 | 1 | (int)... | integral conversion | =7 | prvalue: int | Conversion2.c:2:16:2:21 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | array | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | c | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | definition of j | | | int | Sizeof.c:3:7:3:7 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | i | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | x | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 7 | 1 | 1 | | =1 | prvalue: int | Parenthesis.c:2:12:2:12 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 8 | 0 | 7 | | =7 | prvalue: int | Conversion2.c:2:21:2:21 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 8 | 0 | ... = ... | | | prvalue: char * | ArrayToPointer.c:9:3:9:12 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 8 | 0 | initializer for j | | | | Sizeof.c:3:10:3:23 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 1 | 1 | return ... | | | | Conversion2.c:3:1:3:1 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 5 | 1 | 2 | | =2 | prvalue: int | Parenthesis.c:2:17:2:17 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 9 | 0 | (int)... | integral conversion | =8 | prvalue: int | Sizeof.c:3:11:3:23 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 9 | 0 | name | | | lvalue: char * | ArrayToPointer.c:9:5:9:8 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 11 | 1 | 1 | return ... | | | | Parenthesis.c:3:1:3:1 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 11 | 10 | 0 | sizeof() | | =8 | prvalue: unsigned long | Sizeof.c:3:11:3:23 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 11 | 10 | -1 | s | | | lvalue: S | ArrayToPointer.c:9:3:9:3 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 12 | 9 | 1 | array to pointer conversion | | | prvalue: char * | ArrayToPointer.c:9:12:9:12 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 12 | 11 | 0 | (...) | | | lvalue: int * | Sizeof.c:3:18:3:23 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | array | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | c | | | lvalue: char[6] | ArrayToPointer.c:9:12:9:12 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | c | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | i | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | x | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 14 | 1 | 2 | return ... | | | | Sizeof.c:4:1:4:1 |
+| Cast.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 14 | 1 | 3 | return ... | | | | ArrayToPointer.c:10:1:10:1 |
+| ConditionDecl.cpp:1:6:1:6 | v() -> void | 0 | -1 | 0 | v | | | | ConditionDecl.cpp:1:6:1:6 |
+| ConditionDecl.cpp:1:6:1:6 | v() -> void | 1 | 0 | 0 | { ... } | | | | ConditionDecl.cpp:1:10:5:1 |
+| ConditionDecl.cpp:1:6:1:6 | v() -> void | 2 | 1 | 0 | declaration | | | | ConditionDecl.cpp:2:3:2:12 |
+| ConditionDecl.cpp:1:6:1:6 | v() -> void | 3 | 2 | 0 | definition of j | | | int | ConditionDecl.cpp:2:7:2:7 |
+| ConditionDecl.cpp:1:6:1:6 | v() -> void | 4 | 3 | 0 | initializer for j | | | | ConditionDecl.cpp:2:10:2:11 |
+| ConditionDecl.cpp:1:6:1:6 | v() -> void | 5 | 4 | 0 | 0 | | =0 | prvalue: int | ConditionDecl.cpp:2:10:2:11 |
+| ConditionDecl.cpp:1:6:1:6 | v() -> void | 6 | 1 | 1 | while (...) ... | | | | ConditionDecl.cpp:3:3:4:3 |
+| ConditionDecl.cpp:1:6:1:6 | v() -> void | 7 | 6 | 0 | (condition decl) | | | prvalue: bool | ConditionDecl.cpp:3:9:3:21 |
+| ConditionDecl.cpp:1:6:1:6 | v() -> void | 8 | 7 | 0 | (bool)... | conversion to bool | | prvalue: bool | ConditionDecl.cpp:3:13:3:13 |
+| ConditionDecl.cpp:1:6:1:6 | v() -> void | 9 | 8 | 0 | k | | | prvalue(load): int | ConditionDecl.cpp:3:13:3:13 |
+| ConditionDecl.cpp:1:6:1:6 | v() -> void | 10 | 6 | 1 | { ... } | | | | ConditionDecl.cpp:3:24:4:3 |
+| ConditionDecl.cpp:1:6:1:6 | v() -> void | 11 | 1 | 2 | return ... | | | | ConditionDecl.cpp:5:1:5:1 |
+| ConstructorCall.cpp:1:7:1:7 | C::C(C &&) -> void | 0 | -1 | 0 | C | | | | ConstructorCall.cpp:1:7:1:7 |
+| ConstructorCall.cpp:1:7:1:7 | C::C(const C &) -> void | 0 | -1 | 0 | C | | | | ConstructorCall.cpp:1:7:1:7 |
+| ConstructorCall.cpp:1:7:1:7 | C::operator=(C &&) -> C & | 0 | -1 | 0 | operator= | | | | ConstructorCall.cpp:1:7:1:7 |
+| ConstructorCall.cpp:1:7:1:7 | C::operator=(const C &) -> C & | 0 | -1 | 0 | operator= | | | | ConstructorCall.cpp:1:7:1:7 |
+| ConstructorCall.cpp:1:7:1:7 | C::operator=(const C &) -> C & | 0 | -1 | 0 | operator= | | | | DestructorCall.cpp:1:7:1:7 |
+| ConstructorCall.cpp:3:3:3:3 | C::C(int) -> void | 0 | -1 | 0 | C | | | | ConstructorCall.cpp:3:3:3:3 |
+| ConstructorCall.cpp:3:3:3:3 | C::C(int) -> void | 1 | 0 | 0 | { ... } | | | | ConstructorCall.cpp:3:12:4:3 |
+| ConstructorCall.cpp:3:3:3:3 | C::C(int) -> void | 2 | 1 | 0 | return ... | | | | ConstructorCall.cpp:4:3:4:3 |
+| ConstructorCall.cpp:7:7:7:7 | D::D(D &&) -> void | 0 | -1 | 0 | D | | | | ConstructorCall.cpp:7:7:7:7 |
+| ConstructorCall.cpp:7:7:7:7 | D::D(const D &) -> void | 0 | -1 | 0 | D | | | | ConstructorCall.cpp:7:7:7:7 |
+| ConstructorCall.cpp:7:7:7:7 | D::operator=(D &&) -> D & | 0 | -1 | 0 | operator= | | | | ConstructorCall.cpp:7:7:7:7 |
+| ConstructorCall.cpp:7:7:7:7 | D::operator=(D &&) -> D & | 0 | -1 | 0 | operator= | | | | DestructorCall.cpp:7:7:7:7 |
+| ConstructorCall.cpp:7:7:7:7 | D::operator=(const D &) -> D & | 0 | -1 | 0 | operator= | | | | ConstructorCall.cpp:7:7:7:7 |
+| ConstructorCall.cpp:7:7:7:7 | D::operator=(const D &) -> D & | 0 | -1 | 0 | operator= | | | | DestructorCall.cpp:7:7:7:7 |
+| ConstructorCall.cpp:9:3:9:3 | D::D() -> void | 0 | -1 | 0 | D | | | | ConstructorCall.cpp:9:3:9:3 |
+| ConstructorCall.cpp:9:3:9:3 | D::D() -> void | 1 | 0 | 0 | { ... } | | | | ConstructorCall.cpp:9:7:10:3 |
+| ConstructorCall.cpp:9:3:9:3 | D::D() -> void | 2 | 1 | 0 | return ... | | | | ConstructorCall.cpp:10:3:10:3 |
+| ConstructorCall.cpp:13:7:13:7 | E::operator=(E &&) -> E & | 0 | -1 | 0 | operator= | | | | ConstructorCall.cpp:13:7:13:7 |
+| ConstructorCall.cpp:13:7:13:7 | E::operator=(E &&) -> E & | 0 | -1 | 0 | operator= | | | | Throw.cpp:1:7:1:7 |
+| ConstructorCall.cpp:13:7:13:7 | E::operator=(const E &) -> E & | 0 | -1 | 0 | operator= | | | | ConstructorCall.cpp:13:7:13:7 |
+| ConstructorCall.cpp:13:7:13:7 | E::operator=(const E &) -> E & | 0 | -1 | 0 | operator= | | | | Throw.cpp:1:7:1:7 |
+| ConstructorCall.cpp:17:6:17:6 | v(C *, D *, E *) -> void | 0 | -1 | 0 | v | | | | ConstructorCall.cpp:17:6:17:6 |
+| ConstructorCall.cpp:17:6:17:6 | v(C *, D *, E *) -> void | 1 | 0 | 0 | { ... } | | | | ConstructorCall.cpp:17:26:21:1 |
+| ConstructorCall.cpp:17:6:17:6 | v(C *, D *, E *) -> void | 2 | 1 | 0 | ExprStmt | | | | ConstructorCall.cpp:18:3:18:15 |
+| ConstructorCall.cpp:17:6:17:6 | v(C *, D *, E *) -> void | 3 | 2 | 0 | ... = ... | | | lvalue: C * | ConstructorCall.cpp:18:3:18:14 |
+| ConstructorCall.cpp:17:6:17:6 | v(C *, D *, E *) -> void | 4 | 3 | 0 | c | | | lvalue: C * | ConstructorCall.cpp:18:3:18:3 |
+| ConstructorCall.cpp:17:6:17:6 | v(C *, D *, E *) -> void | 5 | 3 | 1 | new | | | prvalue: C * | ConstructorCall.cpp:18:7:18:14 |
+| ConstructorCall.cpp:17:6:17:6 | v(C *, D *, E *) -> void | 6 | 5 | 1 | call to C | | | prvalue: void | ConstructorCall.cpp:18:7:18:14 |
+| ConstructorCall.cpp:17:6:17:6 | v(C *, D *, E *) -> void | 7 | 6 | 0 | 5 | | =5 | prvalue: int | ConstructorCall.cpp:18:13:18:13 |
+| ConstructorCall.cpp:17:6:17:6 | v(C *, D *, E *) -> void | 8 | 1 | 1 | ExprStmt | | | | ConstructorCall.cpp:19:3:19:14 |
+| ConstructorCall.cpp:17:6:17:6 | v(C *, D *, E *) -> void | 9 | 8 | 0 | ... = ... | | | lvalue: D * | ConstructorCall.cpp:19:3:19:13 |
+| ConstructorCall.cpp:17:6:17:6 | v(C *, D *, E *) -> void | 10 | 9 | 0 | d | | | lvalue: D * | ConstructorCall.cpp:19:3:19:3 |
+| ConstructorCall.cpp:17:6:17:6 | v(C *, D *, E *) -> void | 11 | 9 | 1 | new | | | prvalue: D * | ConstructorCall.cpp:19:7:19:13 |
+| ConstructorCall.cpp:17:6:17:6 | v(C *, D *, E *) -> void | 12 | 11 | 1 | call to D | | | prvalue: void | ConstructorCall.cpp:19:7:19:13 |
+| ConstructorCall.cpp:17:6:17:6 | v(C *, D *, E *) -> void | 13 | 1 | 2 | ExprStmt | | | | ConstructorCall.cpp:20:3:20:14 |
+| ConstructorCall.cpp:17:6:17:6 | v(C *, D *, E *) -> void | 14 | 13 | 0 | ... = ... | | | lvalue: E * | ConstructorCall.cpp:20:3:20:13 |
+| ConstructorCall.cpp:17:6:17:6 | v(C *, D *, E *) -> void | 15 | 14 | 0 | e | | | lvalue: E * | ConstructorCall.cpp:20:3:20:3 |
+| ConstructorCall.cpp:17:6:17:6 | v(C *, D *, E *) -> void | 16 | 14 | 1 | new | | | prvalue: E * | ConstructorCall.cpp:20:7:20:13 |
+| ConstructorCall.cpp:17:6:17:6 | v(C *, D *, E *) -> void | 17 | 16 | 1 | 0 | | =0 | prvalue: E | ConstructorCall.cpp:20:7:20:13 |
+| ConstructorCall.cpp:17:6:17:6 | v(C *, D *, E *) -> void | 18 | 1 | 3 | return ... | | | | ConstructorCall.cpp:21:1:21:1 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | AddressOf.c:1:6:1:6 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | ArrayToPointer.c:5:6:5:6 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Cast.c:1:6:1:6 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Conversion1.c:1:6:1:6 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Conversion2.c:1:6:1:6 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Conversion4.c:1:6:1:6 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Parenthesis.c:1:6:1:6 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | PointerDereference.c:1:6:1:6 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Sizeof.c:1:6:1:6 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | StatementExpr.c:1:6:1:6 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Subscript.c:1:6:1:6 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | AddressOf.c:1:15:3:1 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | ArrayToPointer.c:6:1:10:1 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Cast.c:1:26:3:1 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion1.c:1:10:3:1 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion2.c:1:15:3:1 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion4.c:1:15:3:1 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Parenthesis.c:1:15:3:1 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | PointerDereference.c:1:23:3:1 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Sizeof.c:1:21:4:1 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | StatementExpr.c:1:10:3:1 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Subscript.c:1:24:3:1 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Cast.c:2:3:2:16 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Conversion2.c:2:3:2:22 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Conversion4.c:2:3:2:15 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Parenthesis.c:2:3:2:18 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | PointerDereference.c:2:3:2:9 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Subscript.c:2:3:2:11 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | AddressOf.c:2:3:2:14 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | ArrayToPointer.c:7:3:7:21 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | Conversion1.c:2:3:2:17 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | Sizeof.c:2:3:2:22 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | StatementExpr.c:2:3:2:30 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: char * | Cast.c:2:3:2:15 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Conversion2.c:2:3:2:21 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Conversion4.c:2:3:2:14 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Parenthesis.c:2:3:2:17 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | PointerDereference.c:2:3:2:8 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Subscript.c:2:3:2:10 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of c | | | char[] | ArrayToPointer.c:7:8:7:8 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of i | | | int | Conversion1.c:2:7:2:7 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of i | | | int | Sizeof.c:2:7:2:7 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of j | | | int | StatementExpr.c:2:7:2:7 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of j | | | int * | AddressOf.c:2:8:2:8 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: char * | Cast.c:2:3:2:3 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: char * | Cast.c:2:3:2:3 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: char * | Cast.c:2:3:2:3 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for c | | | | ArrayToPointer.c:7:14:7:20 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for i | | | | Conversion1.c:2:10:2:16 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for i | | | | Sizeof.c:2:10:2:21 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for j | | | | AddressOf.c:2:11:2:13 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for j | | | | StatementExpr.c:2:10:2:29 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | j | | | lvalue: int | PointerDereference.c:2:3:2:3 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | j | | | lvalue: int | Subscript.c:2:3:2:3 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | v | | | lvalue: int | PointerDereference.c:2:3:2:3 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | v | | | lvalue: int | Subscript.c:2:3:2:3 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: char * | Cast.c:2:3:2:3 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | (...) | | =7 | prvalue: int | Conversion4.c:2:7:2:14 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | (char *)... | pointer conversion | | prvalue: char * | Cast.c:2:7:2:15 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | * ... | | | prvalue(load): int | PointerDereference.c:2:7:2:8 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | ... * ... | | | prvalue: int | Parenthesis.c:2:7:2:17 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | ... + ... | | =12 | prvalue: int | Conversion2.c:2:7:2:21 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | access to array | | | prvalue(load): int | Subscript.c:2:7:2:10 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | & ... | | | prvalue: int * | AddressOf.c:2:12:2:13 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | (int)... | integral conversion | =1 | prvalue: int | Conversion1.c:2:11:2:16 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | (int)... | integral conversion | =4 | prvalue: int | Sizeof.c:2:11:2:21 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | (statement expression) | | | prvalue: int | StatementExpr.c:2:11:2:29 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | hello | | =hello | lvalue: char[6] | ArrayToPointer.c:7:14:7:20 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 1 | 1 | declaration | | | | ArrayToPointer.c:8:3:8:13 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 1 | 1 | return ... | | | | StatementExpr.c:3:1:3:1 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | 1 | | =1 | prvalue: int | Conversion1.c:2:16:2:16 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | (...) | | | prvalue: int | Parenthesis.c:2:7:2:13 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | (int)... | integral conversion | =5 | prvalue: int | Conversion2.c:2:7:2:12 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | (int)... | integral conversion | =7 | prvalue: int | Conversion4.c:2:8:2:13 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | array | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | array | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | array | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | c | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | c | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | c | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | i | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | i | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | i | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | j | | | prvalue(load): void * | Cast.c:2:15:2:15 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | sizeof(int) | | =4 | prvalue: unsigned long | Sizeof.c:2:11:2:21 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | v | | | prvalue(load): void * | Cast.c:2:15:2:15 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | x | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | x | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | x | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | declaration | | | | Sizeof.c:3:3:3:24 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | AddressOf.c:3:1:3:1 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | Cast.c:3:1:3:1 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | Conversion1.c:3:1:3:1 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | PointerDereference.c:3:1:3:1 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 5 | 1 | 5 | | =5 | prvalue: int | Subscript.c:2:9:2:9 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | 5 | | =5 | prvalue: int | Conversion2.c:2:12:2:12 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | 7 | | =7 | prvalue: int | Conversion4.c:2:13:2:13 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | ... + ... | | | prvalue: int | Parenthesis.c:2:8:2:12 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | definition of s | | | S | ArrayToPointer.c:8:12:8:12 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 1 | 1 | return ... | | | | Conversion4.c:3:1:3:1 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 1 | 1 | return ... | | | | Subscript.c:3:1:3:1 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 1 | 2 | ExprStmt | | | | ArrayToPointer.c:9:3:9:13 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 5 | 1 | (int)... | integral conversion | =7 | prvalue: int | Conversion2.c:2:16:2:21 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | array | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | c | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | definition of j | | | int | Sizeof.c:3:7:3:7 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | i | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | x | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 7 | 1 | 1 | | =1 | prvalue: int | Parenthesis.c:2:12:2:12 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 8 | 0 | 7 | | =7 | prvalue: int | Conversion2.c:2:21:2:21 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 8 | 0 | ... = ... | | | prvalue: char * | ArrayToPointer.c:9:3:9:12 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 8 | 0 | initializer for j | | | | Sizeof.c:3:10:3:23 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 1 | 1 | return ... | | | | Conversion2.c:3:1:3:1 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 5 | 1 | 2 | | =2 | prvalue: int | Parenthesis.c:2:17:2:17 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 9 | 0 | (int)... | integral conversion | =8 | prvalue: int | Sizeof.c:3:11:3:23 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 9 | 0 | name | | | lvalue: char * | ArrayToPointer.c:9:5:9:8 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 11 | 1 | 1 | return ... | | | | Parenthesis.c:3:1:3:1 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 11 | 10 | 0 | sizeof() | | =8 | prvalue: unsigned long | Sizeof.c:3:11:3:23 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 11 | 10 | -1 | s | | | lvalue: S | ArrayToPointer.c:9:3:9:3 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 12 | 9 | 1 | array to pointer conversion | | | prvalue: char * | ArrayToPointer.c:9:12:9:12 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 12 | 11 | 0 | (...) | | | lvalue: int * | Sizeof.c:3:18:3:23 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | array | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | c | | | lvalue: char[6] | ArrayToPointer.c:9:12:9:12 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | c | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | i | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | x | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 14 | 1 | 2 | return ... | | | | Sizeof.c:4:1:4:1 |
+| Conversion1.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 14 | 1 | 3 | return ... | | | | ArrayToPointer.c:10:1:10:1 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | AddressOf.c:1:6:1:6 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | ArrayToPointer.c:5:6:5:6 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Cast.c:1:6:1:6 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Conversion1.c:1:6:1:6 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Conversion2.c:1:6:1:6 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Conversion4.c:1:6:1:6 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Parenthesis.c:1:6:1:6 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | PointerDereference.c:1:6:1:6 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Sizeof.c:1:6:1:6 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | StatementExpr.c:1:6:1:6 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Subscript.c:1:6:1:6 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | AddressOf.c:1:15:3:1 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | ArrayToPointer.c:6:1:10:1 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Cast.c:1:26:3:1 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion1.c:1:10:3:1 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion2.c:1:15:3:1 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion4.c:1:15:3:1 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Parenthesis.c:1:15:3:1 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | PointerDereference.c:1:23:3:1 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Sizeof.c:1:21:4:1 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | StatementExpr.c:1:10:3:1 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Subscript.c:1:24:3:1 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Cast.c:2:3:2:16 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Conversion2.c:2:3:2:22 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Conversion4.c:2:3:2:15 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Parenthesis.c:2:3:2:18 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | PointerDereference.c:2:3:2:9 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Subscript.c:2:3:2:11 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | AddressOf.c:2:3:2:14 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | ArrayToPointer.c:7:3:7:21 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | Conversion1.c:2:3:2:17 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | Sizeof.c:2:3:2:22 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | StatementExpr.c:2:3:2:30 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: char * | Cast.c:2:3:2:15 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Conversion2.c:2:3:2:21 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Conversion4.c:2:3:2:14 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Parenthesis.c:2:3:2:17 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | PointerDereference.c:2:3:2:8 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Subscript.c:2:3:2:10 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of c | | | char[] | ArrayToPointer.c:7:8:7:8 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of i | | | int | Conversion1.c:2:7:2:7 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of i | | | int | Sizeof.c:2:7:2:7 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of j | | | int | StatementExpr.c:2:7:2:7 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of j | | | int * | AddressOf.c:2:8:2:8 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: char * | Cast.c:2:3:2:3 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: char * | Cast.c:2:3:2:3 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: char * | Cast.c:2:3:2:3 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for c | | | | ArrayToPointer.c:7:14:7:20 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for i | | | | Conversion1.c:2:10:2:16 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for i | | | | Sizeof.c:2:10:2:21 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for j | | | | AddressOf.c:2:11:2:13 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for j | | | | StatementExpr.c:2:10:2:29 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | j | | | lvalue: int | PointerDereference.c:2:3:2:3 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | j | | | lvalue: int | Subscript.c:2:3:2:3 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | v | | | lvalue: int | PointerDereference.c:2:3:2:3 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | v | | | lvalue: int | Subscript.c:2:3:2:3 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: char * | Cast.c:2:3:2:3 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | (...) | | =7 | prvalue: int | Conversion4.c:2:7:2:14 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | (char *)... | pointer conversion | | prvalue: char * | Cast.c:2:7:2:15 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | * ... | | | prvalue(load): int | PointerDereference.c:2:7:2:8 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | ... * ... | | | prvalue: int | Parenthesis.c:2:7:2:17 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | ... + ... | | =12 | prvalue: int | Conversion2.c:2:7:2:21 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | access to array | | | prvalue(load): int | Subscript.c:2:7:2:10 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | & ... | | | prvalue: int * | AddressOf.c:2:12:2:13 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | (int)... | integral conversion | =1 | prvalue: int | Conversion1.c:2:11:2:16 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | (int)... | integral conversion | =4 | prvalue: int | Sizeof.c:2:11:2:21 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | (statement expression) | | | prvalue: int | StatementExpr.c:2:11:2:29 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | hello | | =hello | lvalue: char[6] | ArrayToPointer.c:7:14:7:20 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 1 | 1 | declaration | | | | ArrayToPointer.c:8:3:8:13 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 1 | 1 | return ... | | | | StatementExpr.c:3:1:3:1 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | 1 | | =1 | prvalue: int | Conversion1.c:2:16:2:16 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | (...) | | | prvalue: int | Parenthesis.c:2:7:2:13 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | (int)... | integral conversion | =5 | prvalue: int | Conversion2.c:2:7:2:12 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | (int)... | integral conversion | =7 | prvalue: int | Conversion4.c:2:8:2:13 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | array | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | array | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | array | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | c | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | c | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | c | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | i | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | i | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | i | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | j | | | prvalue(load): void * | Cast.c:2:15:2:15 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | sizeof(int) | | =4 | prvalue: unsigned long | Sizeof.c:2:11:2:21 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | v | | | prvalue(load): void * | Cast.c:2:15:2:15 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | x | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | x | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | x | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | declaration | | | | Sizeof.c:3:3:3:24 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | AddressOf.c:3:1:3:1 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | Cast.c:3:1:3:1 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | Conversion1.c:3:1:3:1 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | PointerDereference.c:3:1:3:1 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 5 | 1 | 5 | | =5 | prvalue: int | Subscript.c:2:9:2:9 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | 5 | | =5 | prvalue: int | Conversion2.c:2:12:2:12 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | 7 | | =7 | prvalue: int | Conversion4.c:2:13:2:13 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | ... + ... | | | prvalue: int | Parenthesis.c:2:8:2:12 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | definition of s | | | S | ArrayToPointer.c:8:12:8:12 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 1 | 1 | return ... | | | | Conversion4.c:3:1:3:1 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 1 | 1 | return ... | | | | Subscript.c:3:1:3:1 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 1 | 2 | ExprStmt | | | | ArrayToPointer.c:9:3:9:13 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 5 | 1 | (int)... | integral conversion | =7 | prvalue: int | Conversion2.c:2:16:2:21 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | array | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | c | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | definition of j | | | int | Sizeof.c:3:7:3:7 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | i | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | x | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 7 | 1 | 1 | | =1 | prvalue: int | Parenthesis.c:2:12:2:12 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 8 | 0 | 7 | | =7 | prvalue: int | Conversion2.c:2:21:2:21 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 8 | 0 | ... = ... | | | prvalue: char * | ArrayToPointer.c:9:3:9:12 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 8 | 0 | initializer for j | | | | Sizeof.c:3:10:3:23 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 1 | 1 | return ... | | | | Conversion2.c:3:1:3:1 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 5 | 1 | 2 | | =2 | prvalue: int | Parenthesis.c:2:17:2:17 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 9 | 0 | (int)... | integral conversion | =8 | prvalue: int | Sizeof.c:3:11:3:23 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 9 | 0 | name | | | lvalue: char * | ArrayToPointer.c:9:5:9:8 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 11 | 1 | 1 | return ... | | | | Parenthesis.c:3:1:3:1 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 11 | 10 | 0 | sizeof() | | =8 | prvalue: unsigned long | Sizeof.c:3:11:3:23 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 11 | 10 | -1 | s | | | lvalue: S | ArrayToPointer.c:9:3:9:3 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 12 | 9 | 1 | array to pointer conversion | | | prvalue: char * | ArrayToPointer.c:9:12:9:12 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 12 | 11 | 0 | (...) | | | lvalue: int * | Sizeof.c:3:18:3:23 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | array | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | c | | | lvalue: char[6] | ArrayToPointer.c:9:12:9:12 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | c | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | i | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | x | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 14 | 1 | 2 | return ... | | | | Sizeof.c:4:1:4:1 |
+| Conversion2.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 14 | 1 | 3 | return ... | | | | ArrayToPointer.c:10:1:10:1 |
+| Conversion3.cpp:1:6:1:6 | v(int) -> void | 0 | -1 | 0 | v | | | | Conversion3.cpp:1:6:1:6 |
+| Conversion3.cpp:1:6:1:6 | v(int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion3.cpp:1:15:3:1 |
+| Conversion3.cpp:1:6:1:6 | v(int) -> void | 2 | 1 | 0 | ExprStmt | | | | Conversion3.cpp:2:3:2:30 |
+| Conversion3.cpp:1:6:1:6 | v(int) -> void | 3 | 2 | 0 | ... = ... | | | lvalue: int | Conversion3.cpp:2:3:2:29 |
+| Conversion3.cpp:1:6:1:6 | v(int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Conversion3.cpp:2:3:2:3 |
+| Conversion3.cpp:1:6:1:6 | v(int) -> void | 5 | 3 | 1 | ... + ... | | =8 | prvalue: int | Conversion3.cpp:2:7:2:29 |
+| Conversion3.cpp:1:6:1:6 | v(int) -> void | 6 | 5 | 0 | (int)... | integral conversion | =1 | prvalue: int | Conversion3.cpp:2:7:2:18 |
+| Conversion3.cpp:1:6:1:6 | v(int) -> void | 7 | 6 | 0 | (bool)... | conversion to bool | =1 | prvalue: bool | Conversion3.cpp:2:7:2:18 |
+| Conversion3.cpp:1:6:1:6 | v(int) -> void | 8 | 7 | 0 | (int)... | integral conversion | =1 | prvalue: int | Conversion3.cpp:2:13:2:18 |
+| Conversion3.cpp:1:6:1:6 | v(int) -> void | 9 | 8 | 0 | 5 | | =5 | prvalue: int | Conversion3.cpp:2:18:2:18 |
+| Conversion3.cpp:1:6:1:6 | v(int) -> void | 10 | 5 | 1 | (...) | | =7 | prvalue: int | Conversion3.cpp:2:22:2:29 |
+| Conversion3.cpp:1:6:1:6 | v(int) -> void | 11 | 10 | 0 | (int)... | integral conversion | =7 | prvalue: int | Conversion3.cpp:2:23:2:28 |
+| Conversion3.cpp:1:6:1:6 | v(int) -> void | 12 | 11 | 0 | 7 | | =7 | prvalue: int | Conversion3.cpp:2:28:2:28 |
+| Conversion3.cpp:1:6:1:6 | v(int) -> void | 13 | 1 | 1 | return ... | | | | Conversion3.cpp:3:1:3:1 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | AddressOf.c:1:6:1:6 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | ArrayToPointer.c:5:6:5:6 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Cast.c:1:6:1:6 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Conversion1.c:1:6:1:6 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Conversion2.c:1:6:1:6 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Conversion4.c:1:6:1:6 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Parenthesis.c:1:6:1:6 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | PointerDereference.c:1:6:1:6 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Sizeof.c:1:6:1:6 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | StatementExpr.c:1:6:1:6 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Subscript.c:1:6:1:6 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | AddressOf.c:1:15:3:1 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | ArrayToPointer.c:6:1:10:1 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Cast.c:1:26:3:1 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion1.c:1:10:3:1 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion2.c:1:15:3:1 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion4.c:1:15:3:1 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Parenthesis.c:1:15:3:1 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | PointerDereference.c:1:23:3:1 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Sizeof.c:1:21:4:1 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | StatementExpr.c:1:10:3:1 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Subscript.c:1:24:3:1 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Cast.c:2:3:2:16 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Conversion2.c:2:3:2:22 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Conversion4.c:2:3:2:15 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Parenthesis.c:2:3:2:18 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | PointerDereference.c:2:3:2:9 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Subscript.c:2:3:2:11 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | AddressOf.c:2:3:2:14 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | ArrayToPointer.c:7:3:7:21 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | Conversion1.c:2:3:2:17 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | Sizeof.c:2:3:2:22 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | StatementExpr.c:2:3:2:30 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: char * | Cast.c:2:3:2:15 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Conversion2.c:2:3:2:21 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Conversion4.c:2:3:2:14 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Parenthesis.c:2:3:2:17 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | PointerDereference.c:2:3:2:8 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Subscript.c:2:3:2:10 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of c | | | char[] | ArrayToPointer.c:7:8:7:8 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of i | | | int | Conversion1.c:2:7:2:7 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of i | | | int | Sizeof.c:2:7:2:7 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of j | | | int | StatementExpr.c:2:7:2:7 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of j | | | int * | AddressOf.c:2:8:2:8 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: char * | Cast.c:2:3:2:3 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: char * | Cast.c:2:3:2:3 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: char * | Cast.c:2:3:2:3 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for c | | | | ArrayToPointer.c:7:14:7:20 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for i | | | | Conversion1.c:2:10:2:16 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for i | | | | Sizeof.c:2:10:2:21 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for j | | | | AddressOf.c:2:11:2:13 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for j | | | | StatementExpr.c:2:10:2:29 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | j | | | lvalue: int | PointerDereference.c:2:3:2:3 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | j | | | lvalue: int | Subscript.c:2:3:2:3 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | v | | | lvalue: int | PointerDereference.c:2:3:2:3 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | v | | | lvalue: int | Subscript.c:2:3:2:3 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: char * | Cast.c:2:3:2:3 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | (...) | | =7 | prvalue: int | Conversion4.c:2:7:2:14 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | (char *)... | pointer conversion | | prvalue: char * | Cast.c:2:7:2:15 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | * ... | | | prvalue(load): int | PointerDereference.c:2:7:2:8 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | ... * ... | | | prvalue: int | Parenthesis.c:2:7:2:17 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | ... + ... | | =12 | prvalue: int | Conversion2.c:2:7:2:21 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | access to array | | | prvalue(load): int | Subscript.c:2:7:2:10 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | & ... | | | prvalue: int * | AddressOf.c:2:12:2:13 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | (int)... | integral conversion | =1 | prvalue: int | Conversion1.c:2:11:2:16 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | (int)... | integral conversion | =4 | prvalue: int | Sizeof.c:2:11:2:21 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | (statement expression) | | | prvalue: int | StatementExpr.c:2:11:2:29 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | hello | | =hello | lvalue: char[6] | ArrayToPointer.c:7:14:7:20 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 1 | 1 | declaration | | | | ArrayToPointer.c:8:3:8:13 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 1 | 1 | return ... | | | | StatementExpr.c:3:1:3:1 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | 1 | | =1 | prvalue: int | Conversion1.c:2:16:2:16 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | (...) | | | prvalue: int | Parenthesis.c:2:7:2:13 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | (int)... | integral conversion | =5 | prvalue: int | Conversion2.c:2:7:2:12 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | (int)... | integral conversion | =7 | prvalue: int | Conversion4.c:2:8:2:13 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | array | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | array | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | array | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | c | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | c | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | c | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | i | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | i | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | i | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | j | | | prvalue(load): void * | Cast.c:2:15:2:15 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | sizeof(int) | | =4 | prvalue: unsigned long | Sizeof.c:2:11:2:21 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | v | | | prvalue(load): void * | Cast.c:2:15:2:15 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | x | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | x | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | x | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | declaration | | | | Sizeof.c:3:3:3:24 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | AddressOf.c:3:1:3:1 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | Cast.c:3:1:3:1 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | Conversion1.c:3:1:3:1 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | PointerDereference.c:3:1:3:1 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 5 | 1 | 5 | | =5 | prvalue: int | Subscript.c:2:9:2:9 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | 5 | | =5 | prvalue: int | Conversion2.c:2:12:2:12 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | 7 | | =7 | prvalue: int | Conversion4.c:2:13:2:13 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | ... + ... | | | prvalue: int | Parenthesis.c:2:8:2:12 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | definition of s | | | S | ArrayToPointer.c:8:12:8:12 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 1 | 1 | return ... | | | | Conversion4.c:3:1:3:1 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 1 | 1 | return ... | | | | Subscript.c:3:1:3:1 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 1 | 2 | ExprStmt | | | | ArrayToPointer.c:9:3:9:13 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 5 | 1 | (int)... | integral conversion | =7 | prvalue: int | Conversion2.c:2:16:2:21 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | array | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | c | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | definition of j | | | int | Sizeof.c:3:7:3:7 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | i | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | x | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 7 | 1 | 1 | | =1 | prvalue: int | Parenthesis.c:2:12:2:12 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 8 | 0 | 7 | | =7 | prvalue: int | Conversion2.c:2:21:2:21 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 8 | 0 | ... = ... | | | prvalue: char * | ArrayToPointer.c:9:3:9:12 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 8 | 0 | initializer for j | | | | Sizeof.c:3:10:3:23 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 1 | 1 | return ... | | | | Conversion2.c:3:1:3:1 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 5 | 1 | 2 | | =2 | prvalue: int | Parenthesis.c:2:17:2:17 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 9 | 0 | (int)... | integral conversion | =8 | prvalue: int | Sizeof.c:3:11:3:23 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 9 | 0 | name | | | lvalue: char * | ArrayToPointer.c:9:5:9:8 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 11 | 1 | 1 | return ... | | | | Parenthesis.c:3:1:3:1 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 11 | 10 | 0 | sizeof() | | =8 | prvalue: unsigned long | Sizeof.c:3:11:3:23 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 11 | 10 | -1 | s | | | lvalue: S | ArrayToPointer.c:9:3:9:3 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 12 | 9 | 1 | array to pointer conversion | | | prvalue: char * | ArrayToPointer.c:9:12:9:12 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 12 | 11 | 0 | (...) | | | lvalue: int * | Sizeof.c:3:18:3:23 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | array | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | c | | | lvalue: char[6] | ArrayToPointer.c:9:12:9:12 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | c | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | i | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | x | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 14 | 1 | 2 | return ... | | | | Sizeof.c:4:1:4:1 |
+| Conversion4.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 14 | 1 | 3 | return ... | | | | ArrayToPointer.c:10:1:10:1 |
+| DestructorCall.cpp:1:7:1:7 | C::operator=(const C &) -> C & | 0 | -1 | 0 | operator= | | | | ConstructorCall.cpp:1:7:1:7 |
+| DestructorCall.cpp:1:7:1:7 | C::operator=(const C &) -> C & | 0 | -1 | 0 | operator= | | | | DestructorCall.cpp:1:7:1:7 |
+| DestructorCall.cpp:3:3:3:4 | C::~C() -> void | 0 | -1 | 0 | ~C | | | | DestructorCall.cpp:3:3:3:4 |
+| DestructorCall.cpp:3:3:3:4 | C::~C() -> void | 1 | 0 | 0 | { ... } | | | | DestructorCall.cpp:3:8:4:3 |
+| DestructorCall.cpp:3:3:3:4 | C::~C() -> void | 2 | 1 | 0 | return ... | | | | DestructorCall.cpp:4:3:4:3 |
+| DestructorCall.cpp:7:7:7:7 | D::operator=(D &&) -> D & | 0 | -1 | 0 | operator= | | | | ConstructorCall.cpp:7:7:7:7 |
+| DestructorCall.cpp:7:7:7:7 | D::operator=(D &&) -> D & | 0 | -1 | 0 | operator= | | | | DestructorCall.cpp:7:7:7:7 |
+| DestructorCall.cpp:7:7:7:7 | D::operator=(const D &) -> D & | 0 | -1 | 0 | operator= | | | | ConstructorCall.cpp:7:7:7:7 |
+| DestructorCall.cpp:7:7:7:7 | D::operator=(const D &) -> D & | 0 | -1 | 0 | operator= | | | | DestructorCall.cpp:7:7:7:7 |
+| DestructorCall.cpp:11:6:11:6 | v(C *, D *) -> void | 0 | -1 | 0 | v | | | | DestructorCall.cpp:11:6:11:6 |
+| DestructorCall.cpp:11:6:11:6 | v(C *, D *) -> void | 1 | 0 | 0 | { ... } | | | | DestructorCall.cpp:11:20:14:1 |
+| DestructorCall.cpp:11:6:11:6 | v(C *, D *) -> void | 2 | 1 | 0 | ExprStmt | | | | DestructorCall.cpp:12:3:12:11 |
+| DestructorCall.cpp:11:6:11:6 | v(C *, D *) -> void | 3 | 2 | 0 | delete | | | prvalue: void | DestructorCall.cpp:12:3:12:10 |
+| DestructorCall.cpp:11:6:11:6 | v(C *, D *) -> void | 4 | 3 | 1 | call to ~C | | | prvalue: void | DestructorCall.cpp:12:3:12:10 |
+| DestructorCall.cpp:11:6:11:6 | v(C *, D *) -> void | 5 | 4 | -1 | c | | | prvalue(load): C * | DestructorCall.cpp:12:10:12:10 |
+| DestructorCall.cpp:11:6:11:6 | v(C *, D *) -> void | 6 | 1 | 1 | ExprStmt | | | | DestructorCall.cpp:13:3:13:11 |
+| DestructorCall.cpp:11:6:11:6 | v(C *, D *) -> void | 7 | 6 | 0 | delete | | | prvalue: void | DestructorCall.cpp:13:3:13:10 |
+| DestructorCall.cpp:11:6:11:6 | v(C *, D *) -> void | 8 | 7 | 3 | d | | | prvalue(load): D * | DestructorCall.cpp:13:10:13:10 |
+| DestructorCall.cpp:11:6:11:6 | v(C *, D *) -> void | 9 | 1 | 2 | return ... | | | | DestructorCall.cpp:14:1:14:1 |
+| DynamicCast.cpp:1:7:1:7 | Base::Base() -> void | 0 | -1 | 0 | Base | | | | DynamicCast.cpp:1:7:1:7 |
+| DynamicCast.cpp:1:7:1:7 | Base::Base() -> void | 0 | -1 | 0 | Base | | | | Typeid.cpp:11:7:11:7 |
+| DynamicCast.cpp:1:7:1:7 | Base::Base(Base &&) -> void | 0 | -1 | 0 | Base | | | | DynamicCast.cpp:1:7:1:7 |
+| DynamicCast.cpp:1:7:1:7 | Base::Base(Base &&) -> void | 0 | -1 | 0 | Base | | | | Typeid.cpp:11:7:11:7 |
+| DynamicCast.cpp:1:7:1:7 | Base::Base(const Base &) -> void | 0 | -1 | 0 | Base | | | | DynamicCast.cpp:1:7:1:7 |
+| DynamicCast.cpp:1:7:1:7 | Base::Base(const Base &) -> void | 0 | -1 | 0 | Base | | | | Typeid.cpp:11:7:11:7 |
+| DynamicCast.cpp:1:7:1:7 | Base::operator=(Base &&) -> Base & | 0 | -1 | 0 | operator= | | | | DynamicCast.cpp:1:7:1:7 |
+| DynamicCast.cpp:1:7:1:7 | Base::operator=(Base &&) -> Base & | 0 | -1 | 0 | operator= | | | | Typeid.cpp:11:7:11:7 |
+| DynamicCast.cpp:1:7:1:7 | Base::operator=(const Base &) -> Base & | 0 | -1 | 0 | operator= | | | | DynamicCast.cpp:1:7:1:7 |
+| DynamicCast.cpp:1:7:1:7 | Base::operator=(const Base &) -> Base & | 1 | 0 | 0 | { ... } | | | | file://:0:0:0:0 |
+| DynamicCast.cpp:1:7:1:7 | Base::operator=(const Base &) -> Base & | 2 | 1 | 0 | return ... | | | | file://:0:0:0:0 |
+| DynamicCast.cpp:1:7:1:7 | Base::operator=(const Base &) -> Base & | 3 | 2 | 0 | (reference to) | | | prvalue: Base & | file://:0:0:0:0 |
+| DynamicCast.cpp:1:7:1:7 | Base::operator=(const Base &) -> Base & | 4 | 3 | 0 | * ... | | | lvalue: Base | file://:0:0:0:0 |
+| DynamicCast.cpp:1:7:1:7 | Base::operator=(const Base &) -> Base & | 5 | 4 | 0 | this | | | prvalue(load): Base * | file://:0:0:0:0 |
+| DynamicCast.cpp:2:16:2:16 | Base::f() -> void | 0 | -1 | 0 | f | | | | DynamicCast.cpp:2:16:2:16 |
+| DynamicCast.cpp:2:16:2:16 | Base::f() -> void | 1 | 0 | 0 | { ... } | | | | DynamicCast.cpp:2:20:2:22 |
+| DynamicCast.cpp:2:16:2:16 | Base::f() -> void | 2 | 1 | 0 | return ... | | | | DynamicCast.cpp:2:22:2:22 |
+| DynamicCast.cpp:4:7:4:7 | Derived::Derived() -> void | 0 | -1 | 0 | Derived | | | | DynamicCast.cpp:4:7:4:7 |
+| DynamicCast.cpp:4:7:4:7 | Derived::Derived() -> void | 0 | -1 | 0 | Derived | | | | Typeid.cpp:15:7:15:7 |
+| DynamicCast.cpp:4:7:4:7 | Derived::Derived(Derived &&) -> void | 0 | -1 | 0 | Derived | | | | DynamicCast.cpp:4:7:4:7 |
+| DynamicCast.cpp:4:7:4:7 | Derived::Derived(Derived &&) -> void | 0 | -1 | 0 | Derived | | | | Typeid.cpp:15:7:15:7 |
+| DynamicCast.cpp:4:7:4:7 | Derived::Derived(const Derived &) -> void | 0 | -1 | 0 | Derived | | | | DynamicCast.cpp:4:7:4:7 |
+| DynamicCast.cpp:4:7:4:7 | Derived::Derived(const Derived &) -> void | 0 | -1 | 0 | Derived | | | | Typeid.cpp:15:7:15:7 |
+| DynamicCast.cpp:4:7:4:7 | Derived::operator=(Derived &&) -> Derived & | 0 | -1 | 0 | operator= | | | | DynamicCast.cpp:4:7:4:7 |
+| DynamicCast.cpp:4:7:4:7 | Derived::operator=(Derived &&) -> Derived & | 0 | -1 | 0 | operator= | | | | Typeid.cpp:15:7:15:7 |
+| DynamicCast.cpp:4:7:4:7 | Derived::operator=(const Derived &) -> Derived & | 0 | -1 | 0 | operator= | | | | DynamicCast.cpp:4:7:4:7 |
+| DynamicCast.cpp:4:7:4:7 | Derived::operator=(const Derived &) -> Derived & | 1 | 0 | 0 | { ... } | | | | file://:0:0:0:0 |
+| DynamicCast.cpp:4:7:4:7 | Derived::operator=(const Derived &) -> Derived & | 2 | 1 | 0 | ExprStmt | | | | file://:0:0:0:0 |
+| DynamicCast.cpp:4:7:4:7 | Derived::operator=(const Derived &) -> Derived & | 3 | 2 | 0 | (reference dereference) | | | lvalue: Base | file://:0:0:0:0 |
+| DynamicCast.cpp:4:7:4:7 | Derived::operator=(const Derived &) -> Derived & | 4 | 3 | 0 | call to operator= | | | prvalue: Base & | DynamicCast.cpp:4:7:4:7 |
+| DynamicCast.cpp:4:7:4:7 | Derived::operator=(const Derived &) -> Derived & | 5 | 4 | -1 | (Base *)... | base class conversion | | prvalue: Base * | file://:0:0:0:0 |
+| DynamicCast.cpp:4:7:4:7 | Derived::operator=(const Derived &) -> Derived & | 6 | 5 | 0 | this | | | prvalue(load): Derived * | file://:0:0:0:0 |
+| DynamicCast.cpp:4:7:4:7 | Derived::operator=(const Derived &) -> Derived & | 7 | 4 | 0 | (reference to) | | | prvalue: const Base & | file://:0:0:0:0 |
+| DynamicCast.cpp:4:7:4:7 | Derived::operator=(const Derived &) -> Derived & | 8 | 7 | 0 | * ... | | | lvalue: const Base | file://:0:0:0:0 |
+| DynamicCast.cpp:4:7:4:7 | Derived::operator=(const Derived &) -> Derived & | 9 | 8 | 0 | (const Base *)... | base class conversion | | prvalue: const Base * | file://:0:0:0:0 |
+| DynamicCast.cpp:4:7:4:7 | Derived::operator=(const Derived &) -> Derived & | 10 | 9 | 0 | & ... | | | prvalue: const Derived * | file://:0:0:0:0 |
+| DynamicCast.cpp:4:7:4:7 | Derived::operator=(const Derived &) -> Derived & | 11 | 10 | 0 | (reference dereference) | | | lvalue: const Derived | file://:0:0:0:0 |
+| DynamicCast.cpp:4:7:4:7 | Derived::operator=(const Derived &) -> Derived & | 12 | 11 | 0 | p#0 | | | prvalue(load): const Derived & | file://:0:0:0:0 |
+| DynamicCast.cpp:4:7:4:7 | Derived::operator=(const Derived &) -> Derived & | 13 | 1 | 1 | return ... | | | | file://:0:0:0:0 |
+| DynamicCast.cpp:4:7:4:7 | Derived::operator=(const Derived &) -> Derived & | 14 | 13 | 0 | (reference to) | | | prvalue: Derived & | file://:0:0:0:0 |
+| DynamicCast.cpp:4:7:4:7 | Derived::operator=(const Derived &) -> Derived & | 15 | 14 | 0 | * ... | | | lvalue: Derived | file://:0:0:0:0 |
+| DynamicCast.cpp:4:7:4:7 | Derived::operator=(const Derived &) -> Derived & | 16 | 15 | 0 | this | | | prvalue(load): Derived * | file://:0:0:0:0 |
+| DynamicCast.cpp:5:8:5:8 | Derived::f() -> void | 0 | -1 | 0 | f | | | | DynamicCast.cpp:5:8:5:8 |
+| DynamicCast.cpp:5:8:5:8 | Derived::f() -> void | 1 | 0 | 0 | { ... } | | | | DynamicCast.cpp:5:12:5:14 |
+| DynamicCast.cpp:5:8:5:8 | Derived::f() -> void | 2 | 1 | 0 | return ... | | | | DynamicCast.cpp:5:14:5:14 |
+| DynamicCast.cpp:8:6:8:6 | v(Base *, Derived *) -> void | 0 | -1 | 0 | v | | | | DynamicCast.cpp:8:6:8:6 |
+| DynamicCast.cpp:8:6:8:6 | v(Base *, Derived *) -> void | 1 | 0 | 0 | { ... } | | | | DynamicCast.cpp:8:30:10:1 |
+| DynamicCast.cpp:8:6:8:6 | v(Base *, Derived *) -> void | 2 | 1 | 0 | ExprStmt | | | | DynamicCast.cpp:9:3:9:34 |
+| DynamicCast.cpp:8:6:8:6 | v(Base *, Derived *) -> void | 3 | 2 | 0 | ... = ... | | | lvalue: Derived * | DynamicCast.cpp:9:3:9:33 |
+| DynamicCast.cpp:8:6:8:6 | v(Base *, Derived *) -> void | 4 | 3 | 0 | d | | | lvalue: Derived * | DynamicCast.cpp:9:3:9:3 |
+| DynamicCast.cpp:8:6:8:6 | v(Base *, Derived *) -> void | 5 | 3 | 1 | dynamic_cast... | dynamic_cast | | prvalue: Derived * | DynamicCast.cpp:9:7:9:33 |
+| DynamicCast.cpp:8:6:8:6 | v(Base *, Derived *) -> void | 6 | 5 | 0 | bp | | | prvalue(load): Base * | DynamicCast.cpp:9:31:9:32 |
+| DynamicCast.cpp:8:6:8:6 | v(Base *, Derived *) -> void | 7 | 1 | 1 | return ... | | | | DynamicCast.cpp:10:1:10:1 |
+| DynamicCast.cpp:12:6:12:10 | v_ref(Base &, Derived &) -> void | 0 | -1 | 0 | v_ref | | | | DynamicCast.cpp:12:6:12:10 |
+| DynamicCast.cpp:12:6:12:10 | v_ref(Base &, Derived &) -> void | 1 | 0 | 0 | { ... } | | | | DynamicCast.cpp:12:34:14:1 |
+| DynamicCast.cpp:12:6:12:10 | v_ref(Base &, Derived &) -> void | 2 | 1 | 0 | ExprStmt | | | | DynamicCast.cpp:13:3:13:34 |
+| DynamicCast.cpp:12:6:12:10 | v_ref(Base &, Derived &) -> void | 3 | 2 | 0 | (reference dereference) | | | lvalue: Derived | DynamicCast.cpp:13:5:13:34 |
+| DynamicCast.cpp:12:6:12:10 | v_ref(Base &, Derived &) -> void | 4 | 3 | 0 | call to operator= | | | prvalue: Derived & | DynamicCast.cpp:13:5:13:5 |
+| DynamicCast.cpp:12:6:12:10 | v_ref(Base &, Derived &) -> void | 5 | 4 | -1 | (reference dereference) | | | lvalue: Derived | DynamicCast.cpp:13:3:13:3 |
+| DynamicCast.cpp:12:6:12:10 | v_ref(Base &, Derived &) -> void | 6 | 5 | 0 | d | | | prvalue(load): Derived & | DynamicCast.cpp:13:3:13:3 |
+| DynamicCast.cpp:12:6:12:10 | v_ref(Base &, Derived &) -> void | 7 | 4 | 0 | (reference to) | | | prvalue: const Derived & | DynamicCast.cpp:13:7:13:33 |
+| DynamicCast.cpp:12:6:12:10 | v_ref(Base &, Derived &) -> void | 8 | 7 | 0 | (const Derived)... | glvalue conversion | | lvalue: const Derived | DynamicCast.cpp:13:7:13:33 |
+| DynamicCast.cpp:12:6:12:10 | v_ref(Base &, Derived &) -> void | 9 | 8 | 0 | dynamic_cast... | dynamic_cast | | lvalue: Derived | DynamicCast.cpp:13:7:13:33 |
+| DynamicCast.cpp:12:6:12:10 | v_ref(Base &, Derived &) -> void | 10 | 9 | 0 | (reference dereference) | | | lvalue: Base | DynamicCast.cpp:13:31:13:32 |
+| DynamicCast.cpp:12:6:12:10 | v_ref(Base &, Derived &) -> void | 11 | 10 | 0 | bp | | | prvalue(load): Base & | DynamicCast.cpp:13:31:13:32 |
+| DynamicCast.cpp:12:6:12:10 | v_ref(Base &, Derived &) -> void | 12 | 1 | 1 | return ... | | | | DynamicCast.cpp:14:1:14:1 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | AddressOf.c:1:6:1:6 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | ArrayToPointer.c:5:6:5:6 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Cast.c:1:6:1:6 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Conversion1.c:1:6:1:6 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Conversion2.c:1:6:1:6 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Conversion4.c:1:6:1:6 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Parenthesis.c:1:6:1:6 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | PointerDereference.c:1:6:1:6 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Sizeof.c:1:6:1:6 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | StatementExpr.c:1:6:1:6 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Subscript.c:1:6:1:6 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | AddressOf.c:1:15:3:1 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | ArrayToPointer.c:6:1:10:1 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Cast.c:1:26:3:1 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion1.c:1:10:3:1 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion2.c:1:15:3:1 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion4.c:1:15:3:1 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Parenthesis.c:1:15:3:1 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | PointerDereference.c:1:23:3:1 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Sizeof.c:1:21:4:1 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | StatementExpr.c:1:10:3:1 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Subscript.c:1:24:3:1 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Cast.c:2:3:2:16 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Conversion2.c:2:3:2:22 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Conversion4.c:2:3:2:15 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Parenthesis.c:2:3:2:18 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | PointerDereference.c:2:3:2:9 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Subscript.c:2:3:2:11 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | AddressOf.c:2:3:2:14 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | ArrayToPointer.c:7:3:7:21 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | Conversion1.c:2:3:2:17 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | Sizeof.c:2:3:2:22 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | StatementExpr.c:2:3:2:30 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: char * | Cast.c:2:3:2:15 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Conversion2.c:2:3:2:21 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Conversion4.c:2:3:2:14 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Parenthesis.c:2:3:2:17 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | PointerDereference.c:2:3:2:8 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Subscript.c:2:3:2:10 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of c | | | char[] | ArrayToPointer.c:7:8:7:8 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of i | | | int | Conversion1.c:2:7:2:7 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of i | | | int | Sizeof.c:2:7:2:7 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of j | | | int | StatementExpr.c:2:7:2:7 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of j | | | int * | AddressOf.c:2:8:2:8 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: char * | Cast.c:2:3:2:3 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: char * | Cast.c:2:3:2:3 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: char * | Cast.c:2:3:2:3 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for c | | | | ArrayToPointer.c:7:14:7:20 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for i | | | | Conversion1.c:2:10:2:16 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for i | | | | Sizeof.c:2:10:2:21 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for j | | | | AddressOf.c:2:11:2:13 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for j | | | | StatementExpr.c:2:10:2:29 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | j | | | lvalue: int | PointerDereference.c:2:3:2:3 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | j | | | lvalue: int | Subscript.c:2:3:2:3 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | v | | | lvalue: int | PointerDereference.c:2:3:2:3 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | v | | | lvalue: int | Subscript.c:2:3:2:3 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: char * | Cast.c:2:3:2:3 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | (...) | | =7 | prvalue: int | Conversion4.c:2:7:2:14 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | (char *)... | pointer conversion | | prvalue: char * | Cast.c:2:7:2:15 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | * ... | | | prvalue(load): int | PointerDereference.c:2:7:2:8 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | ... * ... | | | prvalue: int | Parenthesis.c:2:7:2:17 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | ... + ... | | =12 | prvalue: int | Conversion2.c:2:7:2:21 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | access to array | | | prvalue(load): int | Subscript.c:2:7:2:10 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | & ... | | | prvalue: int * | AddressOf.c:2:12:2:13 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | (int)... | integral conversion | =1 | prvalue: int | Conversion1.c:2:11:2:16 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | (int)... | integral conversion | =4 | prvalue: int | Sizeof.c:2:11:2:21 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | (statement expression) | | | prvalue: int | StatementExpr.c:2:11:2:29 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | hello | | =hello | lvalue: char[6] | ArrayToPointer.c:7:14:7:20 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 1 | 1 | declaration | | | | ArrayToPointer.c:8:3:8:13 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 1 | 1 | return ... | | | | StatementExpr.c:3:1:3:1 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | 1 | | =1 | prvalue: int | Conversion1.c:2:16:2:16 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | (...) | | | prvalue: int | Parenthesis.c:2:7:2:13 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | (int)... | integral conversion | =5 | prvalue: int | Conversion2.c:2:7:2:12 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | (int)... | integral conversion | =7 | prvalue: int | Conversion4.c:2:8:2:13 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | array | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | array | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | array | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | c | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | c | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | c | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | i | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | i | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | i | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | j | | | prvalue(load): void * | Cast.c:2:15:2:15 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | sizeof(int) | | =4 | prvalue: unsigned long | Sizeof.c:2:11:2:21 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | v | | | prvalue(load): void * | Cast.c:2:15:2:15 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | x | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | x | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | x | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | declaration | | | | Sizeof.c:3:3:3:24 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | AddressOf.c:3:1:3:1 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | Cast.c:3:1:3:1 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | Conversion1.c:3:1:3:1 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | PointerDereference.c:3:1:3:1 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 5 | 1 | 5 | | =5 | prvalue: int | Subscript.c:2:9:2:9 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | 5 | | =5 | prvalue: int | Conversion2.c:2:12:2:12 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | 7 | | =7 | prvalue: int | Conversion4.c:2:13:2:13 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | ... + ... | | | prvalue: int | Parenthesis.c:2:8:2:12 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | definition of s | | | S | ArrayToPointer.c:8:12:8:12 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 1 | 1 | return ... | | | | Conversion4.c:3:1:3:1 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 1 | 1 | return ... | | | | Subscript.c:3:1:3:1 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 1 | 2 | ExprStmt | | | | ArrayToPointer.c:9:3:9:13 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 5 | 1 | (int)... | integral conversion | =7 | prvalue: int | Conversion2.c:2:16:2:21 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | array | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | c | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | definition of j | | | int | Sizeof.c:3:7:3:7 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | i | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | x | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 7 | 1 | 1 | | =1 | prvalue: int | Parenthesis.c:2:12:2:12 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 8 | 0 | 7 | | =7 | prvalue: int | Conversion2.c:2:21:2:21 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 8 | 0 | ... = ... | | | prvalue: char * | ArrayToPointer.c:9:3:9:12 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 8 | 0 | initializer for j | | | | Sizeof.c:3:10:3:23 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 1 | 1 | return ... | | | | Conversion2.c:3:1:3:1 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 5 | 1 | 2 | | =2 | prvalue: int | Parenthesis.c:2:17:2:17 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 9 | 0 | (int)... | integral conversion | =8 | prvalue: int | Sizeof.c:3:11:3:23 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 9 | 0 | name | | | lvalue: char * | ArrayToPointer.c:9:5:9:8 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 11 | 1 | 1 | return ... | | | | Parenthesis.c:3:1:3:1 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 11 | 10 | 0 | sizeof() | | =8 | prvalue: unsigned long | Sizeof.c:3:11:3:23 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 11 | 10 | -1 | s | | | lvalue: S | ArrayToPointer.c:9:3:9:3 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 12 | 9 | 1 | array to pointer conversion | | | prvalue: char * | ArrayToPointer.c:9:12:9:12 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 12 | 11 | 0 | (...) | | | lvalue: int * | Sizeof.c:3:18:3:23 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | array | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | c | | | lvalue: char[6] | ArrayToPointer.c:9:12:9:12 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | c | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | i | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | x | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 14 | 1 | 2 | return ... | | | | Sizeof.c:4:1:4:1 |
+| Parenthesis.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 14 | 1 | 3 | return ... | | | | ArrayToPointer.c:10:1:10:1 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | AddressOf.c:1:6:1:6 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | ArrayToPointer.c:5:6:5:6 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Cast.c:1:6:1:6 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Conversion1.c:1:6:1:6 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Conversion2.c:1:6:1:6 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Conversion4.c:1:6:1:6 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Parenthesis.c:1:6:1:6 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | PointerDereference.c:1:6:1:6 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Sizeof.c:1:6:1:6 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | StatementExpr.c:1:6:1:6 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Subscript.c:1:6:1:6 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | AddressOf.c:1:15:3:1 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | ArrayToPointer.c:6:1:10:1 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Cast.c:1:26:3:1 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion1.c:1:10:3:1 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion2.c:1:15:3:1 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion4.c:1:15:3:1 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Parenthesis.c:1:15:3:1 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | PointerDereference.c:1:23:3:1 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Sizeof.c:1:21:4:1 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | StatementExpr.c:1:10:3:1 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Subscript.c:1:24:3:1 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Cast.c:2:3:2:16 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Conversion2.c:2:3:2:22 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Conversion4.c:2:3:2:15 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Parenthesis.c:2:3:2:18 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | PointerDereference.c:2:3:2:9 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Subscript.c:2:3:2:11 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | AddressOf.c:2:3:2:14 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | ArrayToPointer.c:7:3:7:21 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | Conversion1.c:2:3:2:17 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | Sizeof.c:2:3:2:22 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | StatementExpr.c:2:3:2:30 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: char * | Cast.c:2:3:2:15 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Conversion2.c:2:3:2:21 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Conversion4.c:2:3:2:14 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Parenthesis.c:2:3:2:17 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | PointerDereference.c:2:3:2:8 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Subscript.c:2:3:2:10 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of c | | | char[] | ArrayToPointer.c:7:8:7:8 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of i | | | int | Conversion1.c:2:7:2:7 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of i | | | int | Sizeof.c:2:7:2:7 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of j | | | int | StatementExpr.c:2:7:2:7 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of j | | | int * | AddressOf.c:2:8:2:8 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: char * | Cast.c:2:3:2:3 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: char * | Cast.c:2:3:2:3 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: char * | Cast.c:2:3:2:3 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for c | | | | ArrayToPointer.c:7:14:7:20 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for i | | | | Conversion1.c:2:10:2:16 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for i | | | | Sizeof.c:2:10:2:21 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for j | | | | AddressOf.c:2:11:2:13 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for j | | | | StatementExpr.c:2:10:2:29 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | j | | | lvalue: int | PointerDereference.c:2:3:2:3 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | j | | | lvalue: int | Subscript.c:2:3:2:3 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | v | | | lvalue: int | PointerDereference.c:2:3:2:3 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | v | | | lvalue: int | Subscript.c:2:3:2:3 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: char * | Cast.c:2:3:2:3 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | (...) | | =7 | prvalue: int | Conversion4.c:2:7:2:14 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | (char *)... | pointer conversion | | prvalue: char * | Cast.c:2:7:2:15 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | * ... | | | prvalue(load): int | PointerDereference.c:2:7:2:8 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | ... * ... | | | prvalue: int | Parenthesis.c:2:7:2:17 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | ... + ... | | =12 | prvalue: int | Conversion2.c:2:7:2:21 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | access to array | | | prvalue(load): int | Subscript.c:2:7:2:10 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | & ... | | | prvalue: int * | AddressOf.c:2:12:2:13 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | (int)... | integral conversion | =1 | prvalue: int | Conversion1.c:2:11:2:16 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | (int)... | integral conversion | =4 | prvalue: int | Sizeof.c:2:11:2:21 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | (statement expression) | | | prvalue: int | StatementExpr.c:2:11:2:29 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | hello | | =hello | lvalue: char[6] | ArrayToPointer.c:7:14:7:20 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 1 | 1 | declaration | | | | ArrayToPointer.c:8:3:8:13 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 1 | 1 | return ... | | | | StatementExpr.c:3:1:3:1 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | 1 | | =1 | prvalue: int | Conversion1.c:2:16:2:16 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | (...) | | | prvalue: int | Parenthesis.c:2:7:2:13 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | (int)... | integral conversion | =5 | prvalue: int | Conversion2.c:2:7:2:12 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | (int)... | integral conversion | =7 | prvalue: int | Conversion4.c:2:8:2:13 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | array | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | array | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | array | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | c | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | c | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | c | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | i | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | i | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | i | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | j | | | prvalue(load): void * | Cast.c:2:15:2:15 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | sizeof(int) | | =4 | prvalue: unsigned long | Sizeof.c:2:11:2:21 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | v | | | prvalue(load): void * | Cast.c:2:15:2:15 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | x | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | x | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | x | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | declaration | | | | Sizeof.c:3:3:3:24 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | AddressOf.c:3:1:3:1 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | Cast.c:3:1:3:1 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | Conversion1.c:3:1:3:1 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | PointerDereference.c:3:1:3:1 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 5 | 1 | 5 | | =5 | prvalue: int | Subscript.c:2:9:2:9 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | 5 | | =5 | prvalue: int | Conversion2.c:2:12:2:12 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | 7 | | =7 | prvalue: int | Conversion4.c:2:13:2:13 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | ... + ... | | | prvalue: int | Parenthesis.c:2:8:2:12 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | definition of s | | | S | ArrayToPointer.c:8:12:8:12 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 1 | 1 | return ... | | | | Conversion4.c:3:1:3:1 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 1 | 1 | return ... | | | | Subscript.c:3:1:3:1 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 1 | 2 | ExprStmt | | | | ArrayToPointer.c:9:3:9:13 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 5 | 1 | (int)... | integral conversion | =7 | prvalue: int | Conversion2.c:2:16:2:21 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | array | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | c | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | definition of j | | | int | Sizeof.c:3:7:3:7 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | i | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | x | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 7 | 1 | 1 | | =1 | prvalue: int | Parenthesis.c:2:12:2:12 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 8 | 0 | 7 | | =7 | prvalue: int | Conversion2.c:2:21:2:21 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 8 | 0 | ... = ... | | | prvalue: char * | ArrayToPointer.c:9:3:9:12 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 8 | 0 | initializer for j | | | | Sizeof.c:3:10:3:23 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 1 | 1 | return ... | | | | Conversion2.c:3:1:3:1 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 5 | 1 | 2 | | =2 | prvalue: int | Parenthesis.c:2:17:2:17 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 9 | 0 | (int)... | integral conversion | =8 | prvalue: int | Sizeof.c:3:11:3:23 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 9 | 0 | name | | | lvalue: char * | ArrayToPointer.c:9:5:9:8 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 11 | 1 | 1 | return ... | | | | Parenthesis.c:3:1:3:1 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 11 | 10 | 0 | sizeof() | | =8 | prvalue: unsigned long | Sizeof.c:3:11:3:23 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 11 | 10 | -1 | s | | | lvalue: S | ArrayToPointer.c:9:3:9:3 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 12 | 9 | 1 | array to pointer conversion | | | prvalue: char * | ArrayToPointer.c:9:12:9:12 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 12 | 11 | 0 | (...) | | | lvalue: int * | Sizeof.c:3:18:3:23 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | array | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | c | | | lvalue: char[6] | ArrayToPointer.c:9:12:9:12 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | c | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | i | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | x | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 14 | 1 | 2 | return ... | | | | Sizeof.c:4:1:4:1 |
+| PointerDereference.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 14 | 1 | 3 | return ... | | | | ArrayToPointer.c:10:1:10:1 |
+| ReferenceDereference.cpp:4:6:4:6 | v(int &, int) -> void | 0 | -1 | 0 | v | | | | ReferenceDereference.cpp:4:6:4:6 |
+| ReferenceDereference.cpp:4:6:4:6 | v(int &, int) -> void | 1 | 0 | 0 | { ... } | | | | ReferenceDereference.cpp:4:23:6:1 |
+| ReferenceDereference.cpp:4:6:4:6 | v(int &, int) -> void | 2 | 1 | 0 | ExprStmt | | | | ReferenceDereference.cpp:5:3:5:8 |
+| ReferenceDereference.cpp:4:6:4:6 | v(int &, int) -> void | 3 | 2 | 0 | ... = ... | | | lvalue: int | ReferenceDereference.cpp:5:3:5:7 |
+| ReferenceDereference.cpp:4:6:4:6 | v(int &, int) -> void | 4 | 3 | 0 | j | | | lvalue: int | ReferenceDereference.cpp:5:3:5:3 |
+| ReferenceDereference.cpp:4:6:4:6 | v(int &, int) -> void | 5 | 3 | 1 | (reference dereference) | | | prvalue(load): int | ReferenceDereference.cpp:5:7:5:7 |
+| ReferenceDereference.cpp:4:6:4:6 | v(int &, int) -> void | 6 | 5 | 0 | i | | | prvalue(load): int & | ReferenceDereference.cpp:5:7:5:7 |
+| ReferenceDereference.cpp:4:6:4:6 | v(int &, int) -> void | 7 | 1 | 1 | return ... | | | | ReferenceDereference.cpp:6:1:6:1 |
+| ReferenceTo.cpp:1:6:1:6 | v(int *) -> int & | 0 | -1 | 0 | v | | | | ReferenceTo.cpp:1:6:1:6 |
+| ReferenceTo.cpp:1:6:1:6 | v(int *) -> int & | 1 | 0 | 0 | { ... } | | | | ReferenceTo.cpp:1:16:3:1 |
+| ReferenceTo.cpp:1:6:1:6 | v(int *) -> int & | 2 | 1 | 0 | return ... | | | | ReferenceTo.cpp:2:3:2:12 |
+| ReferenceTo.cpp:1:6:1:6 | v(int *) -> int & | 3 | 2 | 0 | (reference to) | | | prvalue: int & | ReferenceTo.cpp:2:10:2:11 |
+| ReferenceTo.cpp:1:6:1:6 | v(int *) -> int & | 4 | 3 | 0 | * ... | | | lvalue: int | ReferenceTo.cpp:2:10:2:11 |
+| ReferenceTo.cpp:1:6:1:6 | v(int *) -> int & | 5 | 4 | 0 | i | | | prvalue(load): int * | ReferenceTo.cpp:2:11:2:11 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | AddressOf.c:1:6:1:6 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | ArrayToPointer.c:5:6:5:6 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Cast.c:1:6:1:6 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Conversion1.c:1:6:1:6 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Conversion2.c:1:6:1:6 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Conversion4.c:1:6:1:6 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Parenthesis.c:1:6:1:6 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | PointerDereference.c:1:6:1:6 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Sizeof.c:1:6:1:6 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | StatementExpr.c:1:6:1:6 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Subscript.c:1:6:1:6 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | AddressOf.c:1:15:3:1 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | ArrayToPointer.c:6:1:10:1 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Cast.c:1:26:3:1 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion1.c:1:10:3:1 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion2.c:1:15:3:1 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion4.c:1:15:3:1 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Parenthesis.c:1:15:3:1 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | PointerDereference.c:1:23:3:1 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Sizeof.c:1:21:4:1 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | StatementExpr.c:1:10:3:1 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Subscript.c:1:24:3:1 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Cast.c:2:3:2:16 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Conversion2.c:2:3:2:22 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Conversion4.c:2:3:2:15 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Parenthesis.c:2:3:2:18 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | PointerDereference.c:2:3:2:9 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Subscript.c:2:3:2:11 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | AddressOf.c:2:3:2:14 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | ArrayToPointer.c:7:3:7:21 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | Conversion1.c:2:3:2:17 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | Sizeof.c:2:3:2:22 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | StatementExpr.c:2:3:2:30 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: char * | Cast.c:2:3:2:15 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Conversion2.c:2:3:2:21 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Conversion4.c:2:3:2:14 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Parenthesis.c:2:3:2:17 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | PointerDereference.c:2:3:2:8 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Subscript.c:2:3:2:10 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of c | | | char[] | ArrayToPointer.c:7:8:7:8 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of i | | | int | Conversion1.c:2:7:2:7 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of i | | | int | Sizeof.c:2:7:2:7 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of j | | | int | StatementExpr.c:2:7:2:7 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of j | | | int * | AddressOf.c:2:8:2:8 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: char * | Cast.c:2:3:2:3 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: char * | Cast.c:2:3:2:3 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: char * | Cast.c:2:3:2:3 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for c | | | | ArrayToPointer.c:7:14:7:20 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for i | | | | Conversion1.c:2:10:2:16 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for i | | | | Sizeof.c:2:10:2:21 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for j | | | | AddressOf.c:2:11:2:13 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for j | | | | StatementExpr.c:2:10:2:29 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | j | | | lvalue: int | PointerDereference.c:2:3:2:3 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | j | | | lvalue: int | Subscript.c:2:3:2:3 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | v | | | lvalue: int | PointerDereference.c:2:3:2:3 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | v | | | lvalue: int | Subscript.c:2:3:2:3 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: char * | Cast.c:2:3:2:3 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | (...) | | =7 | prvalue: int | Conversion4.c:2:7:2:14 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | (char *)... | pointer conversion | | prvalue: char * | Cast.c:2:7:2:15 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | * ... | | | prvalue(load): int | PointerDereference.c:2:7:2:8 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | ... * ... | | | prvalue: int | Parenthesis.c:2:7:2:17 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | ... + ... | | =12 | prvalue: int | Conversion2.c:2:7:2:21 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | access to array | | | prvalue(load): int | Subscript.c:2:7:2:10 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | & ... | | | prvalue: int * | AddressOf.c:2:12:2:13 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | (int)... | integral conversion | =1 | prvalue: int | Conversion1.c:2:11:2:16 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | (int)... | integral conversion | =4 | prvalue: int | Sizeof.c:2:11:2:21 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | (statement expression) | | | prvalue: int | StatementExpr.c:2:11:2:29 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | hello | | =hello | lvalue: char[6] | ArrayToPointer.c:7:14:7:20 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 1 | 1 | declaration | | | | ArrayToPointer.c:8:3:8:13 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 1 | 1 | return ... | | | | StatementExpr.c:3:1:3:1 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | 1 | | =1 | prvalue: int | Conversion1.c:2:16:2:16 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | (...) | | | prvalue: int | Parenthesis.c:2:7:2:13 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | (int)... | integral conversion | =5 | prvalue: int | Conversion2.c:2:7:2:12 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | (int)... | integral conversion | =7 | prvalue: int | Conversion4.c:2:8:2:13 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | array | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | array | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | array | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | c | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | c | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | c | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | i | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | i | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | i | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | j | | | prvalue(load): void * | Cast.c:2:15:2:15 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | sizeof(int) | | =4 | prvalue: unsigned long | Sizeof.c:2:11:2:21 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | v | | | prvalue(load): void * | Cast.c:2:15:2:15 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | x | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | x | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | x | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | declaration | | | | Sizeof.c:3:3:3:24 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | AddressOf.c:3:1:3:1 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | Cast.c:3:1:3:1 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | Conversion1.c:3:1:3:1 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | PointerDereference.c:3:1:3:1 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 5 | 1 | 5 | | =5 | prvalue: int | Subscript.c:2:9:2:9 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | 5 | | =5 | prvalue: int | Conversion2.c:2:12:2:12 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | 7 | | =7 | prvalue: int | Conversion4.c:2:13:2:13 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | ... + ... | | | prvalue: int | Parenthesis.c:2:8:2:12 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | definition of s | | | S | ArrayToPointer.c:8:12:8:12 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 1 | 1 | return ... | | | | Conversion4.c:3:1:3:1 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 1 | 1 | return ... | | | | Subscript.c:3:1:3:1 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 1 | 2 | ExprStmt | | | | ArrayToPointer.c:9:3:9:13 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 5 | 1 | (int)... | integral conversion | =7 | prvalue: int | Conversion2.c:2:16:2:21 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | array | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | c | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | definition of j | | | int | Sizeof.c:3:7:3:7 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | i | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | x | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 7 | 1 | 1 | | =1 | prvalue: int | Parenthesis.c:2:12:2:12 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 8 | 0 | 7 | | =7 | prvalue: int | Conversion2.c:2:21:2:21 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 8 | 0 | ... = ... | | | prvalue: char * | ArrayToPointer.c:9:3:9:12 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 8 | 0 | initializer for j | | | | Sizeof.c:3:10:3:23 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 1 | 1 | return ... | | | | Conversion2.c:3:1:3:1 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 5 | 1 | 2 | | =2 | prvalue: int | Parenthesis.c:2:17:2:17 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 9 | 0 | (int)... | integral conversion | =8 | prvalue: int | Sizeof.c:3:11:3:23 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 9 | 0 | name | | | lvalue: char * | ArrayToPointer.c:9:5:9:8 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 11 | 1 | 1 | return ... | | | | Parenthesis.c:3:1:3:1 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 11 | 10 | 0 | sizeof() | | =8 | prvalue: unsigned long | Sizeof.c:3:11:3:23 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 11 | 10 | -1 | s | | | lvalue: S | ArrayToPointer.c:9:3:9:3 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 12 | 9 | 1 | array to pointer conversion | | | prvalue: char * | ArrayToPointer.c:9:12:9:12 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 12 | 11 | 0 | (...) | | | lvalue: int * | Sizeof.c:3:18:3:23 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | array | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | c | | | lvalue: char[6] | ArrayToPointer.c:9:12:9:12 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | c | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | i | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | x | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 14 | 1 | 2 | return ... | | | | Sizeof.c:4:1:4:1 |
+| Sizeof.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 14 | 1 | 3 | return ... | | | | ArrayToPointer.c:10:1:10:1 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | AddressOf.c:1:6:1:6 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | ArrayToPointer.c:5:6:5:6 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Cast.c:1:6:1:6 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Conversion1.c:1:6:1:6 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Conversion2.c:1:6:1:6 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Conversion4.c:1:6:1:6 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Parenthesis.c:1:6:1:6 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | PointerDereference.c:1:6:1:6 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Sizeof.c:1:6:1:6 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | StatementExpr.c:1:6:1:6 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Subscript.c:1:6:1:6 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | AddressOf.c:1:15:3:1 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | ArrayToPointer.c:6:1:10:1 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Cast.c:1:26:3:1 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion1.c:1:10:3:1 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion2.c:1:15:3:1 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion4.c:1:15:3:1 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Parenthesis.c:1:15:3:1 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | PointerDereference.c:1:23:3:1 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Sizeof.c:1:21:4:1 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | StatementExpr.c:1:10:3:1 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Subscript.c:1:24:3:1 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Cast.c:2:3:2:16 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Conversion2.c:2:3:2:22 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Conversion4.c:2:3:2:15 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Parenthesis.c:2:3:2:18 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | PointerDereference.c:2:3:2:9 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Subscript.c:2:3:2:11 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | AddressOf.c:2:3:2:14 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | ArrayToPointer.c:7:3:7:21 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | Conversion1.c:2:3:2:17 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | Sizeof.c:2:3:2:22 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | StatementExpr.c:2:3:2:30 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: char * | Cast.c:2:3:2:15 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Conversion2.c:2:3:2:21 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Conversion4.c:2:3:2:14 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Parenthesis.c:2:3:2:17 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | PointerDereference.c:2:3:2:8 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Subscript.c:2:3:2:10 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of c | | | char[] | ArrayToPointer.c:7:8:7:8 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of i | | | int | Conversion1.c:2:7:2:7 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of i | | | int | Sizeof.c:2:7:2:7 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of j | | | int | StatementExpr.c:2:7:2:7 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of j | | | int * | AddressOf.c:2:8:2:8 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: char * | Cast.c:2:3:2:3 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: char * | Cast.c:2:3:2:3 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: char * | Cast.c:2:3:2:3 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for c | | | | ArrayToPointer.c:7:14:7:20 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for i | | | | Conversion1.c:2:10:2:16 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for i | | | | Sizeof.c:2:10:2:21 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for j | | | | AddressOf.c:2:11:2:13 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for j | | | | StatementExpr.c:2:10:2:29 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | j | | | lvalue: int | PointerDereference.c:2:3:2:3 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | j | | | lvalue: int | Subscript.c:2:3:2:3 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | v | | | lvalue: int | PointerDereference.c:2:3:2:3 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | v | | | lvalue: int | Subscript.c:2:3:2:3 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: char * | Cast.c:2:3:2:3 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | (...) | | =7 | prvalue: int | Conversion4.c:2:7:2:14 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | (char *)... | pointer conversion | | prvalue: char * | Cast.c:2:7:2:15 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | * ... | | | prvalue(load): int | PointerDereference.c:2:7:2:8 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | ... * ... | | | prvalue: int | Parenthesis.c:2:7:2:17 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | ... + ... | | =12 | prvalue: int | Conversion2.c:2:7:2:21 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | access to array | | | prvalue(load): int | Subscript.c:2:7:2:10 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | & ... | | | prvalue: int * | AddressOf.c:2:12:2:13 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | (int)... | integral conversion | =1 | prvalue: int | Conversion1.c:2:11:2:16 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | (int)... | integral conversion | =4 | prvalue: int | Sizeof.c:2:11:2:21 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | (statement expression) | | | prvalue: int | StatementExpr.c:2:11:2:29 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | hello | | =hello | lvalue: char[6] | ArrayToPointer.c:7:14:7:20 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 1 | 1 | declaration | | | | ArrayToPointer.c:8:3:8:13 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 1 | 1 | return ... | | | | StatementExpr.c:3:1:3:1 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | 1 | | =1 | prvalue: int | Conversion1.c:2:16:2:16 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | (...) | | | prvalue: int | Parenthesis.c:2:7:2:13 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | (int)... | integral conversion | =5 | prvalue: int | Conversion2.c:2:7:2:12 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | (int)... | integral conversion | =7 | prvalue: int | Conversion4.c:2:8:2:13 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | array | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | array | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | array | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | c | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | c | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | c | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | i | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | i | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | i | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | j | | | prvalue(load): void * | Cast.c:2:15:2:15 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | sizeof(int) | | =4 | prvalue: unsigned long | Sizeof.c:2:11:2:21 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | v | | | prvalue(load): void * | Cast.c:2:15:2:15 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | x | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | x | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | x | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | declaration | | | | Sizeof.c:3:3:3:24 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | AddressOf.c:3:1:3:1 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | Cast.c:3:1:3:1 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | Conversion1.c:3:1:3:1 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | PointerDereference.c:3:1:3:1 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 5 | 1 | 5 | | =5 | prvalue: int | Subscript.c:2:9:2:9 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | 5 | | =5 | prvalue: int | Conversion2.c:2:12:2:12 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | 7 | | =7 | prvalue: int | Conversion4.c:2:13:2:13 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | ... + ... | | | prvalue: int | Parenthesis.c:2:8:2:12 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | definition of s | | | S | ArrayToPointer.c:8:12:8:12 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 1 | 1 | return ... | | | | Conversion4.c:3:1:3:1 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 1 | 1 | return ... | | | | Subscript.c:3:1:3:1 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 1 | 2 | ExprStmt | | | | ArrayToPointer.c:9:3:9:13 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 5 | 1 | (int)... | integral conversion | =7 | prvalue: int | Conversion2.c:2:16:2:21 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | array | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | c | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | definition of j | | | int | Sizeof.c:3:7:3:7 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | i | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | x | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 7 | 1 | 1 | | =1 | prvalue: int | Parenthesis.c:2:12:2:12 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 8 | 0 | 7 | | =7 | prvalue: int | Conversion2.c:2:21:2:21 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 8 | 0 | ... = ... | | | prvalue: char * | ArrayToPointer.c:9:3:9:12 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 8 | 0 | initializer for j | | | | Sizeof.c:3:10:3:23 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 1 | 1 | return ... | | | | Conversion2.c:3:1:3:1 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 5 | 1 | 2 | | =2 | prvalue: int | Parenthesis.c:2:17:2:17 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 9 | 0 | (int)... | integral conversion | =8 | prvalue: int | Sizeof.c:3:11:3:23 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 9 | 0 | name | | | lvalue: char * | ArrayToPointer.c:9:5:9:8 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 11 | 1 | 1 | return ... | | | | Parenthesis.c:3:1:3:1 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 11 | 10 | 0 | sizeof() | | =8 | prvalue: unsigned long | Sizeof.c:3:11:3:23 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 11 | 10 | -1 | s | | | lvalue: S | ArrayToPointer.c:9:3:9:3 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 12 | 9 | 1 | array to pointer conversion | | | prvalue: char * | ArrayToPointer.c:9:12:9:12 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 12 | 11 | 0 | (...) | | | lvalue: int * | Sizeof.c:3:18:3:23 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | array | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | c | | | lvalue: char[6] | ArrayToPointer.c:9:12:9:12 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | c | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | i | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | x | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 14 | 1 | 2 | return ... | | | | Sizeof.c:4:1:4:1 |
+| StatementExpr.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 14 | 1 | 3 | return ... | | | | ArrayToPointer.c:10:1:10:1 |
+| StaticMemberAccess.cpp:1:8:1:8 | X::operator=(X &&) -> X & | 0 | -1 | 0 | operator= | | | | StaticMemberAccess.cpp:1:8:1:8 |
+| StaticMemberAccess.cpp:1:8:1:8 | X::operator=(const X &) -> X & | 0 | -1 | 0 | operator= | | | | StaticMemberAccess.cpp:1:8:1:8 |
+| StaticMemberAccess.cpp:5:6:5:6 | v(int, X &) -> void | 0 | -1 | 0 | v | | | | StaticMemberAccess.cpp:5:6:5:6 |
+| StaticMemberAccess.cpp:5:6:5:6 | v(int, X &) -> void | 1 | 0 | 0 | { ... } | | | | StaticMemberAccess.cpp:5:24:9:1 |
+| StaticMemberAccess.cpp:5:6:5:6 | v(int, X &) -> void | 2 | 1 | 0 | ExprStmt | | | | StaticMemberAccess.cpp:7:3:7:13 |
+| StaticMemberAccess.cpp:5:6:5:6 | v(int, X &) -> void | 3 | 2 | 0 | ... = ... | | | lvalue: int | StaticMemberAccess.cpp:7:3:7:12 |
+| StaticMemberAccess.cpp:5:6:5:6 | v(int, X &) -> void | 4 | 3 | 0 | i | | | lvalue: int | StaticMemberAccess.cpp:7:3:7:3 |
+| StaticMemberAccess.cpp:5:6:5:6 | v(int, X &) -> void | 5 | 3 | 1 | i | | | prvalue: int | StaticMemberAccess.cpp:7:12:7:12 |
+| StaticMemberAccess.cpp:5:6:5:6 | v(int, X &) -> void | 6 | 5 | -1 | (reference dereference) | | | lvalue: X | StaticMemberAccess.cpp:7:7:7:10 |
+| StaticMemberAccess.cpp:5:6:5:6 | v(int, X &) -> void | 7 | 6 | 0 | xref | | | prvalue(load): X & | StaticMemberAccess.cpp:7:7:7:10 |
+| StaticMemberAccess.cpp:5:6:5:6 | v(int, X &) -> void | 8 | 1 | 1 | return ... | | | | StaticMemberAccess.cpp:9:1:9:1 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | AddressOf.c:1:6:1:6 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | ArrayToPointer.c:5:6:5:6 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Cast.c:1:6:1:6 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Conversion1.c:1:6:1:6 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Conversion2.c:1:6:1:6 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Conversion4.c:1:6:1:6 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Parenthesis.c:1:6:1:6 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | PointerDereference.c:1:6:1:6 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Sizeof.c:1:6:1:6 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | StatementExpr.c:1:6:1:6 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 0 | -1 | 0 | v | | | | Subscript.c:1:6:1:6 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | AddressOf.c:1:15:3:1 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | ArrayToPointer.c:6:1:10:1 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Cast.c:1:26:3:1 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion1.c:1:10:3:1 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion2.c:1:15:3:1 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Conversion4.c:1:15:3:1 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Parenthesis.c:1:15:3:1 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | PointerDereference.c:1:23:3:1 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Sizeof.c:1:21:4:1 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | StatementExpr.c:1:10:3:1 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 1 | 0 | 0 | { ... } | | | | Subscript.c:1:24:3:1 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Cast.c:2:3:2:16 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Conversion2.c:2:3:2:22 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Conversion4.c:2:3:2:15 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Parenthesis.c:2:3:2:18 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | PointerDereference.c:2:3:2:9 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | ExprStmt | | | | Subscript.c:2:3:2:11 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | AddressOf.c:2:3:2:14 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | ArrayToPointer.c:7:3:7:21 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | Conversion1.c:2:3:2:17 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | Sizeof.c:2:3:2:22 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 2 | 1 | 0 | declaration | | | | StatementExpr.c:2:3:2:30 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: char * | Cast.c:2:3:2:15 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Conversion2.c:2:3:2:21 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Conversion4.c:2:3:2:14 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Parenthesis.c:2:3:2:17 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | PointerDereference.c:2:3:2:8 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | ... = ... | | | prvalue: int | Subscript.c:2:3:2:10 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of c | | | char[] | ArrayToPointer.c:7:8:7:8 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of i | | | int | Conversion1.c:2:7:2:7 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of i | | | int | Sizeof.c:2:7:2:7 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of j | | | int | StatementExpr.c:2:7:2:7 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 3 | 2 | 0 | definition of j | | | int * | AddressOf.c:2:8:2:8 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: char * | Cast.c:2:3:2:3 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | array | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: char * | Cast.c:2:3:2:3 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | c | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: char * | Cast.c:2:3:2:3 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | i | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for c | | | | ArrayToPointer.c:7:14:7:20 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for i | | | | Conversion1.c:2:10:2:16 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for i | | | | Sizeof.c:2:10:2:21 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for j | | | | AddressOf.c:2:11:2:13 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | initializer for j | | | | StatementExpr.c:2:10:2:29 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | j | | | lvalue: int | PointerDereference.c:2:3:2:3 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | j | | | lvalue: int | Subscript.c:2:3:2:3 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | v | | | lvalue: int | PointerDereference.c:2:3:2:3 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | v | | | lvalue: int | Subscript.c:2:3:2:3 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: char * | Cast.c:2:3:2:3 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Conversion2.c:2:3:2:3 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Conversion4.c:2:3:2:3 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 4 | 3 | 0 | x | | | lvalue: int | Parenthesis.c:2:3:2:3 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | (...) | | =7 | prvalue: int | Conversion4.c:2:7:2:14 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | (char *)... | pointer conversion | | prvalue: char * | Cast.c:2:7:2:15 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | * ... | | | prvalue(load): int | PointerDereference.c:2:7:2:8 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | ... * ... | | | prvalue: int | Parenthesis.c:2:7:2:17 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | ... + ... | | =12 | prvalue: int | Conversion2.c:2:7:2:21 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 3 | 1 | access to array | | | prvalue(load): int | Subscript.c:2:7:2:10 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | & ... | | | prvalue: int * | AddressOf.c:2:12:2:13 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | (int)... | integral conversion | =1 | prvalue: int | Conversion1.c:2:11:2:16 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | (int)... | integral conversion | =4 | prvalue: int | Sizeof.c:2:11:2:21 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | (statement expression) | | | prvalue: int | StatementExpr.c:2:11:2:29 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 5 | 4 | 0 | hello | | =hello | lvalue: char[6] | ArrayToPointer.c:7:14:7:20 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 1 | 1 | declaration | | | | ArrayToPointer.c:8:3:8:13 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 1 | 1 | return ... | | | | StatementExpr.c:3:1:3:1 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | 1 | | =1 | prvalue: int | Conversion1.c:2:16:2:16 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | (...) | | | prvalue: int | Parenthesis.c:2:7:2:13 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | (int)... | integral conversion | =5 | prvalue: int | Conversion2.c:2:7:2:12 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | (int)... | integral conversion | =7 | prvalue: int | Conversion4.c:2:8:2:13 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | array | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | array | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | array | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | c | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | c | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | c | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | i | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | i | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | i | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | j | | | prvalue(load): void * | Cast.c:2:15:2:15 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | sizeof(int) | | =4 | prvalue: unsigned long | Sizeof.c:2:11:2:21 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | v | | | prvalue(load): void * | Cast.c:2:15:2:15 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | x | | | lvalue: int | AddressOf.c:2:13:2:13 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | x | | | prvalue(load): int * | PointerDereference.c:2:8:2:8 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 6 | 5 | 0 | x | | | prvalue(load): int * | Subscript.c:2:7:2:7 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | declaration | | | | Sizeof.c:3:3:3:24 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | AddressOf.c:3:1:3:1 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | Cast.c:3:1:3:1 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | Conversion1.c:3:1:3:1 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 1 | 1 | return ... | | | | PointerDereference.c:3:1:3:1 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 5 | 1 | 5 | | =5 | prvalue: int | Subscript.c:2:9:2:9 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | 5 | | =5 | prvalue: int | Conversion2.c:2:12:2:12 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | 7 | | =7 | prvalue: int | Conversion4.c:2:13:2:13 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | ... + ... | | | prvalue: int | Parenthesis.c:2:8:2:12 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 7 | 6 | 0 | definition of s | | | S | ArrayToPointer.c:8:12:8:12 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 1 | 1 | return ... | | | | Conversion4.c:3:1:3:1 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 1 | 1 | return ... | | | | Subscript.c:3:1:3:1 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 1 | 2 | ExprStmt | | | | ArrayToPointer.c:9:3:9:13 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 5 | 1 | (int)... | integral conversion | =7 | prvalue: int | Conversion2.c:2:16:2:21 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | array | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | c | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | definition of j | | | int | Sizeof.c:3:7:3:7 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | i | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 8 | 7 | 0 | x | | | prvalue(load): int | Parenthesis.c:2:8:2:8 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 7 | 1 | 1 | | =1 | prvalue: int | Parenthesis.c:2:12:2:12 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 8 | 0 | 7 | | =7 | prvalue: int | Conversion2.c:2:21:2:21 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 8 | 0 | ... = ... | | | prvalue: char * | ArrayToPointer.c:9:3:9:12 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 9 | 8 | 0 | initializer for j | | | | Sizeof.c:3:10:3:23 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 1 | 1 | return ... | | | | Conversion2.c:3:1:3:1 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 5 | 1 | 2 | | =2 | prvalue: int | Parenthesis.c:2:17:2:17 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 9 | 0 | (int)... | integral conversion | =8 | prvalue: int | Sizeof.c:3:11:3:23 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 10 | 9 | 0 | name | | | lvalue: char * | ArrayToPointer.c:9:5:9:8 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 11 | 1 | 1 | return ... | | | | Parenthesis.c:3:1:3:1 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 11 | 10 | 0 | sizeof() | | =8 | prvalue: unsigned long | Sizeof.c:3:11:3:23 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 11 | 10 | -1 | s | | | lvalue: S | ArrayToPointer.c:9:3:9:3 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 12 | 9 | 1 | array to pointer conversion | | | prvalue: char * | ArrayToPointer.c:9:12:9:12 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 12 | 11 | 0 | (...) | | | lvalue: int * | Sizeof.c:3:18:3:23 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | array | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | c | | | lvalue: char[6] | ArrayToPointer.c:9:12:9:12 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | c | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | i | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 13 | 12 | 0 | x | | | lvalue: int * | Sizeof.c:3:18:3:22 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 14 | 1 | 2 | return ... | | | | Sizeof.c:4:1:4:1 |
+| Subscript.c:1:6:1:6 | v(int[], int *, int, char *, void *, int) -> void | 14 | 1 | 3 | return ... | | | | ArrayToPointer.c:10:1:10:1 |
+| Throw.cpp:1:7:1:7 | E::operator=(E &&) -> E & | 0 | -1 | 0 | operator= | | | | ConstructorCall.cpp:13:7:13:7 |
+| Throw.cpp:1:7:1:7 | E::operator=(E &&) -> E & | 0 | -1 | 0 | operator= | | | | Throw.cpp:1:7:1:7 |
+| Throw.cpp:1:7:1:7 | E::operator=(const E &) -> E & | 0 | -1 | 0 | operator= | | | | ConstructorCall.cpp:13:7:13:7 |
+| Throw.cpp:1:7:1:7 | E::operator=(const E &) -> E & | 0 | -1 | 0 | operator= | | | | Throw.cpp:1:7:1:7 |
+| Throw.cpp:2:7:2:7 | F::F(F &&) -> void | 0 | -1 | 0 | F | | | | Throw.cpp:2:7:2:7 |
+| Throw.cpp:2:7:2:7 | F::F(F &&) -> void | 1 | 0 | 0 | { ... } | | | | Throw.cpp:2:7:2:7 |
+| Throw.cpp:2:7:2:7 | F::F(F &&) -> void | 2 | 1 | 0 | return ... | | | | Throw.cpp:2:7:2:7 |
+| Throw.cpp:2:7:2:7 | F::F(const F &) -> void | 0 | -1 | 0 | F | | | | Throw.cpp:2:7:2:7 |
+| Throw.cpp:2:7:2:7 | F::operator=(F &&) -> F & | 0 | -1 | 0 | operator= | | | | Throw.cpp:2:7:2:7 |
+| Throw.cpp:2:7:2:7 | F::operator=(const F &) -> F & | 0 | -1 | 0 | operator= | | | | Throw.cpp:2:7:2:7 |
+| Throw.cpp:4:3:4:3 | F::F() -> void | 0 | -1 | 0 | F | | | | Throw.cpp:4:3:4:3 |
+| Throw.cpp:4:3:4:3 | F::F() -> void | 1 | 0 | 0 | { ... } | | | | Throw.cpp:4:7:4:9 |
+| Throw.cpp:4:3:4:3 | F::F() -> void | 2 | 1 | 0 | return ... | | | | Throw.cpp:4:9:4:9 |
+| Throw.cpp:6:6:6:6 | f(int) -> void | 0 | -1 | 0 | f | | | | Throw.cpp:6:6:6:6 |
+| Throw.cpp:6:6:6:6 | f(int) -> void | 0 | -1 | 0 | f | | | | VacuousDestructorCall.cpp:7:6:7:6 |
+| Throw.cpp:6:6:6:6 | f(int) -> void | 1 | 0 | 0 | { ... } | | | | Throw.cpp:6:15:16:1 |
+| Throw.cpp:6:6:6:6 | f(int) -> void | 1 | 0 | 0 | { ... } | | | | VacuousDestructorCall.cpp:7:15:11:1 |
+| Throw.cpp:6:6:6:6 | f(int) -> void | 2 | 1 | 0 | ExprStmt | | | | VacuousDestructorCall.cpp:10:3:10:11 |
+| Throw.cpp:6:6:6:6 | f(int) -> void | 2 | 1 | 0 | try { ... } | | | | Throw.cpp:7:3:12:3 |
+| Throw.cpp:6:6:6:6 | f(int) -> void | 3 | 2 | 0 | call to v | | | prvalue: void | VacuousDestructorCall.cpp:10:3:10:3 |
+| Throw.cpp:6:6:6:6 | f(int) -> void | 3 | 2 | 0 | { ... } | | | | Throw.cpp:7:7:12:3 |
+| Throw.cpp:6:6:6:6 | f(int) -> void | 4 | 3 | 0 | i | | | prvalue(load): int | VacuousDestructorCall.cpp:10:5:10:5 |
+| Throw.cpp:6:6:6:6 | f(int) -> void | 4 | 3 | 0 | if (...) ... | | | | Throw.cpp:8:5:11:16 |
+| Throw.cpp:6:6:6:6 | f(int) -> void | 5 | 3 | 1 | & ... | | | prvalue: int * | VacuousDestructorCall.cpp:10:8:10:9 |
+| Throw.cpp:6:6:6:6 | f(int) -> void | 5 | 4 | 0 | (bool)... | conversion to bool | | prvalue: bool | Throw.cpp:8:8:8:8 |
+| Throw.cpp:6:6:6:6 | f(int) -> void | 6 | 5 | 0 | i | | | lvalue: int | VacuousDestructorCall.cpp:10:9:10:9 |
+| Throw.cpp:6:6:6:6 | f(int) -> void | 6 | 5 | 0 | i | | | prvalue(load): int | Throw.cpp:8:8:8:8 |
+| Throw.cpp:6:6:6:6 | f(int) -> void | 7 | 1 | 1 | return ... | | | | VacuousDestructorCall.cpp:11:1:11:1 |
+| Throw.cpp:6:6:6:6 | f(int) -> void | 7 | 4 | 1 | ExprStmt | | | | Throw.cpp:9:7:9:16 |
+| Throw.cpp:6:6:6:6 | f(int) -> void | 8 | 7 | 0 | throw ... | | | prvalue: E | Throw.cpp:9:7:9:15 |
+| Throw.cpp:6:6:6:6 | f(int) -> void | 9 | 8 | 0 | 0 | | =0 | prvalue: E | Throw.cpp:9:7:9:15 |
+| Throw.cpp:6:6:6:6 | f(int) -> void | 10 | 4 | 2 | ExprStmt | | | | Throw.cpp:11:7:11:16 |
+| Throw.cpp:6:6:6:6 | f(int) -> void | 11 | 10 | 0 | throw ... | | | prvalue: F | Throw.cpp:11:7:11:15 |
+| Throw.cpp:6:6:6:6 | f(int) -> void | 12 | 11 | 0 | call to F | | | prvalue: void | Throw.cpp:11:7:11:15 |
+| Throw.cpp:6:6:6:6 | f(int) -> void | 13 | 2 | 1 | | | | | Throw.cpp:12:17:14:3 |
+| Throw.cpp:6:6:6:6 | f(int) -> void | 14 | 13 | 0 | { ... } | | | | Throw.cpp:12:17:14:3 |
+| Throw.cpp:6:6:6:6 | f(int) -> void | 15 | 14 | 0 | ExprStmt | | | | Throw.cpp:13:5:13:10 |
+| Throw.cpp:6:6:6:6 | f(int) -> void | 16 | 15 | 0 | re-throw exception | | | prvalue: void | Throw.cpp:13:5:13:9 |
+| Typeid.cpp:4:9:4:9 | std::type_info::operator=(const type_info &) -> type_info & | 0 | -1 | 0 | operator= | | | | Typeid.cpp:4:9:4:9 |
+| Typeid.cpp:4:9:4:9 | std::type_info::operator=(type_info &&) -> type_info & | 0 | -1 | 0 | operator= | | | | Typeid.cpp:4:9:4:9 |
+| Typeid.cpp:7:17:7:20 | std::type_info::name() -> const char * | 0 | -1 | 0 | name | | | | Typeid.cpp:7:17:7:20 |
+| Typeid.cpp:11:7:11:7 | Base::Base() -> void | 0 | -1 | 0 | Base | | | | DynamicCast.cpp:1:7:1:7 |
+| Typeid.cpp:11:7:11:7 | Base::Base() -> void | 0 | -1 | 0 | Base | | | | Typeid.cpp:11:7:11:7 |
+| Typeid.cpp:11:7:11:7 | Base::Base(Base &&) -> void | 0 | -1 | 0 | Base | | | | DynamicCast.cpp:1:7:1:7 |
+| Typeid.cpp:11:7:11:7 | Base::Base(Base &&) -> void | 0 | -1 | 0 | Base | | | | Typeid.cpp:11:7:11:7 |
+| Typeid.cpp:11:7:11:7 | Base::Base(const Base &) -> void | 0 | -1 | 0 | Base | | | | DynamicCast.cpp:1:7:1:7 |
+| Typeid.cpp:11:7:11:7 | Base::Base(const Base &) -> void | 0 | -1 | 0 | Base | | | | Typeid.cpp:11:7:11:7 |
+| Typeid.cpp:11:7:11:7 | Base::operator=(Base &&) -> Base & | 0 | -1 | 0 | operator= | | | | DynamicCast.cpp:1:7:1:7 |
+| Typeid.cpp:11:7:11:7 | Base::operator=(Base &&) -> Base & | 0 | -1 | 0 | operator= | | | | Typeid.cpp:11:7:11:7 |
+| Typeid.cpp:13:18:13:18 | Base::v() -> void | 0 | -1 | 0 | v | | | | Typeid.cpp:13:18:13:18 |
+| Typeid.cpp:13:18:13:18 | Base::v() -> void | 1 | 0 | 0 | { ... } | | | | Typeid.cpp:13:22:13:24 |
+| Typeid.cpp:13:18:13:18 | Base::v() -> void | 2 | 1 | 0 | return ... | | | | Typeid.cpp:13:24:13:24 |
+| Typeid.cpp:15:7:15:7 | Derived::Derived() -> void | 0 | -1 | 0 | Derived | | | | DynamicCast.cpp:4:7:4:7 |
+| Typeid.cpp:15:7:15:7 | Derived::Derived() -> void | 0 | -1 | 0 | Derived | | | | Typeid.cpp:15:7:15:7 |
+| Typeid.cpp:15:7:15:7 | Derived::Derived(Derived &&) -> void | 0 | -1 | 0 | Derived | | | | DynamicCast.cpp:4:7:4:7 |
+| Typeid.cpp:15:7:15:7 | Derived::Derived(Derived &&) -> void | 0 | -1 | 0 | Derived | | | | Typeid.cpp:15:7:15:7 |
+| Typeid.cpp:15:7:15:7 | Derived::Derived(const Derived &) -> void | 0 | -1 | 0 | Derived | | | | DynamicCast.cpp:4:7:4:7 |
+| Typeid.cpp:15:7:15:7 | Derived::Derived(const Derived &) -> void | 0 | -1 | 0 | Derived | | | | Typeid.cpp:15:7:15:7 |
+| Typeid.cpp:15:7:15:7 | Derived::operator=(Derived &&) -> Derived & | 0 | -1 | 0 | operator= | | | | DynamicCast.cpp:4:7:4:7 |
+| Typeid.cpp:15:7:15:7 | Derived::operator=(Derived &&) -> Derived & | 0 | -1 | 0 | operator= | | | | Typeid.cpp:15:7:15:7 |
+| Typeid.cpp:18:6:18:6 | v(Base *) -> void | 0 | -1 | 0 | v | | | | Typeid.cpp:18:6:18:6 |
+| Typeid.cpp:18:6:18:6 | v(Base *) -> void | 1 | 0 | 0 | { ... } | | | | Typeid.cpp:18:18:20:1 |
+| Typeid.cpp:18:6:18:6 | v(Base *) -> void | 2 | 1 | 0 | declaration | | | | Typeid.cpp:19:3:19:39 |
+| Typeid.cpp:18:6:18:6 | v(Base *) -> void | 3 | 2 | 0 | definition of name | | | const char * | Typeid.cpp:19:15:19:18 |
+| Typeid.cpp:18:6:18:6 | v(Base *) -> void | 4 | 3 | 0 | initializer for name | | | | Typeid.cpp:19:21:19:38 |
+| Typeid.cpp:18:6:18:6 | v(Base *) -> void | 5 | 4 | 0 | call to name | | | prvalue: const char * | Typeid.cpp:19:33:19:36 |
+| Typeid.cpp:18:6:18:6 | v(Base *) -> void | 6 | 5 | -1 | typeid ... | | | lvalue: const type_info | Typeid.cpp:19:22:19:31 |
+| Typeid.cpp:18:6:18:6 | v(Base *) -> void | 7 | 6 | 0 | bp | | | lvalue: Base * | Typeid.cpp:19:29:19:30 |
+| Typeid.cpp:18:6:18:6 | v(Base *) -> void | 8 | 1 | 1 | return ... | | | | Typeid.cpp:20:1:20:1 |
+| VacuousDestructorCall.cpp:2:6:2:6 | v(T, T *) -> void | 0 | -1 | 0 | v | | | | VacuousDestructorCall.cpp:2:6:2:6 |
+| VacuousDestructorCall.cpp:2:6:2:6 | v(T, T *) -> void | 1 | 0 | 0 | { ... } | | | | VacuousDestructorCall.cpp:2:19:5:1 |
+| VacuousDestructorCall.cpp:2:6:2:6 | v(T, T *) -> void | 2 | 1 | 0 | ExprStmt | | | | VacuousDestructorCall.cpp:3:3:3:12 |
+| VacuousDestructorCall.cpp:2:6:2:6 | v(T, T *) -> void | 3 | 2 | 0 | call to expression | | | prvalue: unknown | VacuousDestructorCall.cpp:3:3:3:11 |
+| VacuousDestructorCall.cpp:2:6:2:6 | v(T, T *) -> void | 4 | 3 | 0 | Unknown literal | | | prvalue: unknown | VacuousDestructorCall.cpp:3:8:3:9 |
+| VacuousDestructorCall.cpp:2:6:2:6 | v(T, T *) -> void | 5 | 4 | -1 | x | | | lvalue: T | VacuousDestructorCall.cpp:3:3:3:3 |
+| VacuousDestructorCall.cpp:2:6:2:6 | v(T, T *) -> void | 6 | 1 | 1 | ExprStmt | | | | VacuousDestructorCall.cpp:4:3:4:13 |
+| VacuousDestructorCall.cpp:2:6:2:6 | v(T, T *) -> void | 7 | 6 | 0 | call to expression | | | prvalue: unknown | VacuousDestructorCall.cpp:4:3:4:12 |
+| VacuousDestructorCall.cpp:2:6:2:6 | v(T, T *) -> void | 8 | 7 | 0 | Unknown literal | | | prvalue: unknown | VacuousDestructorCall.cpp:4:9:4:10 |
+| VacuousDestructorCall.cpp:2:6:2:6 | v(T, T *) -> void | 9 | 8 | -1 | y | | | prvalue(load): T * | VacuousDestructorCall.cpp:4:3:4:3 |
+| VacuousDestructorCall.cpp:2:6:2:6 | v(T, T *) -> void | 10 | 1 | 2 | return ... | | | | VacuousDestructorCall.cpp:5:1:5:1 |
+| VacuousDestructorCall.cpp:2:6:2:6 | v(int, int *) -> void | 0 | -1 | 0 | v | | | | VacuousDestructorCall.cpp:2:6:2:6 |
+| VacuousDestructorCall.cpp:2:6:2:6 | v(int, int *) -> void | 1 | 0 | 0 | { ... } | | | | VacuousDestructorCall.cpp:2:19:5:1 |
+| VacuousDestructorCall.cpp:2:6:2:6 | v(int, int *) -> void | 2 | 1 | 0 | ExprStmt | | | | VacuousDestructorCall.cpp:3:3:3:12 |
+| VacuousDestructorCall.cpp:2:6:2:6 | v(int, int *) -> void | 3 | 2 | 0 | (vacuous destructor call) | | | prvalue: void | VacuousDestructorCall.cpp:3:3:3:11 |
+| VacuousDestructorCall.cpp:2:6:2:6 | v(int, int *) -> void | 4 | 3 | 0 | x | | | lvalue: int | VacuousDestructorCall.cpp:3:3:3:3 |
+| VacuousDestructorCall.cpp:2:6:2:6 | v(int, int *) -> void | 5 | 1 | 1 | ExprStmt | | | | VacuousDestructorCall.cpp:4:3:4:13 |
+| VacuousDestructorCall.cpp:2:6:2:6 | v(int, int *) -> void | 6 | 5 | 0 | (vacuous destructor call) | | | prvalue: void | VacuousDestructorCall.cpp:4:3:4:12 |
+| VacuousDestructorCall.cpp:2:6:2:6 | v(int, int *) -> void | 7 | 1 | 2 | return ... | | | | VacuousDestructorCall.cpp:5:1:5:1 |
+| VacuousDestructorCall.cpp:7:6:7:6 | f(int) -> void | 0 | -1 | 0 | f | | | | Throw.cpp:6:6:6:6 |
+| VacuousDestructorCall.cpp:7:6:7:6 | f(int) -> void | 0 | -1 | 0 | f | | | | VacuousDestructorCall.cpp:7:6:7:6 |
+| VacuousDestructorCall.cpp:7:6:7:6 | f(int) -> void | 1 | 0 | 0 | { ... } | | | | Throw.cpp:6:15:16:1 |
+| VacuousDestructorCall.cpp:7:6:7:6 | f(int) -> void | 1 | 0 | 0 | { ... } | | | | VacuousDestructorCall.cpp:7:15:11:1 |
+| VacuousDestructorCall.cpp:7:6:7:6 | f(int) -> void | 2 | 1 | 0 | ExprStmt | | | | VacuousDestructorCall.cpp:10:3:10:11 |
+| VacuousDestructorCall.cpp:7:6:7:6 | f(int) -> void | 2 | 1 | 0 | try { ... } | | | | Throw.cpp:7:3:12:3 |
+| VacuousDestructorCall.cpp:7:6:7:6 | f(int) -> void | 3 | 2 | 0 | call to v | | | prvalue: void | VacuousDestructorCall.cpp:10:3:10:3 |
+| VacuousDestructorCall.cpp:7:6:7:6 | f(int) -> void | 3 | 2 | 0 | { ... } | | | | Throw.cpp:7:7:12:3 |
+| VacuousDestructorCall.cpp:7:6:7:6 | f(int) -> void | 4 | 3 | 0 | i | | | prvalue(load): int | VacuousDestructorCall.cpp:10:5:10:5 |
+| VacuousDestructorCall.cpp:7:6:7:6 | f(int) -> void | 4 | 3 | 0 | if (...) ... | | | | Throw.cpp:8:5:11:16 |
+| VacuousDestructorCall.cpp:7:6:7:6 | f(int) -> void | 5 | 3 | 1 | & ... | | | prvalue: int * | VacuousDestructorCall.cpp:10:8:10:9 |
+| VacuousDestructorCall.cpp:7:6:7:6 | f(int) -> void | 5 | 4 | 0 | (bool)... | conversion to bool | | prvalue: bool | Throw.cpp:8:8:8:8 |
+| VacuousDestructorCall.cpp:7:6:7:6 | f(int) -> void | 6 | 5 | 0 | i | | | lvalue: int | VacuousDestructorCall.cpp:10:9:10:9 |
+| VacuousDestructorCall.cpp:7:6:7:6 | f(int) -> void | 6 | 5 | 0 | i | | | prvalue(load): int | Throw.cpp:8:8:8:8 |
+| VacuousDestructorCall.cpp:7:6:7:6 | f(int) -> void | 7 | 1 | 1 | return ... | | | | VacuousDestructorCall.cpp:11:1:11:1 |
+| VacuousDestructorCall.cpp:7:6:7:6 | f(int) -> void | 7 | 4 | 1 | ExprStmt | | | | Throw.cpp:9:7:9:16 |
+| VacuousDestructorCall.cpp:7:6:7:6 | f(int) -> void | 8 | 7 | 0 | throw ... | | | prvalue: E | Throw.cpp:9:7:9:15 |
+| VacuousDestructorCall.cpp:7:6:7:6 | f(int) -> void | 9 | 8 | 0 | 0 | | =0 | prvalue: E | Throw.cpp:9:7:9:15 |
+| VacuousDestructorCall.cpp:7:6:7:6 | f(int) -> void | 10 | 4 | 2 | ExprStmt | | | | Throw.cpp:11:7:11:16 |
+| VacuousDestructorCall.cpp:7:6:7:6 | f(int) -> void | 11 | 10 | 0 | throw ... | | | prvalue: F | Throw.cpp:11:7:11:15 |
+| VacuousDestructorCall.cpp:7:6:7:6 | f(int) -> void | 12 | 11 | 0 | call to F | | | prvalue: void | Throw.cpp:11:7:11:15 |
+| VacuousDestructorCall.cpp:7:6:7:6 | f(int) -> void | 13 | 2 | 1 | | | | | Throw.cpp:12:17:14:3 |
+| VacuousDestructorCall.cpp:7:6:7:6 | f(int) -> void | 14 | 13 | 0 | { ... } | | | | Throw.cpp:12:17:14:3 |
+| VacuousDestructorCall.cpp:7:6:7:6 | f(int) -> void | 15 | 14 | 0 | ExprStmt | | | | Throw.cpp:13:5:13:10 |
+| VacuousDestructorCall.cpp:7:6:7:6 | f(int) -> void | 16 | 15 | 0 | re-throw exception | | | prvalue: void | Throw.cpp:13:5:13:9 |
+| Varargs.c:8:6:8:11 | output(const char *) -> void | 0 | -1 | 0 | output | | | | Varargs.c:8:6:8:11 |
+| Varargs.c:8:6:8:11 | output(const char *) -> void | 1 | 0 | 0 | { ... } | | | | Varargs.c:8:36:12:1 |
+| Varargs.c:8:6:8:11 | output(const char *) -> void | 2 | 1 | 0 | declaration | | | | Varargs.c:9:3:9:15 |
+| Varargs.c:8:6:8:11 | output(const char *) -> void | 3 | 2 | 0 | definition of args | | | va_list | Varargs.c:9:11:9:14 |
+| Varargs.c:8:6:8:11 | output(const char *) -> void | 4 | 1 | 1 | ExprStmt | | | | Varargs.c:10:3:10:23 |
+| Varargs.c:8:6:8:11 | output(const char *) -> void | 5 | 4 | 0 | __builtin_va_start | | | prvalue: void | Varargs.c:10:3:10:22 |
+| Varargs.c:8:6:8:11 | output(const char *) -> void | 6 | 5 | 0 | array to pointer conversion | | | prvalue: __va_list_tag * | Varargs.c:10:12:10:15 |
+| Varargs.c:8:6:8:11 | output(const char *) -> void | 7 | 6 | 0 | args | | | lvalue: va_list | Varargs.c:10:12:10:15 |
+| Varargs.c:8:6:8:11 | output(const char *) -> void | 8 | 5 | 1 | text | | | lvalue: const char * | Varargs.c:10:18:10:21 |
+| Varargs.c:8:6:8:11 | output(const char *) -> void | 9 | 1 | 2 | ExprStmt | | | | Varargs.c:11:3:11:16 |
+| Varargs.c:8:6:8:11 | output(const char *) -> void | 10 | 9 | 0 | __builtin_va_end | | | prvalue: void | Varargs.c:11:3:11:15 |
+| Varargs.c:8:6:8:11 | output(const char *) -> void | 11 | 10 | 0 | array to pointer conversion | | | prvalue: __va_list_tag * | Varargs.c:11:11:11:14 |
+| Varargs.c:8:6:8:11 | output(const char *) -> void | 12 | 11 | 0 | args | | | lvalue: va_list | Varargs.c:11:11:11:14 |
+| Varargs.c:8:6:8:11 | output(const char *) -> void | 13 | 1 | 3 | return ... | | | | Varargs.c:12:1:12:1 |
diff --git a/cpp/ql/test/examples/expressions/PrintAST.qlref b/cpp/ql/test/examples/expressions/PrintAST.qlref
new file mode 100644
index 000000000000..6fcb30ac7a6e
--- /dev/null
+++ b/cpp/ql/test/examples/expressions/PrintAST.qlref
@@ -0,0 +1 @@
+semmle/code/cpp/PrintAST.ql
\ No newline at end of file
diff --git a/cpp/ql/test/examples/expressions/ReferenceDereference.cpp b/cpp/ql/test/examples/expressions/ReferenceDereference.cpp
new file mode 100644
index 000000000000..347e962c4c2d
--- /dev/null
+++ b/cpp/ql/test/examples/expressions/ReferenceDereference.cpp
@@ -0,0 +1,6 @@
+/*
+ there is an implicit compiler-generated dereference node before the access to the variable 'i'
+*/
+void v(int &i, int j) {
+ j = i;
+}
\ No newline at end of file
diff --git a/cpp/ql/test/examples/expressions/ReferenceTo.cpp b/cpp/ql/test/examples/expressions/ReferenceTo.cpp
new file mode 100644
index 000000000000..83ddffca6ca7
--- /dev/null
+++ b/cpp/ql/test/examples/expressions/ReferenceTo.cpp
@@ -0,0 +1,3 @@
+int& v(int *i) {
+ return *i;
+}
\ No newline at end of file
diff --git a/cpp/ql/test/examples/expressions/Sizeof.c b/cpp/ql/test/examples/expressions/Sizeof.c
new file mode 100644
index 000000000000..0fbccfe618d5
--- /dev/null
+++ b/cpp/ql/test/examples/expressions/Sizeof.c
@@ -0,0 +1,4 @@
+void v(int array[]) {
+ int i = sizeof(int);
+ int j = sizeof(array);
+}
\ No newline at end of file
diff --git a/cpp/ql/test/examples/expressions/StatementExpr.c b/cpp/ql/test/examples/expressions/StatementExpr.c
new file mode 100644
index 000000000000..89910e714ac1
--- /dev/null
+++ b/cpp/ql/test/examples/expressions/StatementExpr.c
@@ -0,0 +1,3 @@
+void v() {
+ int j = ({ int i = 5; i; });
+}
\ No newline at end of file
diff --git a/cpp/ql/test/examples/expressions/StaticMemberAccess.cpp b/cpp/ql/test/examples/expressions/StaticMemberAccess.cpp
new file mode 100644
index 000000000000..b67c02277057
--- /dev/null
+++ b/cpp/ql/test/examples/expressions/StaticMemberAccess.cpp
@@ -0,0 +1,9 @@
+struct X {
+ static int i;
+};
+
+void v(int i, X &xref) {
+// i = X::i;
+ i = xref.i;
+
+}
\ No newline at end of file
diff --git a/cpp/ql/test/examples/expressions/Subscript.c b/cpp/ql/test/examples/expressions/Subscript.c
new file mode 100644
index 000000000000..fc8d48580c10
--- /dev/null
+++ b/cpp/ql/test/examples/expressions/Subscript.c
@@ -0,0 +1,3 @@
+void v(int i[], int j) {
+ j = i[5];
+}
\ No newline at end of file
diff --git a/cpp/ql/test/examples/expressions/Throw.cpp b/cpp/ql/test/examples/expressions/Throw.cpp
new file mode 100644
index 000000000000..85cb7dc65974
--- /dev/null
+++ b/cpp/ql/test/examples/expressions/Throw.cpp
@@ -0,0 +1,16 @@
+class E { };
+class F {
+ public:
+ F() { }
+};
+void f(int i) {
+ try {
+ if(i)
+ throw E();
+ else
+ throw F();
+ } catch(E *e) {
+ throw;
+ }
+
+}
\ No newline at end of file
diff --git a/cpp/ql/test/examples/expressions/Typeid.cpp b/cpp/ql/test/examples/expressions/Typeid.cpp
new file mode 100644
index 000000000000..b517d300373d
--- /dev/null
+++ b/cpp/ql/test/examples/expressions/Typeid.cpp
@@ -0,0 +1,20 @@
+
+namespace std
+{
+ class type_info
+ {
+ public:
+ const char *name() const;
+ };
+}
+
+class Base {
+ public:
+ virtual void v() { }
+};
+class Derived : public Base {
+};
+
+void v(Base *bp) {
+ const char *name = typeid(bp).name();
+}
\ No newline at end of file
diff --git a/cpp/ql/test/examples/expressions/VacuousDestructorCall.cpp b/cpp/ql/test/examples/expressions/VacuousDestructorCall.cpp
new file mode 100644
index 000000000000..6c0260f382d8
--- /dev/null
+++ b/cpp/ql/test/examples/expressions/VacuousDestructorCall.cpp
@@ -0,0 +1,11 @@
+template
+void v(T x, T *y) {
+ x.T::~T();
+ y->T::~T();
+}
+
+void f(int i) {
+ // An int doesn't have a destructor, but we get to call it anyway through a
+ // template.
+ v(i, &i);
+}
diff --git a/cpp/ql/test/examples/expressions/Varargs.c b/cpp/ql/test/examples/expressions/Varargs.c
new file mode 100644
index 000000000000..4a81b8cb5f6b
--- /dev/null
+++ b/cpp/ql/test/examples/expressions/Varargs.c
@@ -0,0 +1,12 @@
+typedef __builtin_va_list __gnuc_va_list;
+#define va_start(v,l) __builtin_va_start(v,l)
+#define va_end(v) __builtin_va_end(v)
+#define va_arg(v,l) __builtin_va_arg(v,l)
+#define va_copy(d,s) __builtin_va_copy(d,s)
+typedef __gnuc_va_list va_list;
+
+void output(const char *text, ...) {
+ va_list args;
+ va_start(args, text);
+ va_end (args);
+}
diff --git a/cpp/ql/test/examples/lgtm-query-examples/README.md b/cpp/ql/test/examples/lgtm-query-examples/README.md
new file mode 100644
index 000000000000..4d5bba173c6d
--- /dev/null
+++ b/cpp/ql/test/examples/lgtm-query-examples/README.md
@@ -0,0 +1,3 @@
+This directory contains the C++ demo queries used on LGTM that are not also
+standard queries. Maintaining this copy should ensure that they continue to
+work.
diff --git a/cpp/ql/test/examples/lgtm-query-examples/assignment_to_parameter.expected b/cpp/ql/test/examples/lgtm-query-examples/assignment_to_parameter.expected
new file mode 100644
index 000000000000..2a862f3fdea9
--- /dev/null
+++ b/cpp/ql/test/examples/lgtm-query-examples/assignment_to_parameter.expected
@@ -0,0 +1 @@
+| test.cpp:10:5:10:17 | ... = ... | Assignment of '0' to parameter '$@' has no effect. | test.cpp:3:42:3:44 | buf | buf |
diff --git a/cpp/ql/test/examples/lgtm-query-examples/assignment_to_parameter.ql b/cpp/ql/test/examples/lgtm-query-examples/assignment_to_parameter.ql
new file mode 100644
index 000000000000..0fea65969487
--- /dev/null
+++ b/cpp/ql/test/examples/lgtm-query-examples/assignment_to_parameter.ql
@@ -0,0 +1,17 @@
+/**
+ * @name Assignment to parameter has no effect
+ * @description An assignment to a parameter that is not subsequently read may
+ * indicate a logic error.
+ * @kind problem
+ * @problem.severity warning
+ */
+
+import cpp
+
+from Parameter p, Assignment assign
+where assign = p.getAnAssignment()
+ and not assign.getASuccessor+() = p.getAnAccess()
+ and not p.getType() instanceof ReferenceType
+select assign, "Assignment of '"+ assign.getRValue() +
+ "' to parameter '$@' has no effect.",
+ p, p.getName()
diff --git a/cpp/ql/test/examples/lgtm-query-examples/equality_test_on_boolean.expected b/cpp/ql/test/examples/lgtm-query-examples/equality_test_on_boolean.expected
new file mode 100644
index 000000000000..f08cbd1fbd0f
--- /dev/null
+++ b/cpp/ql/test/examples/lgtm-query-examples/equality_test_on_boolean.expected
@@ -0,0 +1 @@
+| test.cpp:4:9:4:17 | ... == ... | Expression tested for equality with 'true' |
diff --git a/cpp/ql/test/examples/lgtm-query-examples/equality_test_on_boolean.ql b/cpp/ql/test/examples/lgtm-query-examples/equality_test_on_boolean.ql
new file mode 100644
index 000000000000..083c4bc1c683
--- /dev/null
+++ b/cpp/ql/test/examples/lgtm-query-examples/equality_test_on_boolean.ql
@@ -0,0 +1,15 @@
+/**
+ * @name Equality test on Boolean
+ * @description Testing equality with `true` is redundant
+ * and can make the code harder to read.
+ * @kind problem
+ * @problem.severity warning
+ */
+import cpp
+
+from EqualityOperation eq, Expr trueExpr
+where
+ trueExpr = eq.getAnOperand() and
+ trueExpr.getType() instanceof BoolType and
+ trueExpr.getValue().toInt() = 1
+select eq, "Expression tested for equality with 'true'"
diff --git a/cpp/ql/test/examples/lgtm-query-examples/non_literal_format_string.expected b/cpp/ql/test/examples/lgtm-query-examples/non_literal_format_string.expected
new file mode 100644
index 000000000000..264d14536209
--- /dev/null
+++ b/cpp/ql/test/examples/lgtm-query-examples/non_literal_format_string.expected
@@ -0,0 +1 @@
+| test.cpp:5:9:5:15 | call to sprintf | sprintf called with variable format string. |
diff --git a/cpp/ql/test/examples/lgtm-query-examples/non_literal_format_string.ql b/cpp/ql/test/examples/lgtm-query-examples/non_literal_format_string.ql
new file mode 100644
index 000000000000..9c1eb974d68e
--- /dev/null
+++ b/cpp/ql/test/examples/lgtm-query-examples/non_literal_format_string.ql
@@ -0,0 +1,16 @@
+/**
+ * @name Call to sprintf with non-literal format string
+ * @description Passing a non-constant 'format' string to a printf-like
+ * function can lead to a mismatch between the number of arguments
+ * defined by the 'format' and the number of arguments actually
+ * passed to the function. If the format string ultimately stems
+ * from an untrusted source, this can be used for exploits.
+ * @kind problem
+ * @problem.severity warning
+ */
+import cpp
+
+from FunctionCall fc
+where fc.getTarget().getQualifiedName() = "sprintf"
+and not fc.getArgument(1) instanceof StringLiteral
+select fc, "sprintf called with variable format string."
diff --git a/cpp/ql/test/examples/lgtm-query-examples/test.cpp b/cpp/ql/test/examples/lgtm-query-examples/test.cpp
new file mode 100644
index 000000000000..17731af04d29
--- /dev/null
+++ b/cpp/ql/test/examples/lgtm-query-examples/test.cpp
@@ -0,0 +1,11 @@
+long sprintf(char *buf, const char *format, ...);
+
+void f(bool b, const char *format, char *buf) {
+ if (b == true) { // BAD
+ sprintf(buf, format, 5); // BAD
+ } else if (!b) { // GOOD
+ buf = buf + 1; // GOOD
+ sprintf(buf, "%d", 5); // GOOD
+ }
+ buf = nullptr; // BAD
+}
diff --git a/cpp/ql/test/header-variant-tests/clang-pch/_.c b/cpp/ql/test/header-variant-tests/clang-pch/_.c
new file mode 100644
index 000000000000..6186edd586f7
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/clang-pch/_.c
@@ -0,0 +1,3 @@
+// This file exists to ensure that the output subdirectory exists prior to
+// a.c being indexed, as said directory needs to exist for the PCH file to
+// be created, and will be created by running the extractor.
diff --git a/cpp/ql/test/header-variant-tests/clang-pch/a.c b/cpp/ql/test/header-variant-tests/clang-pch/a.c
new file mode 100644
index 000000000000..9164cdc19a58
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/clang-pch/a.c
@@ -0,0 +1,3 @@
+#include "a.h"
+#define FOUR 4
+// semmle-extractor-options: --clang -emit-pch -o ${testdir}/clang-pch.testproj/a.pch
diff --git a/cpp/ql/test/header-variant-tests/clang-pch/a.h b/cpp/ql/test/header-variant-tests/clang-pch/a.h
new file mode 100644
index 000000000000..f01809a81bd3
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/clang-pch/a.h
@@ -0,0 +1 @@
+#define ONE 1
diff --git a/cpp/ql/test/header-variant-tests/clang-pch/b.c b/cpp/ql/test/header-variant-tests/clang-pch/b.c
new file mode 100644
index 000000000000..76369e11f221
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/clang-pch/b.c
@@ -0,0 +1,7 @@
+#define TWO 2
+#include "b.h"
+
+int main() {
+ return ONE + TWO + THREE + FOUR;
+}
+// semmle-extractor-options: --clang -include-pch ${testdir}/clang-pch.testproj/a.pch -Iextra_dummy_path
diff --git a/cpp/ql/test/header-variant-tests/clang-pch/b.h b/cpp/ql/test/header-variant-tests/clang-pch/b.h
new file mode 100644
index 000000000000..77685b4fb1d1
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/clang-pch/b.h
@@ -0,0 +1 @@
+#define THREE 3
diff --git a/cpp/ql/test/header-variant-tests/clang-pch/c.c b/cpp/ql/test/header-variant-tests/clang-pch/c.c
new file mode 100644
index 000000000000..0a8b97667137
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/clang-pch/c.c
@@ -0,0 +1,4 @@
+int main() {
+ return ONE + FOUR;
+}
+// semmle-extractor-options: --clang -include ${testdir}/clang-pch.testproj/a -Iextra_dummy_path
diff --git a/cpp/ql/test/header-variant-tests/clang-pch/clang-pch.expected b/cpp/ql/test/header-variant-tests/clang-pch/clang-pch.expected
new file mode 100644
index 000000000000..78c63f748e4d
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/clang-pch/clang-pch.expected
@@ -0,0 +1,6 @@
+| b.c:5:3:5:34 | return ... | 10 |
+| c.c:2:3:2:20 | return ... | 5 |
+| e.c:2:3:2:19 | return ... | 17 |
+| i.c:3:3:3:12 | return ... | 30 |
+| i.c:8:3:8:12 | return ... | 31 |
+| i.c:13:3:13:12 | return ... | 32 |
diff --git a/cpp/ql/test/header-variant-tests/clang-pch/clang-pch.ql b/cpp/ql/test/header-variant-tests/clang-pch/clang-pch.ql
new file mode 100644
index 000000000000..143880a2b248
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/clang-pch/clang-pch.ql
@@ -0,0 +1,4 @@
+import cpp
+
+from ReturnStmt rs
+select rs, rs.getExpr().getValue()
diff --git a/cpp/ql/test/header-variant-tests/clang-pch/d.c b/cpp/ql/test/header-variant-tests/clang-pch/d.c
new file mode 100644
index 000000000000..f81af3d1b63c
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/clang-pch/d.c
@@ -0,0 +1,2 @@
+#import "d.h"
+// semmle-extractor-options: --clang -emit-pch -o ${testdir}/clang-pch.testproj/d.pch
diff --git a/cpp/ql/test/header-variant-tests/clang-pch/d.h b/cpp/ql/test/header-variant-tests/clang-pch/d.h
new file mode 100644
index 000000000000..56c76ce4dc13
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/clang-pch/d.h
@@ -0,0 +1 @@
+enum { SEVENTEEN = 17 };
diff --git a/cpp/ql/test/header-variant-tests/clang-pch/e.c b/cpp/ql/test/header-variant-tests/clang-pch/e.c
new file mode 100644
index 000000000000..abdb59002009
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/clang-pch/e.c
@@ -0,0 +1,4 @@
+int main() {
+ return SEVENTEEN;
+}
+// semmle-extractor-options: --clang -include-pch ${testdir}/clang-pch.testproj/d.pch
diff --git a/cpp/ql/test/header-variant-tests/clang-pch/f.c b/cpp/ql/test/header-variant-tests/clang-pch/f.c
new file mode 100644
index 000000000000..cca56931acd5
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/clang-pch/f.c
@@ -0,0 +1,6 @@
+#if 1
+#pragma hdrstop
+extern int x;
+#define SEEN_F
+#endif
+// semmle-extractor-options: --clang -emit-pch -o ${testdir}/clang-pch.testproj/f.pch
diff --git a/cpp/ql/test/header-variant-tests/clang-pch/g.c b/cpp/ql/test/header-variant-tests/clang-pch/g.c
new file mode 100644
index 000000000000..feabf6be4a7c
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/clang-pch/g.c
@@ -0,0 +1,6 @@
+#ifdef SEEN_F
+static int g() {
+ return 20;
+}
+#endif
+// semmle-extractor-options: --clang -include-pch ${testdir}/clang-pch.testproj/f.pch --expect_errors
diff --git a/cpp/ql/test/header-variant-tests/clang-pch/h.c b/cpp/ql/test/header-variant-tests/clang-pch/h.c
new file mode 100644
index 000000000000..7ffc9b6133c1
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/clang-pch/h.c
@@ -0,0 +1,5 @@
+#include "h1.h"
+#pragma hdrstop
+#include "h2.h"
+#define SEEN_H
+// semmle-extractor-options: --clang -emit-pch -o ${testdir}/clang-pch.testproj/h.pch
diff --git a/cpp/ql/test/header-variant-tests/clang-pch/h1.h b/cpp/ql/test/header-variant-tests/clang-pch/h1.h
new file mode 100644
index 000000000000..aab8ad06bafe
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/clang-pch/h1.h
@@ -0,0 +1,3 @@
+
+#define H1
+
diff --git a/cpp/ql/test/header-variant-tests/clang-pch/h2.h b/cpp/ql/test/header-variant-tests/clang-pch/h2.h
new file mode 100644
index 000000000000..a235a9f17f45
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/clang-pch/h2.h
@@ -0,0 +1,3 @@
+
+#define H2
+
diff --git a/cpp/ql/test/header-variant-tests/clang-pch/i.c b/cpp/ql/test/header-variant-tests/clang-pch/i.c
new file mode 100644
index 000000000000..f162aa818d94
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/clang-pch/i.c
@@ -0,0 +1,16 @@
+#ifdef SEEN_H
+static int h() {
+ return 30; // [FALSE POSITIVE] (#pragma hdrstop bug, SEEN_H should not be defined in the precompiled header)
+}
+#endif
+#ifdef H1
+static int h1() {
+ return 31;
+}
+#endif
+#ifdef H2
+static int h2() {
+ return 32; // [FALSE POSITIVE] (#pragma hdrstop bug, H2 should not be defined in the precompiled header)
+}
+#endif
+// semmle-extractor-options: --clang -include-pch ${testdir}/clang-pch.testproj/h.pch
diff --git a/cpp/ql/test/header-variant-tests/deduplication/bar.h b/cpp/ql/test/header-variant-tests/deduplication/bar.h
new file mode 100644
index 000000000000..dc712a5029e7
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/deduplication/bar.h
@@ -0,0 +1,8 @@
+const char* bar()
+{
+#ifndef BAR
+ return "bar";
+#else
+ return "baz";
+#endif
+}
diff --git a/cpp/ql/test/header-variant-tests/deduplication/classes.expected b/cpp/ql/test/header-variant-tests/deduplication/classes.expected
new file mode 100644
index 000000000000..5f909e716631
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/deduplication/classes.expected
@@ -0,0 +1,4 @@
+| file://:0:0:0:0 | __va_list_tag | 1 distinct class(es) called __va_list_tag |
+| main2.cpp:7:7:7:7 | C | 2 distinct class(es) called C |
+| main2.cpp:7:7:7:7 | C | 2 distinct class(es) called C |
+| main2.cpp:15:7:15:7 | D | 1 distinct class(es) called D |
diff --git a/cpp/ql/test/header-variant-tests/deduplication/classes.ql b/cpp/ql/test/header-variant-tests/deduplication/classes.ql
new file mode 100644
index 000000000000..2fe0098c9cf7
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/deduplication/classes.ql
@@ -0,0 +1,5 @@
+import default
+
+from Class c, string n
+where n = count(Class x | x.getName() = c.getName()) + " distinct class(es) called " + c.getName()
+select c, n
diff --git a/cpp/ql/test/header-variant-tests/deduplication/foo.h b/cpp/ql/test/header-variant-tests/deduplication/foo.h
new file mode 100644
index 000000000000..5d74392fb01f
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/deduplication/foo.h
@@ -0,0 +1,10 @@
+const char* foo()
+{
+ return "foo";
+}
+
+#ifdef FOO
+int foo_defined;
+#else
+int foo_not_defined;
+#endif
diff --git a/cpp/ql/test/header-variant-tests/deduplication/functions.expected b/cpp/ql/test/header-variant-tests/deduplication/functions.expected
new file mode 100644
index 000000000000..a5ffe6852907
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/deduplication/functions.expected
@@ -0,0 +1,15 @@
+| bar.h:1:13:1:15 | bar | Function | 2 | |
+| bar.h:1:13:1:15 | bar | MemberFunction | 1 | C |
+| bar.h:1:13:1:15 | bar | MemberFunction | 1 | C |
+| bar.h:1:13:1:15 | bar | MemberFunction | 2 | D |
+| file://:0:0:0:0 | operator= | MemberFunction | 0 | __va_list_tag |
+| file://:0:0:0:0 | operator= | MemberFunction | 0 | __va_list_tag |
+| foo.h:1:13:1:15 | foo | Function | 1 | |
+| foo.h:1:13:1:15 | foo | MemberFunction | 1 | C |
+| foo.h:1:13:1:15 | foo | MemberFunction | 1 | C |
+| main2.cpp:7:7:7:7 | operator= | MemberFunction | 0 | C |
+| main2.cpp:7:7:7:7 | operator= | MemberFunction | 0 | C |
+| main2.cpp:7:7:7:7 | operator= | MemberFunction | 0 | C |
+| main2.cpp:7:7:7:7 | operator= | MemberFunction | 0 | C |
+| main2.cpp:15:7:15:7 | operator= | MemberFunction | 0 | D |
+| main2.cpp:15:7:15:7 | operator= | MemberFunction | 0 | D |
diff --git a/cpp/ql/test/header-variant-tests/deduplication/functions.ql b/cpp/ql/test/header-variant-tests/deduplication/functions.ql
new file mode 100644
index 000000000000..8265e5dfab5c
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/deduplication/functions.ql
@@ -0,0 +1,9 @@
+import cpp
+
+from Function f, string d, string c
+where if f instanceof MemberFunction then (
+ d = "MemberFunction" and c = ((MemberFunction)f).getDeclaringType().getName()
+) else (
+ d = "Function" and c = ""
+)
+select f, d, count(f.getBlock()), c
diff --git a/cpp/ql/test/header-variant-tests/deduplication/main1.cpp b/cpp/ql/test/header-variant-tests/deduplication/main1.cpp
new file mode 100644
index 000000000000..f4f5ac2bb1ec
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/deduplication/main1.cpp
@@ -0,0 +1,3 @@
+#define FOO
+#define BAR
+#include "main2.cpp"
diff --git a/cpp/ql/test/header-variant-tests/deduplication/main2.cpp b/cpp/ql/test/header-variant-tests/deduplication/main2.cpp
new file mode 100644
index 000000000000..1ea7730d3411
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/deduplication/main2.cpp
@@ -0,0 +1,18 @@
+#include "foo.h"
+#include "bar.h"
+
+// This will cause multiple, incompatible definitions of C since the member
+// variable in foo.h has different names depending on whether or not FOO is
+// defined.
+class C
+{
+#include "foo.h"
+#include "bar.h"
+};
+
+// All definitions of D should be merged, since all members have the same name
+// and type.
+class D
+{
+#include "bar.h"
+};
diff --git a/cpp/ql/test/header-variant-tests/deduplication/variables.expected b/cpp/ql/test/header-variant-tests/deduplication/variables.expected
new file mode 100644
index 000000000000..05233432cdbd
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/deduplication/variables.expected
@@ -0,0 +1,14 @@
+| file://:0:0:0:0 | fp_offset | file://:0:0:0:0 | unsigned int | MemberVariable | __va_list_tag |
+| file://:0:0:0:0 | gp_offset | file://:0:0:0:0 | unsigned int | MemberVariable | __va_list_tag |
+| file://:0:0:0:0 | overflow_arg_area | file://:0:0:0:0 | void * | MemberVariable | __va_list_tag |
+| file://:0:0:0:0 | p#0 | file://:0:0:0:0 | C && | Variable | |
+| file://:0:0:0:0 | p#0 | file://:0:0:0:0 | C && | Variable | |
+| file://:0:0:0:0 | p#0 | file://:0:0:0:0 | D && | Variable | |
+| file://:0:0:0:0 | p#0 | file://:0:0:0:0 | const C & | Variable | |
+| file://:0:0:0:0 | p#0 | file://:0:0:0:0 | const C & | Variable | |
+| file://:0:0:0:0 | p#0 | file://:0:0:0:0 | const D & | Variable | |
+| file://:0:0:0:0 | reg_save_area | file://:0:0:0:0 | void * | MemberVariable | __va_list_tag |
+| foo.h:7:5:7:15 | foo_defined | file://:0:0:0:0 | int | MemberVariable | C |
+| foo.h:7:5:7:15 | foo_defined | file://:0:0:0:0 | int | Variable | |
+| foo.h:9:5:9:19 | foo_not_defined | file://:0:0:0:0 | int | MemberVariable | C |
+| foo.h:9:5:9:19 | foo_not_defined | file://:0:0:0:0 | int | Variable | |
diff --git a/cpp/ql/test/header-variant-tests/deduplication/variables.ql b/cpp/ql/test/header-variant-tests/deduplication/variables.ql
new file mode 100644
index 000000000000..1dc60d846156
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/deduplication/variables.ql
@@ -0,0 +1,9 @@
+import cpp
+
+from Variable v, string d, string c
+where if v instanceof MemberVariable then (
+ d = "MemberVariable" and c = ((MemberVariable)v).getDeclaringType().getName()
+) else (
+ d = "Variable" and c = ""
+)
+select v, v.getType(), d, c
diff --git a/cpp/ql/test/header-variant-tests/functions-in-headers/a.h b/cpp/ql/test/header-variant-tests/functions-in-headers/a.h
new file mode 100644
index 000000000000..7d359607cf20
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/functions-in-headers/a.h
@@ -0,0 +1,10 @@
+int complex()
+{
+ auto x = 4;
+ return x * x;
+}
+
+static int simple()
+{
+ return SIMPLE;
+}
diff --git a/cpp/ql/test/header-variant-tests/functions-in-headers/both_variants.expected b/cpp/ql/test/header-variant-tests/functions-in-headers/both_variants.expected
new file mode 100644
index 000000000000..f270a9d622ef
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/functions-in-headers/both_variants.expected
@@ -0,0 +1,2 @@
+| a.h:9:3:9:16 | return ... | a.h:7:12:7:17 | simple | 1 |
+| a.h:9:3:9:16 | return ... | a.h:7:12:7:17 | simple | 2 |
diff --git a/cpp/ql/test/header-variant-tests/functions-in-headers/both_variants.ql b/cpp/ql/test/header-variant-tests/functions-in-headers/both_variants.ql
new file mode 100644
index 000000000000..4887df40e8db
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/functions-in-headers/both_variants.ql
@@ -0,0 +1,4 @@
+import cpp
+
+from ReturnStmt r
+select r, r.getEnclosingFunction(), r.getExpr().getValue()
diff --git a/cpp/ql/test/header-variant-tests/functions-in-headers/one.cpp b/cpp/ql/test/header-variant-tests/functions-in-headers/one.cpp
new file mode 100644
index 000000000000..e1907a0e097d
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/functions-in-headers/one.cpp
@@ -0,0 +1,4 @@
+#define SIMPLE 1
+#include "a.h"
+
+int one() { return simple(); }
\ No newline at end of file
diff --git a/cpp/ql/test/header-variant-tests/functions-in-headers/one_x.expected b/cpp/ql/test/header-variant-tests/functions-in-headers/one_x.expected
new file mode 100644
index 000000000000..990c69a3946d
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/functions-in-headers/one_x.expected
@@ -0,0 +1,5 @@
+| a.h:3:8:3:8 | x | x | true |
+| file://:0:0:0:0 | fp_offset | fp_offset | false |
+| file://:0:0:0:0 | gp_offset | gp_offset | false |
+| file://:0:0:0:0 | overflow_arg_area | overflow_arg_area | false |
+| file://:0:0:0:0 | reg_save_area | reg_save_area | false |
diff --git a/cpp/ql/test/header-variant-tests/functions-in-headers/one_x.ql b/cpp/ql/test/header-variant-tests/functions-in-headers/one_x.ql
new file mode 100644
index 000000000000..c48216313642
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/functions-in-headers/one_x.ql
@@ -0,0 +1,5 @@
+import cpp
+
+from Variable x, boolean auto
+where if x.declaredUsingAutoType() then auto = true else auto = false
+select x, x.getName(), auto
diff --git a/cpp/ql/test/header-variant-tests/functions-in-headers/two.cpp b/cpp/ql/test/header-variant-tests/functions-in-headers/two.cpp
new file mode 100644
index 000000000000..3e9a5131c5d1
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/functions-in-headers/two.cpp
@@ -0,0 +1,4 @@
+#define SIMPLE 2
+#include "a.h"
+
+int two() { return simple(); }
\ No newline at end of file
diff --git a/cpp/ql/test/header-variant-tests/headermaps/1.h b/cpp/ql/test/header-variant-tests/headermaps/1.h
new file mode 100644
index 000000000000..5aa756c6f219
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/headermaps/1.h
@@ -0,0 +1 @@
+static int one = __COUNTER__;
diff --git a/cpp/ql/test/header-variant-tests/headermaps/2.h b/cpp/ql/test/header-variant-tests/headermaps/2.h
new file mode 100644
index 000000000000..80c0489bafe4
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/headermaps/2.h
@@ -0,0 +1 @@
+static int two = __COUNTER__;
\ No newline at end of file
diff --git a/cpp/ql/test/header-variant-tests/headermaps/3.h b/cpp/ql/test/header-variant-tests/headermaps/3.h
new file mode 100644
index 000000000000..21c3bb1e48e6
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/headermaps/3.h
@@ -0,0 +1 @@
+static int three = __COUNTER__;
\ No newline at end of file
diff --git a/cpp/ql/test/header-variant-tests/headermaps/4.h b/cpp/ql/test/header-variant-tests/headermaps/4.h
new file mode 100644
index 000000000000..bbe3dc057051
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/headermaps/4.h
@@ -0,0 +1 @@
+static int four = __COUNTER__;
diff --git a/cpp/ql/test/header-variant-tests/headermaps/5.h b/cpp/ql/test/header-variant-tests/headermaps/5.h
new file mode 100644
index 000000000000..c621c57ab285
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/headermaps/5.h
@@ -0,0 +1 @@
+static int five = __COUNTER__;
diff --git a/cpp/ql/test/header-variant-tests/headermaps/6.h b/cpp/ql/test/header-variant-tests/headermaps/6.h
new file mode 100644
index 000000000000..858b0eb9a537
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/headermaps/6.h
@@ -0,0 +1 @@
+static int six = __COUNTER__;
diff --git a/cpp/ql/test/header-variant-tests/headermaps/7.h b/cpp/ql/test/header-variant-tests/headermaps/7.h
new file mode 100644
index 000000000000..7cc3a5329d53
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/headermaps/7.h
@@ -0,0 +1 @@
+static int seven = __COUNTER__;
diff --git a/cpp/ql/test/header-variant-tests/headermaps/8.h b/cpp/ql/test/header-variant-tests/headermaps/8.h
new file mode 100644
index 000000000000..7e8614b22f17
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/headermaps/8.h
@@ -0,0 +1 @@
+static int eight = __COUNTER__;
diff --git a/cpp/ql/test/header-variant-tests/headermaps/big_langtests.hmap b/cpp/ql/test/header-variant-tests/headermaps/big_langtests.hmap
new file mode 100644
index 000000000000..b0bf0dc0d68b
Binary files /dev/null and b/cpp/ql/test/header-variant-tests/headermaps/big_langtests.hmap differ
diff --git a/cpp/ql/test/header-variant-tests/headermaps/big_qltest.hmap b/cpp/ql/test/header-variant-tests/headermaps/big_qltest.hmap
new file mode 100644
index 000000000000..d8c8271b8b1a
Binary files /dev/null and b/cpp/ql/test/header-variant-tests/headermaps/big_qltest.hmap differ
diff --git a/cpp/ql/test/header-variant-tests/headermaps/headermaps.c b/cpp/ql/test/header-variant-tests/headermaps/headermaps.c
new file mode 100644
index 000000000000..9d340da7042d
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/headermaps/headermaps.c
@@ -0,0 +1,15 @@
+static int zero = __COUNTER__;
+
+// these map to 1.h through 4.h via little.hmap
+#include "a.h"
+#include "b.h"
+#include "C.H"
+#include "D.H"
+
+// these map to 5.h through 8.h via big.hmap
+#include "e.h"
+#include "f.h"
+#include "G.H"
+#include "H.H"
+
+// semmle-extractor-options: -I${testdir}/little_qltest.hmap -I${testdir}/big_qltest.hmap
diff --git a/cpp/ql/test/header-variant-tests/headermaps/headermaps.expected b/cpp/ql/test/header-variant-tests/headermaps/headermaps.expected
new file mode 100644
index 000000000000..3f0afe13eb05
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/headermaps/headermaps.expected
@@ -0,0 +1,9 @@
+| 1.h:1:12:1:14 | one | 1 |
+| 2.h:1:12:1:14 | two | 2 |
+| 3.h:1:12:1:16 | three | 3 |
+| 4.h:1:12:1:15 | four | 4 |
+| 5.h:1:12:1:15 | five | 5 |
+| 6.h:1:12:1:14 | six | 6 |
+| 7.h:1:12:1:16 | seven | 7 |
+| 8.h:1:12:1:16 | eight | 8 |
+| headermaps.c:1:12:1:15 | zero | 0 |
diff --git a/cpp/ql/test/header-variant-tests/headermaps/headermaps.ql b/cpp/ql/test/header-variant-tests/headermaps/headermaps.ql
new file mode 100644
index 000000000000..19157bc9ff2d
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/headermaps/headermaps.ql
@@ -0,0 +1,4 @@
+import cpp
+
+from Variable v
+select v, v.getInitializer().getExpr().getValue()
diff --git a/cpp/ql/test/header-variant-tests/headermaps/little_langtests.hmap b/cpp/ql/test/header-variant-tests/headermaps/little_langtests.hmap
new file mode 100644
index 000000000000..56ed71108e5d
Binary files /dev/null and b/cpp/ql/test/header-variant-tests/headermaps/little_langtests.hmap differ
diff --git a/cpp/ql/test/header-variant-tests/headermaps/little_qltest.hmap b/cpp/ql/test/header-variant-tests/headermaps/little_qltest.hmap
new file mode 100644
index 000000000000..5b259d62e12b
Binary files /dev/null and b/cpp/ql/test/header-variant-tests/headermaps/little_qltest.hmap differ
diff --git a/cpp/ql/test/header-variant-tests/headermaps/make_maps.lua b/cpp/ql/test/header-variant-tests/headermaps/make_maps.lua
new file mode 100644
index 000000000000..abaf7a1169f9
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/headermaps/make_maps.lua
@@ -0,0 +1,90 @@
+-- This file generates the header map files used by this test.
+-- (it is provided in case the maps need to be changed)
+
+local function hash(str)
+ local n = 0
+ for c in str:lower():gmatch"." do
+ n = n + c:byte()*13
+ end
+ return n
+end
+
+local function write_map(filename, endian, mapping)
+ local num_entries = 0
+ local max_value_length = 0
+ for k, v in pairs(mapping) do
+ num_entries = num_entries + 1
+ max_value_length = math.max(max_value_length, #v)
+ end
+ local num_buckets = 2^math.ceil(math.log(num_entries + 1)/math.log(2))
+ local f = io.open(filename, "wb")
+ local function write_uint32(val)
+ local b0 = (val % 256); val = (val - b0) / 256
+ local b1 = (val % 256); val = (val - b1) / 256
+ local b2 = (val % 256); val = (val - b2) / 256
+ local b3 = (val % 256);
+ if endian == "little" then
+ f:write(string.char(b0, b1, b2, b3))
+ elseif endian == "big" then
+ f:write(string.char(b3, b2, b1, b0))
+ else
+ error(("Expected endian of %q or %q, got %q"):format("little", "big", endian))
+ end
+ end
+ if endian == "little" then
+ f:write("pamh\1\0")
+ else
+ f:write("hmap\0\1")
+ end
+ f:write("\0\0")
+ write_uint32(6*4 + num_buckets*12)
+ write_uint32(num_entries)
+ write_uint32(num_buckets)
+ write_uint32(max_value_length)
+
+ local string_pieces = {"\0"}
+ local string_piece_length = 1
+ local encode = setmetatable({}, {__index = function(cache, str)
+ local result = string_piece_length
+ cache[str] = result
+ str = str .."\0"
+ string_pieces[#string_pieces + 1] = str
+ string_piece_length = string_piece_length + #str
+ return result
+ end})
+ local buckets = {}
+ for k, v in pairs(mapping) do
+ local i = hash(k) % num_buckets
+ while buckets[i] do
+ i = (i + 1) % num_buckets
+ end
+ local v1, v2 = v:match"(.*/)([^/]*)$"
+ buckets[i] = {encode[k], encode[v1], encode[v2]}
+ end
+
+ for i = 0, num_buckets-1 do
+ for _, v in ipairs(buckets[i] or {0, 0, 0}) do
+ write_uint32(v)
+ end
+ end
+ f:write(table.unpack(string_pieces))
+
+ f:close()
+end
+
+-- for langtests:
+--local root = "semmlecode-cpp-tests/header-variant-tests/headermaps/"
+-- for qltest:
+local root = "./"
+write_map("little.hmap", "little", {
+ ["a.h"] = root .."1.h",
+ ["B.h"] = root .."2.h",
+ ["c.H"] = root .."3.h",
+ ["D.H"] = root .."4.h",
+})
+write_map("big.hmap", "big", {
+ ["e.h"] = root .."5.h",
+ ["F.h"] = root .."6.h",
+ ["g.H"] = root .."7.h",
+ ["H.H"] = root .."8.h",
+})
diff --git a/cpp/ql/test/header-variant-tests/iquote/dir1/a.h b/cpp/ql/test/header-variant-tests/iquote/dir1/a.h
new file mode 100644
index 000000000000..a14c8e050e97
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/iquote/dir1/a.h
@@ -0,0 +1 @@
+static int dir1_a = __COUNTER__;
diff --git a/cpp/ql/test/header-variant-tests/iquote/dir1/b.h b/cpp/ql/test/header-variant-tests/iquote/dir1/b.h
new file mode 100644
index 000000000000..5056fdd94842
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/iquote/dir1/b.h
@@ -0,0 +1 @@
+static int dir1_b = __COUNTER__;
diff --git a/cpp/ql/test/header-variant-tests/iquote/dir2/a.h b/cpp/ql/test/header-variant-tests/iquote/dir2/a.h
new file mode 100644
index 000000000000..5c6391b7e0c1
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/iquote/dir2/a.h
@@ -0,0 +1 @@
+static int dir2_a = __COUNTER__;
diff --git a/cpp/ql/test/header-variant-tests/iquote/iquote.c b/cpp/ql/test/header-variant-tests/iquote/iquote.c
new file mode 100644
index 000000000000..a2b6e279a54b
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/iquote/iquote.c
@@ -0,0 +1,6 @@
+#include "a.h"
+#include
+#include "b.h"
+static int has_angle_b = __has_include();
+
+// semmle-extractor-options: -I${testdir}/dir2 -iquote ${testdir}/dir1 --edg --clang
diff --git a/cpp/ql/test/header-variant-tests/iquote/iquote.expected b/cpp/ql/test/header-variant-tests/iquote/iquote.expected
new file mode 100644
index 000000000000..a12c6197c476
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/iquote/iquote.expected
@@ -0,0 +1,4 @@
+| dir1/a.h:1:12:1:17 | dir1_a | 0 |
+| dir1/b.h:1:12:1:17 | dir1_b | 2 |
+| dir2/a.h:1:12:1:17 | dir2_a | 1 |
+| iquote.c:4:12:4:22 | has_angle_b | 0 |
diff --git a/cpp/ql/test/header-variant-tests/iquote/iquote.ql b/cpp/ql/test/header-variant-tests/iquote/iquote.ql
new file mode 100644
index 000000000000..19157bc9ff2d
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/iquote/iquote.ql
@@ -0,0 +1,4 @@
+import cpp
+
+from Variable v
+select v, v.getInitializer().getExpr().getValue()
diff --git a/cpp/ql/test/header-variant-tests/isysroot/isysroot.c b/cpp/ql/test/header-variant-tests/isysroot/isysroot.c
new file mode 100644
index 000000000000..727f4bc0f603
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/isysroot/isysroot.c
@@ -0,0 +1,3 @@
+#include "a.h"
+#include "b.h"
+// semmle-extractor-options: -I${testdir}/other -I/usr/include -isysroot ${testdir}
diff --git a/cpp/ql/test/header-variant-tests/isysroot/isysroot.expected b/cpp/ql/test/header-variant-tests/isysroot/isysroot.expected
new file mode 100644
index 000000000000..feee7901e690
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/isysroot/isysroot.expected
@@ -0,0 +1,2 @@
+| other/b.h:0:0:0:0 | other/b.h |
+| usr/include/a.h:0:0:0:0 | usr/include/a.h |
diff --git a/cpp/ql/test/header-variant-tests/isysroot/isysroot.ql b/cpp/ql/test/header-variant-tests/isysroot/isysroot.ql
new file mode 100644
index 000000000000..e5dfbd00e37e
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/isysroot/isysroot.ql
@@ -0,0 +1,4 @@
+import cpp
+
+from HeaderFile hf
+select hf
diff --git a/cpp/ql/test/header-variant-tests/isysroot/other/b.h b/cpp/ql/test/header-variant-tests/isysroot/other/b.h
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/cpp/ql/test/header-variant-tests/isysroot/usr/include/a.h b/cpp/ql/test/header-variant-tests/isysroot/usr/include/a.h
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/cpp/ql/test/header-variant-tests/line-directives-in-functions/main.c b/cpp/ql/test/header-variant-tests/line-directives-in-functions/main.c
new file mode 100644
index 000000000000..551f76e2a7bd
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/line-directives-in-functions/main.c
@@ -0,0 +1,4 @@
+int main() {
+#line 152 "TokenLookup.gperf"
+ return 0;
+}
diff --git a/cpp/ql/test/header-variant-tests/line-directives-in-functions/main.expected b/cpp/ql/test/header-variant-tests/line-directives-in-functions/main.expected
new file mode 100644
index 000000000000..b5e11c3cb8a1
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/line-directives-in-functions/main.expected
@@ -0,0 +1 @@
+| main.c:3:3:3:11 | return ... |
diff --git a/cpp/ql/test/header-variant-tests/line-directives-in-functions/main.ql b/cpp/ql/test/header-variant-tests/line-directives-in-functions/main.ql
new file mode 100644
index 000000000000..75b5c5ad279c
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/line-directives-in-functions/main.ql
@@ -0,0 +1,4 @@
+import cpp
+
+from ReturnStmt rs
+select rs
diff --git a/cpp/ql/test/header-variant-tests/microsoft-pch/_.c b/cpp/ql/test/header-variant-tests/microsoft-pch/_.c
new file mode 100644
index 000000000000..6186edd586f7
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/microsoft-pch/_.c
@@ -0,0 +1,3 @@
+// This file exists to ensure that the output subdirectory exists prior to
+// a.c being indexed, as said directory needs to exist for the PCH file to
+// be created, and will be created by running the extractor.
diff --git a/cpp/ql/test/header-variant-tests/microsoft-pch/a.c b/cpp/ql/test/header-variant-tests/microsoft-pch/a.c
new file mode 100644
index 000000000000..ba41bafcaade
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/microsoft-pch/a.c
@@ -0,0 +1,2 @@
+#include "a.h"
+// semmle-extractor-options: --microsoft /Yca.h /Fp${testdir}/microsoft-pch.testproj/a.pch
diff --git a/cpp/ql/test/header-variant-tests/microsoft-pch/a.h b/cpp/ql/test/header-variant-tests/microsoft-pch/a.h
new file mode 100644
index 000000000000..ab2a05dbbf84
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/microsoft-pch/a.h
@@ -0,0 +1 @@
+#define A 1
diff --git a/cpp/ql/test/header-variant-tests/microsoft-pch/b.c b/cpp/ql/test/header-variant-tests/microsoft-pch/b.c
new file mode 100644
index 000000000000..b6ea5085fd1f
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/microsoft-pch/b.c
@@ -0,0 +1,7 @@
+#pragma hdrstop
+#include "b.h"
+
+int b() {
+ return A;
+}
+// semmle-extractor-options: --microsoft /Yub.h /Fp${testdir}/microsoft-pch.testproj/a.pch
diff --git a/cpp/ql/test/header-variant-tests/microsoft-pch/c.c b/cpp/ql/test/header-variant-tests/microsoft-pch/c.c
new file mode 100644
index 000000000000..aaddbae8688d
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/microsoft-pch/c.c
@@ -0,0 +1,7 @@
+#include "d.h"
+#include "c.h"
+
+int c() {
+ return A;
+}
+// semmle-extractor-options: --microsoft /Yuc.h /Fp${testdir}/microsoft-pch.testproj/a.pch
diff --git a/cpp/ql/test/header-variant-tests/microsoft-pch/microsoft-pch.expected b/cpp/ql/test/header-variant-tests/microsoft-pch/microsoft-pch.expected
new file mode 100644
index 000000000000..0e61937f0a0f
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/microsoft-pch/microsoft-pch.expected
@@ -0,0 +1,2 @@
+| b | 1 |
+| c | 1 |
diff --git a/cpp/ql/test/header-variant-tests/microsoft-pch/microsoft-pch.ql b/cpp/ql/test/header-variant-tests/microsoft-pch/microsoft-pch.ql
new file mode 100644
index 000000000000..d29ab57cf7ba
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/microsoft-pch/microsoft-pch.ql
@@ -0,0 +1,4 @@
+import cpp
+
+from ReturnStmt rs
+select rs.getEnclosingFunction().getName(), ((Literal)rs.getExpr()).getValue()
diff --git a/cpp/ql/test/header-variant-tests/multi-target-includes/arrays.expected b/cpp/ql/test/header-variant-tests/multi-target-includes/arrays.expected
new file mode 100644
index 000000000000..a206a2be3dbb
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/multi-target-includes/arrays.expected
@@ -0,0 +1 @@
+| common.h:5:12:5:18 | myArray | int[1] |
diff --git a/cpp/ql/test/header-variant-tests/multi-target-includes/arrays.ql b/cpp/ql/test/header-variant-tests/multi-target-includes/arrays.ql
new file mode 100644
index 000000000000..b70e83993ad5
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/multi-target-includes/arrays.ql
@@ -0,0 +1,5 @@
+import cpp
+
+from Variable v, ArrayType t
+where v.getType() = t
+select v, t.toString()
\ No newline at end of file
diff --git a/cpp/ql/test/header-variant-tests/multi-target-includes/common.h b/cpp/ql/test/header-variant-tests/multi-target-includes/common.h
new file mode 100644
index 000000000000..8c20e36220b3
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/multi-target-includes/common.h
@@ -0,0 +1,5 @@
+// common.h
+
+#include "nameclash.h"
+
+static int myArray[sizeof(MYTYPE)];
\ No newline at end of file
diff --git a/cpp/ql/test/header-variant-tests/multi-target-includes/define1.h b/cpp/ql/test/header-variant-tests/multi-target-includes/define1.h
new file mode 100644
index 000000000000..85d137900cef
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/multi-target-includes/define1.h
@@ -0,0 +1,4 @@
+// define1.h
+
+#if 1
+#endif
\ No newline at end of file
diff --git a/cpp/ql/test/header-variant-tests/multi-target-includes/define2.h b/cpp/ql/test/header-variant-tests/multi-target-includes/define2.h
new file mode 100644
index 000000000000..58d077e9275f
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/multi-target-includes/define2.h
@@ -0,0 +1,4 @@
+// define2.h
+
+#if 1
+#endif
\ No newline at end of file
diff --git a/cpp/ql/test/header-variant-tests/multi-target-includes/defines_issue.h b/cpp/ql/test/header-variant-tests/multi-target-includes/defines_issue.h
new file mode 100644
index 000000000000..f80f739121e9
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/multi-target-includes/defines_issue.h
@@ -0,0 +1,3 @@
+// defines_issue.h
+
+#include DEFINED_HEADER
\ No newline at end of file
diff --git a/cpp/ql/test/header-variant-tests/multi-target-includes/includes.expected b/cpp/ql/test/header-variant-tests/multi-target-includes/includes.expected
new file mode 100644
index 000000000000..209af4b8ec49
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/multi-target-includes/includes.expected
@@ -0,0 +1,10 @@
+| common.h:3:1:3:22 | #include "nameclash.h" | Include | nameclash.h | 1 |
+| defines_issue.h:3:1:3:23 | #include DEFINED_HEADER | Include | define1.h | 1 |
+| defines_issue.h:3:1:3:23 | #include DEFINED_HEADER | Include | define2.h | 1 |
+| main1.cpp:3:1:3:19 | #include "common.h" | Include | common.h | 1 |
+| main1.cpp:7:1:7:26 | #include "defines_issue.h" | Include | defines_issue.h | 1 |
+| main2.cpp:3:1:3:19 | #include "common.h" | Include | common.h | 1 |
+| main2.cpp:7:1:7:26 | #include "defines_issue.h" | Include | defines_issue.h | 1 |
+| nameclash.h:3:1:3:27 | #include_next "nameclash.h" | IncludeNext | nameclash.h | 1 |
+| nameclash.h:3:1:3:27 | #include_next "nameclash.h" | IncludeNext | subdir1/nameclash.h | 1 |
+| nameclash.h:3:1:3:27 | #include_next "nameclash.h" | IncludeNext | subdir2/nameclash.h | 1 |
diff --git a/cpp/ql/test/header-variant-tests/multi-target-includes/includes.ql b/cpp/ql/test/header-variant-tests/multi-target-includes/includes.ql
new file mode 100644
index 000000000000..ada7782f8748
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/multi-target-includes/includes.ql
@@ -0,0 +1,5 @@
+import cpp
+
+from Include i, string d
+where if i instanceof IncludeNext then d = "IncludeNext" else d = "Include"
+select i, d, i.getIncludedFile().getAbsolutePath(), count(i.getIncludedFile())
diff --git a/cpp/ql/test/header-variant-tests/multi-target-includes/main1.cpp b/cpp/ql/test/header-variant-tests/multi-target-includes/main1.cpp
new file mode 100644
index 000000000000..5dcd1483cc0a
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/multi-target-includes/main1.cpp
@@ -0,0 +1,7 @@
+// semmle-extractor-options: -I${testdir}/subdir1
+// main1.cpp
+#include "common.h"
+
+#define DEFINED_HEADER "define1.h"
+
+#include "defines_issue.h"
diff --git a/cpp/ql/test/header-variant-tests/multi-target-includes/main2.cpp b/cpp/ql/test/header-variant-tests/multi-target-includes/main2.cpp
new file mode 100644
index 000000000000..49ec6536942e
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/multi-target-includes/main2.cpp
@@ -0,0 +1,7 @@
+// semmle-extractor-options: -I${testdir}/subdir2
+// main2.cpp
+#include "common.h"
+
+#define DEFINED_HEADER "define2.h"
+
+#include "defines_issue.h"
diff --git a/cpp/ql/test/header-variant-tests/multi-target-includes/nameclash.h b/cpp/ql/test/header-variant-tests/multi-target-includes/nameclash.h
new file mode 100644
index 000000000000..9ab85dc2b12e
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/multi-target-includes/nameclash.h
@@ -0,0 +1,3 @@
+// nameclash.h
+
+#include_next "nameclash.h"
\ No newline at end of file
diff --git a/cpp/ql/test/header-variant-tests/multi-target-includes/subdir1/nameclash.h b/cpp/ql/test/header-variant-tests/multi-target-includes/subdir1/nameclash.h
new file mode 100644
index 000000000000..d0361b16bdd9
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/multi-target-includes/subdir1/nameclash.h
@@ -0,0 +1,3 @@
+// subdir1/nameclash.h
+
+typedef long long int MYTYPE;
\ No newline at end of file
diff --git a/cpp/ql/test/header-variant-tests/multi-target-includes/subdir2/nameclash.h b/cpp/ql/test/header-variant-tests/multi-target-includes/subdir2/nameclash.h
new file mode 100644
index 000000000000..469a0c9b3039
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/multi-target-includes/subdir2/nameclash.h
@@ -0,0 +1,3 @@
+// subdir2/nameclash.h
+
+typedef char MYTYPE;
\ No newline at end of file
diff --git a/cpp/ql/test/header-variant-tests/type_variants/common.h b/cpp/ql/test/header-variant-tests/type_variants/common.h
new file mode 100644
index 000000000000..8b7c9fd90027
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/type_variants/common.h
@@ -0,0 +1,11 @@
+int printf(...);
+
+void print_int(int x) {
+ printf("%d\n", x);
+}
+
+void common_function() {
+ for(IteratorT itr = first(); itr != last(); ++itr) {
+ print_int(*itr);
+ }
+}
diff --git a/cpp/ql/test/header-variant-tests/type_variants/debug.cpp b/cpp/ql/test/header-variant-tests/type_variants/debug.cpp
new file mode 100644
index 000000000000..9a23aa1db0cb
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/type_variants/debug.cpp
@@ -0,0 +1,21 @@
+struct IteratorT {
+ IteratorT(int value) : m_value(value) {}
+
+ int operator*() const { return m_value; }
+ IteratorT& operator++() { ++m_value; return *this; }
+
+private:
+ int m_value;
+};
+
+bool operator!=(const IteratorT& lhs, const IteratorT& rhs) { return *lhs != *rhs; }
+
+IteratorT first() {
+ return IteratorT(0);
+}
+
+IteratorT last() {
+ return IteratorT(10);
+}
+
+#include "common.h"
diff --git a/cpp/ql/test/header-variant-tests/type_variants/release.cpp b/cpp/ql/test/header-variant-tests/type_variants/release.cpp
new file mode 100644
index 000000000000..3e449b6f6912
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/type_variants/release.cpp
@@ -0,0 +1,15 @@
+typedef int* IteratorT;
+
+static int g_values[] = {
+ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9
+};
+
+IteratorT first() {
+ return g_values;
+}
+
+IteratorT last() {
+ return g_values + (sizeof(g_values) / sizeof(*g_values));
+}
+
+#include "common.h"
diff --git a/cpp/ql/test/header-variant-tests/type_variants/variants.expected b/cpp/ql/test/header-variant-tests/type_variants/variants.expected
new file mode 100644
index 000000000000..e608a4d10b1f
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/type_variants/variants.expected
@@ -0,0 +1,8 @@
+| IteratorT | 1 |
+| common_function | 2 |
+| first | 2 |
+| last | 2 |
+| operator!= | 1 |
+| operator* | 1 |
+| operator++ | 1 |
+| print_int | 1 |
diff --git a/cpp/ql/test/header-variant-tests/type_variants/variants.ql b/cpp/ql/test/header-variant-tests/type_variants/variants.ql
new file mode 100644
index 000000000000..23a5f30d2ed1
--- /dev/null
+++ b/cpp/ql/test/header-variant-tests/type_variants/variants.ql
@@ -0,0 +1,4 @@
+import cpp
+
+from Function f
+select f.getName(), strictcount(f.getBlock())
diff --git a/cpp/ql/test/library-tests/CPP-205/CPP-205.cpp b/cpp/ql/test/library-tests/CPP-205/CPP-205.cpp
new file mode 100644
index 000000000000..4a48e68fd424
--- /dev/null
+++ b/cpp/ql/test/library-tests/CPP-205/CPP-205.cpp
@@ -0,0 +1,9 @@
+template
+int fn(T out) {
+ typedef int y[sizeof(out) + 1];
+ return 0;
+}
+
+int main() {
+ return fn(0);
+}
diff --git a/cpp/ql/test/library-tests/CPP-205/diags.expected b/cpp/ql/test/library-tests/CPP-205/diags.expected
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/cpp/ql/test/library-tests/CPP-205/diags.ql b/cpp/ql/test/library-tests/CPP-205/diags.ql
new file mode 100644
index 000000000000..8c255348ea7a
--- /dev/null
+++ b/cpp/ql/test/library-tests/CPP-205/diags.ql
@@ -0,0 +1,4 @@
+import cpp
+
+from Diagnostic d
+select d, d.getSeverity(), d.getTag(), d.getFullMessage()
diff --git a/cpp/ql/test/library-tests/CPP-205/elements.expected b/cpp/ql/test/library-tests/CPP-205/elements.expected
new file mode 100644
index 000000000000..5988280f9a91
--- /dev/null
+++ b/cpp/ql/test/library-tests/CPP-205/elements.expected
@@ -0,0 +1,30 @@
+| CPP-205.cpp:0:0:0:0 | CPP-205.cpp |
+| CPP-205.cpp:1:20:1:20 | T |
+| CPP-205.cpp:1:20:1:20 | definition of T |
+| CPP-205.cpp:2:5:2:6 | definition of fn |
+| CPP-205.cpp:2:5:2:6 | fn |
+| CPP-205.cpp:2:5:2:6 | fn |
+| CPP-205.cpp:2:10:2:12 | definition of out |
+| CPP-205.cpp:2:10:2:12 | out |
+| CPP-205.cpp:2:10:2:12 | out |
+| CPP-205.cpp:2:15:5:1 | { ... } |
+| CPP-205.cpp:2:15:5:1 | { ... } |
+| CPP-205.cpp:3:3:3:33 | declaration |
+| CPP-205.cpp:3:3:3:33 | declaration |
+| CPP-205.cpp:3:15:3:15 | declaration of y |
+| CPP-205.cpp:3:15:3:15 | declaration of y |
+| CPP-205.cpp:3:15:3:15 | y |
+| CPP-205.cpp:3:15:3:15 | y |
+| CPP-205.cpp:3:17:3:31 | 5 |
+| CPP-205.cpp:4:3:4:11 | return ... |
+| CPP-205.cpp:4:3:4:11 | return ... |
+| CPP-205.cpp:4:10:4:10 | 0 |
+| CPP-205.cpp:4:10:4:10 | 0 |
+| CPP-205.cpp:7:5:7:8 | definition of main |
+| CPP-205.cpp:7:5:7:8 | main |
+| CPP-205.cpp:7:12:9:1 | { ... } |
+| CPP-205.cpp:8:3:8:15 | return ... |
+| CPP-205.cpp:8:10:8:11 | call to fn |
+| CPP-205.cpp:8:13:8:13 | 0 |
+| file://:0:0:0:0 | operator= |
+| file://:0:0:0:0 | operator= |
diff --git a/cpp/ql/test/library-tests/CPP-205/elements.ql b/cpp/ql/test/library-tests/CPP-205/elements.ql
new file mode 100644
index 000000000000..36659f08c985
--- /dev/null
+++ b/cpp/ql/test/library-tests/CPP-205/elements.ql
@@ -0,0 +1,6 @@
+import cpp
+
+from Element e
+where not e.getLocation() instanceof UnknownLocation
+ and not e instanceof Folder
+select e
diff --git a/cpp/ql/test/library-tests/CPP-206/CPP-206.cpp b/cpp/ql/test/library-tests/CPP-206/CPP-206.cpp
new file mode 100644
index 000000000000..bdc74b36de7d
--- /dev/null
+++ b/cpp/ql/test/library-tests/CPP-206/CPP-206.cpp
@@ -0,0 +1,16 @@
+template struct Int {};
+
+template
+constexpr bool operator==(Int lhs, Int rhs) { return Ia == Ja; }
+
+template
+struct AsArraySize
+{
+ char arr[Int() == Int()];
+};
+
+template
+constexpr int operator+(Int lhs, Int rhs) { return Ic + Jc; }
+
+template
+struct Sum : Int() + Int()> { };
diff --git a/cpp/ql/test/library-tests/CPP-206/CPP-206.expected b/cpp/ql/test/library-tests/CPP-206/CPP-206.expected
new file mode 100644
index 000000000000..c44d5fb5f0a4
--- /dev/null
+++ b/cpp/ql/test/library-tests/CPP-206/CPP-206.expected
@@ -0,0 +1 @@
+| 0 |
\ No newline at end of file
diff --git a/cpp/ql/test/library-tests/CPP-206/CPP-206.ql b/cpp/ql/test/library-tests/CPP-206/CPP-206.ql
new file mode 100644
index 000000000000..2bd8cad16b5f
--- /dev/null
+++ b/cpp/ql/test/library-tests/CPP-206/CPP-206.ql
@@ -0,0 +1,3 @@
+import cpp
+
+select count(Diagnostic d)
diff --git a/cpp/ql/test/library-tests/CPP-207/CPP-207.cpp b/cpp/ql/test/library-tests/CPP-207/CPP-207.cpp
new file mode 100644
index 000000000000..554675022a14
--- /dev/null
+++ b/cpp/ql/test/library-tests/CPP-207/CPP-207.cpp
@@ -0,0 +1,19 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+typedef void *t;
+
+class C
+{
+ const struct t *v;
+};
diff --git a/cpp/ql/test/library-tests/CPP-207/CPP-207.expected b/cpp/ql/test/library-tests/CPP-207/CPP-207.expected
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/cpp/ql/test/library-tests/CPP-207/CPP-207.ql b/cpp/ql/test/library-tests/CPP-207/CPP-207.ql
new file mode 100644
index 000000000000..3fa864748e16
--- /dev/null
+++ b/cpp/ql/test/library-tests/CPP-207/CPP-207.ql
@@ -0,0 +1,4 @@
+import cpp
+
+from Diagnostic d
+select d
diff --git a/cpp/ql/test/library-tests/CPP-207/options b/cpp/ql/test/library-tests/CPP-207/options
new file mode 100644
index 000000000000..45e0279b139f
--- /dev/null
+++ b/cpp/ql/test/library-tests/CPP-207/options
@@ -0,0 +1 @@
+extractor_flags: --edg --microsoft
diff --git a/cpp/ql/test/library-tests/__builtin_constant_p/__builtin_constant_p.c b/cpp/ql/test/library-tests/__builtin_constant_p/__builtin_constant_p.c
new file mode 100644
index 000000000000..7aa567898e05
--- /dev/null
+++ b/cpp/ql/test/library-tests/__builtin_constant_p/__builtin_constant_p.c
@@ -0,0 +1,13 @@
+
+extern int g(void);
+
+void f(int i) {
+ static const int i1 = 1;
+ static const int i2 = g();
+ static const int i3 = i;
+ static const int i4 = __builtin_constant_p(i);
+ static const int i5 = 5;
+
+ char str[0 - !__builtin_constant_p(i)];
+}
+
diff --git a/cpp/ql/test/library-tests/__builtin_constant_p/diag.expected b/cpp/ql/test/library-tests/__builtin_constant_p/diag.expected
new file mode 100644
index 000000000000..707a4bfe3f06
--- /dev/null
+++ b/cpp/ql/test/library-tests/__builtin_constant_p/diag.expected
@@ -0,0 +1,3 @@
+| __builtin_constant_p.c:6:27:6:27 | function call is not allowed in a constant expression | 4 | bad_constant_function_call |
+| __builtin_constant_p.c:7:27:7:27 | expression must have a constant value | 4 | expr_not_constant |
+| file://:0:0:0:0 | There was an error during this compilation | 4 | Error occurred |
diff --git a/cpp/ql/test/library-tests/__builtin_constant_p/diag.ql b/cpp/ql/test/library-tests/__builtin_constant_p/diag.ql
new file mode 100644
index 000000000000..53e8ea5de9da
--- /dev/null
+++ b/cpp/ql/test/library-tests/__builtin_constant_p/diag.ql
@@ -0,0 +1,4 @@
+import cpp
+
+from Diagnostic d
+select d, d.getSeverity(), d.getTag()
diff --git a/cpp/ql/test/library-tests/__builtin_constant_p/options b/cpp/ql/test/library-tests/__builtin_constant_p/options
new file mode 100644
index 000000000000..4181beff3c28
--- /dev/null
+++ b/cpp/ql/test/library-tests/__builtin_constant_p/options
@@ -0,0 +1 @@
+extractor_flags: --expect_errors
diff --git a/cpp/ql/test/library-tests/abi/diag.expected b/cpp/ql/test/library-tests/abi/diag.expected
new file mode 100644
index 000000000000..cad0aeb2762c
--- /dev/null
+++ b/cpp/ql/test/library-tests/abi/diag.expected
@@ -0,0 +1,3 @@
+| file://:0:0:0:0 | There was an error during this compilation | 4 | Error occurred |
+| packed.c:11:16:11:16 | the size of an array must be greater than zero | 4 | array_size_must_be_positive |
+| packed.c:14:16:14:16 | the size of an array must be greater than zero | 4 | array_size_must_be_positive |
diff --git a/cpp/ql/test/library-tests/abi/diag.ql b/cpp/ql/test/library-tests/abi/diag.ql
new file mode 100644
index 000000000000..53e8ea5de9da
--- /dev/null
+++ b/cpp/ql/test/library-tests/abi/diag.ql
@@ -0,0 +1,4 @@
+import cpp
+
+from Diagnostic d
+select d, d.getSeverity(), d.getTag()
diff --git a/cpp/ql/test/library-tests/abi/options b/cpp/ql/test/library-tests/abi/options
new file mode 100644
index 000000000000..4181beff3c28
--- /dev/null
+++ b/cpp/ql/test/library-tests/abi/options
@@ -0,0 +1 @@
+extractor_flags: --expect_errors
diff --git a/cpp/ql/test/library-tests/abi/packed.c b/cpp/ql/test/library-tests/abi/packed.c
new file mode 100644
index 000000000000..f35ff5564b17
--- /dev/null
+++ b/cpp/ql/test/library-tests/abi/packed.c
@@ -0,0 +1,21 @@
+
+struct stru {
+ union {
+ int i;
+ char s[6];
+ } __attribute__((packed));
+};
+
+void f(void)
+{
+ char test1[((int)sizeof(int)) - 5]; // 4 - 5 = -1 error
+ char test2[((int)sizeof(int)) - 4]; // 4 - 4 = 0
+ char test3[((int)sizeof(int)) - 3]; // 4 - 3 = 1
+ char test4[((int)sizeof(struct stru)) - 7]; // 6 - 7 = -1 error
+ char test5[((int)sizeof(struct stru)) - 6]; // 6 - 6 = 0
+ char test6[((int)sizeof(struct stru)) - 5]; // 6 - 5 = 1
+ char test7[9 - ((int)sizeof(struct stru))]; // 9 - 6 = 3
+ char test8[8 - ((int)sizeof(struct stru))]; // 8 - 6 = 2
+ char test9[7 - ((int)sizeof(struct stru))]; // 7 - 6 = 1
+}
+
diff --git a/cpp/ql/test/library-tests/access/DerivationAccess/DerivationAccess.cpp b/cpp/ql/test/library-tests/access/DerivationAccess/DerivationAccess.cpp
new file mode 100644
index 000000000000..bedb38746bc5
--- /dev/null
+++ b/cpp/ql/test/library-tests/access/DerivationAccess/DerivationAccess.cpp
@@ -0,0 +1,68 @@
+namespace ambiguous {
+ class Duplicated {};
+
+ class Intermediate: public Duplicated {};
+
+ class C: protected Duplicated, public Intermediate {};
+}
+
+namespace chain {
+ class C {
+ public: static void pubC();
+ protected: static void protC();
+ private: static void priC();
+ };
+
+ class D: public C {
+ private: static void priD();
+ };
+
+ class E: protected D {};
+
+ class F: public E {};
+}
+
+namespace diamond {
+ class Top {
+ public: static void pub();
+ protected: static void prot();
+ };
+
+ class Left: private Top {};
+
+ class Right: public Top {};
+
+ class Bottom: public Left, protected Right {};
+
+ class Alone {
+ Alone();
+ };
+}
+
+namespace friend_class {
+ class A {
+ };
+
+ class B : private A {
+ friend class D1;
+ friend class D2;
+
+ public:
+ void fun() {};
+ };
+
+ class C : private B {
+ public:
+ void fun() {};
+ };
+
+ class D1 : private C {
+ public:
+ void fun() {};
+ };
+
+ class D2 : private B {
+ protected:
+ void fun() {};
+ };
+}
diff --git a/cpp/ql/test/library-tests/access/DerivationAccess/actual_member.expected b/cpp/ql/test/library-tests/access/DerivationAccess/actual_member.expected
new file mode 100644
index 000000000000..35628f38c53d
--- /dev/null
+++ b/cpp/ql/test/library-tests/access/DerivationAccess/actual_member.expected
@@ -0,0 +1,26 @@
+| chain::C | chain::C::priC | private |
+| chain::C | chain::C::protC | protected |
+| chain::C | chain::C::pubC | public |
+| chain::D | chain::C::protC | protected |
+| chain::D | chain::C::pubC | public |
+| chain::D | chain::D::priD | private |
+| chain::E | chain::C::protC | protected |
+| chain::E | chain::C::pubC | protected |
+| chain::F | chain::C::protC | protected |
+| chain::F | chain::C::pubC | protected |
+| diamond::Alone | diamond::Alone::Alone | private |
+| diamond::Bottom | diamond::Top::prot | protected |
+| diamond::Bottom | diamond::Top::pub | protected |
+| diamond::Left | diamond::Top::prot | private |
+| diamond::Left | diamond::Top::pub | private |
+| diamond::Right | diamond::Top::prot | protected |
+| diamond::Right | diamond::Top::pub | public |
+| diamond::Top | diamond::Top::prot | protected |
+| diamond::Top | diamond::Top::pub | public |
+| friend_class::B | friend_class::B::fun | public |
+| friend_class::C | friend_class::B::fun | private |
+| friend_class::C | friend_class::C::fun | public |
+| friend_class::D1 | friend_class::C::fun | private |
+| friend_class::D1 | friend_class::D1::fun | public |
+| friend_class::D2 | friend_class::B::fun | private |
+| friend_class::D2 | friend_class::D2::fun | protected |
diff --git a/cpp/ql/test/library-tests/access/DerivationAccess/actual_member.ql b/cpp/ql/test/library-tests/access/DerivationAccess/actual_member.ql
new file mode 100644
index 000000000000..ef4d021671fd
--- /dev/null
+++ b/cpp/ql/test/library-tests/access/DerivationAccess/actual_member.ql
@@ -0,0 +1,7 @@
+import cpp
+
+from Class c, Declaration member
+where not member.(Function).isCompilerGenerated()
+select c.getQualifiedName(),
+ member.getQualifiedName(),
+ c.accessOfBaseMember(member).getName()
diff --git a/cpp/ql/test/library-tests/access/DerivationAccess/hypothetical_member.expected b/cpp/ql/test/library-tests/access/DerivationAccess/hypothetical_member.expected
new file mode 100644
index 000000000000..49c48f64d4a0
--- /dev/null
+++ b/cpp/ql/test/library-tests/access/DerivationAccess/hypothetical_member.expected
@@ -0,0 +1,35 @@
+| ambiguous::C | ambiguous::C | public |
+| ambiguous::C | ambiguous::Duplicated | public |
+| ambiguous::C | ambiguous::Intermediate | public |
+| ambiguous::Duplicated | ambiguous::Duplicated | public |
+| ambiguous::Intermediate | ambiguous::Duplicated | public |
+| ambiguous::Intermediate | ambiguous::Intermediate | public |
+| chain::C | chain::C | public |
+| chain::D | chain::C | public |
+| chain::D | chain::D | public |
+| chain::E | chain::C | protected |
+| chain::E | chain::D | protected |
+| chain::E | chain::E | public |
+| chain::F | chain::C | protected |
+| chain::F | chain::D | protected |
+| chain::F | chain::E | public |
+| chain::F | chain::F | public |
+| diamond::Alone | diamond::Alone | public |
+| diamond::Bottom | diamond::Bottom | public |
+| diamond::Bottom | diamond::Left | public |
+| diamond::Bottom | diamond::Right | protected |
+| diamond::Bottom | diamond::Top | protected |
+| diamond::Left | diamond::Left | public |
+| diamond::Left | diamond::Top | private |
+| diamond::Right | diamond::Right | public |
+| diamond::Right | diamond::Top | public |
+| diamond::Top | diamond::Top | public |
+| friend_class::A | friend_class::A | public |
+| friend_class::B | friend_class::A | private |
+| friend_class::B | friend_class::B | public |
+| friend_class::C | friend_class::B | private |
+| friend_class::C | friend_class::C | public |
+| friend_class::D1 | friend_class::C | private |
+| friend_class::D1 | friend_class::D1 | public |
+| friend_class::D2 | friend_class::B | private |
+| friend_class::D2 | friend_class::D2 | public |
diff --git a/cpp/ql/test/library-tests/access/DerivationAccess/hypothetical_member.ql b/cpp/ql/test/library-tests/access/DerivationAccess/hypothetical_member.ql
new file mode 100644
index 000000000000..20bc19bd85a6
--- /dev/null
+++ b/cpp/ql/test/library-tests/access/DerivationAccess/hypothetical_member.ql
@@ -0,0 +1,9 @@
+import cpp
+
+from Class base, Class derived, AccessSpecifier public
+where public.hasName("public")
+ and // filter out compiler-generated junk
+ not derived.getNamespace() instanceof GlobalNamespace
+select derived.getQualifiedName(),
+ base.getQualifiedName(),
+ derived.accessOfBaseMember(base, public).getName()
diff --git a/cpp/ql/test/library-tests/access/FieldAccess/FieldAccess.cpp b/cpp/ql/test/library-tests/access/FieldAccess/FieldAccess.cpp
new file mode 100644
index 000000000000..50c02ab889e0
--- /dev/null
+++ b/cpp/ql/test/library-tests/access/FieldAccess/FieldAccess.cpp
@@ -0,0 +1,86 @@
+typedef int I;
+typedef I* P;
+
+struct D {
+ int *p1;
+ P p2;
+
+ D() : p1(new int), p2(new int) {}
+
+ virtual ~D() {
+ delete p1;
+ delete p2;
+ }
+};
+
+struct S {
+ D d;
+ int x1;
+ I x2;
+
+ int get1() {
+ // This looks like an implicit access of `this->x1`, but it is
+ // apparently automatically converted to `this->x1` by the frontend, so it
+ // comes out as a `PointerFieldAccess`.
+ return x1;
+ }
+
+ int get2() {
+ return this->x2;
+ }
+
+ virtual ~S() {
+ // Implicit access of `d`, to call its destructor.
+ }
+};
+
+typedef S ST;
+
+union U {
+ int x;
+ double d;
+};
+
+int test_ptr00(S *s) {
+ return s->x1;
+}
+
+int test_ptr01(S *s) {
+ return *(s->d.p1);
+}
+
+int test_ptr02(ST *s) {
+ return s->x2;
+}
+
+int test_ptr03(ST *s) {
+ return *(s->d.p2);
+}
+
+int test_ptr04(U *u) {
+ return u->x;
+}
+
+int test_ref00(S &s) {
+ return s.x1;
+}
+
+int test_ref01(S &s) {
+ return s.x2;
+}
+
+int test_ref02(U &u) {
+ return u.x;
+}
+
+int test_ref03(S &&s) {
+ return s.x1;
+}
+
+int test_val00(S s) {
+ return s.x1;
+}
+
+int test_val01(U u) {
+ return u.x;
+}
diff --git a/cpp/ql/test/library-tests/access/FieldAccess/FieldAccess.expected b/cpp/ql/test/library-tests/access/FieldAccess/FieldAccess.expected
new file mode 100644
index 000000000000..659bb032e43c
--- /dev/null
+++ b/cpp/ql/test/library-tests/access/FieldAccess/FieldAccess.expected
@@ -0,0 +1,18 @@
+| FieldAccess.cpp:11:12:11:13 | p1 | ptr |
+| FieldAccess.cpp:12:12:12:13 | p2 | ptr |
+| FieldAccess.cpp:25:12:25:13 | x1 | ptr |
+| FieldAccess.cpp:29:18:29:19 | x2 | ptr |
+| FieldAccess.cpp:34:3:34:3 | d | this |
+| FieldAccess.cpp:45:13:45:14 | x1 | ptr |
+| FieldAccess.cpp:49:15:49:15 | d | ptr |
+| FieldAccess.cpp:49:17:49:18 | p1 | val |
+| FieldAccess.cpp:53:13:53:14 | x2 | ptr |
+| FieldAccess.cpp:57:15:57:15 | d | ptr |
+| FieldAccess.cpp:57:17:57:18 | p2 | val |
+| FieldAccess.cpp:61:13:61:13 | x | ptr |
+| FieldAccess.cpp:65:12:65:13 | x1 | ref |
+| FieldAccess.cpp:69:12:69:13 | x2 | ref |
+| FieldAccess.cpp:73:12:73:12 | x | ref |
+| FieldAccess.cpp:77:12:77:13 | x1 | ref |
+| FieldAccess.cpp:81:12:81:13 | x1 | val |
+| FieldAccess.cpp:85:12:85:12 | x | val |
diff --git a/cpp/ql/test/library-tests/access/FieldAccess/FieldAccess.ql b/cpp/ql/test/library-tests/access/FieldAccess/FieldAccess.ql
new file mode 100644
index 000000000000..32af8bd6bde7
--- /dev/null
+++ b/cpp/ql/test/library-tests/access/FieldAccess/FieldAccess.ql
@@ -0,0 +1,14 @@
+import cpp
+
+string describeAccess(FieldAccess access) {
+ (access instanceof PointerFieldAccess and result = "ptr")
+ or
+ (access instanceof ReferenceFieldAccess and result = "ref")
+ or
+ (access instanceof ValueFieldAccess and result = "val")
+ or
+ (access instanceof ImplicitThisFieldAccess and result = "this")
+}
+
+from FieldAccess access
+select access, concat(describeAccess(access), ", ")
diff --git a/cpp/ql/test/library-tests/access/MemberOrFriend/MemberOrFriend.cpp b/cpp/ql/test/library-tests/access/MemberOrFriend/MemberOrFriend.cpp
new file mode 100644
index 000000000000..30e1e6cbf7b1
--- /dev/null
+++ b/cpp/ql/test/library-tests/access/MemberOrFriend/MemberOrFriend.cpp
@@ -0,0 +1,59 @@
+int topLevelFriend();
+
+class HasFriendFunction {
+public:
+ static int friendFunction();
+};
+
+class C {
+ friend class Friend;
+ friend int f() { return 1; }
+ friend int topLevelFriend();
+ friend int HasFriendFunction::friendFunction();
+
+ C();
+ C(const C& c) {}
+ static int return2() { return 2; }
+
+ class Nested {
+ Nested();
+ int nested1() {
+ struct Local {
+ int localOfNested() { return return2(); }
+ } l;
+ return l.localOfNested();
+ }
+ struct Nested2 {
+ void nested2();
+ };
+ };
+};
+
+class Friend {
+ int f() {
+ auto lambdaFriend = [](int a, int b) { return a + b + C::return2(); };
+ return lambdaFriend(1, 2);
+ }
+};
+
+class NotFriend {
+ int f() {
+ auto lambdaNotFriend = [](int a, int b) { return a + b; };
+ return lambdaNotFriend(1, 2);
+ }
+};
+
+int topLevelFriend() {
+ struct LocalOfFriend {
+ int localOfFriend() { return C::return2(); }
+ } l;
+ return l.localOfFriend();
+}
+
+class DerivesFromC : public C {
+ int f();
+};
+
+C::C() {
+ (void)return2();
+}
diff --git a/cpp/ql/test/library-tests/access/MemberOrFriend/MemberOrFriend.expected b/cpp/ql/test/library-tests/access/MemberOrFriend/MemberOrFriend.expected
new file mode 100644
index 000000000000..e25239967e1e
--- /dev/null
+++ b/cpp/ql/test/library-tests/access/MemberOrFriend/MemberOrFriend.expected
@@ -0,0 +1,12 @@
+| MemberOrFriend.cpp:8:7:8:7 | C | MemberOrFriend.cpp:5:14:5:27 | friendFunction | HasFriendFunction::friendFunction() |
+| MemberOrFriend.cpp:8:7:8:7 | C | MemberOrFriend.cpp:15:3:15:3 | C | C::C(const C & c) |
+| MemberOrFriend.cpp:8:7:8:7 | C | MemberOrFriend.cpp:16:14:16:20 | return2 | C::return2() |
+| MemberOrFriend.cpp:8:7:8:7 | C | MemberOrFriend.cpp:19:5:19:10 | Nested | C::Nested::Nested() |
+| MemberOrFriend.cpp:8:7:8:7 | C | MemberOrFriend.cpp:20:9:20:15 | nested1 | C::Nested::nested1() |
+| MemberOrFriend.cpp:8:7:8:7 | C | MemberOrFriend.cpp:22:13:22:25 | localOfNested | localOfNested() |
+| MemberOrFriend.cpp:8:7:8:7 | C | MemberOrFriend.cpp:27:12:27:18 | nested2 | C::Nested::Nested2::nested2() |
+| MemberOrFriend.cpp:8:7:8:7 | C | MemberOrFriend.cpp:33:7:33:7 | f | Friend::f() |
+| MemberOrFriend.cpp:8:7:8:7 | C | MemberOrFriend.cpp:34:27:34:27 | operator() | operator()(int a, int b) |
+| MemberOrFriend.cpp:8:7:8:7 | C | MemberOrFriend.cpp:46:5:46:18 | topLevelFriend | topLevelFriend() |
+| MemberOrFriend.cpp:8:7:8:7 | C | MemberOrFriend.cpp:48:9:48:21 | localOfFriend | localOfFriend() |
+| MemberOrFriend.cpp:8:7:8:7 | C | MemberOrFriend.cpp:57:1:57:4 | C | C::C() |
diff --git a/cpp/ql/test/library-tests/access/MemberOrFriend/MemberOrFriend.ql b/cpp/ql/test/library-tests/access/MemberOrFriend/MemberOrFriend.ql
new file mode 100644
index 000000000000..670030e24c64
--- /dev/null
+++ b/cpp/ql/test/library-tests/access/MemberOrFriend/MemberOrFriend.ql
@@ -0,0 +1,12 @@
+import cpp
+
+string functionName(Function f) {
+ result = f.getQualifiedName() +"("+ f.getParameterString() +")" or
+ not exists(f.getQualifiedName()) and
+ result = f.getName() +"("+ f.getParameterString() +")"
+}
+
+from Class c, Function f
+where c.getName() = "C" and f.inMemberOrFriendOf(c)
+ and not f.isCompilerGenerated()
+select c, f, functionName(f)
diff --git a/cpp/ql/test/library-tests/access/canAccessClass/canAccessClass.cpp b/cpp/ql/test/library-tests/access/canAccessClass/canAccessClass.cpp
new file mode 100644
index 000000000000..9190300e0fe6
--- /dev/null
+++ b/cpp/ql/test/library-tests/access/canAccessClass/canAccessClass.cpp
@@ -0,0 +1,100 @@
+
+namespace simple {
+ class Base {};
+ class Derived : private Base {
+ public: Base *castme() { return this; }
+ };
+
+ Base *top(Derived *p) {
+ return (Base*)p; // C-style cast needed
+ }
+}
+
+namespace side_tree {
+ class B {};
+ class S: protected B {};
+ class N: public S {};
+ class P: private S {
+ static B* f(N* n) {
+ // Allowed by C++14 11.2/4 since N can be converted to S by (4.1) and S
+ // can be converted to B by (4.3).
+ return n;
+ }
+ };
+}
+
+namespace gcc44 {
+ struct B { };
+ struct D1: protected B { };
+ struct D2: B {
+ B* f(D1* d) {
+ return nullptr;
+ // This conversion was allowed by GCC < 4.4, and the frontend defaults to
+ // emulating GCC 4.3, so it will actually accept the following illegal
+ // conversion.
+ //return d;
+ }
+ };
+}
+
+namespace mixed {
+ class A {
+ };
+
+ class B : private A {
+ public:
+ void fun() {}; // can convert B -> A; D -> C (public)
+ };
+
+ class C : protected B {
+ public:
+ void fun() {}; // can convert C -> B; D -> B, C (public)
+ };
+
+ class D : public C {
+ public:
+ void fun() {}; // can convert C-> B; D -> C, B (public)
+ };
+
+ void fun() {}; // can convert D -> C (public)
+}
+
+namespace friend_class {
+ class A {
+ };
+
+ class B : private A {
+ friend class D1;
+ friend class D2;
+
+ public:
+ void fun() {}; // can convert B -> A
+ };
+
+ class C : private B {
+ public:
+ void fun() {}; // can convert C -> B
+ };
+
+ class D1 : private C {
+ public:
+ void fun() {}; // can convert D1 -> B, C -> A (due to friend decl)
+ };
+
+ class D2 : private B {
+ protected:
+ void fun() {}; // can convert D2 -> A, B, B -> A (due to friend decl)
+ };
+}
+
+namespace friend_fun {
+ class A {
+ };
+
+ class B : private A {
+ friend void fun2();
+ };
+
+ void fun1() {};
+ void fun2() {}; // can convert B -> A (due to friend decl)
+}
diff --git a/cpp/ql/test/library-tests/access/canAccessClass/canAccessClass.expected b/cpp/ql/test/library-tests/access/canAccessClass/canAccessClass.expected
new file mode 100644
index 000000000000..6e5472574930
--- /dev/null
+++ b/cpp/ql/test/library-tests/access/canAccessClass/canAccessClass.expected
@@ -0,0 +1,75 @@
+| friend_class::B::fun | Can convert A -> A |
+| friend_class::B::fun | Can convert B -> A |
+| friend_class::B::fun | Can convert B -> B |
+| friend_class::B::fun | Can convert C -> C |
+| friend_class::B::fun | Can convert D1 -> D1 |
+| friend_class::B::fun | Can convert D2 -> D2 |
+| friend_class::C::fun | Can convert A -> A |
+| friend_class::C::fun | Can convert B -> B |
+| friend_class::C::fun | Can convert C -> B |
+| friend_class::C::fun | Can convert C -> C |
+| friend_class::C::fun | Can convert D1 -> D1 |
+| friend_class::C::fun | Can convert D2 -> D2 |
+| friend_class::D1::fun | Can convert A -> A |
+| friend_class::D1::fun | Can convert B -> A |
+| friend_class::D1::fun | Can convert B -> B |
+| friend_class::D1::fun | Can convert C -> C |
+| friend_class::D1::fun | Can convert D1 -> C |
+| friend_class::D1::fun | Can convert D1 -> D1 |
+| friend_class::D1::fun | Can convert D2 -> D2 |
+| friend_class::D2::fun | Can convert A -> A |
+| friend_class::D2::fun | Can convert B -> A |
+| friend_class::D2::fun | Can convert B -> B |
+| friend_class::D2::fun | Can convert C -> C |
+| friend_class::D2::fun | Can convert D1 -> D1 |
+| friend_class::D2::fun | Can convert D2 -> A |
+| friend_class::D2::fun | Can convert D2 -> B |
+| friend_class::D2::fun | Can convert D2 -> D2 |
+| friend_fun::fun1 | Can convert A -> A |
+| friend_fun::fun1 | Can convert B -> B |
+| friend_fun::fun2 | Can convert A -> A |
+| friend_fun::fun2 | Can convert B -> A |
+| friend_fun::fun2 | Can convert B -> B |
+| gcc44::D2::f | Can convert B -> B |
+| gcc44::D2::f | Can convert D1 -> D1 |
+| gcc44::D2::f | Can convert D2 -> B |
+| gcc44::D2::f | Can convert D2 -> D2 |
+| mixed::B::fun | Can convert A -> A |
+| mixed::B::fun | Can convert B -> A |
+| mixed::B::fun | Can convert B -> B |
+| mixed::B::fun | Can convert C -> C |
+| mixed::B::fun | Can convert D -> C |
+| mixed::B::fun | Can convert D -> D |
+| mixed::C::fun | Can convert A -> A |
+| mixed::C::fun | Can convert B -> B |
+| mixed::C::fun | Can convert C -> B |
+| mixed::C::fun | Can convert C -> C |
+| mixed::C::fun | Can convert D -> B |
+| mixed::C::fun | Can convert D -> C |
+| mixed::C::fun | Can convert D -> D |
+| mixed::D::fun | Can convert A -> A |
+| mixed::D::fun | Can convert B -> B |
+| mixed::D::fun | Can convert C -> B |
+| mixed::D::fun | Can convert C -> C |
+| mixed::D::fun | Can convert D -> B |
+| mixed::D::fun | Can convert D -> C |
+| mixed::D::fun | Can convert D -> D |
+| mixed::fun | Can convert A -> A |
+| mixed::fun | Can convert B -> B |
+| mixed::fun | Can convert C -> C |
+| mixed::fun | Can convert D -> C |
+| mixed::fun | Can convert D -> D |
+| side_tree::P::f | Can convert B -> B |
+| side_tree::P::f | Can convert N -> B |
+| side_tree::P::f | Can convert N -> N |
+| side_tree::P::f | Can convert N -> S |
+| side_tree::P::f | Can convert P -> B |
+| side_tree::P::f | Can convert P -> P |
+| side_tree::P::f | Can convert P -> S |
+| side_tree::P::f | Can convert S -> B |
+| side_tree::P::f | Can convert S -> S |
+| simple::Derived::castme | Can convert Base -> Base |
+| simple::Derived::castme | Can convert Derived -> Base |
+| simple::Derived::castme | Can convert Derived -> Derived |
+| simple::top | Can convert Base -> Base |
+| simple::top | Can convert Derived -> Derived |
diff --git a/cpp/ql/test/library-tests/access/canAccessClass/canAccessClass.ql b/cpp/ql/test/library-tests/access/canAccessClass/canAccessClass.ql
new file mode 100644
index 000000000000..58a91c597512
--- /dev/null
+++ b/cpp/ql/test/library-tests/access/canAccessClass/canAccessClass.ql
@@ -0,0 +1,11 @@
+import cpp
+
+from Function f, Class namingClass, Class base
+where f.canAccessClass(base, namingClass)
+ and // filter out compiler-generated junk
+ not namingClass.getNamespace() instanceof GlobalNamespace
+ and // only in same namespace
+ f.getNamespace() = namingClass.getNamespace()
+ and not f.isCompilerGenerated()
+select f.getQualifiedName(),
+ "Can convert "+ namingClass.getName() +" -> "+ base.getName()
diff --git a/cpp/ql/test/library-tests/access/canAccessMember/canAccessMember.cpp b/cpp/ql/test/library-tests/access/canAccessMember/canAccessMember.cpp
new file mode 100644
index 000000000000..6afd846741f8
--- /dev/null
+++ b/cpp/ql/test/library-tests/access/canAccessMember/canAccessMember.cpp
@@ -0,0 +1,160 @@
+
+
+namespace direct_friend {
+ class C {
+ friend class D;
+ private:
+ C(C &) {}
+ };
+
+ class D {
+ C x;
+ void f() {}
+ };
+}
+
+namespace field_and_base {
+ class B {
+ // An access expression `x.m`, where `m` as a member of `x` is protected
+ // and not static, may only occur in a member or friend of a (reflexive,
+ // transitive) base class of `x`'s class (N4140 11.4).
+ // To keep the implementation simple and fast, we apply this restriction to
+ // static members as well even though it's wrong. If that should ever be
+ // fixed, the expected results of this test should be updated to show that
+ // `P::f` can indeed access `P::m_static`.
+ protected:
+ int m;
+ static int m_static;
+ };
+ class P: public B {
+ B fieldB;
+ int f() {
+ // In the fully general syntax `x.B::m`, the _naming class_ `B` may be
+ // different from the static type of `x`. Our encoding of access rules
+ // currently pretends that they are always the same.
+ return this->m + this->B::m + this->m_static + B::m_static;
+ }
+ };
+}
+
+namespace protected_derived {
+ class B {
+ public:
+ int m;
+ };
+ class BN : protected B { };
+ class BPNprot;
+ class BPNpub;
+ class BP : protected B {
+ int f(BN*, BPNprot*, BPNpub*);
+ };
+ class BPNprot : protected BP { };
+ class BPNpub : public BP { };
+ int BP::f(BN* bn, BPNprot* bpnProt, BPNpub* bpnPub) {
+ return bpnPub->m;
+ }
+}
+
+namespace protected_virtual {
+ class B {
+ protected:
+ int m;
+ };
+
+ class Npub;
+ class Nprot;
+ class P : virtual private B {
+ int f(Npub*, Nprot*);
+ };
+
+ // f can access Npub::m since because it can convert an Npub* to a B* and
+ // then access B::m.
+ class Npub : virtual public B, private P { };
+
+ class Nprot : virtual protected B, private P { };
+
+ int P::f(Npub* pub, Nprot* prot) {
+ return pub->m;
+ }
+}
+
+namespace simple {
+ class Base {};
+ class Derived : private Base {
+ public: Base *castme() { return this; }
+ };
+
+ Base *top(Derived *p) {
+ return (Base*)p; // C-style cast needed
+ }
+}
+
+namespace mixed {
+ class A {
+ private:
+ int x;
+ static int y;
+ };
+
+ class B : private A {
+ private:
+ void fun() {};
+ };
+
+ class C : protected B {
+ private:
+ void fun() {};
+ };
+
+ class D : public C {
+ private:
+ void fun() {};
+ };
+}
+
+namespace friend_class {
+ class B {
+ friend class D1;
+ friend class D2;
+
+ private:
+ int a;
+ static int b;
+
+ void fun() {};
+ };
+
+ class C : private B {
+ private:
+ int x;
+ static int y;
+
+ void fun() {};
+ };
+
+ class D1 : private C {
+ private:
+ void fun() {};
+ };
+
+ class D2 : private B {
+ protected:
+ void fun() {};
+ };
+}
+
+namespace friend_fun {
+ class A {
+ };
+
+ class B : private A {
+ private:
+ int x;
+ static int y;
+
+ friend void fun2();
+ };
+
+ void fun1() {};
+ void fun2() {};
+}
diff --git a/cpp/ql/test/library-tests/access/canAccessMember/canAccessMember.expected b/cpp/ql/test/library-tests/access/canAccessMember/canAccessMember.expected
new file mode 100644
index 000000000000..9238c6182984
--- /dev/null
+++ b/cpp/ql/test/library-tests/access/canAccessMember/canAccessMember.expected
@@ -0,0 +1,96 @@
+| direct_friend::C::C | Can access C::C |
+| direct_friend::C::C | Can access C::operator= |
+| direct_friend::C::C | Can access D::D |
+| direct_friend::C::C | Can access D::operator= |
+| direct_friend::D::f | Can access C::C |
+| direct_friend::D::f | Can access C::operator= |
+| direct_friend::D::f | Can access D::D |
+| direct_friend::D::f | Can access D::f |
+| direct_friend::D::f | Can access D::operator= |
+| direct_friend::D::f | Can access D::x |
+| field_and_base::P::f | Can access B::operator= |
+| field_and_base::P::f | Can access P::f |
+| field_and_base::P::f | Can access P::fieldB |
+| field_and_base::P::f | Can access P::m |
+| field_and_base::P::f | Can access P::m_static |
+| field_and_base::P::f | Can access P::operator= |
+| friend_class::B::fun | Can access B::a |
+| friend_class::B::fun | Can access B::b |
+| friend_class::B::fun | Can access B::fun |
+| friend_class::B::fun | Can access B::operator= |
+| friend_class::B::fun | Can access C::operator= |
+| friend_class::B::fun | Can access D1::operator= |
+| friend_class::B::fun | Can access D2::operator= |
+| friend_class::C::fun | Can access B::operator= |
+| friend_class::C::fun | Can access C::fun |
+| friend_class::C::fun | Can access C::operator= |
+| friend_class::C::fun | Can access C::x |
+| friend_class::C::fun | Can access C::y |
+| friend_class::C::fun | Can access D1::operator= |
+| friend_class::C::fun | Can access D2::operator= |
+| friend_class::D1::fun | Can access B::a |
+| friend_class::D1::fun | Can access B::b |
+| friend_class::D1::fun | Can access B::fun |
+| friend_class::D1::fun | Can access B::operator= |
+| friend_class::D1::fun | Can access C::operator= |
+| friend_class::D1::fun | Can access D1::fun |
+| friend_class::D1::fun | Can access D1::operator= |
+| friend_class::D1::fun | Can access D2::operator= |
+| friend_class::D2::fun | Can access B::a |
+| friend_class::D2::fun | Can access B::b |
+| friend_class::D2::fun | Can access B::fun |
+| friend_class::D2::fun | Can access B::operator= |
+| friend_class::D2::fun | Can access C::operator= |
+| friend_class::D2::fun | Can access D1::operator= |
+| friend_class::D2::fun | Can access D2::a |
+| friend_class::D2::fun | Can access D2::b |
+| friend_class::D2::fun | Can access D2::fun |
+| friend_class::D2::fun | Can access D2::operator= |
+| friend_fun::fun1 | Can access A::operator= |
+| friend_fun::fun1 | Can access B::operator= |
+| friend_fun::fun2 | Can access A::operator= |
+| friend_fun::fun2 | Can access B::operator= |
+| friend_fun::fun2 | Can access B::x |
+| friend_fun::fun2 | Can access B::y |
+| mixed::B::fun | Can access A::operator= |
+| mixed::B::fun | Can access B::fun |
+| mixed::B::fun | Can access B::operator= |
+| mixed::B::fun | Can access C::operator= |
+| mixed::B::fun | Can access D::operator= |
+| mixed::C::fun | Can access A::operator= |
+| mixed::C::fun | Can access B::operator= |
+| mixed::C::fun | Can access C::fun |
+| mixed::C::fun | Can access C::operator= |
+| mixed::C::fun | Can access D::fun |
+| mixed::C::fun | Can access D::operator= |
+| mixed::D::fun | Can access A::operator= |
+| mixed::D::fun | Can access B::operator= |
+| mixed::D::fun | Can access C::operator= |
+| mixed::D::fun | Can access D::fun |
+| mixed::D::fun | Can access D::operator= |
+| protected_derived::BP::f | Can access B::m |
+| protected_derived::BP::f | Can access B::operator= |
+| protected_derived::BP::f | Can access BN::operator= |
+| protected_derived::BP::f | Can access BP::f |
+| protected_derived::BP::f | Can access BP::m |
+| protected_derived::BP::f | Can access BP::operator= |
+| protected_derived::BP::f | Can access BPNprot::operator= |
+| protected_derived::BP::f | Can access BPNpub::f |
+| protected_derived::BP::f | Can access BPNpub::m |
+| protected_derived::BP::f | Can access BPNpub::operator= |
+| protected_virtual::P::f | Can access B::operator= |
+| protected_virtual::P::f | Can access Nprot::Nprot |
+| protected_virtual::P::f | Can access Nprot::operator= |
+| protected_virtual::P::f | Can access Npub::Npub |
+| protected_virtual::P::f | Can access Npub::m |
+| protected_virtual::P::f | Can access Npub::operator= |
+| protected_virtual::P::f | Can access P::P |
+| protected_virtual::P::f | Can access P::f |
+| protected_virtual::P::f | Can access P::m |
+| protected_virtual::P::f | Can access P::operator= |
+| simple::Derived::castme | Can access Base::operator= |
+| simple::Derived::castme | Can access Derived::castme |
+| simple::Derived::castme | Can access Derived::operator= |
+| simple::top | Can access Base::operator= |
+| simple::top | Can access Derived::castme |
+| simple::top | Can access Derived::operator= |
diff --git a/cpp/ql/test/library-tests/access/canAccessMember/canAccessMember.ql b/cpp/ql/test/library-tests/access/canAccessMember/canAccessMember.ql
new file mode 100644
index 000000000000..ecd0f803158e
--- /dev/null
+++ b/cpp/ql/test/library-tests/access/canAccessMember/canAccessMember.ql
@@ -0,0 +1,9 @@
+import cpp
+
+from Function f, Class namingClass, Declaration member
+where f.canAccessMember(member, namingClass)
+ and // only in same namespace
+ f.getNamespace() = namingClass.getNamespace()
+ and not f.isCompilerGenerated()
+select f.getQualifiedName(),
+ "Can access "+ namingClass.getName() +"::"+ member.getName()
diff --git a/cpp/ql/test/library-tests/access/noPublic/noPublic.cpp b/cpp/ql/test/library-tests/access/noPublic/noPublic.cpp
new file mode 100644
index 000000000000..f59a4f4f8fef
--- /dev/null
+++ b/cpp/ql/test/library-tests/access/noPublic/noPublic.cpp
@@ -0,0 +1,5 @@
+// Some of our libraries depend on the resulting access of a hypothetical
+// public member. This test verifies that the database contains QL
+// `AccessSpecifier` instances for both `private` and `public` even when
+// extracting a program that does not contain those keywords. Indeed, this
+// program contains nothing at all except this comment.
diff --git a/cpp/ql/test/library-tests/access/noPublic/noPublic.expected b/cpp/ql/test/library-tests/access/noPublic/noPublic.expected
new file mode 100644
index 000000000000..dd09d291f323
--- /dev/null
+++ b/cpp/ql/test/library-tests/access/noPublic/noPublic.expected
@@ -0,0 +1,2 @@
+| file://:0:0:0:0 | private |
+| file://:0:0:0:0 | public |
diff --git a/cpp/ql/test/library-tests/access/noPublic/noPublic.ql b/cpp/ql/test/library-tests/access/noPublic/noPublic.ql
new file mode 100644
index 000000000000..e6d78dcfd5ab
--- /dev/null
+++ b/cpp/ql/test/library-tests/access/noPublic/noPublic.ql
@@ -0,0 +1,7 @@
+import cpp
+
+from AccessSpecifier spec
+// There is no way to create "protected" access without writing the keyword
+// `protected` in the source, so we don't need to test for that.
+where spec.hasName("private") or spec.hasName("public")
+select spec
diff --git a/cpp/ql/test/library-tests/alias_templates/alias_templates.cpp b/cpp/ql/test/library-tests/alias_templates/alias_templates.cpp
new file mode 100644
index 000000000000..b25861663333
--- /dev/null
+++ b/cpp/ql/test/library-tests/alias_templates/alias_templates.cpp
@@ -0,0 +1,18 @@
+template struct pair {
+ T first;
+ U second;
+};
+
+struct coords {
+ int x;
+ template using a_wild_alias_template_appeared = pair;
+ int y;
+ int z;
+ enum {
+ after_alias_template = 1
+ };
+};
+
+enum {
+ global_constant = 0
+};
diff --git a/cpp/ql/test/library-tests/alias_templates/enum_const_parents.expected b/cpp/ql/test/library-tests/alias_templates/enum_const_parents.expected
new file mode 100644
index 000000000000..02b0654dae4d
--- /dev/null
+++ b/cpp/ql/test/library-tests/alias_templates/enum_const_parents.expected
@@ -0,0 +1 @@
+| alias_templates.cpp:12:5:12:24 | after_alias_template | alias_templates.cpp:6:8:6:13 | coords |
diff --git a/cpp/ql/test/library-tests/alias_templates/enum_const_parents.ql b/cpp/ql/test/library-tests/alias_templates/enum_const_parents.ql
new file mode 100644
index 000000000000..0ef60fadfd84
--- /dev/null
+++ b/cpp/ql/test/library-tests/alias_templates/enum_const_parents.ql
@@ -0,0 +1,4 @@
+import cpp
+
+from EnumConstant ec
+select ec, ec.getDeclaringType()
diff --git a/cpp/ql/test/library-tests/aliased_ssa/constants/constants.cpp b/cpp/ql/test/library-tests/aliased_ssa/constants/constants.cpp
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/cpp/ql/test/library-tests/aliased_ssa/constants/constants.expected b/cpp/ql/test/library-tests/aliased_ssa/constants/constants.expected
new file mode 100644
index 000000000000..6c555a03b210
--- /dev/null
+++ b/cpp/ql/test/library-tests/aliased_ssa/constants/constants.expected
@@ -0,0 +1,35 @@
+| 0 * 0 | 0 |
+| 0 * INT_MAX | 0 |
+| 0 * unknown | 0 |
+| 0 + 0 | 0 |
+| 0 + -INT_MAX | -2147483647 |
+| 0 + INT_MAX | 2147483647 |
+| 0 - -INT_MAX | 2147483647 |
+| 0 - INT_MAX | -2147483647 |
+| 0 / -INT_MAX | 0 |
+| 0 / unknown | unknown |
+| 1 + -INT_MAX | -2147483646 |
+| 1 + INT_MAX | unknown |
+| 2 * INT_MAX | unknown |
+| 5 * 7 | 35 |
+| 5 + unknown | unknown |
+| 5 - unknown | unknown |
+| 35 / 7 | 5 |
+| 35 / 8 | 4 |
+| 35 / -7 | -5 |
+| 35 / -8 | -4 |
+| -1 * -INT_MAX | 2147483647 |
+| -1 - -INT_MAX | 2147483646 |
+| -1 - INT_MAX | unknown |
+| -35 / 7 | -5 |
+| -35 / 8 | -4 |
+| -35 / -7 | 5 |
+| -35 / -8 | 4 |
+| INT_MAX * INT_MAX | unknown |
+| INT_MAX / 0 | unknown |
+| unknown + 5 | unknown |
+| unknown + unknown | unknown |
+| unknown - 5 | unknown |
+| unknown - unknown | unknown |
+| unknown / 3 | unknown |
+| unknown / unknown | unknown |
diff --git a/cpp/ql/test/library-tests/aliased_ssa/constants/constants.ql b/cpp/ql/test/library-tests/aliased_ssa/constants/constants.ql
new file mode 100644
index 000000000000..eb11adc22862
--- /dev/null
+++ b/cpp/ql/test/library-tests/aliased_ssa/constants/constants.ql
@@ -0,0 +1,49 @@
+import cpp
+import semmle.code.cpp.ssa.internal.IntegerConstant as Ints
+
+bindingset[n]
+string resultString(int n) {
+ if Ints::hasValue(n) then
+ result = n.toString()
+ else
+ result = "unknown"
+}
+
+from string expr, int res
+where
+ expr = "0 + 0" and res = Ints::add(0, 0) or
+ expr = "0 + INT_MAX" and res = Ints::add(0, Ints::maxValue()) or
+ expr = "0 + -INT_MAX" and res = Ints::add(0, Ints::minValue()) or
+ expr = "1 + INT_MAX" and res = Ints::add(1, Ints::maxValue()) or
+ expr = "1 + -INT_MAX" and res = Ints::add(1, Ints::minValue()) or
+ expr = "unknown + unknown" and res = Ints::add(Ints::unknown(), Ints::unknown()) or
+ expr = "5 + unknown" and res = Ints::add(5, Ints::unknown()) or
+ expr = "unknown + 5" and res = Ints::add(Ints::unknown(), 5) or
+ expr = "0 - INT_MAX" and res = Ints::sub(0, Ints::maxValue()) or
+ expr = "0 - -INT_MAX" and res = Ints::sub(0, Ints::minValue()) or
+ expr = "-1 - INT_MAX" and res = Ints::sub(-1, Ints::maxValue()) or
+ expr = "-1 - -INT_MAX" and res = Ints::sub(-1, Ints::minValue()) or
+ expr = "unknown - unknown" and res = Ints::sub(Ints::unknown(), Ints::unknown()) or
+ expr = "5 - unknown" and res = Ints::sub(5, Ints::unknown()) or
+ expr = "unknown - 5" and res = Ints::sub(Ints::unknown(), 5) or
+ expr = "0 * 0" and res = Ints::mul(0, 0) or
+ expr = "5 * 7" and res = Ints::mul(5, 7) or
+ expr = "0 * INT_MAX" and res = Ints::mul(0, Ints::maxValue()) or
+ expr = "2 * INT_MAX" and res = Ints::mul(2, Ints::maxValue()) or
+ expr = "-1 * -INT_MAX" and res = Ints::mul(-1, Ints::minValue()) or
+ expr = "INT_MAX * INT_MAX" and res = Ints::mul(Ints::maxValue(), Ints::maxValue()) or
+ expr = "0 * unknown" and res = Ints::mul(0, Ints::unknown()) or
+ expr = "35 / 7" and res = Ints::div(35, 7) or
+ expr = "35 / 8" and res = Ints::div(35, 8) or
+ expr = "35 / -7" and res = Ints::div(35, -7) or
+ expr = "35 / -8" and res = Ints::div(35, -8) or
+ expr = "-35 / 7" and res = Ints::div(-35, 7) or
+ expr = "-35 / 8" and res = Ints::div(-35, 8) or
+ expr = "-35 / -7" and res = Ints::div(-35, -7) or
+ expr = "-35 / -8" and res = Ints::div(-35, -8) or
+ expr = "0 / -INT_MAX" and res = Ints::div(0, Ints::minValue()) or
+ expr = "INT_MAX / 0" and res = Ints::div(Ints::maxValue(), 0) or
+ expr = "0 / unknown" and res = Ints::div(0, Ints::unknown()) or
+ expr = "unknown / 3" and res = Ints::div(Ints::unknown(), 3) or
+ expr = "unknown / unknown" and res = Ints::div(Ints::unknown(), Ints::unknown())
+select expr, resultString(res)
diff --git a/cpp/ql/test/library-tests/aliased_ssa/escape/escape.cpp b/cpp/ql/test/library-tests/aliased_ssa/escape/escape.cpp
new file mode 100644
index 000000000000..81a23ac4fb21
--- /dev/null
+++ b/cpp/ql/test/library-tests/aliased_ssa/escape/escape.cpp
@@ -0,0 +1,98 @@
+void CallByPointer(int* p);
+void CallByReference(int& r);
+
+struct Point {
+ float x;
+ float y;
+ float z;
+};
+
+struct Base {
+ float b;
+};
+
+struct ReusedBase {
+ float rb;
+};
+
+struct Intermediate1 : Base, ReusedBase {
+ float i1;
+};
+
+struct Intermediate2 : ReusedBase {
+ float i2;
+};
+
+struct Derived : Intermediate1, Intermediate2 {
+ float d;
+};
+
+void Escape()
+{
+ int no_result;
+ int no_;
+
+ no_ = 1;
+ no_ = no_;
+ no_result = no_;
+ no_result = *&no_;
+// no_result = (int&)no_; Restore when we have correct IR types for glvalues
+ no_;
+ &no_;
+ no_result = *((&no_) + 0);
+ no_result = *((&no_) - 0);
+ no_result = *(0 + &no_);
+ if (&no_) {
+ }
+ while (&no_) {
+ }
+ do {
+ } while (&no_);
+ for(&no_; &no_; &no_) {
+ }
+
+ if (&no_ == nullptr) {
+ }
+ while (&no_ != nullptr) {
+ }
+
+ int no_Array[10];
+ no_Array;
+ (int*)no_Array;
+ no_Array[5];
+ 5[no_Array];
+ no_result = no_Array[5];
+ no_result = 5[no_Array];
+
+ Point no_Point = { 1, 2, 3 };
+ float no_x = no_Point.x;
+ no_Point.y = no_x;
+ float no_y = (&no_Point)->y;
+ (&no_Point)->y = no_y;
+ float no_z = *(&no_Point.z);
+ *(&no_Point.z) = no_z;
+
+ Derived no_Derived;
+ no_Derived.b = 0;
+ float no_b = no_Derived.b;
+ no_Derived.i2 = 1;
+ float no_i2 = no_Derived.i2;
+
+ int no_ssa_addrOf;
+ int* no_p = &no_ssa_addrOf;
+
+ int no_ssa_refTo;
+ int& no_r = no_ssa_refTo;
+
+ int no_ssa_refToArrayElement[10];
+ int& no_rae = no_ssa_refToArrayElement[5];
+
+ int no_ssa_refToArray[10];
+ int (&no_ra)[10] = no_ssa_refToArray;
+
+ int passByPtr;
+ CallByPointer(&passByPtr);
+
+ int passByRef;
+ CallByReference(passByRef);
+}
diff --git a/cpp/ql/test/library-tests/aliased_ssa/escape/escape.expected b/cpp/ql/test/library-tests/aliased_ssa/escape/escape.expected
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/cpp/ql/test/library-tests/aliased_ssa/escape/escape.ql b/cpp/ql/test/library-tests/aliased_ssa/escape/escape.ql
new file mode 100644
index 000000000000..6dcedf72db76
--- /dev/null
+++ b/cpp/ql/test/library-tests/aliased_ssa/escape/escape.ql
@@ -0,0 +1,22 @@
+import default
+import semmle.code.cpp.ssa.internal.ssa.AliasAnalysis
+import semmle.code.cpp.ir.IR
+
+predicate shouldEscape(IRAutomaticUserVariable var) {
+ exists(string name |
+ name = var.getVariable().getName() and
+ name.matches("no_%") and
+ not name.matches("no_ssa_%")
+ )
+}
+
+from IRAutomaticUserVariable var
+where
+ exists(FunctionIR funcIR |
+ funcIR = var.getFunctionIR() and
+ (
+ (shouldEscape(var) and variableAddressEscapes(var)) or
+ (not shouldEscape(var) and not variableAddressEscapes(var))
+ )
+ )
+select var
diff --git a/cpp/ql/test/library-tests/aliased_ssa/escape/points_to.expected b/cpp/ql/test/library-tests/aliased_ssa/escape/points_to.expected
new file mode 100644
index 000000000000..5d387a4b267d
--- /dev/null
+++ b/cpp/ql/test/library-tests/aliased_ssa/escape/points_to.expected
@@ -0,0 +1,108 @@
+| escape.cpp:32:9:32:17 | VariableAddress[no_result] | no_result+0:0 |
+| escape.cpp:33:9:33:11 | VariableAddress[no_] | no_+0:0 |
+| escape.cpp:35:5:35:7 | VariableAddress[no_] | no_+0:0 |
+| escape.cpp:36:5:36:7 | VariableAddress[no_] | no_+0:0 |
+| escape.cpp:36:11:36:13 | VariableAddress[no_] | no_+0:0 |
+| escape.cpp:37:5:37:13 | VariableAddress[no_result] | no_result+0:0 |
+| escape.cpp:37:17:37:19 | VariableAddress[no_] | no_+0:0 |
+| escape.cpp:38:5:38:13 | VariableAddress[no_result] | no_result+0:0 |
+| escape.cpp:38:19:38:21 | VariableAddress[no_] | no_+0:0 |
+| escape.cpp:40:5:40:7 | VariableAddress[no_] | no_+0:0 |
+| escape.cpp:41:6:41:8 | VariableAddress[no_] | no_+0:0 |
+| escape.cpp:42:5:42:13 | VariableAddress[no_result] | no_result+0:0 |
+| escape.cpp:42:19:42:28 | PointerAdd[4] | no_+0:0 |
+| escape.cpp:42:21:42:23 | VariableAddress[no_] | no_+0:0 |
+| escape.cpp:43:5:43:13 | VariableAddress[no_result] | no_result+0:0 |
+| escape.cpp:43:19:43:28 | PointerSub[4] | no_+0:0 |
+| escape.cpp:43:21:43:23 | VariableAddress[no_] | no_+0:0 |
+| escape.cpp:44:5:44:13 | VariableAddress[no_result] | no_result+0:0 |
+| escape.cpp:44:19:44:26 | PointerAdd[4] | no_+0:0 |
+| escape.cpp:44:24:44:26 | VariableAddress[no_] | no_+0:0 |
+| escape.cpp:45:10:45:12 | VariableAddress[no_] | no_+0:0 |
+| escape.cpp:47:13:47:15 | VariableAddress[no_] | no_+0:0 |
+| escape.cpp:50:15:50:17 | VariableAddress[no_] | no_+0:0 |
+| escape.cpp:51:10:51:12 | VariableAddress[no_] | no_+0:0 |
+| escape.cpp:51:16:51:18 | VariableAddress[no_] | no_+0:0 |
+| escape.cpp:51:22:51:24 | VariableAddress[no_] | no_+0:0 |
+| escape.cpp:54:10:54:12 | VariableAddress[no_] | no_+0:0 |
+| escape.cpp:56:13:56:15 | VariableAddress[no_] | no_+0:0 |
+| escape.cpp:59:9:59:16 | VariableAddress[no_Array] | no_Array+0:0 |
+| escape.cpp:60:5:60:12 | VariableAddress[no_Array] | no_Array+0:0 |
+| escape.cpp:61:5:61:18 | Convert | no_Array+0:0 |
+| escape.cpp:61:11:61:18 | Convert | no_Array+0:0 |
+| escape.cpp:61:11:61:18 | VariableAddress[no_Array] | no_Array+0:0 |
+| escape.cpp:62:5:62:12 | Convert | no_Array+0:0 |
+| escape.cpp:62:5:62:12 | VariableAddress[no_Array] | no_Array+0:0 |
+| escape.cpp:62:5:62:15 | PointerAdd[4] | no_Array+20:0 |
+| escape.cpp:63:5:63:15 | PointerAdd[4] | no_Array+20:0 |
+| escape.cpp:63:7:63:14 | Convert | no_Array+0:0 |
+| escape.cpp:63:7:63:14 | VariableAddress[no_Array] | no_Array+0:0 |
+| escape.cpp:64:5:64:13 | VariableAddress[no_result] | no_result+0:0 |
+| escape.cpp:64:17:64:24 | Convert | no_Array+0:0 |
+| escape.cpp:64:17:64:24 | VariableAddress[no_Array] | no_Array+0:0 |
+| escape.cpp:64:17:64:27 | PointerAdd[4] | no_Array+20:0 |
+| escape.cpp:65:5:65:13 | VariableAddress[no_result] | no_result+0:0 |
+| escape.cpp:65:17:65:27 | PointerAdd[4] | no_Array+20:0 |
+| escape.cpp:65:19:65:26 | Convert | no_Array+0:0 |
+| escape.cpp:65:19:65:26 | VariableAddress[no_Array] | no_Array+0:0 |
+| escape.cpp:67:11:67:18 | VariableAddress[no_Point] | no_Point+0:0 |
+| escape.cpp:67:21:67:32 | FieldAddress[x] | no_Point+0:0 |
+| escape.cpp:67:21:67:32 | FieldAddress[y] | no_Point+4:0 |
+| escape.cpp:67:21:67:32 | FieldAddress[z] | no_Point+8:0 |
+| escape.cpp:68:11:68:14 | VariableAddress[no_x] | no_x+0:0 |
+| escape.cpp:68:18:68:25 | VariableAddress[no_Point] | no_Point+0:0 |
+| escape.cpp:68:27:68:27 | FieldAddress[x] | no_Point+0:0 |
+| escape.cpp:69:5:69:12 | VariableAddress[no_Point] | no_Point+0:0 |
+| escape.cpp:69:14:69:14 | FieldAddress[y] | no_Point+4:0 |
+| escape.cpp:69:18:69:21 | VariableAddress[no_x] | no_x+0:0 |
+| escape.cpp:70:11:70:14 | VariableAddress[no_y] | no_y+0:0 |
+| escape.cpp:70:20:70:27 | VariableAddress[no_Point] | no_Point+0:0 |
+| escape.cpp:70:31:70:31 | FieldAddress[y] | no_Point+4:0 |
+| escape.cpp:71:7:71:14 | VariableAddress[no_Point] | no_Point+0:0 |
+| escape.cpp:71:18:71:18 | FieldAddress[y] | no_Point+4:0 |
+| escape.cpp:71:22:71:25 | VariableAddress[no_y] | no_y+0:0 |
+| escape.cpp:72:11:72:14 | VariableAddress[no_z] | no_z+0:0 |
+| escape.cpp:72:21:72:28 | VariableAddress[no_Point] | no_Point+0:0 |
+| escape.cpp:72:30:72:30 | FieldAddress[z] | no_Point+8:0 |
+| escape.cpp:73:8:73:15 | VariableAddress[no_Point] | no_Point+0:0 |
+| escape.cpp:73:17:73:17 | FieldAddress[z] | no_Point+8:0 |
+| escape.cpp:73:22:73:25 | VariableAddress[no_z] | no_z+0:0 |
+| escape.cpp:75:13:75:22 | VariableAddress[no_Derived] | no_Derived+0:0 |
+| escape.cpp:76:5:76:14 | ConvertToBase[Derived : Intermediate1] | no_Derived+0:0 |
+| escape.cpp:76:5:76:14 | ConvertToBase[Intermediate1 : Base] | no_Derived+0:0 |
+| escape.cpp:76:5:76:14 | VariableAddress[no_Derived] | no_Derived+0:0 |
+| escape.cpp:76:16:76:16 | FieldAddress[b] | no_Derived+0:0 |
+| escape.cpp:77:11:77:14 | VariableAddress[no_b] | no_b+0:0 |
+| escape.cpp:77:18:77:27 | ConvertToBase[Derived : Intermediate1] | no_Derived+0:0 |
+| escape.cpp:77:18:77:27 | ConvertToBase[Intermediate1 : Base] | no_Derived+0:0 |
+| escape.cpp:77:18:77:27 | VariableAddress[no_Derived] | no_Derived+0:0 |
+| escape.cpp:77:29:77:29 | FieldAddress[b] | no_Derived+0:0 |
+| escape.cpp:78:5:78:14 | ConvertToBase[Derived : Intermediate2] | no_Derived+12:0 |
+| escape.cpp:78:5:78:14 | VariableAddress[no_Derived] | no_Derived+0:0 |
+| escape.cpp:78:16:78:17 | FieldAddress[i2] | no_Derived+16:0 |
+| escape.cpp:79:11:79:15 | VariableAddress[no_i2] | no_i2+0:0 |
+| escape.cpp:79:19:79:28 | ConvertToBase[Derived : Intermediate2] | no_Derived+12:0 |
+| escape.cpp:79:19:79:28 | VariableAddress[no_Derived] | no_Derived+0:0 |
+| escape.cpp:79:30:79:31 | FieldAddress[i2] | no_Derived+16:0 |
+| escape.cpp:81:9:81:21 | VariableAddress[no_ssa_addrOf] | no_ssa_addrOf+0:0 |
+| escape.cpp:82:10:82:13 | VariableAddress[no_p] | no_p+0:0 |
+| escape.cpp:82:17:82:30 | Store | no_ssa_addrOf+0:0 |
+| escape.cpp:82:18:82:30 | VariableAddress[no_ssa_addrOf] | no_ssa_addrOf+0:0 |
+| escape.cpp:84:9:84:20 | VariableAddress[no_ssa_refTo] | no_ssa_refTo+0:0 |
+| escape.cpp:85:10:85:13 | VariableAddress[no_r] | no_r+0:0 |
+| escape.cpp:85:17:85:28 | Store | no_ssa_refTo+0:0 |
+| escape.cpp:85:17:85:28 | VariableAddress[no_ssa_refTo] | no_ssa_refTo+0:0 |
+| escape.cpp:87:9:87:32 | VariableAddress[no_ssa_refToArrayElement] | no_ssa_refToArrayElement+0:0 |
+| escape.cpp:88:10:88:15 | VariableAddress[no_rae] | no_rae+0:0 |
+| escape.cpp:88:19:88:42 | Convert | no_ssa_refToArrayElement+0:0 |
+| escape.cpp:88:19:88:42 | VariableAddress[no_ssa_refToArrayElement] | no_ssa_refToArrayElement+0:0 |
+| escape.cpp:88:19:88:45 | PointerAdd[4] | no_ssa_refToArrayElement+20:0 |
+| escape.cpp:88:19:88:45 | Store | no_ssa_refToArrayElement+20:0 |
+| escape.cpp:90:9:90:25 | VariableAddress[no_ssa_refToArray] | no_ssa_refToArray+0:0 |
+| escape.cpp:91:11:91:15 | VariableAddress[no_ra] | no_ra+0:0 |
+| escape.cpp:91:24:91:40 | Store | no_ssa_refToArray+0:0 |
+| escape.cpp:91:24:91:40 | VariableAddress[no_ssa_refToArray] | no_ssa_refToArray+0:0 |
+| escape.cpp:93:9:93:17 | VariableAddress[passByPtr] | passByPtr+0:0 |
+| escape.cpp:94:20:94:28 | VariableAddress[passByPtr] | passByPtr+0:0 |
+| escape.cpp:96:9:96:17 | VariableAddress[passByRef] | passByRef+0:0 |
+| escape.cpp:97:21:97:29 | VariableAddress[passByRef] | passByRef+0:0 |
diff --git a/cpp/ql/test/library-tests/aliased_ssa/escape/points_to.ql b/cpp/ql/test/library-tests/aliased_ssa/escape/points_to.ql
new file mode 100644
index 000000000000..95746737a148
--- /dev/null
+++ b/cpp/ql/test/library-tests/aliased_ssa/escape/points_to.ql
@@ -0,0 +1,11 @@
+import default
+import semmle.code.cpp.ssa.internal.ssa.AliasAnalysis
+import semmle.code.cpp.ir.IR
+
+from Instruction instr, string pointsTo
+where
+ exists(IRVariable var, int bitOffset |
+ resultPointsTo(instr, var, bitOffset) and
+ pointsTo = var.toString() + getBitOffsetString(bitOffset)
+ )
+select instr, pointsTo
diff --git a/cpp/ql/test/library-tests/aliased_ssa/escape/ssa_escape.expected b/cpp/ql/test/library-tests/aliased_ssa/escape/ssa_escape.expected
new file mode 100644
index 000000000000..e69de29bb2d1
diff --git a/cpp/ql/test/library-tests/aliased_ssa/escape/ssa_escape.ql b/cpp/ql/test/library-tests/aliased_ssa/escape/ssa_escape.ql
new file mode 100644
index 000000000000..f38fab307401
--- /dev/null
+++ b/cpp/ql/test/library-tests/aliased_ssa/escape/ssa_escape.ql
@@ -0,0 +1,21 @@
+import default
+import semmle.code.cpp.ssa.internal.aliased_ssa.AliasAnalysis
+import semmle.code.cpp.ssa.SSAIR
+
+predicate shouldEscape(IRAutomaticUserVariable var) {
+ exists(string name |
+ name = var.getVariable().getName() and
+ name.matches("no_%")
+ )
+}
+
+from IRAutomaticUserVariable var
+where
+ exists(FunctionIR funcIR |
+ funcIR = var.getFunctionIR() and
+ (
+ (shouldEscape(var) and variableAddressEscapes(var)) or
+ (not shouldEscape(var) and not variableAddressEscapes(var))
+ )
+ )
+select var
diff --git a/cpp/ql/test/library-tests/allocators/allocators.cpp b/cpp/ql/test/library-tests/allocators/allocators.cpp
new file mode 100644
index 000000000000..a15056b0f19c
--- /dev/null
+++ b/cpp/ql/test/library-tests/allocators/allocators.cpp
@@ -0,0 +1,111 @@
+// extractor_flags: -std=c++17
+typedef unsigned long size_t;
+namespace std {
+ enum class align_val_t : size_t {};
+}
+
+void* operator new(size_t, float);
+void* operator new[](size_t, float);
+void* operator new(size_t, std::align_val_t, float);
+void* operator new[](size_t, std::align_val_t, float);
+void operator delete(void*, float);
+void operator delete[](void*, float);
+void operator delete(void*, std::align_val_t, float);
+void operator delete[](void*, std::align_val_t, float);
+
+struct String {
+ String();
+ String(const String&);
+ String(String&&);
+ String(const char*);
+ ~String();
+
+ String& operator=(const String&);
+ String& operator=(String&&);
+
+ const char* c_str() const;
+
+private:
+ const char* p;
+};
+
+struct SizedDealloc {
+ char a[32];
+ void* operator new(size_t);
+ void* operator new[](size_t);
+ void operator delete(void*, size_t);
+ void operator delete[](void*, size_t);
+};
+
+struct alignas(128) Overaligned {
+ char a[256];
+};
+
+struct PolymorphicBase {
+ virtual ~PolymorphicBase();
+};
+
+void OperatorNew() {
+ new int; // No constructor
+ new(1.0f) int; // Placement new, no constructor
+ new int(); // Zero-init
+ new String(); // Constructor
+ new(1.0f) String("hello"); // Placement new, constructor with args
+ new Overaligned; // Aligned new
+ new(1.0f) Overaligned(); // Placement aligned new
+}
+
+void OperatorDelete() {
+ delete static_cast(nullptr); // No destructor
+ delete static_cast(nullptr); // Non-virtual destructor, with size.
+ delete static_cast(nullptr); // No destructor, with size.
+ delete static_cast(nullptr); // No destructor, with size and alignment.
+ delete static_cast(nullptr); // Virtual destructor
+ delete static_cast(nullptr); // Pointer to const
+}
+
+void OperatorNewArray(int n) {
+ new int[n]; // No constructor
+ new(1.0f) int[n]; // Placement new, no constructor
+ new String[n]; // Constructor
+ new Overaligned[n]; // Aligned new
+ new String[10]; // Constant size
+}
+
+int* const GetPointer();
+
+void OperatorDeleteArray() {
+ delete[] static_cast(nullptr); // No destructor
+ delete[] static_cast(nullptr); // Non-virtual destructor, with size.
+ delete[] static_cast(nullptr); // No destructor, with size.
+ delete[] static_cast(nullptr); // No destructor, with size and alignment.
+ delete[] static_cast(nullptr); // Virtual destructor
+ delete[] GetPointer();
+}
+
+struct FailedInit {
+ FailedInit();
+ ~FailedInit();
+
+ void* operator new(size_t); // Non-placement
+ void* operator new[](size_t); // Non-placement
+ void operator delete(void*, size_t); // Sized deallocation
+ void operator delete[](void*, size_t); // Sized deallocation
+};
+
+struct alignas(128) FailedInitOveraligned {
+ FailedInitOveraligned();
+ ~FailedInitOveraligned();
+
+ void* operator new(size_t, std::align_val_t, float); // Aligned placement
+ void* operator new[](size_t, std::align_val_t, float); // Aligned placement
+ void operator delete(void*, std::align_val_t, float); // Aligned placement
+ void operator delete[](void*, std::align_val_t, float); // Aligned placement
+};
+
+void TestFailedInit(int n) {
+ new FailedInit();
+ new FailedInit[n];
+ new(1.0f) FailedInitOveraligned();
+ new(1.0f) FailedInitOveraligned[10];
+}
diff --git a/cpp/ql/test/library-tests/allocators/allocators.expected b/cpp/ql/test/library-tests/allocators/allocators.expected
new file mode 100644
index 000000000000..586b82c8664f
--- /dev/null
+++ b/cpp/ql/test/library-tests/allocators/allocators.expected
@@ -0,0 +1,41 @@
+newExprs
+| allocators.cpp:49:3:49:9 | new | int | operator new(unsigned long) -> void * | 4 | 4 | |
+| allocators.cpp:50:3:50:15 | new | int | operator new(size_t, float) -> void * | 4 | 4 | |
+| allocators.cpp:51:3:51:11 | new | int | operator new(unsigned long) -> void * | 4 | 4 | |
+| allocators.cpp:52:3:52:14 | new | String | operator new(unsigned long) -> void * | 8 | 8 | |
+| allocators.cpp:53:3:53:27 | new | String | operator new(size_t, float) -> void * | 8 | 8 | |
+| allocators.cpp:54:3:54:17 | new | Overaligned | operator new(unsigned long, align_val_t) -> void * | 256 | 128 | aligned |
+| allocators.cpp:55:3:55:25 | new | Overaligned | operator new(size_t, align_val_t, float) -> void * | 256 | 128 | aligned |
+| allocators.cpp:107:3:107:18 | new | FailedInit | FailedInit::operator new(size_t) -> void * | 1 | 1 | |
+| allocators.cpp:109:3:109:35 | new | FailedInitOveraligned | FailedInitOveraligned::operator new(size_t, align_val_t, float) -> void * | 128 | 128 | aligned |
+newArrayExprs
+| allocators.cpp:68:3:68:12 | new[] | int | operator new[](unsigned long) -> void * | 4 | 4 | |
+| allocators.cpp:69:3:69:18 | new[] | int | operator new[](size_t, float) -> void * | 4 | 4 | |
+| allocators.cpp:70:3:70:15 | new[] | String | operator new[](unsigned long) -> void * | 8 | 8 | |
+| allocators.cpp:71:3:71:20 | new[] | Overaligned | operator new[](unsigned long, align_val_t) -> void * | 256 | 128 | aligned |
+| allocators.cpp:72:3:72:16 | new[] | String | operator new[](unsigned long) -> void * | 8 | 8 | |
+| allocators.cpp:108:3:108:19 | new[] | FailedInit | FailedInit::operator new[](size_t) -> void * | 1 | 1 | |
+| allocators.cpp:110:3:110:37 | new[] | FailedInitOveraligned | FailedInitOveraligned::operator new[](size_t, align_val_t, float) -> void * | 128 | 128 | aligned |
+newExprDeallocators
+| allocators.cpp:52:3:52:14 | new | String | operator delete(void *, unsigned long) -> void | 8 | 8 | sized |
+| allocators.cpp:53:3:53:27 | new | String | operator delete(void *, float) -> void | 8 | 8 | |
+| allocators.cpp:107:3:107:18 | new | FailedInit | FailedInit::operator delete(void *, size_t) -> void | 1 | 1 | sized |
+| allocators.cpp:109:3:109:35 | new | FailedInitOveraligned | FailedInitOveraligned::operator delete(void *, align_val_t, float) -> void | 128 | 128 | aligned |
+newArrayExprDeallocators
+| allocators.cpp:70:3:70:15 | new[] | String | operator delete[](void *, unsigned long) -> void | 8 | 8 | sized |
+| allocators.cpp:72:3:72:16 | new[] | String | operator delete[](void *, unsigned long) -> void | 8 | 8 | sized |
+| allocators.cpp:108:3:108:19 | new[] | FailedInit | FailedInit::operator delete[](void *, size_t) -> void | 1 | 1 | sized |
+| allocators.cpp:110:3:110:37 | new[] | FailedInitOveraligned | FailedInitOveraligned::operator delete[](void *, align_val_t, float) -> void | 128 | 128 | aligned |
+deleteExprs
+| allocators.cpp:59:3:59:35 | delete | int | operator delete(void *, unsigned long) -> void | 4 | 4 | sized |
+| allocators.cpp:60:3:60:38 | delete | String | operator delete(void *, unsigned long) -> void | 8 | 8 | sized |
+| allocators.cpp:61:3:61:44 | delete | SizedDealloc | SizedDealloc::operator delete(void *, size_t) -> void | 32 | 1 | sized |
+| allocators.cpp:62:3:62:43 | delete | Overaligned | operator delete(void *, unsigned long, align_val_t) -> void | 256 | 128 | sized aligned |
+| allocators.cpp:64:3:64:44 | delete | const String | operator delete(void *, unsigned long) -> void | 8 | 8 | sized |
+deleteArrayExprs
+| allocators.cpp:78:3:78:37 | delete[] | int | operator delete[](void *, unsigned long) -> void | 4 | 4 | sized |
+| allocators.cpp:79:3:79:40 | delete[] | String | operator delete[](void *, unsigned long) -> void | 8 | 8 | sized |
+| allocators.cpp:80:3:80:46 | delete[] | SizedDealloc | SizedDealloc::operator delete[](void *, size_t) -> void | 32 | 1 | sized |
+| allocators.cpp:81:3:81:45 | delete[] | Overaligned | operator delete[](void *, unsigned long, align_val_t) -> void | 256 | 128 | sized aligned |
+| allocators.cpp:82:3:82:49 | delete[] | PolymorphicBase | operator delete[](void *, unsigned long) -> void | 8 | 8 | sized |
+| allocators.cpp:83:3:83:23 | delete[] | int | operator delete[](void *, unsigned long) -> void | 4 | 4 | sized |
diff --git a/cpp/ql/test/library-tests/allocators/allocators.ql b/cpp/ql/test/library-tests/allocators/allocators.ql
new file mode 100644
index 000000000000..66c8d20b3f40
--- /dev/null
+++ b/cpp/ql/test/library-tests/allocators/allocators.ql
@@ -0,0 +1,89 @@
+import default
+
+query predicate newExprs(NewExpr expr, string type, string sig, int size, int alignment, string form) {
+ exists(Function allocator, Type allocatedType |
+ expr.getAllocator() = allocator and
+ sig = allocator.getFullSignature() and
+ allocatedType = expr.getAllocatedType() and
+ type = allocatedType.toString() and
+ size = allocatedType.getSize() and
+ alignment = allocatedType.getAlignment() and
+ if expr.hasAlignedAllocation() then form = "aligned" else form = ""
+ )
+}
+
+query predicate newArrayExprs(NewArrayExpr expr, string type, string sig, int size, int alignment, string form) {
+ exists(Function allocator, Type elementType |
+ expr.getAllocator() = allocator and
+ sig = allocator.getFullSignature() and
+ elementType = expr.getAllocatedElementType() and
+ type = elementType.toString() and
+ size = elementType.getSize() and
+ alignment = elementType.getAlignment() and
+ if expr.hasAlignedAllocation() then form = "aligned" else form = ""
+ )
+}
+
+query predicate newExprDeallocators(NewExpr expr, string type, string sig, int size, int alignment, string form) {
+ exists(Function deallocator, Type allocatedType |
+ expr.getDeallocator() = deallocator and
+ sig = deallocator.getFullSignature() and
+ allocatedType = expr.getAllocatedType() and
+ type = allocatedType.toString() and
+ size = allocatedType.getSize() and
+ alignment = allocatedType.getAlignment() and
+ exists(string sized, string aligned |
+ (if expr.hasAlignedDeallocation() then aligned = "aligned" else aligned = "") and
+ (if expr.hasSizedDeallocation() then sized = "sized" else sized = "") and
+ form = sized + " " + aligned
+ )
+ )
+}
+
+query predicate newArrayExprDeallocators(NewArrayExpr expr, string type, string sig, int size, int alignment, string form) {
+ exists(Function deallocator, Type elementType |
+ expr.getDeallocator() = deallocator and
+ sig = deallocator.getFullSignature() and
+ elementType = expr.getAllocatedElementType() and
+ type = elementType.toString() and
+ size = elementType.getSize() and
+ alignment = elementType.getAlignment() and
+ exists(string sized, string aligned |
+ (if expr.hasAlignedDeallocation() then aligned = "aligned" else aligned = "") and
+ (if expr.hasSizedDeallocation() then sized = "sized" else sized = "") and
+ form = sized + " " + aligned
+ )
+ )
+}
+
+query predicate deleteExprs(DeleteExpr expr, string type, string sig, int size, int alignment, string form) {
+ exists(Function deallocator, Type deletedType |
+ expr.getDeallocator() = deallocator and
+ sig = deallocator.getFullSignature() and
+ deletedType = expr.getDeletedObjectType() and
+ type = deletedType.toString() and
+ size = deletedType.getSize() and
+ alignment = deletedType.getAlignment() and
+ exists(string sized, string aligned |
+ (if expr.hasAlignedDeallocation() then aligned = "aligned" else aligned = "") and
+ (if expr.hasSizedDeallocation() then sized = "sized" else sized = "") and
+ form = sized + " " + aligned
+ )
+ )
+}
+
+query predicate deleteArrayExprs(DeleteArrayExpr expr, string type, string sig, int size, int alignment, string form) {
+ exists(Function deallocator, Type elementType |
+ expr.getDeallocator() = deallocator and
+ sig = deallocator.getFullSignature() and
+ elementType = expr.getDeletedElementType() and
+ type = elementType.toString() and
+ size = elementType.getSize() and
+ alignment = elementType.getAlignment() and
+ exists(string sized, string aligned |
+ (if expr.hasAlignedDeallocation() then aligned = "aligned" else aligned = "") and
+ (if expr.hasSizedDeallocation() then sized = "sized" else sized = "") and
+ form = sized + " " + aligned
+ )
+ )
+}
diff --git a/cpp/ql/test/library-tests/anachronisms/options b/cpp/ql/test/library-tests/anachronisms/options
new file mode 100644
index 000000000000..a01498a45e5d
--- /dev/null
+++ b/cpp/ql/test/library-tests/anachronisms/options
@@ -0,0 +1,2 @@
+extractor_flags: --edg --anachronisms
+
diff --git a/cpp/ql/test/library-tests/anachronisms/test.cpp b/cpp/ql/test/library-tests/anachronisms/test.cpp
new file mode 100644
index 000000000000..146e5e6c2153
--- /dev/null
+++ b/cpp/ql/test/library-tests/anachronisms/test.cpp
@@ -0,0 +1,15 @@
+
+class A {
+public:
+ virtual int f();
+};
+
+class B: public A {
+public:
+ int f() { return 1; }
+};
+
+A *p = new A;
+int (*pf)() = (int (*)())p->f;
+
+
diff --git a/cpp/ql/test/library-tests/anachronisms/virtfunptrexpr.expected b/cpp/ql/test/library-tests/anachronisms/virtfunptrexpr.expected
new file mode 100644
index 000000000000..2a4f078a25fc
--- /dev/null
+++ b/cpp/ql/test/library-tests/anachronisms/virtfunptrexpr.expected
@@ -0,0 +1 @@
+| 1 |
diff --git a/cpp/ql/test/library-tests/anachronisms/virtfunptrexpr.ql b/cpp/ql/test/library-tests/anachronisms/virtfunptrexpr.ql
new file mode 100644
index 000000000000..a10e4bb03426
--- /dev/null
+++ b/cpp/ql/test/library-tests/anachronisms/virtfunptrexpr.ql
@@ -0,0 +1,3 @@
+import cpp
+
+select count(@virtfunptrexpr e)
diff --git a/cpp/ql/test/library-tests/arguments/arguments.c b/cpp/ql/test/library-tests/arguments/arguments.c
new file mode 100644
index 000000000000..fe7ca426b11e
--- /dev/null
+++ b/cpp/ql/test/library-tests/arguments/arguments.c
@@ -0,0 +1 @@
+// semmle-extractor-options: -Werror
diff --git a/cpp/ql/test/library-tests/arguments/arguments.expected b/cpp/ql/test/library-tests/arguments/arguments.expected
new file mode 100644
index 000000000000..7422d01133b0
--- /dev/null
+++ b/cpp/ql/test/library-tests/arguments/arguments.expected
@@ -0,0 +1,14 @@
+| arguments.c | 1 | --preprocessArgs |
+| arguments.c | 2 | --force-recompute |
+| arguments.c | 3 | --edg |
+| arguments.c | 4 | --disable_system_macros |
+| arguments.c | 5 | --edg |
+| arguments.c | 6 | --target |
+| arguments.c | 7 | --edg |
+| arguments.c | 8 | linux_x86_64 |
+| arguments.c | 9 | --gcc |
+| arguments.c | 10 | --predefined_macros |
+| arguments.c | 11 | /tools/qltest/predefined_macros |
+| arguments.c | 12 | -w |
+| arguments.c | 13 | -Werror |
+| arguments.c | 14 | arguments.c |
diff --git a/cpp/ql/test/library-tests/arguments/arguments.ql b/cpp/ql/test/library-tests/arguments/arguments.ql
new file mode 100644
index 000000000000..2680fd90d18b
--- /dev/null
+++ b/cpp/ql/test/library-tests/arguments/arguments.ql
@@ -0,0 +1,10 @@
+import cpp
+
+from Compilation c, int i, string s
+// Skip the extractor name; it'll vary depending on platform
+where i > 0
+ and s = c.getArgument(i).replaceAll("\\", "/")
+ .regexpReplaceAll(".*(tools/qltest/predefined_macros)", "/$1")
+select c.getAFileCompiled().toString(),
+ i, s
+
diff --git a/cpp/ql/test/library-tests/array_expr/array_expr.c b/cpp/ql/test/library-tests/array_expr/array_expr.c
new file mode 100644
index 000000000000..21cf54358dcd
--- /dev/null
+++ b/cpp/ql/test/library-tests/array_expr/array_expr.c
@@ -0,0 +1,4 @@
+int main() {
+ int arr[] = {1};
+ return arr[0] + 0[arr];
+}
diff --git a/cpp/ql/test/library-tests/array_expr/parts.expected b/cpp/ql/test/library-tests/array_expr/parts.expected
new file mode 100644
index 000000000000..f9edd46e934f
--- /dev/null
+++ b/cpp/ql/test/library-tests/array_expr/parts.expected
@@ -0,0 +1,4 @@
+| getArrayBase | array_expr.c:3:10:3:12 | arr |
+| getArrayBase | array_expr.c:3:21:3:23 | arr |
+| getArrayOffset | array_expr.c:3:14:3:14 | 0 |
+| getArrayOffset | array_expr.c:3:19:3:19 | 0 |
diff --git a/cpp/ql/test/library-tests/array_expr/parts.ql b/cpp/ql/test/library-tests/array_expr/parts.ql
new file mode 100644
index 000000000000..ed627e12210d
--- /dev/null
+++ b/cpp/ql/test/library-tests/array_expr/parts.ql
@@ -0,0 +1,6 @@
+import cpp
+
+from ArrayExpr ae, string meth, Expr expr
+where (meth = "getArrayBase" and expr = ae.getArrayBase())
+ or (meth = "getArrayOffset" and expr = ae.getArrayOffset())
+select meth, expr
diff --git a/cpp/ql/test/library-tests/array_sizes/arr1.expected b/cpp/ql/test/library-tests/array_sizes/arr1.expected
new file mode 100644
index 000000000000..02bdc937204a
--- /dev/null
+++ b/cpp/ql/test/library-tests/array_sizes/arr1.expected
@@ -0,0 +1,6 @@
+| array_sizes.c:10:10:10:20 | sizeof_arr5 |
+| array_sizes.c:11:11:11:21 | sizeof_arr6 |
+| array_sizes.c:14:14:14:24 | sizeof_arr7 |
+| array_sizes.cpp:7:10:7:20 | sizeof_arr1 |
+| array_sizes.cpp:8:11:8:21 | sizeof_arr2 |
+| array_sizes.cpp:11:14:11:24 | sizeof_arr3 |
diff --git a/cpp/ql/test/library-tests/array_sizes/arr1.ql b/cpp/ql/test/library-tests/array_sizes/arr1.ql
new file mode 100644
index 000000000000..66bfbaeb9495
--- /dev/null
+++ b/cpp/ql/test/library-tests/array_sizes/arr1.ql
@@ -0,0 +1,6 @@
+import cpp
+
+from EnumConstant ec, Access ac
+where ec.getName().matches("sizeof\\_arr%")
+and ac = ec.getAnAccess()
+select ac
diff --git a/cpp/ql/test/library-tests/array_sizes/arr2.expected b/cpp/ql/test/library-tests/array_sizes/arr2.expected
new file mode 100644
index 000000000000..959f04358288
--- /dev/null
+++ b/cpp/ql/test/library-tests/array_sizes/arr2.expected
@@ -0,0 +1,7 @@
+| file://:0:0:0:0 | char[6] | 6 |
+| file://:0:0:0:0 | char[26] | 26 |
+| file://:0:0:0:0 | int[1] | 1 |
+| file://:0:0:0:0 | int[11] | 11 |
+| file://:0:0:0:0 | long[] | |
+| file://:0:0:0:0 | short[5] | 5 |
+| file://:0:0:0:0 | short[15] | 15 |
diff --git a/cpp/ql/test/library-tests/array_sizes/arr2.ql b/cpp/ql/test/library-tests/array_sizes/arr2.ql
new file mode 100644
index 000000000000..f7345ca93353
--- /dev/null
+++ b/cpp/ql/test/library-tests/array_sizes/arr2.ql
@@ -0,0 +1,5 @@
+import cpp
+
+from ArrayType at, string sz
+where if exists(at.getArraySize()) then sz = at.getArraySize().toString() else sz = ""
+select at, sz
diff --git a/cpp/ql/test/library-tests/array_sizes/array_sizes.c b/cpp/ql/test/library-tests/array_sizes/array_sizes.c
new file mode 100644
index 000000000000..d8796a8ac14f
--- /dev/null
+++ b/cpp/ql/test/library-tests/array_sizes/array_sizes.c
@@ -0,0 +1,16 @@
+// semmle-extractor-options: --g++ --gnu_version 40602
+// this test is in a .c file with compiler flags set to be like g++. This is a workaround to
+// build as C++ without C++11, a configuration where we've had problems in the past.
+enum {
+ sizeof_arr5 = 11,
+ sizeof_arr6 = 13,
+ sizeof_arr7 = 15
+};
+
+int arr5[sizeof_arr5] = {0};
+char arr6[sizeof_arr6 * 2];
+
+int main(int argc) {
+ short arr7[sizeof_arr7];
+ long arr8[argc];
+}
diff --git a/cpp/ql/test/library-tests/array_sizes/array_sizes.cpp b/cpp/ql/test/library-tests/array_sizes/array_sizes.cpp
new file mode 100644
index 000000000000..1586bbd55eaf
--- /dev/null
+++ b/cpp/ql/test/library-tests/array_sizes/array_sizes.cpp
@@ -0,0 +1,13 @@
+enum {
+ sizeof_arr1 = 1,
+ sizeof_arr2 = 3,
+ sizeof_arr3 = 5
+};
+
+int arr1[sizeof_arr1] = {0};
+char arr2[sizeof_arr2 * 2];
+
+int main(int argc) {
+ short arr3[sizeof_arr3];
+ long arr4[argc];
+}
diff --git a/cpp/ql/test/library-tests/atomic/atomic.cpp b/cpp/ql/test/library-tests/atomic/atomic.cpp
new file mode 100644
index 000000000000..96153c2118ca
--- /dev/null
+++ b/cpp/ql/test/library-tests/atomic/atomic.cpp
@@ -0,0 +1,21 @@
+template
+struct atomic_box
+{
+ mutable _Atomic(T) value;
+};
+
+int main() {
+ _Atomic int a;
+ _Atomic(int) b;
+ _Atomic int *c, d;
+ _Atomic(int*) e, f;
+ atomic_box g;
+ _Atomic const int h = 0;
+ const _Atomic(int) i = 0;
+ _Atomic(_Atomic(int)*) j;
+ _Atomic int* _Atomic k;
+ int m = 0;
+
+ a = m;
+ m = a;
+}
diff --git a/cpp/ql/test/library-tests/atomic/options b/cpp/ql/test/library-tests/atomic/options
new file mode 100644
index 000000000000..5e8fada6b21f
--- /dev/null
+++ b/cpp/ql/test/library-tests/atomic/options
@@ -0,0 +1 @@
+extractor_flags: --clang
diff --git a/cpp/ql/test/library-tests/atomic/variables.expected b/cpp/ql/test/library-tests/atomic/variables.expected
new file mode 100644
index 000000000000..e5303709924c
--- /dev/null
+++ b/cpp/ql/test/library-tests/atomic/variables.expected
@@ -0,0 +1,20 @@
+| a | _Atomic(int) | atomic {int} |
+| b | _Atomic(int) | atomic {int} |
+| c | _Atomic(int) * | pointer to {atomic {int}} |
+| d | _Atomic(int) | atomic {int} |
+| e | int *_Atomic | atomic {pointer to {int}} |
+| f | int *_Atomic | atomic {pointer to {int}} |
+| fp_offset | unsigned int | unsigned int |
+| g | atomic_box | struct atomic_box |
+| gp_offset | unsigned int | unsigned int |
+| h | const _Atomic(int) | atomic const {int} |
+| i | const _Atomic(int) | atomic const {int} |
+| j | _Atomic(int) *_Atomic | atomic {pointer to {atomic {int}}} |
+| k | _Atomic(int) *_Atomic | atomic {pointer to {atomic {int}}} |
+| m | int | int |
+| overflow_arg_area | void * | pointer to {void} |
+| p#0 | atomic_box && | rvalue reference to {struct atomic_box} |
+| p#0 | const atomic_box & | reference to {const {struct atomic_box}} |
+| reg_save_area | void * | pointer to {void} |
+| value | _Atomic(T) | atomic {T} |
+| value | _Atomic(int) | atomic {int} |
diff --git a/cpp/ql/test/library-tests/atomic/variables.ql b/cpp/ql/test/library-tests/atomic/variables.ql
new file mode 100644
index 000000000000..c1643ac75f7a
--- /dev/null
+++ b/cpp/ql/test/library-tests/atomic/variables.ql
@@ -0,0 +1,4 @@
+import cpp
+
+from Variable v
+select v.getName(), v.getType().toString(), v.getType().explain()
diff --git a/cpp/ql/test/library-tests/attributes/alignment/alignment.cpp b/cpp/ql/test/library-tests/attributes/alignment/alignment.cpp
new file mode 100644
index 000000000000..a6ca72526ae5
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/alignment/alignment.cpp
@@ -0,0 +1,35 @@
+namespace AlignAs {
+struct alignas(16) sse_t
+{
+ float sse_data[4];
+};
+
+struct alignas(sse_t) avx_t
+{
+ float avx_data[8];
+};
+
+}
+namespace AttributeAlign {
+
+struct [[align(16)]] sse_t
+{
+ float sse_data[4];
+};
+
+struct [[align(sse_t)]] avx_t
+{
+ float avx_data[8];
+};
+
+struct [[align(1024 * 8)]] align_to_8_kilobytes
+{
+ int x;
+};
+
+struct [[align(1024 * 1024 * 256)]] align_to_256_megabytes
+{
+ int x;
+};
+
+}
diff --git a/cpp/ql/test/library-tests/attributes/alignment/alignment.expected b/cpp/ql/test/library-tests/attributes/alignment/alignment.expected
new file mode 100644
index 000000000000..168ff2abe63c
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/alignment/alignment.expected
@@ -0,0 +1,6 @@
+| alignment.cpp:2:8:2:14 | AlignAs::sse_t | 16 |
+| alignment.cpp:7:8:7:14 | AlignAs::avx_t | AlignAs::sse_t |
+| alignment.cpp:15:10:15:14 | AttributeAlign::sse_t | 16 |
+| alignment.cpp:20:10:20:14 | AttributeAlign::avx_t | AttributeAlign::sse_t |
+| alignment.cpp:25:10:25:14 | AttributeAlign::align_to_8_kilobytes | 8192 |
+| alignment.cpp:30:10:30:14 | AttributeAlign::align_to_256_megabytes | 268435456 |
diff --git a/cpp/ql/test/library-tests/attributes/alignment/alignment.ql b/cpp/ql/test/library-tests/attributes/alignment/alignment.ql
new file mode 100644
index 000000000000..2f81e786b193
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/alignment/alignment.ql
@@ -0,0 +1,6 @@
+import cpp
+
+from Struct s, Attribute a, string alignment
+where a = s.getAnAttribute()
+ and (alignment = a.getAnArgument().getValueInt().toString() or alignment = ((Struct)a.getAnArgument().getValueType()).getQualifiedName())
+select a.getLocation().toString(), s.getQualifiedName(), alignment
diff --git a/cpp/ql/test/library-tests/attributes/availability/availability.c b/cpp/ql/test/library-tests/attributes/availability/availability.c
new file mode 100644
index 000000000000..8e7892aa1082
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/availability/availability.c
@@ -0,0 +1,11 @@
+#if __has_feature(attribute_availability)
+void f(void) __attribute__((availability(macosx,introduced=10.4,deprecated=10.6,obsoleted=10.7)));
+#endif
+
+#if __has_feature(attribute_availability_with_message)
+void g(void) __attribute__((availability(ios,unavailable,message="Woah, don't use this.")));
+#endif
+
+void h(void);
+
+void tententhree(void) __attribute__((availability(macosx,introduced=10.10.3,message = "Ten" "Ten" "Three")));
diff --git a/cpp/ql/test/library-tests/attributes/availability/availability.expected b/cpp/ql/test/library-tests/attributes/availability/availability.expected
new file mode 100644
index 000000000000..270c386bfb06
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/availability/availability.expected
@@ -0,0 +1,16 @@
+| f | 0 | availability.c:2:42:2:47 | macosx |
+| f | 1 | availability.c:2:49:2:58 | introduced |
+| f | 2 | availability.c:2:60:2:63 | 10.4 |
+| f | 3 | availability.c:2:65:2:74 | deprecated |
+| f | 4 | availability.c:2:76:2:79 | 10.6 |
+| f | 5 | availability.c:2:81:2:89 | obsoleted |
+| f | 6 | availability.c:2:91:2:94 | 10.7 |
+| g | 0 | availability.c:6:42:6:44 | ios |
+| g | 1 | availability.c:6:46:6:56 | unavailable |
+| g | 2 | availability.c:6:58:6:64 | message |
+| g | 3 | availability.c:6:66:6:88 | "Woah, don\\'t use this." |
+| tententhree | 0 | availability.c:11:52:11:57 | macosx |
+| tententhree | 1 | availability.c:11:59:11:68 | introduced |
+| tententhree | 2 | availability.c:11:70:11:76 | 10.10.3 |
+| tententhree | 3 | availability.c:11:78:11:84 | message |
+| tententhree | 4 | availability.c:11:88:11:106 | "TenTenThree" |
diff --git a/cpp/ql/test/library-tests/attributes/availability/availability.ql b/cpp/ql/test/library-tests/attributes/availability/availability.ql
new file mode 100644
index 000000000000..2894df522c7a
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/availability/availability.ql
@@ -0,0 +1,6 @@
+import cpp
+
+from Function f, Attribute a, int i
+where a = f.getAnAttribute()
+ and a.hasName("availability")
+select f.getName(), i, a.getArgument(i)
diff --git a/cpp/ql/test/library-tests/attributes/availability/options b/cpp/ql/test/library-tests/attributes/availability/options
new file mode 100644
index 000000000000..93878bfd66cb
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/availability/options
@@ -0,0 +1 @@
+extractor_flags: --edg --clang
diff --git a/cpp/ql/test/library-tests/attributes/deprecated_with_msg/clang421.c b/cpp/ql/test/library-tests/attributes/deprecated_with_msg/clang421.c
new file mode 100644
index 000000000000..43e489fdffb8
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/deprecated_with_msg/clang421.c
@@ -0,0 +1,2 @@
+static int clang421 = __has_feature(attribute_deprecated_with_message);
+// semmle-extractor-options: --gnu_version 40201 --edg --clang
diff --git a/cpp/ql/test/library-tests/attributes/deprecated_with_msg/clang450.c b/cpp/ql/test/library-tests/attributes/deprecated_with_msg/clang450.c
new file mode 100644
index 000000000000..80b0a5a8711c
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/deprecated_with_msg/clang450.c
@@ -0,0 +1,2 @@
+static int clang450 = __has_feature(attribute_deprecated_with_message);
+// semmle-extractor-options: --gnu_version 40500 --edg --clang
diff --git a/cpp/ql/test/library-tests/attributes/deprecated_with_msg/deprecated_with_msg.expected b/cpp/ql/test/library-tests/attributes/deprecated_with_msg/deprecated_with_msg.expected
new file mode 100644
index 000000000000..fcc90fac7abd
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/deprecated_with_msg/deprecated_with_msg.expected
@@ -0,0 +1,4 @@
+| clang421.c:1:12:1:19 | clang421 | 0 |
+| clang450.c:1:12:1:19 | clang450 | 1 |
+| gcc421.c:1:12:1:17 | gcc421 | 0 |
+| gcc450.c:1:12:1:17 | gcc450 | 1 |
diff --git a/cpp/ql/test/library-tests/attributes/deprecated_with_msg/deprecated_with_msg.ql b/cpp/ql/test/library-tests/attributes/deprecated_with_msg/deprecated_with_msg.ql
new file mode 100644
index 000000000000..19157bc9ff2d
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/deprecated_with_msg/deprecated_with_msg.ql
@@ -0,0 +1,4 @@
+import cpp
+
+from Variable v
+select v, v.getInitializer().getExpr().getValue()
diff --git a/cpp/ql/test/library-tests/attributes/deprecated_with_msg/gcc421.c b/cpp/ql/test/library-tests/attributes/deprecated_with_msg/gcc421.c
new file mode 100644
index 000000000000..25ca6a4f694c
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/deprecated_with_msg/gcc421.c
@@ -0,0 +1,2 @@
+static int gcc421 = __has_feature(attribute_deprecated_with_message);
+// semmle-extractor-options: --gnu_version 40201 --edg --clang
diff --git a/cpp/ql/test/library-tests/attributes/deprecated_with_msg/gcc450.c b/cpp/ql/test/library-tests/attributes/deprecated_with_msg/gcc450.c
new file mode 100644
index 000000000000..e10dd05dfc85
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/deprecated_with_msg/gcc450.c
@@ -0,0 +1,2 @@
+static int gcc450 = __has_feature(attribute_deprecated_with_message);
+// semmle-extractor-options: --gnu_version 40500 --edg --clang
diff --git a/cpp/ql/test/library-tests/attributes/enumerators/enumerators.c b/cpp/ql/test/library-tests/attributes/enumerators/enumerators.c
new file mode 100644
index 000000000000..deccab31ee51
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/enumerators/enumerators.c
@@ -0,0 +1,23 @@
+// Some source code checks for enumerator_attributes prior to using enumerator attributes:
+enum OperationMode {
+ OM_Invalid,
+ OM_Normal,
+ OM_Terrified
+#if __has_feature(enumerator_attributes)
+ __attribute__((deprecated))
+#endif
+ ,
+ OM_AbortOnError
+#if __has_feature(enumerator_attributes)
+ __attribute__((deprecated))
+#endif
+ = 4
+};
+
+// Other source code just goes ahead and uses them:
+enum NSUserNotificationActivationType {
+ NSUserNotificationActivationTypeNone = 0,
+ NSUserNotificationActivationTypeContentsClicked = 1,
+ NSUserNotificationActivationTypeActionButtonClicked = 2,
+ NSUserNotificationActivationTypeReplied __attribute__((availability(macosx,introduced=10.9))) = 3
+};
diff --git a/cpp/ql/test/library-tests/attributes/enumerators/enumerators.expected b/cpp/ql/test/library-tests/attributes/enumerators/enumerators.expected
new file mode 100644
index 000000000000..c4799c9bed2c
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/enumerators/enumerators.expected
@@ -0,0 +1,3 @@
+| enumerators.c:5:3:5:14 | OM_Terrified | enumerators.c:7:18:7:27 | deprecated |
+| enumerators.c:10:3:10:17 | OM_AbortOnError | enumerators.c:12:18:12:27 | deprecated |
+| enumerators.c:22:5:22:43 | NSUserNotificationActivationTypeReplied | enumerators.c:22:60:22:71 | availability |
diff --git a/cpp/ql/test/library-tests/attributes/enumerators/enumerators.ql b/cpp/ql/test/library-tests/attributes/enumerators/enumerators.ql
new file mode 100644
index 000000000000..9fe445d76056
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/enumerators/enumerators.ql
@@ -0,0 +1,4 @@
+import cpp
+
+from EnumConstant ec
+select ec, ec.getAnAttribute()
diff --git a/cpp/ql/test/library-tests/attributes/enumerators/options b/cpp/ql/test/library-tests/attributes/enumerators/options
new file mode 100644
index 000000000000..5e8fada6b21f
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/enumerators/options
@@ -0,0 +1 @@
+extractor_flags: --clang
diff --git a/cpp/ql/test/library-tests/attributes/exclusive_locks_required/attributes.expected b/cpp/ql/test/library-tests/attributes/exclusive_locks_required/attributes.expected
new file mode 100644
index 000000000000..5d29f0487eef
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/exclusive_locks_required/attributes.expected
@@ -0,0 +1,5 @@
+| file://:0:0:0:0 | operator= | |
+| file://:0:0:0:0 | operator= | |
+| test.cpp:2:33:2:33 | operator= | |
+| test.cpp:2:33:2:33 | operator= | |
+| test.cpp:7:6:7:6 | f | exclusive_locks_required |
diff --git a/cpp/ql/test/library-tests/attributes/exclusive_locks_required/attributes.ql b/cpp/ql/test/library-tests/attributes/exclusive_locks_required/attributes.ql
new file mode 100644
index 000000000000..628006311be9
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/exclusive_locks_required/attributes.ql
@@ -0,0 +1,11 @@
+import cpp
+
+string attribute(Function f) {
+ if exists(f.getAnAttribute())
+ then result = f.getAnAttribute().toString()
+ else result = ""
+}
+
+from Function f
+select f, attribute(f)
+
diff --git a/cpp/ql/test/library-tests/attributes/exclusive_locks_required/test.cpp b/cpp/ql/test/library-tests/attributes/exclusive_locks_required/test.cpp
new file mode 100644
index 000000000000..346a1a5ca58c
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/exclusive_locks_required/test.cpp
@@ -0,0 +1,9 @@
+
+class __attribute__((lockable)) CSW {
+};
+
+CSW* csw;
+
+void f(void) __attribute__((exclusive_locks_required(csw))) {
+}
+
diff --git a/cpp/ql/test/library-tests/attributes/gnu_visibility/visibility.c b/cpp/ql/test/library-tests/attributes/gnu_visibility/visibility.c
new file mode 100644
index 000000000000..2eb8e4d9adb8
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/gnu_visibility/visibility.c
@@ -0,0 +1,14 @@
+int h_var __attribute__((visibility("hidden")));
+int p_var __attribute__((visibility("protected")));
+int i_var __attribute__((visibility("internal")));
+int d_var __attribute__((visibility("default")));
+
+__attribute__((visibility("hidden"))) void h_rout();
+__attribute__((visibility("protected"))) void p_rout();
+__attribute__((visibility("internal"))) void i_rout();
+__attribute__((visibility("default"))) void d_rout();
+
+struct __attribute__((visibility("hidden"))) h_type {};
+struct __attribute__((visibility("protected"))) p_type {};
+struct __attribute__((visibility("internal"))) i_type {};
+struct __attribute__((visibility("default"))) d_type {};
diff --git a/cpp/ql/test/library-tests/attributes/gnu_visibility/visibility.expected b/cpp/ql/test/library-tests/attributes/gnu_visibility/visibility.expected
new file mode 100644
index 000000000000..e48cd7bb4970
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/gnu_visibility/visibility.expected
@@ -0,0 +1,12 @@
+| visibility.c:1:5:1:9 | h_var | visibility.c:1:26:1:35 | visibility | visibility.c:1:37:1:44 | hidden |
+| visibility.c:2:5:2:9 | p_var | visibility.c:2:26:2:35 | visibility | visibility.c:2:37:2:47 | protected |
+| visibility.c:3:5:3:9 | i_var | visibility.c:3:26:3:35 | visibility | visibility.c:3:37:3:46 | internal |
+| visibility.c:4:5:4:9 | d_var | visibility.c:4:26:4:35 | visibility | visibility.c:4:37:4:45 | default |
+| visibility.c:6:47:6:52 | h_rout | visibility.c:6:16:6:25 | visibility | visibility.c:6:27:6:34 | hidden |
+| visibility.c:7:47:7:52 | p_rout | visibility.c:7:16:7:25 | visibility | visibility.c:7:27:7:37 | protected |
+| visibility.c:8:47:8:52 | i_rout | visibility.c:8:16:8:25 | visibility | visibility.c:8:27:8:36 | internal |
+| visibility.c:9:47:9:52 | d_rout | visibility.c:9:16:9:25 | visibility | visibility.c:9:27:9:35 | default |
+| visibility.c:11:49:11:54 | h_type | visibility.c:11:23:11:32 | visibility | visibility.c:11:34:11:41 | hidden |
+| visibility.c:12:49:12:54 | p_type | visibility.c:12:23:12:32 | visibility | visibility.c:12:34:12:44 | protected |
+| visibility.c:13:49:13:54 | i_type | visibility.c:13:23:13:32 | visibility | visibility.c:13:34:13:43 | internal |
+| visibility.c:14:49:14:54 | d_type | visibility.c:14:23:14:32 | visibility | visibility.c:14:34:14:42 | default |
diff --git a/cpp/ql/test/library-tests/attributes/gnu_visibility/visibility.ql b/cpp/ql/test/library-tests/attributes/gnu_visibility/visibility.ql
new file mode 100644
index 000000000000..566d9992726d
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/gnu_visibility/visibility.ql
@@ -0,0 +1,7 @@
+import cpp
+
+from Element e, Attribute a
+where a = ((Variable)e).getAnAttribute()
+ or a = ((Function)e).getAnAttribute()
+ or a = ((Struct )e).getAnAttribute()
+select e, a, a.getAnArgument()
diff --git a/cpp/ql/test/library-tests/attributes/ms_repeated/ms_repeated.c b/cpp/ql/test/library-tests/attributes/ms_repeated/ms_repeated.c
new file mode 100644
index 000000000000..5528fc6cf4e4
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/ms_repeated/ms_repeated.c
@@ -0,0 +1,2 @@
+#define FN __declspec(deprecated("aaa")) __declspec(deprecated("bbb")) int x()
+FN;
diff --git a/cpp/ql/test/library-tests/attributes/ms_repeated/ms_repeated.expected b/cpp/ql/test/library-tests/attributes/ms_repeated/ms_repeated.expected
new file mode 100644
index 000000000000..9474169d8bd2
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/ms_repeated/ms_repeated.expected
@@ -0,0 +1,2 @@
+| ms_repeated.c:2:1:2:2 | deprecated | ms_repeated.c:2:1:2:2 | aaa |
+| ms_repeated.c:2:1:2:2 | deprecated | ms_repeated.c:2:1:2:2 | bbb |
diff --git a/cpp/ql/test/library-tests/attributes/ms_repeated/ms_repeated.ql b/cpp/ql/test/library-tests/attributes/ms_repeated/ms_repeated.ql
new file mode 100644
index 000000000000..ba1916e263db
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/ms_repeated/ms_repeated.ql
@@ -0,0 +1,4 @@
+import cpp
+
+from Attribute a
+select a, a.getAnArgument()
diff --git a/cpp/ql/test/library-tests/attributes/ms_repeated/options b/cpp/ql/test/library-tests/attributes/ms_repeated/options
new file mode 100644
index 000000000000..d759bfdab2ee
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/ms_repeated/options
@@ -0,0 +1 @@
+extractor_flags: --microsoft --microsoft_version 1700
diff --git a/cpp/ql/test/library-tests/attributes/nonnull/attrs.expected b/cpp/ql/test/library-tests/attributes/nonnull/attrs.expected
new file mode 100644
index 000000000000..74b5b83c4d8c
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/nonnull/attrs.expected
@@ -0,0 +1,4 @@
+| nonnull.c:3:28:3:34 | nonnull | 1 |
+| nonnull.c:3:28:3:34 | nonnull | 2 |
+| nonnull.c:6:28:6:34 | nonnull | empty argument |
+| nonnull.c:9:28:9:34 | nonnull | |
diff --git a/cpp/ql/test/library-tests/attributes/nonnull/attrs.ql b/cpp/ql/test/library-tests/attributes/nonnull/attrs.ql
new file mode 100644
index 000000000000..847264af9e93
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/nonnull/attrs.ql
@@ -0,0 +1,10 @@
+import cpp
+
+string attributeArg(Attribute a) {
+ if exists(a.getAnArgument())
+ then result = a.getAnArgument().toString()
+ else result = ""
+}
+
+from Attribute a
+select a, attributeArg(a)
diff --git a/cpp/ql/test/library-tests/attributes/nonnull/nonnull.c b/cpp/ql/test/library-tests/attributes/nonnull/nonnull.c
new file mode 100644
index 000000000000..8ed4dcfc31df
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/nonnull/nonnull.c
@@ -0,0 +1,10 @@
+
+extern void *f1 (void *px, const void *py, int ii)
+ __attribute__((nonnull (1, 2)));
+
+extern void *f2 (void *px, const void *py, int ii)
+ __attribute__((nonnull ()));
+
+extern void *f3 (void *px, const void *py, int ii)
+ __attribute__((nonnull));
+
diff --git a/cpp/ql/test/library-tests/attributes/routine_attributes/arguments.expected b/cpp/ql/test/library-tests/attributes/routine_attributes/arguments.expected
new file mode 100644
index 000000000000..7be35948ed88
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/routine_attributes/arguments.expected
@@ -0,0 +1,7 @@
+| declspec.cpp:4:23:4:43 | Use fatal() instead | declspec.cpp:4:59:4:62 | exit | declspec.cpp:4:12:4:21 | deprecated | Use fatal() instead |
+| routine_attributes.c:3:53:3:59 | dummy | routine_attributes.c:3:12:3:24 | named_weakref | routine_attributes.c:3:44:3:50 | weakref | dummy |
+| routine_attributes.c:4:62:4:68 | dummy | routine_attributes.c:4:12:4:26 | aliased_weakref | routine_attributes.c:4:55:4:59 | alias | dummy |
+| routine_attributes.c:6:49:6:55 | dummy | routine_attributes.c:6:12:6:22 | plain_alias | routine_attributes.c:6:42:6:46 | alias | dummy |
+| routine_attributes.c:8:49:8:51 | 100 | routine_attributes.c:8:12:8:18 | init_fn | routine_attributes.c:8:37:8:47 | constructor | 100 |
+| routine_attributes.c:9:50:9:52 | 200 | routine_attributes.c:9:12:9:20 | uninit_fn | routine_attributes.c:9:39:9:48 | destructor | 200 |
+| routine_attributes.c:20:67:20:79 | "No, really!" | routine_attributes.c:20:12:20:21 | impossible | routine_attributes.c:20:40:20:65 | solves_the_halting_problem | "No, really!" |
diff --git a/cpp/ql/test/library-tests/attributes/routine_attributes/arguments.ql b/cpp/ql/test/library-tests/attributes/routine_attributes/arguments.ql
new file mode 100644
index 000000000000..f9bac5b82be7
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/routine_attributes/arguments.ql
@@ -0,0 +1,6 @@
+import cpp
+
+from Function f, Attribute a, AttributeArgument arg
+where a = f.getAnAttribute()
+ and arg = a.getAnArgument()
+select arg, f, a, arg.getValueText()
diff --git a/cpp/ql/test/library-tests/attributes/routine_attributes/declspec.cpp b/cpp/ql/test/library-tests/attributes/routine_attributes/declspec.cpp
new file mode 100644
index 000000000000..5beeed241a1c
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/routine_attributes/declspec.cpp
@@ -0,0 +1,14 @@
+__declspec(noreturn) extern void fatal();
+__declspec(dllimport) int imported();
+__declspec(dllexport) int exported() { return 4; }
+__declspec(deprecated("Use fatal() instead")) extern void exit();
+__declspec(naked) int no_clothes() {}
+__declspec(restrict) float* ma(int size);
+__declspec(noalias) void multiply(float* a, float* b, float* c);
+class X {
+ __declspec(noinline) int mbrfunc() {
+ return 0;
+ } // will not inline
+};
+static __declspec(nothrow, safebuffers) int noCheckBuffers();
+// semmle-extractor-options: --microsoft
diff --git a/cpp/ql/test/library-tests/attributes/routine_attributes/header.h b/cpp/ql/test/library-tests/attributes/routine_attributes/header.h
new file mode 100644
index 000000000000..69ba55ad316b
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/routine_attributes/header.h
@@ -0,0 +1,13 @@
+// header.h
+
+#ifndef HEADER_H
+#define HEADER_H
+
+ DLLEXPORT void myFunction1(int a, int b, int c);
+ DLLEXPORT void myFunction2(int a, int b, int c);
+ DLLEXPORT void myFunction3(int a, int b, int c);
+
+ DLLEXPORT void myFunction5(int a, int b, int c);
+ void myFunction5(int a, int b, int c);
+
+#endif // HEADER_H
diff --git a/cpp/ql/test/library-tests/attributes/routine_attributes/header_export.cpp b/cpp/ql/test/library-tests/attributes/routine_attributes/header_export.cpp
new file mode 100644
index 000000000000..e8ee94b00668
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/routine_attributes/header_export.cpp
@@ -0,0 +1,20 @@
+// semmle-extractor-options: --microsoft
+// header_export.cpp
+#define DLLEXPORT __declspec(dllexport)
+#include "header.h"
+
+DLLEXPORT void myFunction1(int a, int b, int c)
+{
+}
+
+void myFunction2(int a, int b, int c)
+{
+}
+
+DLLEXPORT void myFunction4(int a, int b, int c)
+{
+}
+
+void myFunction5(int a, int b, int c)
+{
+}
diff --git a/cpp/ql/test/library-tests/attributes/routine_attributes/header_import.cpp b/cpp/ql/test/library-tests/attributes/routine_attributes/header_import.cpp
new file mode 100644
index 000000000000..8886070392dd
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/routine_attributes/header_import.cpp
@@ -0,0 +1,4 @@
+// semmle-extractor-options: --microsoft
+// header_import.cpp
+#define DLLEXPORT __declspec(dllimport)
+#include "header.h"
diff --git a/cpp/ql/test/library-tests/attributes/routine_attributes/routine_attributes.c b/cpp/ql/test/library-tests/attributes/routine_attributes/routine_attributes.c
new file mode 100644
index 000000000000..cc10556f2740
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/routine_attributes/routine_attributes.c
@@ -0,0 +1,21 @@
+static int dummy() {}
+
+static int named_weakref() __attribute__ ((weakref ("dummy")));
+static int aliased_weakref() __attribute__ ((weakref, alias ("dummy")));
+static int plain_weakref() __attribute__ ((weakref));
+static int plain_alias() __attribute__ ((alias ("dummy")));
+
+static int init_fn() __attribute__((constructor(100)));
+static int uninit_fn() __attribute__((destructor(200)));
+
+static int pure_fn() __attribute__((pure));
+
+static int used_fn() __attribute__((used));
+static int unused_fn() __attribute__((unused));
+
+static void* my_alloc() __attribute__((malloc));
+
+static int cocktail1() __attribute__((naked, no_instrument_function, no_check_memory_usage, noinline));
+static int cocktail2() __attribute__((always_inline, nothrow));
+static int impossible() __attribute__((solves_the_halting_problem("No, really!"), cures_cancer, is_batman));
+static int empty_attr() __attribute__(());
diff --git a/cpp/ql/test/library-tests/attributes/routine_attributes/routine_attributes.expected b/cpp/ql/test/library-tests/attributes/routine_attributes/routine_attributes.expected
new file mode 100644
index 000000000000..1d2d5f1d395d
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/routine_attributes/routine_attributes.expected
@@ -0,0 +1,41 @@
+| declspec.cpp:1:34:1:38 | fatal | declspec.cpp:1:12:1:19 | noreturn |
+| declspec.cpp:2:27:2:34 | imported | declspec.cpp:2:12:2:20 | dllimport |
+| declspec.cpp:3:27:3:34 | exported | declspec.cpp:3:12:3:20 | dllexport |
+| declspec.cpp:4:59:4:62 | exit | declspec.cpp:4:12:4:21 | deprecated |
+| declspec.cpp:5:23:5:32 | no_clothes | declspec.cpp:5:12:5:16 | naked |
+| declspec.cpp:6:29:6:30 | ma | declspec.cpp:6:12:6:19 | restrict |
+| declspec.cpp:7:26:7:33 | multiply | declspec.cpp:7:12:7:18 | noalias |
+| declspec.cpp:9:29:9:35 | mbrfunc | declspec.cpp:9:15:9:22 | noinline |
+| declspec.cpp:13:45:13:58 | noCheckBuffers | declspec.cpp:13:19:13:25 | nothrow |
+| declspec.cpp:13:45:13:58 | noCheckBuffers | declspec.cpp:13:28:13:38 | safebuffers |
+| header.h:8:17:8:27 | myFunction3 | header.h:8:2:8:10 | dllexport |
+| header.h:8:17:8:27 | myFunction3 | header.h:8:2:8:10 | dllimport |
+| header_export.cpp:6:16:6:26 | myFunction1 | header.h:6:2:6:10 | dllexport |
+| header_export.cpp:6:16:6:26 | myFunction1 | header.h:6:2:6:10 | dllimport |
+| header_export.cpp:6:16:6:26 | myFunction1 | header_export.cpp:6:1:6:9 | dllexport |
+| header_export.cpp:10:6:10:16 | myFunction2 | header.h:7:2:7:10 | dllexport |
+| header_export.cpp:10:6:10:16 | myFunction2 | header.h:7:2:7:10 | dllimport |
+| header_export.cpp:14:16:14:26 | myFunction4 | header_export.cpp:14:1:14:9 | dllexport |
+| header_export.cpp:18:6:18:16 | myFunction5 | header.h:10:2:10:10 | dllexport |
+| header_export.cpp:18:6:18:16 | myFunction5 | header.h:10:2:10:10 | dllimport |
+| routine_attributes.c:3:12:3:24 | named_weakref | routine_attributes.c:3:44:3:50 | weakref |
+| routine_attributes.c:4:12:4:26 | aliased_weakref | routine_attributes.c:4:46:4:52 | weakref |
+| routine_attributes.c:4:12:4:26 | aliased_weakref | routine_attributes.c:4:55:4:59 | alias |
+| routine_attributes.c:5:12:5:24 | plain_weakref | routine_attributes.c:5:44:5:50 | weakref |
+| routine_attributes.c:6:12:6:22 | plain_alias | routine_attributes.c:6:42:6:46 | alias |
+| routine_attributes.c:8:12:8:18 | init_fn | routine_attributes.c:8:37:8:47 | constructor |
+| routine_attributes.c:9:12:9:20 | uninit_fn | routine_attributes.c:9:39:9:48 | destructor |
+| routine_attributes.c:11:12:11:18 | pure_fn | routine_attributes.c:11:37:11:40 | pure |
+| routine_attributes.c:13:12:13:18 | used_fn | routine_attributes.c:13:37:13:40 | used |
+| routine_attributes.c:14:12:14:20 | unused_fn | routine_attributes.c:14:39:14:44 | unused |
+| routine_attributes.c:16:14:16:21 | my_alloc | routine_attributes.c:16:40:16:45 | malloc |
+| routine_attributes.c:18:12:18:20 | cocktail1 | routine_attributes.c:18:39:18:43 | naked |
+| routine_attributes.c:18:12:18:20 | cocktail1 | routine_attributes.c:18:46:18:67 | no_instrument_function |
+| routine_attributes.c:18:12:18:20 | cocktail1 | routine_attributes.c:18:70:18:90 | no_check_memory_usage |
+| routine_attributes.c:18:12:18:20 | cocktail1 | routine_attributes.c:18:93:18:100 | noinline |
+| routine_attributes.c:19:12:19:20 | cocktail2 | routine_attributes.c:19:39:19:51 | always_inline |
+| routine_attributes.c:19:12:19:20 | cocktail2 | routine_attributes.c:19:54:19:60 | nothrow |
+| routine_attributes.c:20:12:20:21 | impossible | routine_attributes.c:20:40:20:65 | solves_the_halting_problem |
+| routine_attributes.c:20:12:20:21 | impossible | routine_attributes.c:20:83:20:94 | cures_cancer |
+| routine_attributes.c:20:12:20:21 | impossible | routine_attributes.c:20:97:20:105 | is_batman |
+| routine_attributes.c:21:12:21:21 | empty_attr | routine_attributes.c:21:40:21:40 | |
diff --git a/cpp/ql/test/library-tests/attributes/routine_attributes/routine_attributes.ql b/cpp/ql/test/library-tests/attributes/routine_attributes/routine_attributes.ql
new file mode 100644
index 000000000000..6df8ce4d68a8
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/routine_attributes/routine_attributes.ql
@@ -0,0 +1,5 @@
+import cpp
+
+from Function f, Attribute a
+where a = f.getAnAttribute()
+select f, a
diff --git a/cpp/ql/test/library-tests/attributes/sal/options b/cpp/ql/test/library-tests/attributes/sal/options
new file mode 100644
index 000000000000..d759bfdab2ee
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/sal/options
@@ -0,0 +1 @@
+extractor_flags: --microsoft --microsoft_version 1700
diff --git a/cpp/ql/test/library-tests/attributes/sal/sal.cpp b/cpp/ql/test/library-tests/attributes/sal/sal.cpp
new file mode 100644
index 000000000000..0b58ba7b44e4
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/sal/sal.cpp
@@ -0,0 +1,15 @@
+void Bar( // Attribute style:
+[SA_Pre(Null=SA_No,ValidBytes="cb")]
+[SA_Pre(Deref=1,Valid=SA_Yes)]
+[SA_Pre(Deref=1,Access=SA_Read)] char* pBuf, size_t cb);
+
+void Foo( // Declspec style:
+__declspec("SAL_pre")
+__declspec("SAL_valid")
+__declspec("SAL_pre")
+__declspec("SAL_deref")
+__declspec("SAL_readonly")
+__declspec("SAL_pre")
+__declspec("SAL_readableTo(byteCount(cb))") char* pBuf, size_t cb);
+
+int Exotic(__declspec("{#foo}") int thisIsWhyAttributeNamesAreHashedInFullIds);
diff --git a/cpp/ql/test/library-tests/attributes/sal/sal.expected b/cpp/ql/test/library-tests/attributes/sal/sal.expected
new file mode 100644
index 000000000000..00edf9c83b89
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/sal/sal.expected
@@ -0,0 +1,14 @@
+| 2 | sal.cpp:4:40:4:43 | pBuf | sal.cpp:2:2:2:2 | SA_Pre | 0 | Null | SA_No |
+| 2 | sal.cpp:4:40:4:43 | pBuf | sal.cpp:2:2:2:2 | SA_Pre | 1 | ValidBytes | "cb" |
+| 3 | sal.cpp:4:40:4:43 | pBuf | sal.cpp:3:2:3:2 | SA_Pre | 0 | Deref | 1 |
+| 3 | sal.cpp:4:40:4:43 | pBuf | sal.cpp:3:2:3:2 | SA_Pre | 1 | Valid | SA_Yes |
+| 4 | sal.cpp:4:40:4:43 | pBuf | sal.cpp:4:2:4:2 | SA_Pre | 0 | Deref | 1 |
+| 4 | sal.cpp:4:40:4:43 | pBuf | sal.cpp:4:2:4:2 | SA_Pre | 1 | Access | SA_Read |
+| 7 | sal.cpp:13:51:13:54 | pBuf | sal.cpp:7:12:7:12 | SAL_pre | -1 | | |
+| 8 | sal.cpp:13:51:13:54 | pBuf | sal.cpp:8:12:8:12 | SAL_valid | -1 | | |
+| 9 | sal.cpp:13:51:13:54 | pBuf | sal.cpp:9:12:9:12 | SAL_pre | -1 | | |
+| 10 | sal.cpp:13:51:13:54 | pBuf | sal.cpp:10:12:10:12 | SAL_deref | -1 | | |
+| 11 | sal.cpp:13:51:13:54 | pBuf | sal.cpp:11:12:11:12 | SAL_readonly | -1 | | |
+| 12 | sal.cpp:13:51:13:54 | pBuf | sal.cpp:12:12:12:12 | SAL_pre | -1 | | |
+| 13 | sal.cpp:13:51:13:54 | pBuf | sal.cpp:13:12:13:12 | SAL_readableTo(byteCount(cb)) | -1 | | |
+| 15 | sal.cpp:15:37:15:77 | thisIsWhyAttributeNamesAreHashedInFullIds | sal.cpp:15:23:15:23 | {#foo} | -1 | | |
diff --git a/cpp/ql/test/library-tests/attributes/sal/sal.ql b/cpp/ql/test/library-tests/attributes/sal/sal.ql
new file mode 100644
index 000000000000..e4e41a796dc5
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/sal/sal.ql
@@ -0,0 +1,23 @@
+import cpp
+
+predicate argsOrPlaceholder(Attribute a, int index, int start_line, string name, string value) {
+ if exists(a.getAnArgument()) then
+ exists(AttributeArgument arg | arg = a.getAnArgument() |
+ index = arg.getIndex() and
+ start_line = arg.getLocation().getStartLine() and
+ name = arg.getName() and
+ value = arg.getValueText()
+ )
+ else
+ (
+ index = -1 and
+ start_line = a.getLocation().getStartLine() and
+ name = "" and
+ value = ""
+ )
+}
+
+from Parameter p, Attribute a, int arg_index, int arg_line, string arg_name, string arg_value
+where a = p.getAnAttribute()
+ and argsOrPlaceholder(a, arg_index, arg_line, arg_name, arg_value)
+select arg_line, p, a, arg_index, arg_name, arg_value
diff --git a/cpp/ql/test/library-tests/attributes/stmt_attributes/all_attributes.expected b/cpp/ql/test/library-tests/attributes/stmt_attributes/all_attributes.expected
new file mode 100644
index 000000000000..83a8a2f600e5
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/stmt_attributes/all_attributes.expected
@@ -0,0 +1,6 @@
+| clang_fallthrough.cpp:11:3:11:25 | ; | clang_fallthrough.cpp:11:5:11:22 | fallthrough |
+| clang_fallthrough.cpp:20:3:20:25 | ; | clang_fallthrough.cpp:20:5:20:22 | fallthrough |
+| clang_fallthrough.cpp:22:3:22:25 | ; | clang_fallthrough.cpp:22:5:22:22 | fallthrough |
+| clang_fallthrough.cpp:36:4:36:26 | ; | clang_fallthrough.cpp:36:6:36:23 | fallthrough |
+| clang_fallthrough.cpp:41:5:41:27 | ; | clang_fallthrough.cpp:41:7:41:24 | fallthrough |
+| clang_fallthrough.cpp:43:3:43:25 | ; | clang_fallthrough.cpp:43:5:43:22 | fallthrough |
diff --git a/cpp/ql/test/library-tests/attributes/stmt_attributes/all_attributes.ql b/cpp/ql/test/library-tests/attributes/stmt_attributes/all_attributes.ql
new file mode 100644
index 000000000000..d7b70aa9a683
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/stmt_attributes/all_attributes.ql
@@ -0,0 +1,5 @@
+import cpp
+
+from Stmt s, Attribute a
+where a = s.getAnAttribute()
+select s, a
diff --git a/cpp/ql/test/library-tests/attributes/stmt_attributes/clang_fallthrough.cpp b/cpp/ql/test/library-tests/attributes/stmt_attributes/clang_fallthrough.cpp
new file mode 100644
index 000000000000..9d92b937d671
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/stmt_attributes/clang_fallthrough.cpp
@@ -0,0 +1,45 @@
+
+void test(int x) {
+ int y = 0;
+
+ switch (x)
+ {
+ case 1:
+ break;
+ case 2:
+ case 3:
+ [[clang::fallthrough]];
+
+ case 4:
+ y++;
+ break;
+ case 5:
+ y++;
+ case 6:
+ y++;
+ [[clang::fallthrough]];
+ case 7:
+ [[clang::fallthrough]];
+ y++;
+
+ case 8:
+ {
+ y++;
+ } break;
+ case 9:
+ {
+ y++;
+ }
+ case 10:
+ {
+ y++;
+ [[clang::fallthrough]];
+ }
+ case 11:
+ {
+ y++;
+ } [[clang::fallthrough]];
+ default:
+ [[clang::fallthrough]];
+ }
+}
diff --git a/cpp/ql/test/library-tests/attributes/stmt_attributes/clang_fallthrough.expected b/cpp/ql/test/library-tests/attributes/stmt_attributes/clang_fallthrough.expected
new file mode 100644
index 000000000000..c59d73cfdad8
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/stmt_attributes/clang_fallthrough.expected
@@ -0,0 +1,4 @@
+| clang_fallthrough.cpp:11:3:11:25 | ; | clang_fallthrough.cpp:11:5:11:22 |
+| clang_fallthrough.cpp:20:3:20:25 | ; | clang_fallthrough.cpp:20:5:20:22 |
+| clang_fallthrough.cpp:36:4:36:26 | ; | clang_fallthrough.cpp:36:6:36:23 |
+| clang_fallthrough.cpp:41:5:41:27 | ; | clang_fallthrough.cpp:41:7:41:24 |
diff --git a/cpp/ql/test/library-tests/attributes/stmt_attributes/clang_fallthrough.ql b/cpp/ql/test/library-tests/attributes/stmt_attributes/clang_fallthrough.ql
new file mode 100644
index 000000000000..cb4dbdb7bf75
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/stmt_attributes/clang_fallthrough.ql
@@ -0,0 +1,7 @@
+import cpp
+
+from Stmt s, StdAttribute a
+where s.getASuccessor() instanceof SwitchCase
+ and a = s.getAnAttribute()
+ and a.hasQualifiedName("clang", "fallthrough")
+select s, a.getLocation().toString()
diff --git a/cpp/ql/test/library-tests/attributes/type_attributes/arguments.expected b/cpp/ql/test/library-tests/attributes/type_attributes/arguments.expected
new file mode 100644
index 000000000000..b668523ad4e6
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/type_attributes/arguments.expected
@@ -0,0 +1,3 @@
+| type_attributes_ms.cpp:4:67:4:75 | IDispatch | type_attributes_ms.cpp:4:19:4:22 | uuid | type_attributes_ms.cpp:4:24:4:63 | {00020400-0000-0000-c000-000000000046} |
+| type_attributes_ms.cpp:5:30:5:33 | Str1 | type_attributes_ms.cpp:5:12:5:16 | align | type_attributes_ms.cpp:5:18:5:19 | 32 |
+| type_attributes_ms.cpp:6:55:6:62 | IUnknown | type_attributes_ms.cpp:6:2:6:2 | uuid | type_attributes_ms.cpp:6:2:6:2 | 00000000-0000-0000-c000-000000000046 |
diff --git a/cpp/ql/test/library-tests/attributes/type_attributes/arguments.ql b/cpp/ql/test/library-tests/attributes/type_attributes/arguments.ql
new file mode 100644
index 000000000000..c17576c97475
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/type_attributes/arguments.ql
@@ -0,0 +1,6 @@
+import cpp
+
+from Type t, Attribute a, AttributeArgument arg
+where a = t.getAnAttribute()
+ and arg = a.getAnArgument()
+select t, a, arg
diff --git a/cpp/ql/test/library-tests/attributes/type_attributes/type_attributes.c b/cpp/ql/test/library-tests/attributes/type_attributes/type_attributes.c
new file mode 100644
index 000000000000..1111602430a5
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/type_attributes/type_attributes.c
@@ -0,0 +1,26 @@
+// Compilable with
+// gcc -c type_attributes.c
+// clang -c type_attributes.c
+
+struct __attribute__((__packed__)) my_packed_struct {
+ char c;
+ int i;
+};
+
+typedef union __attribute__((__transparent_union__)) {
+ int i;
+ int j;
+} tu;
+
+// This union can't be made transparent, as the types aren't the same size
+typedef union __attribute__((__transparent_union__)) {
+ char c;
+ long long int j;
+} notTransparent;
+
+typedef __attribute__((unused)) int unusedInt;
+
+typedef int depInt __attribute__ ((deprecated));
+
+typedef short __attribute__((__may_alias__)) short_a;
+
diff --git a/cpp/ql/test/library-tests/attributes/type_attributes/type_attributes.expected b/cpp/ql/test/library-tests/attributes/type_attributes/type_attributes.expected
new file mode 100644
index 000000000000..7002f036019b
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/type_attributes/type_attributes.expected
@@ -0,0 +1,10 @@
+| file://:0:0:0:0 | short __attribute((__may_alias__)) | type_attributes.c:25:30:25:42 | may_alias |
+| type_attributes.c:5:36:5:51 | my_packed_struct | type_attributes.c:5:23:5:32 | packed |
+| type_attributes.c:10:54:10:54 | union | type_attributes.c:10:30:10:50 | transparent_union |
+| type_attributes.c:16:54:16:54 | union | type_attributes.c:16:30:16:50 | transparent_union |
+| type_attributes.c:21:37:21:45 | unusedInt | type_attributes.c:21:24:21:29 | unused |
+| type_attributes.c:23:13:23:18 | depInt | type_attributes.c:23:36:23:45 | deprecated |
+| type_attributes_ms.cpp:1:29:1:29 | X | type_attributes_ms.cpp:1:19:1:26 | novtable |
+| type_attributes_ms.cpp:4:67:4:75 | IDispatch | type_attributes_ms.cpp:4:19:4:22 | uuid |
+| type_attributes_ms.cpp:5:30:5:33 | Str1 | type_attributes_ms.cpp:5:12:5:16 | align |
+| type_attributes_ms.cpp:6:55:6:62 | IUnknown | type_attributes_ms.cpp:6:2:6:2 | uuid |
diff --git a/cpp/ql/test/library-tests/attributes/type_attributes/type_attributes.ql b/cpp/ql/test/library-tests/attributes/type_attributes/type_attributes.ql
new file mode 100644
index 000000000000..90e7b5bd26d2
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/type_attributes/type_attributes.ql
@@ -0,0 +1,5 @@
+import cpp
+
+from Type t, Attribute a
+where a = t.getAnAttribute()
+select t, a
diff --git a/cpp/ql/test/library-tests/attributes/type_attributes/type_attributes_ms.cpp b/cpp/ql/test/library-tests/attributes/type_attributes/type_attributes_ms.cpp
new file mode 100644
index 000000000000..8f3658e38d9a
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/type_attributes/type_attributes_ms.cpp
@@ -0,0 +1,8 @@
+struct __declspec(novtable) X {
+ virtual void mf();
+};
+struct __declspec(uuid("{00020400-0000-0000-c000-000000000046}")) IDispatch;
+__declspec(align(32)) struct Str1{ int a; };
+[uuid("00000000-0000-0000-C000-000000000046")] struct IUnknown;
+
+// semmle-extractor-options: --microsoft
diff --git a/cpp/ql/test/library-tests/attributes/var_attributes/ms_var_attributes.cpp b/cpp/ql/test/library-tests/attributes/var_attributes/ms_var_attributes.cpp
new file mode 100644
index 000000000000..5952529e93eb
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/var_attributes/ms_var_attributes.cpp
@@ -0,0 +1,18 @@
+// semmle-extractor-options: --microsoft
+// ms_var_attributes.cpp
+#define DLLEXPORT __declspec(dllexport)
+#include "ms_var_attributes.h"
+
+DLLEXPORT int myInt1 = 100;
+int myInt2 = 100;
+DLLEXPORT int myInt4 = 100;
+int myInt5 = 100;
+
+class AddressOfGetter {
+ __declspec(property(get = getter)) int field;
+ int& getter() throw();
+ void f() throw()
+ {
+ &field;
+ }
+};
diff --git a/cpp/ql/test/library-tests/attributes/var_attributes/ms_var_attributes.h b/cpp/ql/test/library-tests/attributes/var_attributes/ms_var_attributes.h
new file mode 100644
index 000000000000..527f6e892f1c
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/var_attributes/ms_var_attributes.h
@@ -0,0 +1,8 @@
+// ms_var_attributes.h
+
+DLLEXPORT extern int myInt1;
+DLLEXPORT extern int myInt2;
+DLLEXPORT extern int myInt3;
+
+DLLEXPORT extern int myInt5;
+extern int myInt5;
diff --git a/cpp/ql/test/library-tests/attributes/var_attributes/var_attributes.c b/cpp/ql/test/library-tests/attributes/var_attributes/var_attributes.c
new file mode 100644
index 000000000000..336b6971bdfb
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/var_attributes/var_attributes.c
@@ -0,0 +1,6 @@
+ int weak_var __attribute__((weak));
+static int weakref_var __attribute__((weakref));
+static int used_var __attribute__((used));
+static int unused_var __attribute__((unused));
+
+static void f1(unsigned unused_param __attribute__((unused))) {}
diff --git a/cpp/ql/test/library-tests/attributes/var_attributes/var_attributes.expected b/cpp/ql/test/library-tests/attributes/var_attributes/var_attributes.expected
new file mode 100644
index 000000000000..2ef69dc6c441
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/var_attributes/var_attributes.expected
@@ -0,0 +1,11 @@
+| ms_var_attributes.cpp:6:15:6:20 | myInt1 | ms_var_attributes.cpp:6:1:6:9 | dllexport |
+| ms_var_attributes.cpp:6:15:6:20 | myInt1 | ms_var_attributes.h:3:1:3:9 | dllexport |
+| ms_var_attributes.cpp:7:5:7:10 | myInt2 | ms_var_attributes.h:4:1:4:9 | dllexport |
+| ms_var_attributes.cpp:8:15:8:20 | myInt4 | ms_var_attributes.cpp:8:1:8:9 | dllexport |
+| ms_var_attributes.cpp:9:5:9:10 | myInt5 | ms_var_attributes.h:7:1:7:9 | dllexport |
+| ms_var_attributes.h:5:22:5:27 | myInt3 | ms_var_attributes.h:5:1:5:9 | dllexport |
+| var_attributes.c:1:12:1:19 | weak_var | var_attributes.c:1:36:1:39 | weak |
+| var_attributes.c:2:12:2:22 | weakref_var | var_attributes.c:2:39:2:45 | weakref |
+| var_attributes.c:3:12:3:19 | used_var | var_attributes.c:3:36:3:39 | used |
+| var_attributes.c:4:12:4:21 | unused_var | var_attributes.c:4:38:4:43 | unused |
+| var_attributes.c:6:25:6:36 | unused_param | var_attributes.c:6:53:6:58 | unused |
diff --git a/cpp/ql/test/library-tests/attributes/var_attributes/var_attributes.ql b/cpp/ql/test/library-tests/attributes/var_attributes/var_attributes.ql
new file mode 100644
index 000000000000..4c63354fa9c7
--- /dev/null
+++ b/cpp/ql/test/library-tests/attributes/var_attributes/var_attributes.ql
@@ -0,0 +1,5 @@
+import cpp
+
+from Variable v, Attribute a
+where a = v.getAnAttribute()
+select v, a
diff --git a/cpp/ql/test/library-tests/basic_blocks/bb_cfg.expected b/cpp/ql/test/library-tests/basic_blocks/bb_cfg.expected
new file mode 100644
index 000000000000..a081680ad466
--- /dev/null
+++ b/cpp/ql/test/library-tests/basic_blocks/bb_cfg.expected
@@ -0,0 +1,235 @@
+| f_cond_1 | false | 421 | 421 | 3 [test.c:93:17:93:17] |
+| f_cond_1 | false | 424 | 424 | 4 [test.c:93:21:93:21] |
+| f_cond_1 | false | 433 | 433 | return ... [test.c:94:5:94:11] |
+| f_cond_1 | false | 435 | 435 | { ... } [test.c:92:22:95:1] |
+| f_cond_1 | true | 421 | 433 | |
+| f_cond_1 | true | 424 | 433 | |
+| f_cond_1 | true | 435 | 421 | T |
+| f_cond_1 | true | 435 | 424 | F |
+| f_cond_2 | false | 447 | 447 | 3 [test.c:98:17:98:17] |
+| f_cond_2 | false | 450 | 450 | 4 [test.c:98:21:98:21] |
+| f_cond_2 | false | 461 | 461 | return ... [test.c:99:5:99:11] |
+| f_cond_2 | false | 463 | 463 | { ... } [test.c:97:21:100:1] |
+| f_cond_2 | true | 447 | 461 | |
+| f_cond_2 | true | 450 | 461 | |
+| f_cond_2 | true | 463 | 447 | T |
+| f_cond_3 | false | 475 | 475 | 3 [test.c:103:17:103:17] |
+| f_cond_3 | false | 478 | 478 | 4 [test.c:103:21:103:21] |
+| f_cond_3 | false | 489 | 489 | return ... [test.c:104:5:104:11] |
+| f_cond_3 | false | 491 | 491 | { ... } [test.c:102:21:105:1] |
+| f_cond_3 | true | 475 | 489 | |
+| f_cond_3 | true | 478 | 489 | |
+| f_cond_3 | true | 491 | 478 | F |
+| f_do_1 | false | 368 | 368 | { ... } [test.c:72:8:74:5] |
+| f_do_1 | false | 372 | 372 | return ... [test.c:75:5:75:11] |
+| f_do_1 | false | 374 | 374 | { ... } [test.c:71:20:76:1] |
+| f_do_1 | true | 368 | 368 | T |
+| f_do_1 | true | 368 | 372 | F |
+| f_do_1 | true | 374 | 368 | |
+| f_do_2 | false | 385 | 385 | { ... } [test.c:79:8:81:5] |
+| f_do_2 | false | 389 | 389 | return ... [test.c:82:5:82:11] |
+| f_do_2 | false | 391 | 391 | { ... } [test.c:78:19:83:1] |
+| f_do_2 | true | 385 | 385 | T |
+| f_do_2 | true | 391 | 385 | |
+| f_do_3 | false | 402 | 402 | { ... } [test.c:86:8:88:5] |
+| f_do_3 | false | 406 | 406 | return ... [test.c:89:5:89:11] |
+| f_do_3 | false | 408 | 408 | { ... } [test.c:85:19:90:1] |
+| f_do_3 | true | 402 | 406 | F |
+| f_do_3 | true | 408 | 402 | |
+| f_for_1 | false | 198 | 198 | i [test.c:28:16:28:16] |
+| f_for_1 | false | 207 | 207 | { ... } [test.c:28:29:30:5] |
+| f_for_1 | false | 224 | 224 | return ... [test.c:31:5:31:11] |
+| f_for_1 | false | 226 | 226 | { ... } [test.c:26:20:32:1] |
+| f_for_1 | true | 198 | 207 | T |
+| f_for_1 | true | 198 | 224 | F |
+| f_for_1 | true | 207 | 198 | |
+| f_for_1 | true | 226 | 198 | |
+| f_for_2 | false | 239 | 239 | 1 [test.c:36:16:36:16] |
+| f_for_2 | false | 242 | 242 | { ... } [test.c:36:24:38:5] |
+| f_for_2 | false | 259 | 259 | return ... [test.c:39:5:39:11] |
+| f_for_2 | false | 261 | 261 | { ... } [test.c:34:20:40:1] |
+| f_for_2 | true | 239 | 242 | T |
+| f_for_2 | true | 242 | 239 | |
+| f_for_2 | true | 261 | 239 | |
+| f_for_3 | false | 274 | 274 | 0 [test.c:44:16:44:16] |
+| f_for_3 | false | 277 | 277 | { ... } [test.c:44:24:46:5] |
+| f_for_3 | false | 294 | 294 | return ... [test.c:47:5:47:11] |
+| f_for_3 | false | 296 | 296 | { ... } [test.c:42:20:48:1] |
+| f_for_3 | true | 274 | 294 | F |
+| f_for_3 | true | 277 | 274 | |
+| f_for_3 | true | 296 | 274 | |
+| f_if_1 | false | 135 | 135 | { ... } [test.c:3:12:5:5] |
+| f_if_1 | false | 139 | 139 | { ... } [test.c:5:12:7:5] |
+| f_if_1 | false | 143 | 143 | return ... [test.c:8:1:8:1] |
+| f_if_1 | false | 145 | 145 | { ... } [test.c:2:20:8:1] |
+| f_if_1 | true | 135 | 143 | |
+| f_if_1 | true | 139 | 143 | |
+| f_if_1 | true | 145 | 135 | T |
+| f_if_1 | true | 145 | 139 | F |
+| f_if_2 | false | 156 | 156 | { ... } [test.c:11:12:13:5] |
+| f_if_2 | false | 160 | 160 | { ... } [test.c:13:12:15:5] |
+| f_if_2 | false | 164 | 164 | return ... [test.c:16:1:16:1] |
+| f_if_2 | false | 166 | 166 | { ... } [test.c:10:19:16:1] |
+| f_if_2 | true | 156 | 164 | |
+| f_if_2 | true | 160 | 164 | |
+| f_if_2 | true | 166 | 156 | T |
+| f_if_3 | false | 177 | 177 | { ... } [test.c:19:12:21:5] |
+| f_if_3 | false | 181 | 181 | { ... } [test.c:21:12:23:5] |
+| f_if_3 | false | 185 | 185 | return ... [test.c:24:1:24:1] |
+| f_if_3 | false | 187 | 187 | { ... } [test.c:18:19:24:1] |
+| f_if_3 | true | 177 | 185 | |
+| f_if_3 | true | 181 | 185 | |
+| f_if_3 | true | 187 | 181 | F |
+| f_switch_1 | false | 495 | 495 | f_switch_1 [test.c:107:6:107:15] |
+| f_switch_1 | false | 504 | 504 | case ...: [test.c:109:9:109:15] |
+| f_switch_1 | false | 511 | 511 | case ...: [test.c:111:9:111:15] |
+| f_switch_1 | false | 518 | 518 | case ...: [test.c:113:9:113:15] |
+| f_switch_1 | false | 523 | 523 | case ...: [test.c:114:9:114:15] |
+| f_switch_1 | false | 530 | 530 | case ...: [test.c:116:9:116:15] |
+| f_switch_1 | false | 534 | 534 | default: [test.c:118:9:118:16] |
+| f_switch_1 | false | 542 | 542 | return ... [test.c:121:5:121:11] |
+| f_switch_1 | false | 544 | 544 | { ... } [test.c:107:24:122:1] |
+| f_switch_1 | true | 504 | 495 | |
+| f_switch_1 | true | 511 | 495 | |
+| f_switch_1 | true | 518 | 523 | |
+| f_switch_1 | true | 523 | 530 | |
+| f_switch_1 | true | 530 | 495 | |
+| f_switch_1 | true | 534 | 495 | |
+| f_switch_1 | true | 542 | 495 | |
+| f_switch_1 | true | 544 | 504 | |
+| f_switch_1 | true | 544 | 511 | |
+| f_switch_1 | true | 544 | 518 | |
+| f_switch_1 | true | 544 | 523 | |
+| f_switch_1 | true | 544 | 530 | |
+| f_switch_1 | true | 544 | 534 | |
+| f_switch_2 | false | 548 | 548 | f_switch_2 [test.c:124:6:124:15] |
+| f_switch_2 | false | 557 | 557 | case ...: [test.c:126:9:126:15] |
+| f_switch_2 | false | 564 | 564 | case ...: [test.c:128:9:128:15] |
+| f_switch_2 | false | 571 | 571 | case ...: [test.c:130:9:130:15] |
+| f_switch_2 | false | 576 | 576 | case ...: [test.c:131:9:131:15] |
+| f_switch_2 | false | 583 | 583 | case ...: [test.c:133:9:133:15] |
+| f_switch_2 | false | 591 | 591 | return ... [test.c:136:5:136:11] |
+| f_switch_2 | false | 593 | 593 | { ... } [test.c:124:24:137:1] |
+| f_switch_2 | true | 557 | 548 | |
+| f_switch_2 | true | 564 | 548 | |
+| f_switch_2 | true | 571 | 576 | |
+| f_switch_2 | true | 576 | 583 | |
+| f_switch_2 | true | 583 | 548 | |
+| f_switch_2 | true | 591 | 548 | |
+| f_switch_2 | true | 593 | 557 | |
+| f_switch_2 | true | 593 | 564 | |
+| f_switch_2 | true | 593 | 571 | |
+| f_switch_2 | true | 593 | 576 | |
+| f_switch_2 | true | 593 | 583 | |
+| f_switch_2 | true | 593 | 591 | |
+| f_switch_3 | false | 596 | 596 | f_switch_3 [test.c:139:6:139:15] |
+| f_switch_3 | false | 605 | 605 | case ...: [test.c:141:9:141:15] |
+| f_switch_3 | false | 612 | 612 | case ...: [test.c:143:9:143:15] |
+| f_switch_3 | false | 619 | 619 | case ...: [test.c:145:9:145:15] |
+| f_switch_3 | false | 624 | 624 | case ...: [test.c:146:9:146:15] |
+| f_switch_3 | false | 631 | 631 | case ...: [test.c:148:9:148:15] |
+| f_switch_3 | false | 635 | 635 | default: [test.c:150:9:150:16] |
+| f_switch_3 | false | 643 | 643 | return ... [test.c:153:5:153:11] |
+| f_switch_3 | false | 645 | 645 | { ... } [test.c:139:23:154:1] |
+| f_switch_3 | true | 605 | 596 | |
+| f_switch_3 | true | 612 | 596 | |
+| f_switch_3 | true | 619 | 624 | |
+| f_switch_3 | true | 624 | 631 | |
+| f_switch_3 | true | 631 | 596 | |
+| f_switch_3 | true | 635 | 596 | |
+| f_switch_3 | true | 643 | 596 | |
+| f_switch_3 | true | 645 | 612 | |
+| f_switch_4 | false | 648 | 648 | f_switch_4 [test.c:156:6:156:15] |
+| f_switch_4 | false | 657 | 657 | case ...: [test.c:158:9:158:15] |
+| f_switch_4 | false | 664 | 664 | case ...: [test.c:160:9:160:15] |
+| f_switch_4 | false | 671 | 671 | case ...: [test.c:162:9:162:15] |
+| f_switch_4 | false | 676 | 676 | case ...: [test.c:163:9:163:15] |
+| f_switch_4 | false | 683 | 683 | case ...: [test.c:165:9:165:15] |
+| f_switch_4 | false | 691 | 691 | return ... [test.c:168:5:168:11] |
+| f_switch_4 | false | 693 | 693 | { ... } [test.c:156:23:169:1] |
+| f_switch_4 | true | 657 | 648 | |
+| f_switch_4 | true | 664 | 648 | |
+| f_switch_4 | true | 671 | 676 | |
+| f_switch_4 | true | 676 | 683 | |
+| f_switch_4 | true | 683 | 648 | |
+| f_switch_4 | true | 691 | 648 | |
+| f_switch_4 | true | 693 | 664 | |
+| f_switch_4 | true | 693 | 691 | |
+| f_switch_5 | false | 696 | 696 | f_switch_5 [test.c:171:6:171:15] |
+| f_switch_5 | false | 705 | 705 | case ...: [test.c:173:9:173:15] |
+| f_switch_5 | false | 712 | 712 | case ...: [test.c:175:9:175:15] |
+| f_switch_5 | false | 719 | 719 | case ...: [test.c:177:9:177:15] |
+| f_switch_5 | false | 724 | 724 | case ...: [test.c:178:9:178:15] |
+| f_switch_5 | false | 731 | 731 | case ...: [test.c:180:9:180:15] |
+| f_switch_5 | false | 735 | 735 | default: [test.c:182:9:182:16] |
+| f_switch_5 | false | 743 | 743 | return ... [test.c:185:5:185:11] |
+| f_switch_5 | false | 745 | 745 | { ... } [test.c:171:23:186:1] |
+| f_switch_5 | true | 705 | 696 | |
+| f_switch_5 | true | 712 | 696 | |
+| f_switch_5 | true | 719 | 724 | |
+| f_switch_5 | true | 724 | 731 | |
+| f_switch_5 | true | 731 | 696 | |
+| f_switch_5 | true | 735 | 696 | |
+| f_switch_5 | true | 743 | 696 | |
+| f_switch_5 | true | 745 | 735 | |
+| f_switch_6 | false | 748 | 748 | f_switch_6 [test.c:188:6:188:15] |
+| f_switch_6 | false | 757 | 757 | case ...: [test.c:190:9:190:15] |
+| f_switch_6 | false | 764 | 764 | case ...: [test.c:192:9:192:15] |
+| f_switch_6 | false | 771 | 771 | case ...: [test.c:194:9:194:15] |
+| f_switch_6 | false | 776 | 776 | case ...: [test.c:195:9:195:15] |
+| f_switch_6 | false | 783 | 783 | case ...: [test.c:197:9:197:15] |
+| f_switch_6 | false | 791 | 791 | return ... [test.c:200:5:200:11] |
+| f_switch_6 | false | 793 | 793 | { ... } [test.c:188:23:201:1] |
+| f_switch_6 | true | 757 | 748 | |
+| f_switch_6 | true | 764 | 748 | |
+| f_switch_6 | true | 771 | 776 | |
+| f_switch_6 | true | 776 | 783 | |
+| f_switch_6 | true | 783 | 748 | |
+| f_switch_6 | true | 791 | 748 | |
+| f_switch_6 | true | 793 | 791 | |
+| f_switch_7 | false | 797 | 797 | f_switch_7 [test.c:203:6:203:15] |
+| f_switch_7 | false | 805 | 805 | 1 [test.c:204:16:204:16] |
+| f_switch_7 | false | 808 | 808 | 3 [test.c:204:20:204:20] |
+| f_switch_7 | false | 814 | 814 | case ...: [test.c:205:9:205:15] |
+| f_switch_7 | false | 821 | 821 | case ...: [test.c:207:9:207:15] |
+| f_switch_7 | false | 828 | 828 | case ...: [test.c:209:9:209:15] |
+| f_switch_7 | false | 833 | 833 | case ...: [test.c:210:9:210:15] |
+| f_switch_7 | false | 840 | 840 | case ...: [test.c:212:9:212:15] |
+| f_switch_7 | false | 844 | 844 | { ... } [test.c:204:23:214:5] |
+| f_switch_7 | false | 848 | 848 | return ... [test.c:215:5:215:11] |
+| f_switch_7 | false | 850 | 850 | { ... } [test.c:203:24:216:1] |
+| f_switch_7 | true | 805 | 844 | |
+| f_switch_7 | true | 808 | 844 | |
+| f_switch_7 | true | 814 | 797 | |
+| f_switch_7 | true | 821 | 797 | |
+| f_switch_7 | true | 828 | 833 | |
+| f_switch_7 | true | 833 | 840 | |
+| f_switch_7 | true | 840 | 797 | |
+| f_switch_7 | true | 844 | 821 | |
+| f_switch_7 | true | 844 | 833 | |
+| f_switch_7 | true | 844 | 848 | |
+| f_switch_7 | true | 848 | 797 | |
+| f_switch_7 | true | 850 | 805 | T |
+| f_switch_7 | true | 850 | 808 | F |
+| f_while_1 | false | 304 | 304 | i [test.c:51:11:51:11] |
+| f_while_1 | false | 312 | 312 | { ... } [test.c:51:14:53:5] |
+| f_while_1 | false | 316 | 316 | return ... [test.c:54:5:54:11] |
+| f_while_1 | false | 318 | 318 | { ... } [test.c:50:23:55:1] |
+| f_while_1 | true | 304 | 312 | T |
+| f_while_1 | true | 304 | 316 | F |
+| f_while_1 | true | 312 | 304 | |
+| f_while_1 | true | 318 | 304 | |
+| f_while_2 | false | 326 | 326 | 1 [test.c:58:11:58:11] |
+| f_while_2 | false | 329 | 329 | { ... } [test.c:58:14:60:5] |
+| f_while_2 | false | 333 | 333 | return ... [test.c:61:5:61:11] |
+| f_while_2 | false | 335 | 335 | { ... } [test.c:57:22:62:1] |
+| f_while_2 | true | 326 | 329 | T |
+| f_while_2 | true | 329 | 326 | |
+| f_while_2 | true | 335 | 326 | |
+| f_while_3 | false | 343 | 343 | 0 [test.c:65:11:65:11] |
+| f_while_3 | false | 346 | 346 | { ... } [test.c:65:14:67:5] |
+| f_while_3 | false | 350 | 350 | return ... [test.c:68:5:68:11] |
+| f_while_3 | false | 352 | 352 | { ... } [test.c:64:22:69:1] |
+| f_while_3 | true | 343 | 350 | F |
+| f_while_3 | true | 346 | 343 | |
+| f_while_3 | true | 352 | 343 | |
diff --git a/cpp/ql/test/library-tests/basic_blocks/bb_cfg.ql b/cpp/ql/test/library-tests/basic_blocks/bb_cfg.ql
new file mode 100644
index 000000000000..96bcd3987109
--- /dev/null
+++ b/cpp/ql/test/library-tests/basic_blocks/bb_cfg.ql
@@ -0,0 +1,34 @@
+// query-type: graph
+import cpp
+
+class DestructorCallEnhanced extends DestructorCall {
+ override string toString() {
+ if exists(this.getQualifier().(VariableAccess).getTarget().getName())
+ then result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." + this.getTarget().getName()
+ else result = super.toString()
+ }
+}
+
+string scope(ControlFlowNode x) {
+ if exists(x.getControlFlowScope().getQualifiedName())
+ then result = x.getControlFlowScope().getQualifiedName()
+ else result = ""
+}
+
+predicate isNode(boolean isEdge, BasicBlock x, BasicBlock y, string label) {
+ isEdge = false and x = y and label = x.getStart().toString() + " [" + x.getStart().getLocation().toString() + "]"
+}
+
+predicate isSuccessor(boolean isEdge, BasicBlock x, BasicBlock y, string label) {
+ exists(string truelabel, string falselabel |
+ isEdge = true
+ and x.getASuccessor() = y
+ and if x.getATrueSuccessor() = y then truelabel = "T" else truelabel = ""
+ and if x.getAFalseSuccessor() = y then falselabel = "F" else falselabel = ""
+ and label = truelabel + falselabel)
+}
+
+from boolean isEdge, BasicBlock x, BasicBlock y, string label
+where isNode(isEdge, x, y, label) or isSuccessor(isEdge, x, y, label)
+select scope(x), isEdge, x, y, label
+
diff --git a/cpp/ql/test/library-tests/basic_blocks/cfg.expected b/cpp/ql/test/library-tests/basic_blocks/cfg.expected
new file mode 100644
index 000000000000..11bdb1e3e58b
--- /dev/null
+++ b/cpp/ql/test/library-tests/basic_blocks/cfg.expected
@@ -0,0 +1,548 @@
+| f_cond_1 | false | 354 | 354 | f_cond_1 |
+| f_cond_1 | false | 363 | 363 | ... ? ... : ... |
+| f_cond_1 | false | 365 | 365 | i |
+| f_cond_1 | false | 369 | 369 | 3 |
+| f_cond_1 | false | 372 | 372 | 4 |
+| f_cond_1 | false | 373 | 373 | initializer for j |
+| f_cond_1 | false | 377 | 377 | { ... } |
+| f_cond_1 | false | 379 | 379 | declaration |
+| f_cond_1 | false | 381 | 381 | return ... |
+| f_cond_1 | true | 363 | 365 | |
+| f_cond_1 | true | 365 | 369 | T |
+| f_cond_1 | true | 365 | 372 | F |
+| f_cond_1 | true | 369 | 381 | |
+| f_cond_1 | true | 372 | 381 | |
+| f_cond_1 | true | 373 | 363 | |
+| f_cond_1 | true | 377 | 379 | |
+| f_cond_1 | true | 379 | 373 | |
+| f_cond_1 | true | 381 | 354 | |
+| f_cond_2 | false | 383 | 383 | f_cond_2 |
+| f_cond_2 | false | 389 | 389 | ... ? ... : ... |
+| f_cond_2 | false | 393 | 393 | 1 |
+| f_cond_2 | false | 396 | 396 | 3 |
+| f_cond_2 | false | 399 | 399 | 4 |
+| f_cond_2 | false | 402 | 402 | initializer for j |
+| f_cond_2 | false | 406 | 406 | { ... } |
+| f_cond_2 | false | 408 | 408 | declaration |
+| f_cond_2 | false | 410 | 410 | return ... |
+| f_cond_2 | true | 389 | 393 | |
+| f_cond_2 | true | 393 | 396 | T |
+| f_cond_2 | true | 396 | 410 | |
+| f_cond_2 | true | 399 | 410 | |
+| f_cond_2 | true | 402 | 389 | |
+| f_cond_2 | true | 406 | 408 | |
+| f_cond_2 | true | 408 | 402 | |
+| f_cond_2 | true | 410 | 383 | |
+| f_cond_3 | false | 412 | 412 | f_cond_3 |
+| f_cond_3 | false | 418 | 418 | ... ? ... : ... |
+| f_cond_3 | false | 422 | 422 | 0 |
+| f_cond_3 | false | 425 | 425 | 3 |
+| f_cond_3 | false | 428 | 428 | 4 |
+| f_cond_3 | false | 431 | 431 | initializer for j |
+| f_cond_3 | false | 435 | 435 | { ... } |
+| f_cond_3 | false | 437 | 437 | declaration |
+| f_cond_3 | false | 439 | 439 | return ... |
+| f_cond_3 | true | 418 | 422 | |
+| f_cond_3 | true | 422 | 428 | F |
+| f_cond_3 | true | 425 | 439 | |
+| f_cond_3 | true | 428 | 439 | |
+| f_cond_3 | true | 431 | 418 | |
+| f_cond_3 | true | 435 | 437 | |
+| f_cond_3 | true | 437 | 431 | |
+| f_cond_3 | true | 439 | 412 | |
+| f_do_1 | false | 294 | 294 | f_do_1 |
+| f_do_1 | false | 302 | 302 | { ... } |
+| f_do_1 | false | 304 | 304 | do (...) ... |
+| f_do_1 | false | 306 | 306 | { ... } |
+| f_do_1 | false | 308 | 308 | ExprStmt |
+| f_do_1 | false | 310 | 310 | ... -- |
+| f_do_1 | false | 312 | 312 | i |
+| f_do_1 | false | 314 | 314 | i |
+| f_do_1 | false | 316 | 316 | return ... |
+| f_do_1 | true | 302 | 304 | |
+| f_do_1 | true | 304 | 306 | |
+| f_do_1 | true | 306 | 308 | |
+| f_do_1 | true | 308 | 312 | |
+| f_do_1 | true | 310 | 314 | |
+| f_do_1 | true | 312 | 310 | |
+| f_do_1 | true | 314 | 306 | T |
+| f_do_1 | true | 314 | 316 | F |
+| f_do_1 | true | 316 | 294 | |
+| f_do_2 | false | 318 | 318 | f_do_2 |
+| f_do_2 | false | 323 | 323 | { ... } |
+| f_do_2 | false | 325 | 325 | do (...) ... |
+| f_do_2 | false | 327 | 327 | { ... } |
+| f_do_2 | false | 329 | 329 | ; |
+| f_do_2 | false | 333 | 333 | 1 |
+| f_do_2 | false | 334 | 334 | return ... |
+| f_do_2 | true | 323 | 325 | |
+| f_do_2 | true | 325 | 327 | |
+| f_do_2 | true | 327 | 329 | |
+| f_do_2 | true | 329 | 333 | |
+| f_do_2 | true | 333 | 327 | T |
+| f_do_2 | true | 334 | 318 | |
+| f_do_3 | false | 336 | 336 | f_do_3 |
+| f_do_3 | false | 341 | 341 | { ... } |
+| f_do_3 | false | 343 | 343 | do (...) ... |
+| f_do_3 | false | 345 | 345 | { ... } |
+| f_do_3 | false | 347 | 347 | ; |
+| f_do_3 | false | 351 | 351 | 0 |
+| f_do_3 | false | 352 | 352 | return ... |
+| f_do_3 | true | 341 | 343 | |
+| f_do_3 | true | 343 | 345 | |
+| f_do_3 | true | 345 | 347 | |
+| f_do_3 | true | 347 | 351 | |
+| f_do_3 | true | 351 | 352 | F |
+| f_do_3 | true | 352 | 336 | |
+| f_for_1 | false | 122 | 122 | f_for_1 |
+| f_for_1 | false | 130 | 130 | { ... } |
+| f_for_1 | false | 132 | 132 | declaration |
+| f_for_1 | false | 134 | 134 | for(...;...;...) ... |
+| f_for_1 | false | 136 | 136 | ExprStmt |
+| f_for_1 | false | 138 | 138 | ... = ... |
+| f_for_1 | false | 140 | 140 | i |
+| f_for_1 | false | 144 | 144 | 0 |
+| f_for_1 | false | 145 | 145 | ... < ... |
+| f_for_1 | false | 147 | 147 | i |
+| f_for_1 | false | 151 | 151 | 10 |
+| f_for_1 | false | 152 | 152 | ... ++ |
+| f_for_1 | false | 154 | 154 | i |
+| f_for_1 | false | 156 | 156 | { ... } |
+| f_for_1 | false | 158 | 158 | ; |
+| f_for_1 | false | 160 | 160 | return ... |
+| f_for_1 | true | 130 | 132 | |
+| f_for_1 | true | 132 | 134 | |
+| f_for_1 | true | 134 | 136 | |
+| f_for_1 | true | 136 | 144 | |
+| f_for_1 | true | 138 | 147 | |
+| f_for_1 | true | 140 | 138 | |
+| f_for_1 | true | 144 | 140 | |
+| f_for_1 | true | 145 | 156 | T |
+| f_for_1 | true | 145 | 160 | F |
+| f_for_1 | true | 147 | 151 | |
+| f_for_1 | true | 151 | 145 | |
+| f_for_1 | true | 152 | 147 | |
+| f_for_1 | true | 154 | 152 | |
+| f_for_1 | true | 156 | 158 | |
+| f_for_1 | true | 158 | 154 | |
+| f_for_1 | true | 160 | 122 | |
+| f_for_2 | false | 162 | 162 | f_for_2 |
+| f_for_2 | false | 170 | 170 | { ... } |
+| f_for_2 | false | 172 | 172 | declaration |
+| f_for_2 | false | 174 | 174 | for(...;...;...) ... |
+| f_for_2 | false | 176 | 176 | ExprStmt |
+| f_for_2 | false | 178 | 178 | ... = ... |
+| f_for_2 | false | 180 | 180 | i |
+| f_for_2 | false | 184 | 184 | 0 |
+| f_for_2 | false | 187 | 187 | 1 |
+| f_for_2 | false | 188 | 188 | ... ++ |
+| f_for_2 | false | 190 | 190 | i |
+| f_for_2 | false | 192 | 192 | { ... } |
+| f_for_2 | false | 194 | 194 | ; |
+| f_for_2 | false | 196 | 196 | return ... |
+| f_for_2 | true | 170 | 172 | |
+| f_for_2 | true | 172 | 174 | |
+| f_for_2 | true | 174 | 176 | |
+| f_for_2 | true | 176 | 184 | |
+| f_for_2 | true | 178 | 187 | |
+| f_for_2 | true | 180 | 178 | |
+| f_for_2 | true | 184 | 180 | |
+| f_for_2 | true | 187 | 192 | T |
+| f_for_2 | true | 188 | 187 | |
+| f_for_2 | true | 190 | 188 | |
+| f_for_2 | true | 192 | 194 | |
+| f_for_2 | true | 194 | 190 | |
+| f_for_2 | true | 196 | 162 | |
+| f_for_3 | false | 198 | 198 | f_for_3 |
+| f_for_3 | false | 206 | 206 | { ... } |
+| f_for_3 | false | 208 | 208 | declaration |
+| f_for_3 | false | 210 | 210 | for(...;...;...) ... |
+| f_for_3 | false | 212 | 212 | ExprStmt |
+| f_for_3 | false | 214 | 214 | ... = ... |
+| f_for_3 | false | 216 | 216 | i |
+| f_for_3 | false | 220 | 220 | 0 |
+| f_for_3 | false | 223 | 223 | 0 |
+| f_for_3 | false | 224 | 224 | ... ++ |
+| f_for_3 | false | 226 | 226 | i |
+| f_for_3 | false | 228 | 228 | { ... } |
+| f_for_3 | false | 230 | 230 | ; |
+| f_for_3 | false | 232 | 232 | return ... |
+| f_for_3 | true | 206 | 208 | |
+| f_for_3 | true | 208 | 210 | |
+| f_for_3 | true | 210 | 212 | |
+| f_for_3 | true | 212 | 220 | |
+| f_for_3 | true | 214 | 223 | |
+| f_for_3 | true | 216 | 214 | |
+| f_for_3 | true | 220 | 216 | |
+| f_for_3 | true | 223 | 232 | F |
+| f_for_3 | true | 224 | 223 | |
+| f_for_3 | true | 226 | 224 | |
+| f_for_3 | true | 228 | 230 | |
+| f_for_3 | true | 230 | 226 | |
+| f_for_3 | true | 232 | 198 | |
+| f_if_1 | false | 54 | 54 | f_if_1 |
+| f_if_1 | false | 62 | 62 | { ... } |
+| f_if_1 | false | 64 | 64 | if (...) ... |
+| f_if_1 | false | 66 | 66 | i |
+| f_if_1 | false | 68 | 68 | { ... } |
+| f_if_1 | false | 70 | 70 | ; |
+| f_if_1 | false | 72 | 72 | { ... } |
+| f_if_1 | false | 74 | 74 | ; |
+| f_if_1 | false | 76 | 76 | return ... |
+| f_if_1 | true | 62 | 64 | |
+| f_if_1 | true | 64 | 66 | |
+| f_if_1 | true | 66 | 68 | T |
+| f_if_1 | true | 66 | 72 | F |
+| f_if_1 | true | 68 | 70 | |
+| f_if_1 | true | 70 | 76 | |
+| f_if_1 | true | 72 | 74 | |
+| f_if_1 | true | 74 | 76 | |
+| f_if_1 | true | 76 | 54 | |
+| f_if_2 | false | 78 | 78 | f_if_2 |
+| f_if_2 | false | 83 | 83 | { ... } |
+| f_if_2 | false | 85 | 85 | if (...) ... |
+| f_if_2 | false | 89 | 89 | 1 |
+| f_if_2 | false | 90 | 90 | { ... } |
+| f_if_2 | false | 92 | 92 | ; |
+| f_if_2 | false | 94 | 94 | { ... } |
+| f_if_2 | false | 96 | 96 | ; |
+| f_if_2 | false | 98 | 98 | return ... |
+| f_if_2 | true | 83 | 85 | |
+| f_if_2 | true | 85 | 89 | |
+| f_if_2 | true | 89 | 90 | T |
+| f_if_2 | true | 90 | 92 | |
+| f_if_2 | true | 92 | 98 | |
+| f_if_2 | true | 94 | 96 | |
+| f_if_2 | true | 96 | 98 | |
+| f_if_2 | true | 98 | 78 | |
+| f_if_3 | false | 100 | 100 | f_if_3 |
+| f_if_3 | false | 105 | 105 | { ... } |
+| f_if_3 | false | 107 | 107 | if (...) ... |
+| f_if_3 | false | 111 | 111 | 0 |
+| f_if_3 | false | 112 | 112 | { ... } |
+| f_if_3 | false | 114 | 114 | ; |
+| f_if_3 | false | 116 | 116 | { ... } |
+| f_if_3 | false | 118 | 118 | ; |
+| f_if_3 | false | 120 | 120 | return ... |
+| f_if_3 | true | 105 | 107 | |
+| f_if_3 | true | 107 | 111 | |
+| f_if_3 | true | 111 | 116 | F |
+| f_if_3 | true | 112 | 114 | |
+| f_if_3 | true | 114 | 120 | |
+| f_if_3 | true | 116 | 118 | |
+| f_if_3 | true | 118 | 120 | |
+| f_if_3 | true | 120 | 100 | |
+| f_switch_1 | false | 441 | 441 | f_switch_1 |
+| f_switch_1 | false | 449 | 449 | { ... } |
+| f_switch_1 | false | 451 | 451 | switch (...) ... |
+| f_switch_1 | false | 453 | 453 | i |
+| f_switch_1 | false | 455 | 455 | { ... } |
+| f_switch_1 | false | 459 | 459 | 0 |
+| f_switch_1 | false | 460 | 460 | case ...: |
+| f_switch_1 | false | 462 | 462 | return ... |
+| f_switch_1 | false | 466 | 466 | 1 |
+| f_switch_1 | false | 467 | 467 | case ...: |
+| f_switch_1 | false | 469 | 469 | return ... |
+| f_switch_1 | false | 473 | 473 | 2 |
+| f_switch_1 | false | 474 | 474 | case ...: |
+| f_switch_1 | false | 478 | 478 | 3 |
+| f_switch_1 | false | 479 | 479 | case ...: |
+| f_switch_1 | false | 481 | 481 | ; |
+| f_switch_1 | false | 485 | 485 | 4 |
+| f_switch_1 | false | 486 | 486 | case ...: |
+| f_switch_1 | false | 488 | 488 | return ... |
+| f_switch_1 | false | 490 | 490 | default: |
+| f_switch_1 | false | 492 | 492 | return ... |
+| f_switch_1 | false | 494 | 494 | return ... |
+| f_switch_1 | true | 449 | 451 | |
+| f_switch_1 | true | 451 | 453 | |
+| f_switch_1 | true | 453 | 455 | |
+| f_switch_1 | true | 455 | 460 | |
+| f_switch_1 | true | 455 | 467 | |
+| f_switch_1 | true | 455 | 474 | |
+| f_switch_1 | true | 455 | 479 | |
+| f_switch_1 | true | 455 | 486 | |
+| f_switch_1 | true | 455 | 490 | |
+| f_switch_1 | true | 460 | 462 | |
+| f_switch_1 | true | 462 | 441 | |
+| f_switch_1 | true | 467 | 469 | |
+| f_switch_1 | true | 469 | 441 | |
+| f_switch_1 | true | 474 | 479 | |
+| f_switch_1 | true | 479 | 481 | |
+| f_switch_1 | true | 481 | 486 | |
+| f_switch_1 | true | 486 | 488 | |
+| f_switch_1 | true | 488 | 441 | |
+| f_switch_1 | true | 490 | 492 | |
+| f_switch_1 | true | 492 | 441 | |
+| f_switch_1 | true | 494 | 441 | |
+| f_switch_2 | false | 496 | 496 | f_switch_2 |
+| f_switch_2 | false | 504 | 504 | { ... } |
+| f_switch_2 | false | 506 | 506 | switch (...) ... |
+| f_switch_2 | false | 508 | 508 | i |
+| f_switch_2 | false | 510 | 510 | { ... } |
+| f_switch_2 | false | 514 | 514 | 0 |
+| f_switch_2 | false | 515 | 515 | case ...: |
+| f_switch_2 | false | 517 | 517 | return ... |
+| f_switch_2 | false | 521 | 521 | 1 |
+| f_switch_2 | false | 522 | 522 | case ...: |
+| f_switch_2 | false | 524 | 524 | return ... |
+| f_switch_2 | false | 528 | 528 | 2 |
+| f_switch_2 | false | 529 | 529 | case ...: |
+| f_switch_2 | false | 533 | 533 | 3 |
+| f_switch_2 | false | 534 | 534 | case ...: |
+| f_switch_2 | false | 536 | 536 | ; |
+| f_switch_2 | false | 540 | 540 | 4 |
+| f_switch_2 | false | 541 | 541 | case ...: |
+| f_switch_2 | false | 543 | 543 | return ... |
+| f_switch_2 | false | 545 | 545 | return ... |
+| f_switch_2 | true | 504 | 506 | |
+| f_switch_2 | true | 506 | 508 | |
+| f_switch_2 | true | 508 | 510 | |
+| f_switch_2 | true | 510 | 515 | |
+| f_switch_2 | true | 510 | 522 | |
+| f_switch_2 | true | 510 | 529 | |
+| f_switch_2 | true | 510 | 534 | |
+| f_switch_2 | true | 510 | 541 | |
+| f_switch_2 | true | 510 | 545 | |
+| f_switch_2 | true | 515 | 517 | |
+| f_switch_2 | true | 517 | 496 | |
+| f_switch_2 | true | 522 | 524 | |
+| f_switch_2 | true | 524 | 496 | |
+| f_switch_2 | true | 529 | 534 | |
+| f_switch_2 | true | 534 | 536 | |
+| f_switch_2 | true | 536 | 541 | |
+| f_switch_2 | true | 541 | 543 | |
+| f_switch_2 | true | 543 | 496 | |
+| f_switch_2 | true | 545 | 496 | |
+| f_switch_3 | false | 547 | 547 | f_switch_3 |
+| f_switch_3 | false | 552 | 552 | { ... } |
+| f_switch_3 | false | 554 | 554 | switch (...) ... |
+| f_switch_3 | false | 558 | 558 | 1 |
+| f_switch_3 | false | 559 | 559 | { ... } |
+| f_switch_3 | false | 563 | 563 | 0 |
+| f_switch_3 | false | 564 | 564 | case ...: |
+| f_switch_3 | false | 566 | 566 | return ... |
+| f_switch_3 | false | 570 | 570 | 1 |
+| f_switch_3 | false | 571 | 571 | case ...: |
+| f_switch_3 | false | 573 | 573 | return ... |
+| f_switch_3 | false | 577 | 577 | 2 |
+| f_switch_3 | false | 578 | 578 | case ...: |
+| f_switch_3 | false | 582 | 582 | 3 |
+| f_switch_3 | false | 583 | 583 | case ...: |
+| f_switch_3 | false | 585 | 585 | ; |
+| f_switch_3 | false | 589 | 589 | 4 |
+| f_switch_3 | false | 590 | 590 | case ...: |
+| f_switch_3 | false | 592 | 592 | return ... |
+| f_switch_3 | false | 594 | 594 | default: |
+| f_switch_3 | false | 596 | 596 | return ... |
+| f_switch_3 | false | 598 | 598 | return ... |
+| f_switch_3 | true | 552 | 554 | |
+| f_switch_3 | true | 554 | 558 | |
+| f_switch_3 | true | 558 | 559 | |
+| f_switch_3 | true | 559 | 571 | |
+| f_switch_3 | true | 564 | 566 | |
+| f_switch_3 | true | 566 | 547 | |
+| f_switch_3 | true | 571 | 573 | |
+| f_switch_3 | true | 573 | 547 | |
+| f_switch_3 | true | 578 | 583 | |
+| f_switch_3 | true | 583 | 585 | |
+| f_switch_3 | true | 585 | 590 | |
+| f_switch_3 | true | 590 | 592 | |
+| f_switch_3 | true | 592 | 547 | |
+| f_switch_3 | true | 594 | 596 | |
+| f_switch_3 | true | 596 | 547 | |
+| f_switch_3 | true | 598 | 547 | |
+| f_switch_4 | false | 600 | 600 | f_switch_4 |
+| f_switch_4 | false | 605 | 605 | { ... } |
+| f_switch_4 | false | 607 | 607 | switch (...) ... |
+| f_switch_4 | false | 611 | 611 | 1 |
+| f_switch_4 | false | 612 | 612 | { ... } |
+| f_switch_4 | false | 616 | 616 | 0 |
+| f_switch_4 | false | 617 | 617 | case ...: |
+| f_switch_4 | false | 619 | 619 | return ... |
+| f_switch_4 | false | 623 | 623 | 1 |
+| f_switch_4 | false | 624 | 624 | case ...: |
+| f_switch_4 | false | 626 | 626 | return ... |
+| f_switch_4 | false | 630 | 630 | 2 |
+| f_switch_4 | false | 631 | 631 | case ...: |
+| f_switch_4 | false | 635 | 635 | 3 |
+| f_switch_4 | false | 636 | 636 | case ...: |
+| f_switch_4 | false | 638 | 638 | ; |
+| f_switch_4 | false | 642 | 642 | 4 |
+| f_switch_4 | false | 643 | 643 | case ...: |
+| f_switch_4 | false | 645 | 645 | return ... |
+| f_switch_4 | false | 647 | 647 | return ... |
+| f_switch_4 | true | 605 | 607 | |
+| f_switch_4 | true | 607 | 611 | |
+| f_switch_4 | true | 611 | 612 | |
+| f_switch_4 | true | 612 | 624 | |
+| f_switch_4 | true | 612 | 647 | |
+| f_switch_4 | true | 617 | 619 | |
+| f_switch_4 | true | 619 | 600 | |
+| f_switch_4 | true | 624 | 626 | |
+| f_switch_4 | true | 626 | 600 | |
+| f_switch_4 | true | 631 | 636 | |
+| f_switch_4 | true | 636 | 638 | |
+| f_switch_4 | true | 638 | 643 | |
+| f_switch_4 | true | 643 | 645 | |
+| f_switch_4 | true | 645 | 600 | |
+| f_switch_4 | true | 647 | 600 | |
+| f_switch_5 | false | 649 | 649 | f_switch_5 |
+| f_switch_5 | false | 654 | 654 | { ... } |
+| f_switch_5 | false | 656 | 656 | switch (...) ... |
+| f_switch_5 | false | 660 | 660 | 9 |
+| f_switch_5 | false | 661 | 661 | { ... } |
+| f_switch_5 | false | 665 | 665 | 0 |
+| f_switch_5 | false | 666 | 666 | case ...: |
+| f_switch_5 | false | 668 | 668 | return ... |
+| f_switch_5 | false | 672 | 672 | 1 |
+| f_switch_5 | false | 673 | 673 | case ...: |
+| f_switch_5 | false | 675 | 675 | return ... |
+| f_switch_5 | false | 679 | 679 | 2 |
+| f_switch_5 | false | 680 | 680 | case ...: |
+| f_switch_5 | false | 684 | 684 | 3 |
+| f_switch_5 | false | 685 | 685 | case ...: |
+| f_switch_5 | false | 687 | 687 | ; |
+| f_switch_5 | false | 691 | 691 | 4 |
+| f_switch_5 | false | 692 | 692 | case ...: |
+| f_switch_5 | false | 694 | 694 | return ... |
+| f_switch_5 | false | 696 | 696 | default: |
+| f_switch_5 | false | 698 | 698 | return ... |
+| f_switch_5 | false | 700 | 700 | return ... |
+| f_switch_5 | true | 654 | 656 | |
+| f_switch_5 | true | 656 | 660 | |
+| f_switch_5 | true | 660 | 661 | |
+| f_switch_5 | true | 661 | 696 | |
+| f_switch_5 | true | 666 | 668 | |
+| f_switch_5 | true | 668 | 649 | |
+| f_switch_5 | true | 673 | 675 | |
+| f_switch_5 | true | 675 | 649 | |
+| f_switch_5 | true | 680 | 685 | |
+| f_switch_5 | true | 685 | 687 | |
+| f_switch_5 | true | 687 | 692 | |
+| f_switch_5 | true | 692 | 694 | |
+| f_switch_5 | true | 694 | 649 | |
+| f_switch_5 | true | 696 | 698 | |
+| f_switch_5 | true | 698 | 649 | |
+| f_switch_5 | true | 700 | 649 | |
+| f_switch_6 | false | 702 | 702 | f_switch_6 |
+| f_switch_6 | false | 707 | 707 | { ... } |
+| f_switch_6 | false | 709 | 709 | switch (...) ... |
+| f_switch_6 | false | 713 | 713 | 9 |
+| f_switch_6 | false | 714 | 714 | { ... } |
+| f_switch_6 | false | 718 | 718 | 0 |
+| f_switch_6 | false | 719 | 719 | case ...: |
+| f_switch_6 | false | 721 | 721 | return ... |
+| f_switch_6 | false | 725 | 725 | 1 |
+| f_switch_6 | false | 726 | 726 | case ...: |
+| f_switch_6 | false | 728 | 728 | return ... |
+| f_switch_6 | false | 732 | 732 | 2 |
+| f_switch_6 | false | 733 | 733 | case ...: |
+| f_switch_6 | false | 737 | 737 | 3 |
+| f_switch_6 | false | 738 | 738 | case ...: |
+| f_switch_6 | false | 740 | 740 | ; |
+| f_switch_6 | false | 744 | 744 | 4 |
+| f_switch_6 | false | 745 | 745 | case ...: |
+| f_switch_6 | false | 747 | 747 | return ... |
+| f_switch_6 | false | 749 | 749 | return ... |
+| f_switch_6 | true | 707 | 709 | |
+| f_switch_6 | true | 709 | 713 | |
+| f_switch_6 | true | 713 | 714 | |
+| f_switch_6 | true | 714 | 749 | |
+| f_switch_6 | true | 719 | 721 | |
+| f_switch_6 | true | 721 | 702 | |
+| f_switch_6 | true | 726 | 728 | |
+| f_switch_6 | true | 728 | 702 | |
+| f_switch_6 | true | 733 | 738 | |
+| f_switch_6 | true | 738 | 740 | |
+| f_switch_6 | true | 740 | 745 | |
+| f_switch_6 | true | 745 | 747 | |
+| f_switch_6 | true | 747 | 702 | |
+| f_switch_6 | true | 749 | 702 | |
+| f_switch_7 | false | 751 | 751 | f_switch_7 |
+| f_switch_7 | false | 759 | 759 | { ... } |
+| f_switch_7 | false | 761 | 761 | switch (...) ... |
+| f_switch_7 | false | 763 | 763 | ... ? ... : ... |
+| f_switch_7 | false | 765 | 765 | i |
+| f_switch_7 | false | 769 | 769 | 1 |
+| f_switch_7 | false | 772 | 772 | 3 |
+| f_switch_7 | false | 773 | 773 | { ... } |
+| f_switch_7 | false | 777 | 777 | 0 |
+| f_switch_7 | false | 778 | 778 | case ...: |
+| f_switch_7 | false | 780 | 780 | return ... |
+| f_switch_7 | false | 784 | 784 | 1 |
+| f_switch_7 | false | 785 | 785 | case ...: |
+| f_switch_7 | false | 787 | 787 | return ... |
+| f_switch_7 | false | 791 | 791 | 2 |
+| f_switch_7 | false | 792 | 792 | case ...: |
+| f_switch_7 | false | 796 | 796 | 3 |
+| f_switch_7 | false | 797 | 797 | case ...: |
+| f_switch_7 | false | 799 | 799 | ; |
+| f_switch_7 | false | 803 | 803 | 4 |
+| f_switch_7 | false | 804 | 804 | case ...: |
+| f_switch_7 | false | 806 | 806 | return ... |
+| f_switch_7 | false | 808 | 808 | return ... |
+| f_switch_7 | true | 759 | 761 | |
+| f_switch_7 | true | 761 | 763 | |
+| f_switch_7 | true | 763 | 765 | |
+| f_switch_7 | true | 765 | 769 | T |
+| f_switch_7 | true | 765 | 772 | F |
+| f_switch_7 | true | 769 | 773 | |
+| f_switch_7 | true | 772 | 773 | |
+| f_switch_7 | true | 773 | 785 | |
+| f_switch_7 | true | 773 | 797 | |
+| f_switch_7 | true | 773 | 808 | |
+| f_switch_7 | true | 778 | 780 | |
+| f_switch_7 | true | 780 | 751 | |
+| f_switch_7 | true | 785 | 787 | |
+| f_switch_7 | true | 787 | 751 | |
+| f_switch_7 | true | 792 | 797 | |
+| f_switch_7 | true | 797 | 799 | |
+| f_switch_7 | true | 799 | 804 | |
+| f_switch_7 | true | 804 | 806 | |
+| f_switch_7 | true | 806 | 751 | |
+| f_switch_7 | true | 808 | 751 | |
+| f_while_1 | false | 234 | 234 | f_while_1 |
+| f_while_1 | false | 242 | 242 | { ... } |
+| f_while_1 | false | 244 | 244 | while (...) ... |
+| f_while_1 | false | 246 | 246 | i |
+| f_while_1 | false | 248 | 248 | { ... } |
+| f_while_1 | false | 250 | 250 | ExprStmt |
+| f_while_1 | false | 252 | 252 | ... -- |
+| f_while_1 | false | 254 | 254 | i |
+| f_while_1 | false | 256 | 256 | return ... |
+| f_while_1 | true | 242 | 244 | |
+| f_while_1 | true | 244 | 246 | |
+| f_while_1 | true | 246 | 248 | T |
+| f_while_1 | true | 246 | 256 | F |
+| f_while_1 | true | 248 | 250 | |
+| f_while_1 | true | 250 | 254 | |
+| f_while_1 | true | 252 | 246 | |
+| f_while_1 | true | 254 | 252 | |
+| f_while_1 | true | 256 | 234 | |
+| f_while_2 | false | 258 | 258 | f_while_2 |
+| f_while_2 | false | 263 | 263 | { ... } |
+| f_while_2 | false | 265 | 265 | while (...) ... |
+| f_while_2 | false | 269 | 269 | 1 |
+| f_while_2 | false | 270 | 270 | { ... } |
+| f_while_2 | false | 272 | 272 | ; |
+| f_while_2 | false | 274 | 274 | return ... |
+| f_while_2 | true | 263 | 265 | |
+| f_while_2 | true | 265 | 269 | |
+| f_while_2 | true | 269 | 270 | T |
+| f_while_2 | true | 270 | 272 | |
+| f_while_2 | true | 272 | 269 | |
+| f_while_2 | true | 274 | 258 | |
+| f_while_3 | false | 276 | 276 | f_while_3 |
+| f_while_3 | false | 281 | 281 | { ... } |
+| f_while_3 | false | 283 | 283 | while (...) ... |
+| f_while_3 | false | 287 | 287 | 0 |
+| f_while_3 | false | 288 | 288 | { ... } |
+| f_while_3 | false | 290 | 290 | ; |
+| f_while_3 | false | 292 | 292 | return ... |
+| f_while_3 | true | 281 | 283 | |
+| f_while_3 | true | 283 | 287 | |
+| f_while_3 | true | 287 | 292 | F |
+| f_while_3 | true | 288 | 290 | |
+| f_while_3 | true | 290 | 287 | |
+| f_while_3 | true | 292 | 276 | |
diff --git a/cpp/ql/test/library-tests/basic_blocks/cfg.ql b/cpp/ql/test/library-tests/basic_blocks/cfg.ql
new file mode 100644
index 000000000000..4c3d73d46eea
--- /dev/null
+++ b/cpp/ql/test/library-tests/basic_blocks/cfg.ql
@@ -0,0 +1,34 @@
+// query-type: graph
+import cpp
+
+class DestructorCallEnhanced extends DestructorCall {
+ override string toString() {
+ if exists(this.getQualifier().(VariableAccess).getTarget().getName())
+ then result = "call to " + this.getQualifier().(VariableAccess).getTarget().getName() + "." + this.getTarget().getName()
+ else result = super.toString()
+ }
+}
+
+string scope(ControlFlowNode x) {
+ if exists(x.getControlFlowScope().getQualifiedName())
+ then result = x.getControlFlowScope().getQualifiedName()
+ else result = ""
+}
+
+predicate isNode(boolean isEdge, ControlFlowNode x, ControlFlowNode y, string label) {
+ isEdge = false and x = y and label = x.toString()
+}
+
+predicate isSuccessor(boolean isEdge, ControlFlowNode x, ControlFlowNode y, string label) {
+ exists(string truelabel, string falselabel |
+ isEdge = true
+ and x.getASuccessor() = y
+ and if x.getATrueSuccessor() = y then truelabel = "T" else truelabel = ""
+ and if x.getAFalseSuccessor() = y then falselabel = "F" else falselabel = ""
+ and label = truelabel + falselabel)
+}
+
+from boolean isEdge, ControlFlowNode x, ControlFlowNode y, string label
+where isNode(isEdge, x, y, label) or isSuccessor(isEdge, x, y, label)
+select scope(x), isEdge, x, y, label
+
diff --git a/cpp/ql/test/library-tests/basic_blocks/test.c b/cpp/ql/test/library-tests/basic_blocks/test.c
new file mode 100644
index 000000000000..9b1d30762905
--- /dev/null
+++ b/cpp/ql/test/library-tests/basic_blocks/test.c
@@ -0,0 +1,217 @@
+
+void f_if_1(int i) {
+ if (i) {
+ ;
+ } else {
+ ;
+ }
+}
+
+void f_if_2(void) {
+ if (1) {
+ ;
+ } else {
+ ;
+ }
+}
+
+void f_if_3(void) {
+ if (0) {
+ ;
+ } else {
+ ;
+ }
+}
+
+void f_for_1(void) {
+ int i;
+ for(i = 0; i < 10; i++) {
+ ;
+ }
+ return;
+}
+
+void f_for_2(void) {
+ int i;
+ for(i = 0; 1; i++) {
+ ;
+ }
+ return;
+}
+
+void f_for_3(void) {
+ int i;
+ for(i = 0; 0; i++) {
+ ;
+ }
+ return;
+}
+
+void f_while_1(int i) {
+ while(i) {
+ i--;
+ }
+ return;
+}
+
+void f_while_2(void) {
+ while(1) {
+ ;
+ }
+ return;
+}
+
+void f_while_3(void) {
+ while(0) {
+ ;
+ }
+ return;
+}
+
+void f_do_1(int i) {
+ do {
+ i--;
+ } while (i);
+ return;
+}
+
+void f_do_2(void) {
+ do {
+ ;
+ } while (1);
+ return;
+}
+
+void f_do_3(void) {
+ do {
+ ;
+ } while (0);
+ return;
+}
+
+void f_cond_1(int i) {
+ int j = i ? 3 : 4;
+ return;
+}
+
+void f_cond_2(void) {
+ int j = 1 ? 3 : 4;
+ return;
+}
+
+void f_cond_3(void) {
+ int j = 0 ? 3 : 4;
+ return;
+}
+
+void f_switch_1(int i) {
+ switch(i) {
+ case 0:
+ return;
+ case 1:
+ return;
+ case 2:
+ case 3:
+ ;
+ case 4:
+ return;
+ default:
+ return;
+ }
+ return;
+}
+
+void f_switch_2(int i) {
+ switch(i) {
+ case 0:
+ return;
+ case 1:
+ return;
+ case 2:
+ case 3:
+ ;
+ case 4:
+ return;
+ }
+ return;
+}
+
+void f_switch_3(void) {
+ switch(1) {
+ case 0:
+ return;
+ case 1:
+ return;
+ case 2:
+ case 3:
+ ;
+ case 4:
+ return;
+ default:
+ return;
+ }
+ return;
+}
+
+void f_switch_4(void) {
+ switch(1) {
+ case 0:
+ return;
+ case 1:
+ return;
+ case 2:
+ case 3:
+ ;
+ case 4:
+ return;
+ }
+ return;
+}
+
+void f_switch_5(void) {
+ switch(9) {
+ case 0:
+ return;
+ case 1:
+ return;
+ case 2:
+ case 3:
+ ;
+ case 4:
+ return;
+ default:
+ return;
+ }
+ return;
+}
+
+void f_switch_6(void) {
+ switch(9) {
+ case 0:
+ return;
+ case 1:
+ return;
+ case 2:
+ case 3:
+ ;
+ case 4:
+ return;
+ }
+ return;
+}
+
+void f_switch_7(int i) {
+ switch(i ? 1 : 3) {
+ case 0:
+ return;
+ case 1:
+ return;
+ case 2:
+ case 3:
+ ;
+ case 4:
+ return;
+ }
+ return;
+}
+
diff --git a/cpp/ql/test/library-tests/blocks/c/blocks.c b/cpp/ql/test/library-tests/blocks/c/blocks.c
new file mode 100644
index 000000000000..61cdf068b3ff
--- /dev/null
+++ b/cpp/ql/test/library-tests/blocks/c/blocks.c
@@ -0,0 +1,81 @@
+// Compilable with:
+// clang -fblocks -c blocks.c
+
+void (*functionPtrReturningVoidWithVoidArgument)(void);
+int (*functionPtrReturningIntWithIntAndCharArguments)(int, char);
+void (*arrayOfTenFunctionPtrsReturningVoidWithIntArgument[10])(int);
+
+void (^blockReturningVoidWithVoidArgument)(void);
+int (^blockReturningIntWithIntAndCharArguments)(int, char);
+void (^arrayOfTenBlocksReturningVoidWithIntArgument[10])(int);
+
+int x;
+
+void f(void) {
+
+ blockReturningVoidWithVoidArgument
+ = ^ void (void) { x = 1; };
+
+ blockReturningVoidWithVoidArgument
+ = ^ (void) { x = 1; };
+
+ blockReturningVoidWithVoidArgument
+ = ^ { x = 1; };
+
+ // Has an implicit "return;" so result type is void
+ void (^b1)(int, char)
+ = ^ (int y, char z) { x = 1; };
+
+ // Has no implicit "return;" but result type still void
+ void (^b2)(int, char)
+ = ^ (int y, char z) { x = 1; while (1) { } };
+
+ // Explicit return so result type double
+ double (^b3)(int, char)
+ = ^ (int y, char z) { x = 1; return 0.5; };
+
+ // Explicit return so result type double
+ double (^b4)(int, char)
+ = ^ (int y, char z) { x = 1; if (1) { return 0.5; }; while (1) { } };
+
+ // Also has an explicit return type
+ char (^b5)(int, char)
+ = ^ char (int y, char z) { x = 1; return 'c'; };
+
+ // Also has an explicit return type
+ const char * (^b6)(int, char)
+ = ^ const char * (int y, char z) { x = 1; return "str"; };
+
+ // Also has an explicit return type
+ const char * const * (^b7)(int, char)
+ = ^ const char * const * (int y, char z) { x = 1; while (1) { }; };
+
+ char c;
+ double d;
+
+ b1(5, 'a');
+ b2(5, 'a');
+ d = b3(5, 'a');
+ d = b4(5, 'a');
+ c = b5(5, 'a');
+}
+
+int (^fn)() = ^{
+ return 4;
+};
+
+void g(void) {
+ // Implicit parameter list
+ int(^b1)(void) = ^ int { return 4; };
+
+ // Exotic function pointer case
+ typedef int (*pointerToFunctionThatReturnsIntWithCharArg)(char);
+ pointerToFunctionThatReturnsIntWithCharArg functionPointer = 0;
+ pointerToFunctionThatReturnsIntWithCharArg (^b2)(float) = ^int(*(float x))(char) { return functionPointer; };
+}
+
+void h(void) {
+ typedef void(^B)(void);
+ (B)^{};
+ (B)^{};
+}
diff --git a/cpp/ql/test/library-tests/blocks/c/blocks.expected b/cpp/ql/test/library-tests/blocks/c/blocks.expected
new file mode 100644
index 000000000000..91517b67eb79
--- /dev/null
+++ b/cpp/ql/test/library-tests/blocks/c/blocks.expected
@@ -0,0 +1,39 @@
+| blocks.c:4:8:4:47 | functionPtrReturningVoidWithVoidArgument | ..(*)(..) | pointer to {function returning {void} with arguments ()} |
+| blocks.c:5:7:5:52 | functionPtrReturningIntWithIntAndCharArguments | ..(*)(..) | pointer to {function returning {int} with arguments (int,char)} |
+| blocks.c:6:8:6:57 | arrayOfTenFunctionPtrsReturningVoidWithIntArgument | ..(*[10])(..) | array of 10 {pointer to {function returning {void} with arguments (int)}} |
+| blocks.c:8:8:8:41 | blockReturningVoidWithVoidArgument | ..(^)(..) | block of {function returning {void} with arguments ()} |
+| blocks.c:9:7:9:46 | blockReturningIntWithIntAndCharArguments | ..(^)(..) | block of {function returning {int} with arguments (int,char)} |
+| blocks.c:10:8:10:51 | arrayOfTenBlocksReturningVoidWithIntArgument | ..(^[10])(..) | array of 10 {block of {function returning {void} with arguments (int)}} |
+| blocks.c:12:5:12:5 | x | int | int |
+| blocks.c:26:12:26:13 | b1 | ..(^)(..) | block of {function returning {void} with arguments (int,char)} |
+| blocks.c:27:16:27:16 | y | int | int |
+| blocks.c:27:24:27:24 | z | char | char |
+| blocks.c:30:12:30:13 | b2 | ..(^)(..) | block of {function returning {void} with arguments (int,char)} |
+| blocks.c:31:16:31:16 | y | int | int |
+| blocks.c:31:24:31:24 | z | char | char |
+| blocks.c:34:14:34:15 | b3 | ..(^)(..) | block of {function returning {double} with arguments (int,char)} |
+| blocks.c:35:16:35:16 | y | int | int |
+| blocks.c:35:24:35:24 | z | char | char |
+| blocks.c:38:14:38:15 | b4 | ..(^)(..) | block of {function returning {double} with arguments (int,char)} |
+| blocks.c:39:16:39:16 | y | int | int |
+| blocks.c:39:24:39:24 | z | char | char |
+| blocks.c:42:12:42:13 | b5 | ..(^)(..) | block of {function returning {char} with arguments (int,char)} |
+| blocks.c:43:21:43:21 | y | int | int |
+| blocks.c:43:29:43:29 | z | char | char |
+| blocks.c:46:20:46:21 | b6 | ..(^)(..) | block of {function returning {pointer to {const {char}}} with arguments (int,char)} |
+| blocks.c:47:29:47:29 | y | int | int |
+| blocks.c:47:37:47:37 | z | char | char |
+| blocks.c:50:28:50:29 | b7 | ..(^)(..) | block of {function returning {pointer to {const {pointer to {const {char}}}}} with arguments (int,char)} |
+| blocks.c:51:37:51:37 | y | int | int |
+| blocks.c:51:45:51:45 | z | char | char |
+| blocks.c:53:10:53:10 | c | char | char |
+| blocks.c:54:12:54:12 | d | double | double |
+| blocks.c:63:7:63:8 | fn | ..(^)(..) | block of {function returning {int} with arguments ()} |
+| blocks.c:69:8:69:9 | b1 | ..(^)(..) | block of {function returning {int} with arguments ()} |
+| blocks.c:73:46:73:60 | functionPointer | pointerToFunctionThatReturnsIntWithCharArg | typedef {pointer to {function returning {int} with arguments (char)}} as "pointerToFunctionThatReturnsIntWithCharArg" |
+| blocks.c:74:48:74:49 | b2 | ..(^)(..) | block of {function returning {typedef {pointer to {function returning {int} with arguments (char)}} as "pointerToFunctionThatReturnsIntWithCharArg"} with arguments (float)} |
+| blocks.c:74:74:74:74 | x | float | float |
+| file://:0:0:0:0 | fp_offset | unsigned int | unsigned int |
+| file://:0:0:0:0 | gp_offset | unsigned int | unsigned int |
+| file://:0:0:0:0 | overflow_arg_area | void * | pointer to {void} |
+| file://:0:0:0:0 | reg_save_area | void * | pointer to {void} |
diff --git a/cpp/ql/test/library-tests/blocks/c/blocks.ql b/cpp/ql/test/library-tests/blocks/c/blocks.ql
new file mode 100644
index 000000000000..683201375063
--- /dev/null
+++ b/cpp/ql/test/library-tests/blocks/c/blocks.ql
@@ -0,0 +1,7 @@
+import cpp
+
+from Variable v
+select v,
+ v.getType().toString(),
+ v.getType().explain()
+
diff --git a/cpp/ql/test/library-tests/blocks/c/code_blocks.expected b/cpp/ql/test/library-tests/blocks/c/code_blocks.expected
new file mode 100644
index 000000000000..82f6eaa03e02
--- /dev/null
+++ b/cpp/ql/test/library-tests/blocks/c/code_blocks.expected
@@ -0,0 +1,15 @@
+| blocks.c:17:11:17:33 | ^ { ... } | file://:0:0:0:0 | ..(^)(..) | block of {function returning {void} with arguments ()} | blocks.c:17:11:17:11 | | file://:0:0:0:0 | void | void | |
+| blocks.c:20:11:20:28 | ^ { ... } | file://:0:0:0:0 | ..(^)(..) | block of {function returning {void} with arguments ()} | blocks.c:20:11:20:11 | | file://:0:0:0:0 | void | void | |
+| blocks.c:23:11:23:21 | ^ { ... } | file://:0:0:0:0 | ..(^)(..) | block of {function returning {void} with arguments ()} | blocks.c:23:11:23:11 | | file://:0:0:0:0 | void | void | |
+| blocks.c:27:8:27:37 | ^ { ... } | file://:0:0:0:0 | ..(^)(..) | block of {function returning {void} with arguments (int,char)} | blocks.c:27:11:27:11 | | file://:0:0:0:0 | void | void | y(int), z(char) |
+| blocks.c:31:8:31:51 | ^ { ... } | file://:0:0:0:0 | ..(^)(..) | block of {function returning {void} with arguments (int,char)} | blocks.c:31:11:31:11 | | file://:0:0:0:0 | void | void | y(int), z(char) |
+| blocks.c:35:8:35:49 | ^ { ... } | file://:0:0:0:0 | ..(^)(..) | block of {function returning {double} with arguments (int,char)} | blocks.c:35:11:35:11 | | file://:0:0:0:0 | double | double | y(int), z(char) |
+| blocks.c:39:8:39:75 | ^ { ... } | file://:0:0:0:0 | ..(^)(..) | block of {function returning {double} with arguments (int,char)} | blocks.c:39:11:39:11 | | file://:0:0:0:0 | double | double | y(int), z(char) |
+| blocks.c:43:8:43:54 | ^ { ... } | file://:0:0:0:0 | ..(^)(..) | block of {function returning {char} with arguments (int,char)} | blocks.c:43:11:43:11 | | file://:0:0:0:0 | char | char | y(int), z(char) |
+| blocks.c:47:8:47:64 | ^ { ... } | file://:0:0:0:0 | ..(^)(..) | block of {function returning {pointer to {const {char}}} with arguments (int,char)} | blocks.c:47:11:47:11 | | file://:0:0:0:0 | const char * | pointer to {const {char}} | y(int), z(char) |
+| blocks.c:51:8:51:73 | ^ { ... } | file://:0:0:0:0 | ..(^)(..) | block of {function returning {pointer to {const {pointer to {const {char}}}}} with arguments (int,char)} | blocks.c:51:11:51:11 | | file://:0:0:0:0 | const char *const * | pointer to {const {pointer to {const {char}}}} | y(int), z(char) |
+| blocks.c:63:16:65:2 | ^ { ... } | file://:0:0:0:0 | ..(^)(..) | block of {function returning {int} with arguments ()} | blocks.c:63:16:63:16 | | file://:0:0:0:0 | int | int | |
+| blocks.c:69:19:69:39 | ^ { ... } | file://:0:0:0:0 | ..(^)(..) | block of {function returning {int} with arguments ()} | blocks.c:69:22:69:22 | | file://:0:0:0:0 | int | int | |
+| blocks.c:74:60:74:111 | ^ { ... } | file://:0:0:0:0 | ..(^)(..) | block of {function returning {typedef {pointer to {function returning {int} with arguments (char)}} as "pointerToFunctionThatReturnsIntWithCharArg"} with arguments (float)} | blocks.c:74:62:74:62 | | file://:0:0:0:0 | ..(*)(..) | pointer to {function returning {int} with arguments (char)} | x(float) |
+| blocks.c:79:7:79:9 | ^ { ... } | file://:0:0:0:0 | ..(^)(..) | block of {function returning {void} with arguments ()} | blocks.c:79:7:79:7 | | file://:0:0:0:0 | void | void | |
+| blocks.c:80:7:80:9 | ^ { ... } | file://:0:0:0:0 | ..(^)(..) | block of {function returning {void} with arguments ()} | blocks.c:80:7:80:7 | | file://:0:0:0:0 | void | void | |
diff --git a/cpp/ql/test/library-tests/blocks/c/code_blocks.ql b/cpp/ql/test/library-tests/blocks/c/code_blocks.ql
new file mode 100644
index 000000000000..842832fadb63
--- /dev/null
+++ b/cpp/ql/test/library-tests/blocks/c/code_blocks.ql
@@ -0,0 +1,25 @@
+import cpp
+
+predicate paramsString(Function f, int n, string res) {
+ if n = -1 then res = ""
+ else exists(string sep |
+ if n = 0 then sep = "" else sep = ", "
+ and
+ exists(string prefixRes |
+ paramsString(f, n - 1, prefixRes)
+ and
+ res = prefixRes + sep + f.getParameter(n)
+ + "(" + f.getParameter(n).getType() + ")"))
+}
+
+from BlockExpr e, Function f, string params
+where f = e.getFunction()
+ and paramsString(f, f.getNumberOfParameters() - 1, params)
+select e,
+ e.getType() as te,
+ te.explain(),
+ e.getFunction(),
+ f.getType() as tf,
+ tf.explain(),
+ params
+
diff --git a/cpp/ql/test/library-tests/blocks/c/exprs.expected b/cpp/ql/test/library-tests/blocks/c/exprs.expected
new file mode 100644
index 000000000000..73e8a84e0ce5
--- /dev/null
+++ b/cpp/ql/test/library-tests/blocks/c/exprs.expected
@@ -0,0 +1,103 @@
+| blocks.c:6:59:6:60 | 10 |
+| blocks.c:10:53:10:54 | 10 |
+| blocks.c:16:5:16:38 | blockReturningVoidWithVoidArgument |
+| blocks.c:16:5:17:33 | ... = ... |
+| blocks.c:17:11:17:33 | ^ { ... } |
+| blocks.c:17:25:17:25 | x |
+| blocks.c:17:25:17:29 | ... = ... |
+| blocks.c:17:29:17:29 | 1 |
+| blocks.c:19:5:19:38 | blockReturningVoidWithVoidArgument |
+| blocks.c:19:5:20:28 | ... = ... |
+| blocks.c:20:11:20:28 | ^ { ... } |
+| blocks.c:20:20:20:20 | x |
+| blocks.c:20:20:20:24 | ... = ... |
+| blocks.c:20:24:20:24 | 1 |
+| blocks.c:22:5:22:38 | blockReturningVoidWithVoidArgument |
+| blocks.c:22:5:23:21 | ... = ... |
+| blocks.c:23:11:23:21 | ^ { ... } |
+| blocks.c:23:13:23:13 | x |
+| blocks.c:23:13:23:17 | ... = ... |
+| blocks.c:23:17:23:17 | 1 |
+| blocks.c:27:8:27:37 | ^ { ... } |
+| blocks.c:27:29:27:29 | x |
+| blocks.c:27:29:27:33 | ... = ... |
+| blocks.c:27:33:27:33 | 1 |
+| blocks.c:31:8:31:51 | ^ { ... } |
+| blocks.c:31:29:31:29 | x |
+| blocks.c:31:29:31:33 | ... = ... |
+| blocks.c:31:33:31:33 | 1 |
+| blocks.c:31:43:31:43 | 1 |
+| blocks.c:35:8:35:49 | ^ { ... } |
+| blocks.c:35:29:35:29 | x |
+| blocks.c:35:29:35:33 | ... = ... |
+| blocks.c:35:33:35:33 | 1 |
+| blocks.c:35:43:35:45 | 0.5 |
+| blocks.c:39:8:39:75 | ^ { ... } |
+| blocks.c:39:29:39:29 | x |
+| blocks.c:39:29:39:33 | ... = ... |
+| blocks.c:39:33:39:33 | 1 |
+| blocks.c:39:40:39:40 | 1 |
+| blocks.c:39:52:39:54 | 0.5 |
+| blocks.c:39:67:39:67 | 1 |
+| blocks.c:43:8:43:54 | ^ { ... } |
+| blocks.c:43:34:43:34 | x |
+| blocks.c:43:34:43:38 | ... = ... |
+| blocks.c:43:38:43:38 | 1 |
+| blocks.c:43:48:43:50 | 99 |
+| blocks.c:43:48:43:50 | (char)... |
+| blocks.c:47:8:47:64 | ^ { ... } |
+| blocks.c:47:42:47:42 | x |
+| blocks.c:47:42:47:46 | ... = ... |
+| blocks.c:47:46:47:46 | 1 |
+| blocks.c:47:56:47:60 | (const char *)... |
+| blocks.c:47:56:47:60 | array to pointer conversion |
+| blocks.c:47:56:47:60 | str |
+| blocks.c:51:8:51:73 | ^ { ... } |
+| blocks.c:51:50:51:50 | x |
+| blocks.c:51:50:51:54 | ... = ... |
+| blocks.c:51:54:51:54 | 1 |
+| blocks.c:51:64:51:64 | 1 |
+| blocks.c:56:5:56:6 | b1 |
+| blocks.c:56:5:56:14 | call to expression |
+| blocks.c:56:8:56:8 | 5 |
+| blocks.c:56:11:56:13 | 97 |
+| blocks.c:56:11:56:13 | (char)... |
+| blocks.c:57:5:57:6 | b2 |
+| blocks.c:57:5:57:14 | call to expression |
+| blocks.c:57:8:57:8 | 5 |
+| blocks.c:57:11:57:13 | 97 |
+| blocks.c:57:11:57:13 | (char)... |
+| blocks.c:58:5:58:5 | d |
+| blocks.c:58:5:58:18 | ... = ... |
+| blocks.c:58:9:58:10 | b3 |
+| blocks.c:58:9:58:18 | call to expression |
+| blocks.c:58:12:58:12 | 5 |
+| blocks.c:58:15:58:17 | 97 |
+| blocks.c:58:15:58:17 | (char)... |
+| blocks.c:59:5:59:5 | d |
+| blocks.c:59:5:59:18 | ... = ... |
+| blocks.c:59:9:59:10 | b4 |
+| blocks.c:59:9:59:18 | call to expression |
+| blocks.c:59:12:59:12 | 5 |
+| blocks.c:59:15:59:17 | 97 |
+| blocks.c:59:15:59:17 | (char)... |
+| blocks.c:60:5:60:5 | c |
+| blocks.c:60:5:60:18 | ... = ... |
+| blocks.c:60:9:60:10 | b5 |
+| blocks.c:60:9:60:18 | call to expression |
+| blocks.c:60:12:60:12 | 5 |
+| blocks.c:60:15:60:17 | 97 |
+| blocks.c:60:15:60:17 | (char)... |
+| blocks.c:63:16:65:2 | (..(^)(..))... |
+| blocks.c:63:16:65:2 | ^ { ... } |
+| blocks.c:64:10:64:10 | 4 |
+| blocks.c:69:19:69:39 | ^ { ... } |
+| blocks.c:69:35:69:35 | 4 |
+| blocks.c:73:64:73:64 | 0 |
+| blocks.c:73:64:73:64 | (pointerToFunctionThatReturnsIntWithCharArg)... |
+| blocks.c:74:60:74:111 | ^ { ... } |
+| blocks.c:74:93:74:107 | functionPointer |
+| blocks.c:79:3:79:9 | (B)... |
+| blocks.c:79:7:79:9 | ^ { ... } |
+| blocks.c:80:3:80:9 | (B)... |
+| blocks.c:80:7:80:9 | ^ { ... } |
diff --git a/cpp/ql/test/library-tests/blocks/c/exprs.ql b/cpp/ql/test/library-tests/blocks/c/exprs.ql
new file mode 100644
index 000000000000..3c2a3269e72e
--- /dev/null
+++ b/cpp/ql/test/library-tests/blocks/c/exprs.ql
@@ -0,0 +1,5 @@
+import cpp
+
+from Expr e
+select e
+
diff --git a/cpp/ql/test/library-tests/blocks/c/options b/cpp/ql/test/library-tests/blocks/c/options
new file mode 100644
index 000000000000..81574938c6ae
--- /dev/null
+++ b/cpp/ql/test/library-tests/blocks/c/options
@@ -0,0 +1 @@
+extractor_flags: -fblocks
diff --git a/cpp/ql/test/library-tests/blocks/capture/capture.c b/cpp/ql/test/library-tests/blocks/capture/capture.c
new file mode 100644
index 000000000000..69c761df4abb
--- /dev/null
+++ b/cpp/ql/test/library-tests/blocks/capture/capture.c
@@ -0,0 +1,41 @@
+
+void printf(char *str, int a, int b);
+typedef void (^voidBlock)(void);
+voidBlock Block_copy(voidBlock);
+
+int x;
+
+void (^b1)(void);
+void (^b2)(void);
+void (^b3)(void);
+
+void f(void) {
+ __block int y;
+
+ x = 1;
+ y = 2;
+
+ b1 = Block_copy(^ void (void) {
+ printf("%d %d\n", x, y);
+ });
+
+ b2 = Block_copy(^ void (void) {
+ x = 3;
+ y = 4;
+ });
+}
+
+int main(void) {
+ f();
+ b1(); // 1 2
+ b2();
+ b1(); // 3 4
+ b3 = b1;
+ f();
+ b3(); // 1 4 (global x is reset, still using the old y)
+ b1(); // 1 2 (using the new y)
+ b2();
+ b1(); // 3 4
+ return 0;
+}
+
diff --git a/cpp/ql/test/library-tests/blocks/capture/capture.expected b/cpp/ql/test/library-tests/blocks/capture/capture.expected
new file mode 100644
index 000000000000..3fa9dc0baddd
--- /dev/null
+++ b/cpp/ql/test/library-tests/blocks/capture/capture.expected
@@ -0,0 +1,4 @@
+| capture.c:18:23:20:6 | ^ { ... } | capture.c:19:27:19:27 | x | capture.c:6:5:6:5 | x | capture.c:18:23:18:23 | |
+| capture.c:18:23:20:6 | ^ { ... } | capture.c:19:30:19:30 | y | capture.c:13:17:13:17 | y | capture.c:18:23:18:23 | |
+| capture.c:22:23:25:6 | ^ { ... } | capture.c:23:9:23:9 | x | capture.c:6:5:6:5 | x | capture.c:22:23:22:23 | |
+| capture.c:22:23:25:6 | ^ { ... } | capture.c:24:9:24:9 | y | capture.c:13:17:13:17 | y | capture.c:22:23:22:23 | |
diff --git a/cpp/ql/test/library-tests/blocks/capture/capture.ql b/cpp/ql/test/library-tests/blocks/capture/capture.ql
new file mode 100644
index 000000000000..7b40e7377576
--- /dev/null
+++ b/cpp/ql/test/library-tests/blocks/capture/capture.ql
@@ -0,0 +1,9 @@
+import cpp
+
+from VariableAccess a, BlockExpr b
+where a.getEnclosingFunction() = b.getFunction()
+select b,
+ a,
+ a.getTarget(),
+ a.getEnclosingFunction()
+
diff --git a/cpp/ql/test/library-tests/blocks/capture/options b/cpp/ql/test/library-tests/blocks/capture/options
new file mode 100644
index 000000000000..81574938c6ae
--- /dev/null
+++ b/cpp/ql/test/library-tests/blocks/capture/options
@@ -0,0 +1 @@
+extractor_flags: -fblocks
diff --git a/cpp/ql/test/library-tests/blocks/capture/quals.expected b/cpp/ql/test/library-tests/blocks/capture/quals.expected
new file mode 100644
index 000000000000..375ac59046a2
--- /dev/null
+++ b/cpp/ql/test/library-tests/blocks/capture/quals.expected
@@ -0,0 +1 @@
+| capture.c:13:17:13:17 | y | file://:0:0:0:0 | __block |
diff --git a/cpp/ql/test/library-tests/blocks/capture/quals.ql b/cpp/ql/test/library-tests/blocks/capture/quals.ql
new file mode 100644
index 000000000000..61004e4d61de
--- /dev/null
+++ b/cpp/ql/test/library-tests/blocks/capture/quals.ql
@@ -0,0 +1,6 @@
+import cpp
+
+from Variable v
+select v,
+ v.getASpecifier()
+
diff --git a/cpp/ql/test/library-tests/blocks/cpp/blocks.cpp b/cpp/ql/test/library-tests/blocks/cpp/blocks.cpp
new file mode 100644
index 000000000000..d944bf771736
--- /dev/null
+++ b/cpp/ql/test/library-tests/blocks/cpp/blocks.cpp
@@ -0,0 +1,59 @@
+// Compilable with:
+// clang -std=c++11 -fblocks -c blocks.cpp
+
+void (*functionPtrReturningVoidWithVoidArgument)(void);
+int (*functionPtrReturningIntWithIntAndCharArguments)(int, char);
+void (*arrayOfTenFunctionPtrsReturningVoidWithIntArgument[10])(int);
+
+void (^blockReturningVoidWithVoidArgument)(void);
+int (^blockReturningIntWithIntAndCharArguments)(int, char);
+void (^arrayOfTenBlocksReturningVoidWithIntArgument[10])(int);
+
+int x;
+
+void f(void) {
+
+ blockReturningVoidWithVoidArgument
+ = ^ void (void) { x = 1; };
+
+ blockReturningVoidWithVoidArgument
+ = ^ (void) { x = 1; };
+
+ blockReturningVoidWithVoidArgument
+ = ^ { x = 1; };
+
+ // Has an implicit "return;" so result type is void
+ auto b1
+ = ^ (int y, char z) { x = 1; };
+
+ // Has no implicit "return;" but result type still void
+ auto b2
+ = ^ (int y, char z) { x = 1; while (1) { } };
+
+ // Explicit return so result type char
+ auto b3
+ = ^ (int y, char z) { x = 1; return 'c'; };
+
+ // Explicit return so result type char
+ auto b4
+ = ^ (int y, char z) { x = 1; if (1) { return 'c'; }; while (1) { } };
+
+ // Also has an explicit return type
+ auto b5
+ = ^ char (int y, char z) { x = 1; return 'c'; };
+
+ char c;
+
+ b1(5, 'a');
+ b2(5, 'a');
+ c = b3(5, 'a');
+ c = b4(5, 'a');
+ c = b5(5, 'a');
+}
+
+struct Example {
+ int four;
+ int getFour() {
+ return (^{ return four; })();
+ }
+};
diff --git a/cpp/ql/test/library-tests/blocks/cpp/blocks.expected b/cpp/ql/test/library-tests/blocks/cpp/blocks.expected
new file mode 100644
index 000000000000..5a4830a470f1
--- /dev/null
+++ b/cpp/ql/test/library-tests/blocks/cpp/blocks.expected
@@ -0,0 +1,30 @@
+| blocks.cpp:4:8:4:47 | functionPtrReturningVoidWithVoidArgument | file://:0:0:0:0 | ..(*)(..) | pointer to {function returning {void} with arguments ()} |
+| blocks.cpp:5:7:5:52 | functionPtrReturningIntWithIntAndCharArguments | file://:0:0:0:0 | ..(*)(..) | pointer to {function returning {int} with arguments (int,char)} |
+| blocks.cpp:6:8:6:57 | arrayOfTenFunctionPtrsReturningVoidWithIntArgument | file://:0:0:0:0 | ..(*[10])(..) | array of 10 {pointer to {function returning {void} with arguments (int)}} |
+| blocks.cpp:8:8:8:41 | blockReturningVoidWithVoidArgument | file://:0:0:0:0 | ..(^)(..) | block of {function returning {void} with arguments ()} |
+| blocks.cpp:9:7:9:46 | blockReturningIntWithIntAndCharArguments | file://:0:0:0:0 | ..(^)(..) | block of {function returning {int} with arguments (int,char)} |
+| blocks.cpp:10:8:10:51 | arrayOfTenBlocksReturningVoidWithIntArgument | file://:0:0:0:0 | ..(^[10])(..) | array of 10 {block of {function returning {void} with arguments (int)}} |
+| blocks.cpp:12:5:12:5 | x | file://:0:0:0:0 | int | int |
+| blocks.cpp:26:10:26:11 | b1 | file://:0:0:0:0 | ..(^)(..) | block of {function returning {void} with arguments (int,char)} |
+| blocks.cpp:27:16:27:16 | y | file://:0:0:0:0 | int | int |
+| blocks.cpp:27:24:27:24 | z | file://:0:0:0:0 | char | char |
+| blocks.cpp:30:10:30:11 | b2 | file://:0:0:0:0 | ..(^)(..) | block of {function returning {void} with arguments (int,char)} |
+| blocks.cpp:31:16:31:16 | y | file://:0:0:0:0 | int | int |
+| blocks.cpp:31:24:31:24 | z | file://:0:0:0:0 | char | char |
+| blocks.cpp:34:10:34:11 | b3 | file://:0:0:0:0 | ..(^)(..) | block of {function returning {char} with arguments (int,char)} |
+| blocks.cpp:35:16:35:16 | y | file://:0:0:0:0 | int | int |
+| blocks.cpp:35:24:35:24 | z | file://:0:0:0:0 | char | char |
+| blocks.cpp:38:10:38:11 | b4 | file://:0:0:0:0 | ..(^)(..) | block of {function returning {char} with arguments (int,char)} |
+| blocks.cpp:39:16:39:16 | y | file://:0:0:0:0 | int | int |
+| blocks.cpp:39:24:39:24 | z | file://:0:0:0:0 | char | char |
+| blocks.cpp:42:10:42:11 | b5 | file://:0:0:0:0 | ..(^)(..) | block of {function returning {char} with arguments (int,char)} |
+| blocks.cpp:43:21:43:21 | y | file://:0:0:0:0 | int | int |
+| blocks.cpp:43:29:43:29 | z | file://:0:0:0:0 | char | char |
+| blocks.cpp:45:10:45:10 | c | file://:0:0:0:0 | char | char |
+| blocks.cpp:55:7:55:10 | four | file://:0:0:0:0 | int | int |
+| file://:0:0:0:0 | fp_offset | file://:0:0:0:0 | unsigned int | unsigned int |
+| file://:0:0:0:0 | gp_offset | file://:0:0:0:0 | unsigned int | unsigned int |
+| file://:0:0:0:0 | overflow_arg_area | file://:0:0:0:0 | void * | pointer to {void} |
+| file://:0:0:0:0 | p#0 | file://:0:0:0:0 | Example && | rvalue reference to {struct Example} |
+| file://:0:0:0:0 | p#0 | file://:0:0:0:0 | const Example & | reference to {const {struct Example}} |
+| file://:0:0:0:0 | reg_save_area | file://:0:0:0:0 | void * | pointer to {void} |
diff --git a/cpp/ql/test/library-tests/blocks/cpp/blocks.ql b/cpp/ql/test/library-tests/blocks/cpp/blocks.ql
new file mode 100644
index 000000000000..d437dd74f97e
--- /dev/null
+++ b/cpp/ql/test/library-tests/blocks/cpp/blocks.ql
@@ -0,0 +1,7 @@
+import cpp
+
+from Variable v
+select v,
+ v.getType(),
+ v.getType().explain()
+
diff --git a/cpp/ql/test/library-tests/blocks/cpp/code_blocks.expected b/cpp/ql/test/library-tests/blocks/cpp/code_blocks.expected
new file mode 100644
index 000000000000..aadbe3ffe65d
--- /dev/null
+++ b/cpp/ql/test/library-tests/blocks/cpp/code_blocks.expected
@@ -0,0 +1,9 @@
+| blocks.cpp:17:11:17:33 | ^ { ... } | file://:0:0:0:0 | ..(^)(..) | block of {function returning {void} with arguments ()} | blocks.cpp:17:11:17:11 | | file://:0:0:0:0 | void | void | |
+| blocks.cpp:20:11:20:28 | ^ { ... } | file://:0:0:0:0 | ..(^)(..) | block of {function returning {void} with arguments ()} | blocks.cpp:20:11:20:11 | | file://:0:0:0:0 | void | void | |
+| blocks.cpp:23:11:23:21 | ^ { ... } | file://:0:0:0:0 | ..(^)(..) | block of {function returning {void} with arguments ()} | blocks.cpp:23:11:23:11 | | file://:0:0:0:0 | void | void | |
+| blocks.cpp:27:8:27:37 | ^ { ... } | file://:0:0:0:0 | ..(^)(..) | block of {function returning {void} with arguments (int,char)} | blocks.cpp:27:11:27:11 | | file://:0:0:0:0 | void | void | y(int), z(char) |
+| blocks.cpp:31:8:31:51 | ^ { ... } | file://:0:0:0:0 | ..(^)(..) | block of {function returning {void} with arguments (int,char)} | blocks.cpp:31:11:31:11 | | file://:0:0:0:0 | void | void | y(int), z(char) |
+| blocks.cpp:35:8:35:49 | ^ { ... } | file://:0:0:0:0 | ..(^)(..) | block of {function returning {char} with arguments (int,char)} | blocks.cpp:35:11:35:11 | | file://:0:0:0:0 | char | char | y(int), z(char) |
+| blocks.cpp:39:8:39:75 | ^ { ... } | file://:0:0:0:0 | ..(^)(..) | block of {function returning {char} with arguments (int,char)} | blocks.cpp:39:11:39:11 | | file://:0:0:0:0 | char | char | y(int), z(char) |
+| blocks.cpp:43:8:43:54 | ^ { ... } | file://:0:0:0:0 | ..(^)(..) | block of {function returning {char} with arguments (int,char)} | blocks.cpp:43:11:43:11 | | file://:0:0:0:0 | char | char | y(int), z(char) |
+| blocks.cpp:57:14:57:30 | ^ { ... } | file://:0:0:0:0 | ..(^)(..) | block of {function returning {int} with arguments ()} | blocks.cpp:57:14:57:14 | | file://:0:0:0:0 | int | int | |
diff --git a/cpp/ql/test/library-tests/blocks/cpp/code_blocks.ql b/cpp/ql/test/library-tests/blocks/cpp/code_blocks.ql
new file mode 100644
index 000000000000..842832fadb63
--- /dev/null
+++ b/cpp/ql/test/library-tests/blocks/cpp/code_blocks.ql
@@ -0,0 +1,25 @@
+import cpp
+
+predicate paramsString(Function f, int n, string res) {
+ if n = -1 then res = ""
+ else exists(string sep |
+ if n = 0 then sep = "" else sep = ", "
+ and
+ exists(string prefixRes |
+ paramsString(f, n - 1, prefixRes)
+ and
+ res = prefixRes + sep + f.getParameter(n)
+ + "(" + f.getParameter(n).getType() + ")"))
+}
+
+from BlockExpr e, Function f, string params
+where f = e.getFunction()
+ and paramsString(f, f.getNumberOfParameters() - 1, params)
+select e,
+ e.getType() as te,
+ te.explain(),
+ e.getFunction(),
+ f.getType() as tf,
+ tf.explain(),
+ params
+
diff --git a/cpp/ql/test/library-tests/blocks/cpp/exprs.expected b/cpp/ql/test/library-tests/blocks/cpp/exprs.expected
new file mode 100644
index 000000000000..f81990f2c4b5
--- /dev/null
+++ b/cpp/ql/test/library-tests/blocks/cpp/exprs.expected
@@ -0,0 +1,82 @@
+| blocks.cpp:6:59:6:60 | 10 |
+| blocks.cpp:6:59:6:60 | Conversion of 10 |
+| blocks.cpp:10:53:10:54 | 10 |
+| blocks.cpp:10:53:10:54 | Conversion of 10 |
+| blocks.cpp:16:5:16:38 | blockReturningVoidWithVoidArgument |
+| blocks.cpp:16:5:17:33 | ... = ... |
+| blocks.cpp:17:11:17:33 | ^ { ... } |
+| blocks.cpp:17:25:17:25 | x |
+| blocks.cpp:17:25:17:29 | ... = ... |
+| blocks.cpp:17:29:17:29 | 1 |
+| blocks.cpp:19:5:19:38 | blockReturningVoidWithVoidArgument |
+| blocks.cpp:19:5:20:28 | ... = ... |
+| blocks.cpp:20:11:20:28 | ^ { ... } |
+| blocks.cpp:20:20:20:20 | x |
+| blocks.cpp:20:20:20:24 | ... = ... |
+| blocks.cpp:20:24:20:24 | 1 |
+| blocks.cpp:22:5:22:38 | blockReturningVoidWithVoidArgument |
+| blocks.cpp:22:5:23:21 | ... = ... |
+| blocks.cpp:23:11:23:21 | ^ { ... } |
+| blocks.cpp:23:13:23:13 | x |
+| blocks.cpp:23:13:23:17 | ... = ... |
+| blocks.cpp:23:17:23:17 | 1 |
+| blocks.cpp:27:8:27:37 | ^ { ... } |
+| blocks.cpp:27:29:27:29 | x |
+| blocks.cpp:27:29:27:33 | ... = ... |
+| blocks.cpp:27:33:27:33 | 1 |
+| blocks.cpp:31:8:31:51 | ^ { ... } |
+| blocks.cpp:31:29:31:29 | x |
+| blocks.cpp:31:29:31:33 | ... = ... |
+| blocks.cpp:31:33:31:33 | 1 |
+| blocks.cpp:31:43:31:43 | 1 |
+| blocks.cpp:31:43:31:43 | Conversion of 1 |
+| blocks.cpp:35:8:35:49 | ^ { ... } |
+| blocks.cpp:35:29:35:29 | x |
+| blocks.cpp:35:29:35:33 | ... = ... |
+| blocks.cpp:35:33:35:33 | 1 |
+| blocks.cpp:35:43:35:45 | 99 |
+| blocks.cpp:39:8:39:75 | ^ { ... } |
+| blocks.cpp:39:29:39:29 | x |
+| blocks.cpp:39:29:39:33 | ... = ... |
+| blocks.cpp:39:33:39:33 | 1 |
+| blocks.cpp:39:40:39:40 | 1 |
+| blocks.cpp:39:40:39:40 | Conversion of 1 |
+| blocks.cpp:39:52:39:54 | 99 |
+| blocks.cpp:39:67:39:67 | 1 |
+| blocks.cpp:39:67:39:67 | Conversion of 1 |
+| blocks.cpp:43:8:43:54 | ^ { ... } |
+| blocks.cpp:43:34:43:34 | x |
+| blocks.cpp:43:34:43:38 | ... = ... |
+| blocks.cpp:43:38:43:38 | 1 |
+| blocks.cpp:43:48:43:50 | 99 |
+| blocks.cpp:47:5:47:6 | b1 |
+| blocks.cpp:47:5:47:14 | call to expression |
+| blocks.cpp:47:8:47:8 | 5 |
+| blocks.cpp:47:11:47:13 | 97 |
+| blocks.cpp:48:5:48:6 | b2 |
+| blocks.cpp:48:5:48:14 | call to expression |
+| blocks.cpp:48:8:48:8 | 5 |
+| blocks.cpp:48:11:48:13 | 97 |
+| blocks.cpp:49:5:49:5 | c |
+| blocks.cpp:49:5:49:18 | ... = ... |
+| blocks.cpp:49:9:49:10 | b3 |
+| blocks.cpp:49:9:49:18 | call to expression |
+| blocks.cpp:49:12:49:12 | 5 |
+| blocks.cpp:49:15:49:17 | 97 |
+| blocks.cpp:50:5:50:5 | c |
+| blocks.cpp:50:5:50:18 | ... = ... |
+| blocks.cpp:50:9:50:10 | b4 |
+| blocks.cpp:50:9:50:18 | call to expression |
+| blocks.cpp:50:12:50:12 | 5 |
+| blocks.cpp:50:15:50:17 | 97 |
+| blocks.cpp:51:5:51:5 | c |
+| blocks.cpp:51:5:51:18 | ... = ... |
+| blocks.cpp:51:9:51:10 | b5 |
+| blocks.cpp:51:9:51:18 | call to expression |
+| blocks.cpp:51:12:51:12 | 5 |
+| blocks.cpp:51:15:51:17 | 97 |
+| blocks.cpp:57:12:57:30 | (...) |
+| blocks.cpp:57:12:57:32 | call to expression |
+| blocks.cpp:57:14:57:30 | ^ { ... } |
+| blocks.cpp:57:23:57:26 | four |
+| file://:0:0:0:0 | this |
diff --git a/cpp/ql/test/library-tests/blocks/cpp/exprs.ql b/cpp/ql/test/library-tests/blocks/cpp/exprs.ql
new file mode 100644
index 000000000000..1403942f5a1d
--- /dev/null
+++ b/cpp/ql/test/library-tests/blocks/cpp/exprs.ql
@@ -0,0 +1,13 @@
+import cpp
+
+/*
+ * Plainer output for CStyleCast, that does not reference the (potentially platform
+ * dependent) type of the cast.
+ */
+class CStyleCastPlain extends CStyleCast {
+ override string toString() { result = "Conversion of " + getExpr().toString() }
+}
+
+from Expr e
+select e
+
diff --git a/cpp/ql/test/library-tests/blocks/cpp/options b/cpp/ql/test/library-tests/blocks/cpp/options
new file mode 100644
index 000000000000..81574938c6ae
--- /dev/null
+++ b/cpp/ql/test/library-tests/blocks/cpp/options
@@ -0,0 +1 @@
+extractor_flags: -fblocks
diff --git a/cpp/ql/test/library-tests/blocks/deduplication/deduplication.expected b/cpp/ql/test/library-tests/blocks/deduplication/deduplication.expected
new file mode 100644
index 000000000000..d782ab52217b
--- /dev/null
+++ b/cpp/ql/test/library-tests/blocks/deduplication/deduplication.expected
@@ -0,0 +1 @@
+| 1 | 1 |
diff --git a/cpp/ql/test/library-tests/blocks/deduplication/deduplication.ql b/cpp/ql/test/library-tests/blocks/deduplication/deduplication.ql
new file mode 100644
index 000000000000..4bf5f2d5ce1e
--- /dev/null
+++ b/cpp/ql/test/library-tests/blocks/deduplication/deduplication.ql
@@ -0,0 +1,5 @@
+import cpp
+
+select count(BlockExpr be),
+ count(ReturnStmt rs | rs.getExpr().getValue() = "0")
+
diff --git a/cpp/ql/test/library-tests/blocks/deduplication/functions.expected b/cpp/ql/test/library-tests/blocks/deduplication/functions.expected
new file mode 100644
index 000000000000..9f4d90dd1f1f
--- /dev/null
+++ b/cpp/ql/test/library-tests/blocks/deduplication/functions.expected
@@ -0,0 +1,3 @@
+| 1 | 1 |
+| 2 | 1 |
+| 9 | 2 |
diff --git a/cpp/ql/test/library-tests/blocks/deduplication/functions.ql b/cpp/ql/test/library-tests/blocks/deduplication/functions.ql
new file mode 100644
index 000000000000..f6bf2f1b2d3d
--- /dev/null
+++ b/cpp/ql/test/library-tests/blocks/deduplication/functions.ql
@@ -0,0 +1,4 @@
+import cpp
+
+from int line
+select line, strictcount(Function f | f.getLocation().getStartLine() = line)
diff --git a/cpp/ql/test/library-tests/blocks/deduplication/options b/cpp/ql/test/library-tests/blocks/deduplication/options
new file mode 100644
index 000000000000..81574938c6ae
--- /dev/null
+++ b/cpp/ql/test/library-tests/blocks/deduplication/options
@@ -0,0 +1 @@
+extractor_flags: -fblocks
diff --git a/cpp/ql/test/library-tests/blocks/deduplication/primary.c b/cpp/ql/test/library-tests/blocks/deduplication/primary.c
new file mode 100644
index 000000000000..6cbe3f038e3e
--- /dev/null
+++ b/cpp/ql/test/library-tests/blocks/deduplication/primary.c
@@ -0,0 +1,11 @@
+static int common() {
+ return ^{return 0;}();
+}
+
+#ifndef FN
+#define FN primary
+#endif
+
+int FN() {
+ return common();
+}
diff --git a/cpp/ql/test/library-tests/blocks/deduplication/secondary.c b/cpp/ql/test/library-tests/blocks/deduplication/secondary.c
new file mode 100644
index 000000000000..93a63dac7fd6
--- /dev/null
+++ b/cpp/ql/test/library-tests/blocks/deduplication/secondary.c
@@ -0,0 +1,2 @@
+#define FN secondary
+#include "primary.c"
diff --git a/cpp/ql/test/library-tests/bugs/odasa-2709/one.expected b/cpp/ql/test/library-tests/bugs/odasa-2709/one.expected
new file mode 100644
index 000000000000..2a4f078a25fc
--- /dev/null
+++ b/cpp/ql/test/library-tests/bugs/odasa-2709/one.expected
@@ -0,0 +1 @@
+| 1 |
diff --git a/cpp/ql/test/library-tests/bugs/odasa-2709/one.ql b/cpp/ql/test/library-tests/bugs/odasa-2709/one.ql
new file mode 100644
index 000000000000..55cd6933f857
--- /dev/null
+++ b/cpp/ql/test/library-tests/bugs/odasa-2709/one.ql
@@ -0,0 +1,2 @@
+// This test is for the dbcheck only
+select 1
diff --git a/cpp/ql/test/library-tests/bugs/odasa-2709/test1.c b/cpp/ql/test/library-tests/bugs/odasa-2709/test1.c
new file mode 100644
index 000000000000..d37f600da802
--- /dev/null
+++ b/cpp/ql/test/library-tests/bugs/odasa-2709/test1.c
@@ -0,0 +1,2 @@
+void foo(int x) {
+}
diff --git a/cpp/ql/test/library-tests/bugs/odasa-2709/test2.c b/cpp/ql/test/library-tests/bugs/odasa-2709/test2.c
new file mode 100644
index 000000000000..61a08bddd298
--- /dev/null
+++ b/cpp/ql/test/library-tests/bugs/odasa-2709/test2.c
@@ -0,0 +1,3 @@
+int foo(float x) {
+ return (int) (x - 1);
+}
diff --git a/cpp/ql/test/library-tests/builtins/builtins/atomic.cpp b/cpp/ql/test/library-tests/builtins/builtins/atomic.cpp
new file mode 100644
index 000000000000..9c0cae9da712
--- /dev/null
+++ b/cpp/ql/test/library-tests/builtins/builtins/atomic.cpp
@@ -0,0 +1,20 @@
+static int atomic_increment_i(int* ptr)
+{
+ return __atomic_fetch_add(ptr, 1, 0);
+}
+
+static double atomic_increment_c(char* ptr)
+{
+ return __atomic_fetch_add(ptr, 1, 0);
+}
+
+static int atomic_increment_i4(int* ptr)
+{
+ return __atomic_fetch_add_4(ptr, 1, 0);
+}
+
+static char atomic_increment_c1(char* ptr)
+{
+ return __atomic_fetch_add_1(ptr, 1, 0);
+}
+// semmle-extractor-options: --gnu_version 40700
diff --git a/cpp/ql/test/library-tests/builtins/builtins/builtins.expected b/cpp/ql/test/library-tests/builtins/builtins/builtins.expected
new file mode 100644
index 000000000000..046944ee078f
--- /dev/null
+++ b/cpp/ql/test/library-tests/builtins/builtins/builtins.expected
@@ -0,0 +1,4 @@
+| choose_expr.c:3:13:3:42 | __builtin_choose_expr |
+| varargs.c:7:5:7:32 | __builtin_va_start |
+| varargs.c:9:13:9:37 | __builtin_va_arg |
+| varargs.c:11:5:11:24 | __builtin_va_end |
diff --git a/cpp/ql/test/library-tests/builtins/builtins/builtins.ql b/cpp/ql/test/library-tests/builtins/builtins/builtins.ql
new file mode 100644
index 000000000000..6406da42c24e
--- /dev/null
+++ b/cpp/ql/test/library-tests/builtins/builtins/builtins.ql
@@ -0,0 +1,5 @@
+import cpp
+
+from BuiltInOperation op
+select op
+
diff --git a/cpp/ql/test/library-tests/builtins/builtins/calls.expected b/cpp/ql/test/library-tests/builtins/builtins/calls.expected
new file mode 100644
index 000000000000..9aeae327fc95
--- /dev/null
+++ b/cpp/ql/test/library-tests/builtins/builtins/calls.expected
@@ -0,0 +1,4 @@
+| atomic.cpp:3:10:3:27 | call to __atomic_fetch_add_4 |
+| atomic.cpp:8:10:8:27 | call to __atomic_fetch_add_1 |
+| atomic.cpp:13:10:13:29 | call to __atomic_fetch_add_4 |
+| atomic.cpp:18:10:18:29 | call to __atomic_fetch_add_1 |
diff --git a/cpp/ql/test/library-tests/builtins/builtins/calls.ql b/cpp/ql/test/library-tests/builtins/builtins/calls.ql
new file mode 100644
index 000000000000..13cf5c516288
--- /dev/null
+++ b/cpp/ql/test/library-tests/builtins/builtins/calls.ql
@@ -0,0 +1,5 @@
+import cpp
+
+from FunctionCall fc
+where fc.getTarget() instanceof BuiltInFunction
+select fc
diff --git a/cpp/ql/test/library-tests/builtins/builtins/choose_expr.c b/cpp/ql/test/library-tests/builtins/builtins/choose_expr.c
new file mode 100644
index 000000000000..6dd25eaa17ea
--- /dev/null
+++ b/cpp/ql/test/library-tests/builtins/builtins/choose_expr.c
@@ -0,0 +1,5 @@
+
+static void test_choose_expr(void) {
+ int i = __builtin_choose_expr(1, 5, 6);
+}
+
diff --git a/cpp/ql/test/library-tests/builtins/builtins/varargs.c b/cpp/ql/test/library-tests/builtins/builtins/varargs.c
new file mode 100644
index 000000000000..3c374459c675
--- /dev/null
+++ b/cpp/ql/test/library-tests/builtins/builtins/varargs.c
@@ -0,0 +1,13 @@
+
+void f(int args, ...)
+{
+ __builtin_va_list ap;
+ int i, j;
+
+ __builtin_va_start(ap, args);
+ for (i = 0; i < args; i++) {
+ j = __builtin_va_arg(ap, int);
+ }
+ __builtin_va_end(ap);
+}
+
diff --git a/cpp/ql/test/library-tests/builtins/edg/edg.c b/cpp/ql/test/library-tests/builtins/edg/edg.c
new file mode 100644
index 000000000000..d1a78435317c
--- /dev/null
+++ b/cpp/ql/test/library-tests/builtins/edg/edg.c
@@ -0,0 +1,15 @@
+
+struct mystruct {
+ int f1;
+ int f2;
+};
+
+typedef int size_t;
+
+#define edg_offsetof(t, memb) ((size_t)__INTADDR__(&(((t *)0)->memb)))
+
+void f(void) {
+ int i1 = __builtin_offsetof(struct mystruct,f2);
+ int i2 = edg_offsetof(struct mystruct,f2);
+}
+
diff --git a/cpp/ql/test/library-tests/builtins/edg/expr.expected b/cpp/ql/test/library-tests/builtins/edg/expr.expected
new file mode 100644
index 000000000000..ed5cffd449f2
--- /dev/null
+++ b/cpp/ql/test/library-tests/builtins/edg/expr.expected
@@ -0,0 +1,14 @@
+| edg.c:12:14:12:51 | (int)... | 0 | 0 |
+| edg.c:12:14:12:51 | __offsetof | 1 | 1 |
+| edg.c:12:49:12:50 | f2 | 0 | 0 |
+| edg.c:13:14:13:45 | 0 | 0 | 0 |
+| edg.c:13:14:13:45 | & ... | 0 | 0 |
+| edg.c:13:14:13:45 | (...) | 0 | 0 |
+| edg.c:13:14:13:45 | (...) | 0 | 0 |
+| edg.c:13:14:13:45 | (...) | 0 | 0 |
+| edg.c:13:14:13:45 | (mystruct *)... | 0 | 0 |
+| edg.c:13:14:13:45 | (size_t)... | 0 | 0 |
+| edg.c:13:43:13:44 | f2 | 0 | 0 |
+| file://:0:0:0:0 | 0 | 0 | 0 |
+| file://:0:0:0:0 | * ... | 0 | 0 |
+| file://:0:0:0:0 | mystruct | 0 | 0 |
diff --git a/cpp/ql/test/library-tests/builtins/edg/expr.ql b/cpp/ql/test/library-tests/builtins/edg/expr.ql
new file mode 100644
index 000000000000..e11a9b9f39a8
--- /dev/null
+++ b/cpp/ql/test/library-tests/builtins/edg/expr.ql
@@ -0,0 +1,5 @@
+import cpp
+
+from Expr e
+select e, count(e.getAPredecessor()), count(e.getASuccessor())
+
diff --git a/cpp/ql/test/library-tests/builtins/edg/intaddr.expected b/cpp/ql/test/library-tests/builtins/edg/intaddr.expected
new file mode 100644
index 000000000000..2a4f078a25fc
--- /dev/null
+++ b/cpp/ql/test/library-tests/builtins/edg/intaddr.expected
@@ -0,0 +1 @@
+| 1 |
diff --git a/cpp/ql/test/library-tests/builtins/edg/intaddr.ql b/cpp/ql/test/library-tests/builtins/edg/intaddr.ql
new file mode 100644
index 000000000000..64effcd1ba6b
--- /dev/null
+++ b/cpp/ql/test/library-tests/builtins/edg/intaddr.ql
@@ -0,0 +1,4 @@
+import cpp
+
+select count(@intaddrexpr e)
+
diff --git a/cpp/ql/test/library-tests/builtins/functions_file/builtins.txt b/cpp/ql/test/library-tests/builtins/functions_file/builtins.txt
new file mode 100644
index 000000000000..8ba175f507f7
--- /dev/null
+++ b/cpp/ql/test/library-tests/builtins/functions_file/builtins.txt
@@ -0,0 +1,2 @@
+__builtin_foobar(i)i
+__builtin_malloc(i,i,i,f*)f
diff --git a/cpp/ql/test/library-tests/builtins/functions_file/isbuiltin.expected b/cpp/ql/test/library-tests/builtins/functions_file/isbuiltin.expected
new file mode 100644
index 000000000000..00a331f6f44e
--- /dev/null
+++ b/cpp/ql/test/library-tests/builtins/functions_file/isbuiltin.expected
@@ -0,0 +1,4 @@
+| file://:0:0:0:0 | __builtin_add_overflow | true | 0 | file://:0:0:0:0 | bool |
+| file://:0:0:0:0 | __builtin_foobar | true | 0 | file://:0:0:0:0 | int |
+| file://:0:0:0:0 | __builtin_malloc | true | 0 | file://:0:0:0:0 | float |
+| test.c:1:6:1:6 | f | false | 3 | file://:0:0:0:0 | long |
diff --git a/cpp/ql/test/library-tests/builtins/functions_file/isbuiltin.ql b/cpp/ql/test/library-tests/builtins/functions_file/isbuiltin.ql
new file mode 100644
index 000000000000..f450abb84bd5
--- /dev/null
+++ b/cpp/ql/test/library-tests/builtins/functions_file/isbuiltin.ql
@@ -0,0 +1,5 @@
+import cpp
+
+from Function f, boolean isBuiltin
+where if f instanceof BuiltInFunction then isBuiltin = true else isBuiltin = false
+select f, isBuiltin, f.getNumberOfParameters(), f.getType()
diff --git a/cpp/ql/test/library-tests/builtins/functions_file/test.c b/cpp/ql/test/library-tests/builtins/functions_file/test.c
new file mode 100644
index 000000000000..a73061e4eaba
--- /dev/null
+++ b/cpp/ql/test/library-tests/builtins/functions_file/test.c
@@ -0,0 +1,20 @@
+long f(int a, int b, int c) {
+ // A builtin from the builtin_functions_file.
+ int i1 = __builtin_foobar(a);
+
+ // A builtin that's not in the file, but the extractor should handle, given the
+ // --gnu_version flag we pass in.
+ int i2;
+ __builtin_add_overflow(a, b, &i2);
+
+ // A builtin that would normally be defined by the extractor with a type
+ // expecting it to be called like this:
+ //void* x = __builtin_malloc(a);
+ // But we override the type in the builtin_functions_file so it's called like
+ // this:
+ float f1, f2;
+ f1 = __builtin_malloc(a, b, c, &f2);
+
+ return 42;
+}
+// semmle-extractor-options: --gnu_version 50100 --edg --builtin_functions_file --edg ${testdir}/builtins.txt
diff --git a/cpp/ql/test/library-tests/builtins/type_traits/expr.expected b/cpp/ql/test/library-tests/builtins/type_traits/expr.expected
new file mode 100644
index 000000000000..6166de5a80d7
--- /dev/null
+++ b/cpp/ql/test/library-tests/builtins/type_traits/expr.expected
@@ -0,0 +1,298 @@
+| file://:0:0:0:0 | 0 | | 0 |
+| file://:0:0:0:0 | 1 | | 1 |
+| file://:0:0:0:0 | 2 | | 2 |
+| file://:0:0:0:0 | C1 | | |
+| file://:0:0:0:0 | C1 | | |
+| file://:0:0:0:0 | C1 | | |
+| file://:0:0:0:0 | C1 | | |
+| file://:0:0:0:0 | C1 | | |
+| file://:0:0:0:0 | C1 | | |
+| file://:0:0:0:0 | C1 | | |
+| file://:0:0:0:0 | C1 | | |
+| file://:0:0:0:0 | C1 | | |
+| file://:0:0:0:0 | C1 | | |
+| file://:0:0:0:0 | C1 | | |
+| file://:0:0:0:0 | C1 | | |
+| file://:0:0:0:0 | C2 | | |
+| file://:0:0:0:0 | C2 | | |
+| file://:0:0:0:0 | C2 | | |
+| file://:0:0:0:0 | C2 | | |
+| file://:0:0:0:0 | C2 | | |
+| file://:0:0:0:0 | C2 | | |
+| file://:0:0:0:0 | C3 | | |
+| file://:0:0:0:0 | C3 | | |
+| file://:0:0:0:0 | C3 | | |
+| file://:0:0:0:0 | C3 | | |
+| file://:0:0:0:0 | C3 | | |
+| file://:0:0:0:0 | C3 | | |
+| file://:0:0:0:0 | C4 | | |
+| file://:0:0:0:0 | C4 | | |
+| file://:0:0:0:0 | C5 | | |
+| file://:0:0:0:0 | C5 | | |
+| file://:0:0:0:0 | a_final_struct | | |
+| file://:0:0:0:0 | a_struct | | |
+| file://:0:0:0:0 | a_struct | | |
+| file://:0:0:0:0 | a_struct | | |
+| file://:0:0:0:0 | a_struct | | |
+| file://:0:0:0:0 | a_struct | | |
+| file://:0:0:0:0 | a_struct | | |
+| file://:0:0:0:0 | a_struct | | |
+| file://:0:0:0:0 | a_struct | | |
+| file://:0:0:0:0 | a_struct | | |
+| file://:0:0:0:0 | a_struct | | |
+| file://:0:0:0:0 | a_struct | | |
+| file://:0:0:0:0 | a_struct | | |
+| file://:0:0:0:0 | a_struct | | |
+| file://:0:0:0:0 | a_struct | | |
+| file://:0:0:0:0 | a_struct | | |
+| file://:0:0:0:0 | a_struct | | |
+| file://:0:0:0:0 | a_struct_plus | | |
+| file://:0:0:0:0 | a_union | | |
+| file://:0:0:0:0 | a_union | | |
+| file://:0:0:0:0 | a_union | | |
+| file://:0:0:0:0 | abstract | | |
+| file://:0:0:0:0 | abstract | | |
+| file://:0:0:0:0 | abstract | | |
+| file://:0:0:0:0 | an_enum | | |
+| file://:0:0:0:0 | an_enum | | |
+| file://:0:0:0:0 | an_enum | |