Skip to content

Commit ebe8882

Browse files
hvitvedhvitved
committed
Rust: Use nodes from CfgNodes.qll in DataFlowImpl.qll 
1 parent b9e5084 commit ebe8882

File tree

5 files changed

+163
-50
lines changed

5 files changed

+163
-50
lines changed

‎rust/ql/lib/codeql/rust/controlflow/CfgNodes.qll‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,3 +14,127 @@ class AstCfgNode extends CfgNode {
1414

1515
AstCfgNode() { node = this.getAstNode() }
1616
}
17+
18+
/**
19+
* An assignment expression, for example
20+
*
21+
* ```rust
22+
* x = y;
23+
* ```
24+
*/
25+
final class AssignmentExprCfgNode extends BinaryExprCfgNode {
26+
AssignmentExpr a;
27+
28+
AssignmentExprCfgNode() { a = this.getBinaryExpr() }
29+
30+
/** Gets the underlying `AssignmentExpr`. */
31+
AssignmentExpr getAssignmentExpr() { result = a }
32+
}
33+
34+
/**
35+
* A match expression. For example:
36+
* ```rust
37+
* match x {
38+
* Option::Some(y) => y,
39+
* Option::None => 0,
40+
* }
41+
* ```
42+
* ```rust
43+
* match x {
44+
* Some(y) if y != 0 => 1 / y,
45+
* _ => 0,
46+
* }
47+
* ```
48+
*/
49+
final class MatchExprCfgNode extends Nodes::MatchExprCfgNode {
50+
private MatchExpr node;
51+
52+
MatchExprCfgNode() { node = this.getMatchExpr() }
53+
54+
/**
55+
* Gets the pattern of the `i`th match arm, if it exists.
56+
*/
57+
PatCfgNode getArmPat(int i) {
58+
any(ChildMapping mapping).hasCfgChild(node, node.getArm(i).getPat(), this, result)
59+
}
60+
61+
/**
62+
* Gets the guard of the `i`th match arm, if it exists.
63+
*/
64+
ExprCfgNode getArmGuard(int i) {
65+
any(ChildMapping mapping)
66+
.hasCfgChild(node, node.getArm(i).getGuard().getCondition(), this, result)
67+
}
68+
69+
/**
70+
* Gets the expression of the `i`th match arm, if it exists.
71+
*/
72+
ExprCfgNode getArmExpr(int i) {
73+
any(ChildMapping mapping).hasCfgChild(node, node.getArm(i).getExpr(), this, result)
74+
}
75+
}
76+
77+
/**
78+
* A block expression. For example:
79+
* ```rust
80+
* {
81+
* let x = 42;
82+
* }
83+
* ```
84+
* ```rust
85+
* 'label: {
86+
* let x = 42;
87+
* x
88+
* }
89+
* ```
90+
*/
91+
final class BlockExprCfgNode extends Nodes::BlockExprCfgNode {
92+
private BlockExprChildMapping node;
93+
94+
BlockExprCfgNode() { node = this.getAstNode() }
95+
96+
/**
97+
* Gets the tail expression of this block, if it exists.
98+
*/
99+
ExprCfgNode getTailExpr() {
100+
any(ChildMapping mapping).hasCfgChild(node, node.getStmtList().getTailExpr(), this, result)
101+
}
102+
}
103+
104+
/**
105+
* A break expression. For example:
106+
* ```rust
107+
* loop {
108+
* if not_ready() {
109+
* break;
110+
* }
111+
* }
112+
* ```
113+
* ```rust
114+
* let x = 'label: loop {
115+
* if done() {
116+
* break 'label 42;
117+
* }
118+
* };
119+
* ```
120+
* ```rust
121+
* let x = 'label: {
122+
* if exit() {
123+
* break 'label 42;
124+
* }
125+
* 0;
126+
* };
127+
* ```
128+
*/
129+
final class BreakExprCfgNode extends Nodes::BreakExprCfgNode {
130+
/**
131+
* Gets the target of this `break` expression.
132+
*
133+
* The target is either a `LoopExpr`, a `ForExpr`, a `WhileExpr`, or a
134+
* `BlockExpr`.
135+
*/
136+
ExprCfgNode getTarget() {
137+
any(ChildMapping mapping)
138+
.hasCfgChild(this.getBreakExpr().getTarget(), this.getBreakExpr(), result, this)
139+
}
140+
}

‎rust/ql/lib/codeql/rust/controlflow/internal/CfgNodes.qll‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,24 @@ private module CfgNodesInput implements InputSig<Location> {
4343

4444
import MakeCfgNodes<Location, CfgNodesInput>
4545

46+
class MatchExprChildMapping extends AstNodeWithChild, MatchExpr {
47+
override predicate relevantChild(AstNode child) {
48+
child = this.getAnArm().getPat()
49+
or
50+
child = this.getAnArm().getGuard().getCondition()
51+
or
52+
child = this.getAnArm().getExpr()
53+
}
54+
}
55+
56+
class BlockExprChildMapping extends AstNodeWithChild, BlockExpr {
57+
override predicate relevantChild(AstNode child) { child = this.getStmtList().getTailExpr() }
58+
}
59+
60+
class BreakExprTargetChildMapping extends AstNodeWithChild, Expr {
61+
override predicate relevantChild(AstNode child) { child.(BreakExpr).getTarget() = this }
62+
}
63+
4664
private class ChildMappingImpl extends ChildMapping {
4765
pragma[nomagic]
4866
predicate reachesBasicBlock(AstNode parent, AstNode child, CfgNode cfn, BasicBlock bb) {

‎rust/ql/lib/codeql/rust/dataflow/Ssa.qll‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ module Ssa {
99
private import rust
1010
private import codeql.rust.controlflow.BasicBlocks
1111
private import codeql.rust.controlflow.ControlFlowGraph
12+
private import codeql.rust.controlflow.CfgNodes
1213
private import codeql.rust.controlflow.internal.ControlFlowGraphImpl as CfgImpl
1314
private import internal.SsaImpl as SsaImpl
1415

@@ -221,11 +222,11 @@ module Ssa {
221222
* end
222223
* ```
223224
*/
224-
predicate assigns(CfgNode value) {
225-
exists(AssignmentExpr ae, BasicBlock bb, int i |
225+
predicate assigns(ExprCfgNode value) {
226+
exists(AssignmentExprCfgNode ae, BasicBlock bb, int i |
226227
this.definesAt(_, bb, i) and
227-
ae.getLhs() = bb.getNode(i).getAstNode() and
228-
value.getAstNode() = ae.getRhs()
228+
ae.getLhs() = bb.getNode(i) and
229+
value = ae.getRhs()
229230
)
230231
}
231232

‎rust/ql/lib/codeql/rust/dataflow/internal/DataFlowImpl.qll‎

Lines changed: 16 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ module Node {
2727
/**
2828
* Gets the expression that corresponds to this node, if any.
2929
*/
30-
Expr asExpr() { none() }
30+
ExprCfgNode asExpr() { none() }
3131

3232
/**
3333
* Gets the control flow node that corresponds to this data flow node.
@@ -67,11 +67,11 @@ module Node {
6767

6868
ExprNode() { this = TExprNode(n) }
6969

70-
override Location getLocation() { result = n.getExpr().getLocation() }
70+
override Location getLocation() { result = n.getLocation() }
7171

72-
override string toString() { result = n.getExpr().toString() }
72+
override string toString() { result = n.toString() }
7373

74-
override Expr asExpr() { result = n.getExpr() }
74+
override ExprCfgNode asExpr() { result = n }
7575

7676
override CfgNode getCfgNode() { result = n }
7777
}
@@ -152,7 +152,7 @@ module SsaFlow {
152152
Impl::Node asNode(Node n) {
153153
n = TSsaNode(result)
154154
or
155-
result.(Impl::ExprNode).getExpr() = n.(Node::ExprNode).getCfgNode()
155+
result.(Impl::ExprNode).getExpr() = n.asExpr()
156156
or
157157
n = toParameterNode(result.(Impl::ParameterNode).getParameter())
158158
}
@@ -166,29 +166,18 @@ module SsaFlow {
166166
}
167167
}
168168

169-
/**
170-
* Holds for expressions `e` that evaluate to the value of any last (in
171-
* evaluation order) subexpressions within it. E.g., expressions that propagate
172-
* a values from a subexpression.
173-
*
174-
* For instance, the predicate holds for if expressions as `if b { e1 } else {
175-
* e2 }` evalates to the value of one of the subexpressions `e1` or `e2`.
176-
*/
177-
private predicate propagatesValue(Expr e) {
178-
e instanceof IfExpr or
179-
e instanceof LoopExpr or
180-
e instanceof ReturnExpr or
181-
e instanceof BreakExpr or
182-
e.(BlockExpr).getStmtList().hasTailExpr() or
183-
e instanceof MatchExpr
184-
}
185-
186169
/**
187170
* Gets a node that may execute last in `n`, and which, when it executes last,
188171
* will be the value of `n`.
189172
*/
190-
private ExprCfgNode getALastEvalNode(ExprCfgNode n) {
191-
propagatesValue(n.getExpr()) and result.getASuccessor() = n
173+
private ExprCfgNode getALastEvalNode(ExprCfgNode e) {
174+
e = any(IfExprCfgNode n | result = [n.getThen(), n.getElse()]) or
175+
result = e.(LoopExprCfgNode).getLoopBody() or
176+
result = e.(ReturnExprCfgNode).getExpr() or
177+
result = e.(BreakExprCfgNode).getExpr() or
178+
result = e.(BlockExprCfgNode).getTailExpr() or
179+
result = e.(MatchExprCfgNode).getArmExpr(_) or
180+
result.(BreakExprCfgNode).getTarget() = e
192181
}
193182

194183
module LocalFlow {
@@ -230,10 +219,10 @@ module RustDataFlow implements InputSig<Location> {
230219
class DataFlowExpr = ExprCfgNode;
231220

232221
/** Gets the node corresponding to `e`. */
233-
Node exprNode(DataFlowExpr e) { result.getCfgNode() = e }
222+
Node exprNode(DataFlowExpr e) { result.asExpr() = e }
234223

235224
final class DataFlowCall extends TNormalCall {
236-
private CallExpr c;
225+
private CallExprCfgNode c;
237226

238227
DataFlowCall() { this = TNormalCall(c) }
239228

@@ -400,7 +389,7 @@ private module Cached {
400389
TSsaNode(SsaImpl::DataFlowIntegration::SsaNode node)
401390

402391
cached
403-
newtype TDataFlowCall = TNormalCall(CallExpr c)
392+
newtype TDataFlowCall = TNormalCall(CallExprCfgNode c)
404393

405394
cached
406395
newtype TOptionalContentSet =

‎rust/ql/test/query-tests/unusedentities/CONSISTENCY/DataFlowConsistency.expected‎

Lines changed: 0 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -112,25 +112,20 @@ uniqueCallEnclosingCallable
112112
| unreachable.rs:2:5:2:18 | CallExpr | Call should have one enclosing callable but has 0. |
113113
| unreachable.rs:6:5:6:24 | CallExpr | Call should have one enclosing callable but has 0. |
114114
| unreachable.rs:10:5:10:20 | CallExpr | Call should have one enclosing callable but has 0. |
115-
| unreachable.rs:19:9:19:22 | CallExpr | Call should have one enclosing callable but has 0. |
116115
| unreachable.rs:21:9:21:22 | CallExpr | Call should have one enclosing callable but has 0. |
117116
| unreachable.rs:25:9:25:22 | CallExpr | Call should have one enclosing callable but has 0. |
118-
| unreachable.rs:27:9:27:22 | CallExpr | Call should have one enclosing callable but has 0. |
119117
| unreachable.rs:30:13:30:26 | CallExpr | Call should have one enclosing callable but has 0. |
120118
| unreachable.rs:33:13:33:26 | CallExpr | Call should have one enclosing callable but has 0. |
121119
| unreachable.rs:37:8:37:13 | CallExpr | Call should have one enclosing callable but has 0. |
122-
| unreachable.rs:39:9:39:22 | CallExpr | Call should have one enclosing callable but has 0. |
123120
| unreachable.rs:42:8:42:13 | CallExpr | Call should have one enclosing callable but has 0. |
124121
| unreachable.rs:43:9:43:22 | CallExpr | Call should have one enclosing callable but has 0. |
125-
| unreachable.rs:46:9:46:22 | CallExpr | Call should have one enclosing callable but has 0. |
126122
| unreachable.rs:48:5:48:18 | CallExpr | Call should have one enclosing callable but has 0. |
127123
| unreachable.rs:50:8:50:13 | CallExpr | Call should have one enclosing callable but has 0. |
128124
| unreachable.rs:51:17:51:22 | CallExpr | Call should have one enclosing callable but has 0. |
129125
| unreachable.rs:54:13:54:26 | CallExpr | Call should have one enclosing callable but has 0. |
130126
| unreachable.rs:56:17:56:30 | CallExpr | Call should have one enclosing callable but has 0. |
131127
| unreachable.rs:58:13:58:26 | CallExpr | Call should have one enclosing callable but has 0. |
132128
| unreachable.rs:62:8:62:13 | CallExpr | Call should have one enclosing callable but has 0. |
133-
| unreachable.rs:67:5:67:18 | CallExpr | Call should have one enclosing callable but has 0. |
134129
| unreachable.rs:71:8:71:13 | CallExpr | Call should have one enclosing callable but has 0. |
135130
| unreachable.rs:72:9:72:22 | CallExpr | Call should have one enclosing callable but has 0. |
136131
| unreachable.rs:73:16:73:25 | CallExpr | Call should have one enclosing callable but has 0. |
@@ -157,15 +152,13 @@ uniqueCallEnclosingCallable
157152
| unreachable.rs:111:8:111:13 | CallExpr | Call should have one enclosing callable but has 0. |
158153
| unreachable.rs:112:9:112:22 | CallExpr | Call should have one enclosing callable but has 0. |
159154
| unreachable.rs:114:13:114:20 | CallExpr | Call should have one enclosing callable but has 0. |
160-
| unreachable.rs:114:13:114:20 | CallExpr | Call should have one enclosing callable but has 0. |
161155
| unreachable.rs:115:9:115:22 | CallExpr | Call should have one enclosing callable but has 0. |
162156
| unreachable.rs:116:22:116:29 | CallExpr | Call should have one enclosing callable but has 0. |
163157
| unreachable.rs:116:22:116:29 | CallExpr | Call should have one enclosing callable but has 0. |
164158
| unreachable.rs:117:9:117:22 | CallExpr | Call should have one enclosing callable but has 0. |
165159
| unreachable.rs:120:8:120:13 | CallExpr | Call should have one enclosing callable but has 0. |
166160
| unreachable.rs:121:9:121:22 | CallExpr | Call should have one enclosing callable but has 0. |
167161
| unreachable.rs:123:13:123:20 | CallExpr | Call should have one enclosing callable but has 0. |
168-
| unreachable.rs:123:13:123:20 | CallExpr | Call should have one enclosing callable but has 0. |
169162
| unreachable.rs:124:9:124:22 | CallExpr | Call should have one enclosing callable but has 0. |
170163
| unreachable.rs:125:21:125:28 | CallExpr | Call should have one enclosing callable but has 0. |
171164
| unreachable.rs:125:21:125:28 | CallExpr | Call should have one enclosing callable but has 0. |
@@ -174,36 +167,24 @@ uniqueCallEnclosingCallable
174167
| unreachable.rs:136:13:136:26 | CallExpr | Call should have one enclosing callable but has 0. |
175168
| unreachable.rs:139:5:139:18 | CallExpr | Call should have one enclosing callable but has 0. |
176169
| unreachable.rs:141:11:141:24 | CallExpr | Call should have one enclosing callable but has 0. |
177-
| unreachable.rs:149:5:149:18 | CallExpr | Call should have one enclosing callable but has 0. |
178170
| unreachable.rs:154:9:154:22 | CallExpr | Call should have one enclosing callable but has 0. |
179-
| unreachable.rs:156:9:156:22 | CallExpr | Call should have one enclosing callable but has 0. |
180171
| unreachable.rs:159:8:159:13 | CallExpr | Call should have one enclosing callable but has 0. |
181172
| unreachable.rs:160:15:160:20 | CallExpr | Call should have one enclosing callable but has 0. |
182173
| unreachable.rs:161:13:161:26 | CallExpr | Call should have one enclosing callable but has 0. |
183-
| unreachable.rs:165:13:165:26 | CallExpr | Call should have one enclosing callable but has 0. |
184174
| unreachable.rs:169:13:169:26 | CallExpr | Call should have one enclosing callable but has 0. |
185-
| unreachable.rs:171:9:171:22 | CallExpr | Call should have one enclosing callable but has 0. |
186175
| unreachable.rs:175:12:175:17 | CallExpr | Call should have one enclosing callable but has 0. |
187-
| unreachable.rs:177:13:177:26 | CallExpr | Call should have one enclosing callable but has 0. |
188176
| unreachable.rs:179:9:179:22 | CallExpr | Call should have one enclosing callable but has 0. |
189177
| unreachable.rs:183:12:183:17 | CallExpr | Call should have one enclosing callable but has 0. |
190-
| unreachable.rs:185:13:185:26 | CallExpr | Call should have one enclosing callable but has 0. |
191-
| unreachable.rs:188:5:188:18 | CallExpr | Call should have one enclosing callable but has 0. |
192-
| unreachable.rs:189:5:189:18 | CallExpr | Call should have one enclosing callable but has 0. |
193-
| unreachable.rs:190:5:190:18 | CallExpr | Call should have one enclosing callable but has 0. |
194178
| unreachable.rs:198:22:198:41 | CallExpr | Call should have one enclosing callable but has 0. |
195179
| unreachable.rs:199:9:199:22 | CallExpr | Call should have one enclosing callable but has 0. |
196180
| unreachable.rs:202:9:202:22 | CallExpr | Call should have one enclosing callable but has 0. |
197181
| unreachable.rs:205:5:205:18 | CallExpr | Call should have one enclosing callable but has 0. |
198182
| unreachable.rs:207:16:207:29 | CallExpr | Call should have one enclosing callable but has 0. |
199183
| unreachable.rs:209:9:209:22 | CallExpr | Call should have one enclosing callable but has 0. |
200-
| unreachable.rs:212:9:212:22 | CallExpr | Call should have one enclosing callable but has 0. |
201-
| unreachable.rs:215:5:215:18 | CallExpr | Call should have one enclosing callable but has 0. |
202184
| unreachable.rs:219:19:219:38 | CallExpr | Call should have one enclosing callable but has 0. |
203185
| unreachable.rs:220:9:220:22 | CallExpr | Call should have one enclosing callable but has 0. |
204186
| unreachable.rs:224:5:224:18 | CallExpr | Call should have one enclosing callable but has 0. |
205187
| unreachable.rs:226:13:226:32 | CallExpr | Call should have one enclosing callable but has 0. |
206-
| unreachable.rs:228:9:228:22 | CallExpr | Call should have one enclosing callable but has 0. |
207188
| unreachable.rs:232:5:232:18 | CallExpr | Call should have one enclosing callable but has 0. |
208189
| unreachable.rs:236:8:236:13 | CallExpr | Call should have one enclosing callable but has 0. |
209190
| unreachable.rs:237:9:237:22 | CallExpr | Call should have one enclosing callable but has 0. |

0 commit comments

Comments
 (0)