diff --git a/cpp/ql/lib/change-notes/2025-01-13-indirect-instruction-barrier-guard.md b/cpp/ql/lib/change-notes/2025-01-13-indirect-instruction-barrier-guard.md new file mode 100644 index 000000000000..61f406a8179e --- /dev/null +++ b/cpp/ql/lib/change-notes/2025-01-13-indirect-instruction-barrier-guard.md @@ -0,0 +1,4 @@ +--- +category: feature +--- +* Add a new predicate `getAnIndirectBarrier` to the parameterized module `InstructionBarrierGuard` in `semmle.code.cpp.dataflow.new.DataFlow` for computing indirect dataflow nodes that are guarded by a given instruction. This predicate is similar to the `getAnIndirectBarrier` predicate on the parameterized module `BarrierGuard`. \ No newline at end of file diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll index 5a5607dbf3bf..4dabd917b3d3 100644 --- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll +++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll @@ -2494,6 +2494,36 @@ module InstructionBarrierGuard; + +predicate indirectBarrierGuard(DataFlow::Node node, int indirectionIndex) { + node = BarrierGuard::getAnIndirectBarrierNode(indirectionIndex) +} + +predicate barrierGuard(DataFlow::Node node) { node = BarrierGuard::getABarrierNode() } + +module Test implements TestSig { + string getARelevantTag() { result = "barrier" } + + predicate hasActualResult(Location location, string element, string tag, string value) { + exists(DataFlow::Node node | + barrierGuard(node) and + value = "" + or + exists(int indirectionIndex | + indirectBarrierGuard(node, indirectionIndex) and + value = indirectionIndex.toString() + ) + | + tag = "barrier" and + element = node.toString() and + location = node.getLocation() + ) + } +} + +import MakeTest